1 2024-03-27 David Malcolm <dmalcolm@redhat.com>
5 (call_summary_replay::convert_svalue_from_summary): Assert that
7 (call_summary_replay::convert_region_from_summary): Likewise.
8 (call_summary_replay::convert_region_from_summary_1): Add missing
9 cast for the deref of RK_SYMBOLIC case.
11 2024-03-23 David Malcolm <dmalcolm@redhat.com>
14 * engine.cc (impl_run_checkers): Free up any dominance info that
16 * kf.cc (class kf_ubsan_handler): New.
17 (register_sanitizer_builtins): New.
18 (register_known_functions): Call register_sanitizer_builtins.
20 2024-03-22 David Malcolm <dmalcolm@redhat.com>
24 * sm-taint.cc (taint_state_machine::on_condition): Strip away
25 casts before considering LHS and RHS, to increase the chance of
26 detecting places where sanitization of a value may have happened.
28 2024-03-22 David Malcolm <dmalcolm@redhat.com>
30 * sm-taint.cc: Include "diagnostic-format-sarif.h".
32 (taint_diagnostic::maybe_add_sarif_properties): New.
33 (tainted_offset::tainted_offset): Add "offset" param.
34 (tainted_offset::maybe_add_sarif_properties): New.
35 (tainted_offset::m_offset): New.
36 (region_model::check_region_for_taint): Pass offset to
39 2024-03-21 David Malcolm <dmalcolm@redhat.com>
42 * region-model.cc (region_model::eval_condition): Fix
43 cast-handling from r14-3632-ge7b267444045c5 so that if those give
44 an unknown result, we continue trying the constraint manager.
46 2024-03-20 David Malcolm <dmalcolm@redhat.com>
49 * sm-malloc.cc (deref_before_check::emit): Reject cases where the
50 check is in a loop header within a macro expansion.
51 (deref_before_check::loop_header_p): New.
53 2024-03-20 Jakub Jelinek <jakub@redhat.com>
55 * constraint-manager.cc (test_range, test_constraint_conditions,
56 test_constant_comparisons, test_constraint_impl, test_purging,
57 test_bits): Use integer_zero_node instead of
58 build_zero_cst (integer_type_node) or
59 build_int_cst (integer_type_node, 0) and integer_one_node instead of
60 build_int_cst (integer_type_node, 1).
61 * region-model.cc (region_model::get_store_value,
62 append_interesting_constants, test_array_1,
63 test_get_representative_tree, test_unique_constants, test_assignment,
64 test_stack_frames, test_constraint_merging, test_widening_constraints,
65 test_iteration_1, test_array_2): Likewise.
67 2024-03-19 Jakub Jelinek <jakub@redhat.com>
70 * region-model.cc (get_tree_for_byte_offset,
71 region_model::get_representative_path_var_1,
72 test_mem_ref, test_POINTER_PLUS_EXPR_then_MEM_REF): Use
73 char __attribute__((may_alias)) * as type of MEM_REF second argument.
75 2024-03-19 David Malcolm <dmalcolm@redhat.com>
78 * kf.cc (class kf_atomic_exchange): Reimplement based on signature
79 seen in gimple, rather than user-facing signature.
80 (class kf_atomic_load): Likewise.
81 (class kf_atomic_store): New.
82 (register_atomic_builtins): Register kf_atomic_store.
84 2024-03-18 David Malcolm <dmalcolm@redhat.com>
90 * access-diagram.cc: Include "analyzer/analyzer-selftests.h".
91 (get_access_size_str): Reimplement for conversion of
92 implmementation of bit_size_expr from tree to const svalue &. Use
93 svalue::maybe_print_for_user rather than tree printing routines.
94 (remove_ssa_names): Make non-static.
95 (bit_size_expr::get_formatted_str): Rename to...
96 (bit_size_expr::maybe_get_formatted_str): ...this, adding "model"
97 param and converting return type to a unique_ptr. Update for
98 conversion of implementation of bit_size_expr from tree to
99 const svalue &. Use svalue::maybe_print_for_user rather than tree
101 (bit_size_expr::print): Rename to...
102 (bit_size_expr::maybe_print_for_user): ...this, adding "model"
103 param and converting return type to bool. Update for
104 conversion of implementation of bit_size_expr from tree to
105 const svalue &. Use svalue::maybe_print_for_user rather than tree
107 (bit_size_expr::maybe_get_as_bytes): Add "mgr" param and convert
108 return type from tree to const svalue *; reimplement.
109 (access_range::access_range): Call strip_types when on region_offset
111 (access_range::get_size): Update for conversion of implementation
112 of bit_size_expr from tree to const svalue &.
113 (access_operation::get_valid_bits): Pass manager to access_range
115 (access_operation::maybe_get_invalid_before_bits): Likewise.
116 (access_operation::maybe_get_invalid_after_bits): Likewise.
117 (boundaries::add): Likewise.
118 (bit_to_table_map::populate): Add "mgr" param and pass it to
120 (access_diagram_impl::access_diagram_impl): Pass manager to
121 bit_to_table_map::populate.
122 (access_diagram_impl::maybe_add_gap): Use svalue rather than tree
123 for symbolic bit offsets. Port to new bit_size_expr
125 (access_diagram_impl::add_valid_vs_invalid_ruler): Port to new
126 bit_size_expr representation.
127 (selftest::assert_eq_typeless_integer): New.
128 (ASSERT_EQ_TYPELESS_INTEGER): New.
129 (selftest::test_bit_size_expr_to_bytes): New.
130 (selftest::analyzer_access_diagram_cc_tests): New.
131 * access-diagram.h (class bit_size_expr): Reimplement, converting
132 implementation from tree to const svalue &.
133 (access_range::access_range): Add "mgr" param. Call strip_types
134 on region_offset initializations.
135 (access_range::get_size): Update decl for reimplementation.
136 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
137 selftest::analyzer_access_diagram_cc_tests.
138 * analyzer-selftests.h
139 (selftest::analyzer_checker_script_cc_tests): Delete this stray
141 (selftest::analyzer_access_diagram_cc_tests): New decl.
142 * analyzer.h (print_expr_for_user): New decl.
143 (calc_symbolic_bit_offset): Update decl for reimplementation.
144 (strip_types): New decls.
145 (remove_ssa_names): New decl.
146 * bounds-checking.cc (strip_types): New.
147 (region_model::check_symbolic_bounds): Use typeless svalues.
148 * region-model-manager.cc
149 (region_model_manager::get_or_create_constant_svalue): Add "type"
150 param. Add overload with old signature.
151 (region_model_manager::get_or_create_int_cst): Support type being
153 (region_model_manager::maybe_fold_unaryop): Gracefully reject folding
154 of casts to NULL_TREE type.
155 (get_code_for_cast): Use NOP_EXPR for "casting" svalues to
157 (region_model_manager::get_or_create_cast): Support "casting"
158 svalues to NULL_TREE type.
159 (region_model_manager::maybe_fold_binop): Don't crash on inputs
160 with NULL_TREE type. Handle folding of binops on constants with
161 NULL_TREE type. Add missing cast from PR analyzer/110902.
162 Support enough folding of other ops on NULL_TREE type to support
164 (region_model_manager::get_or_create_const_fn_result_svalue):
165 Remove assertion that type is nonnull.
166 * region-model-manager.h
167 (region_model_manager::get_or_create_constant_svalue): Add
168 overloaded decl taking a type.
169 (region_model_manager::maybe_fold_binop): Make public.
170 (region_model_manager::constants_map_t): Use
171 constant_svalue::key_t for the key, rather than just tree.
172 * region-model.cc (print_expr_for_user): New.
173 (selftest::test_array_2): Handle casts.
174 * region.cc (region_offset::calc_symbolic_bit_offset): Return
175 const svalue & rather than tree, and reimplement accordingly.
176 (region::calc_offset): Use ptrdiff_type_node for types of byte
178 (region::maybe_print_for_user): New.
179 (element_region::get_relative_symbolic_offset): Use NULL_TREE for
180 types of bit offsets.
181 (offset_region::get_bit_offset): Likewise.
182 (sized_region::get_bit_size_sval): Likewise for bit sizes.
183 * region.h (region::maybe_print_for_user): New decl.
184 * svalue.cc (class auto_add_parens): New.
185 (svalue::maybe_print_for_user): New.
186 (svalue::cmp_ptr): Support typeless constant svalues.
187 (tristate_from_boolean_tree_node): New, taken from...
188 (constant_svalue::eval_condition): ...here. Handle comparison of
189 typeless integer svalue constants.
190 * svalue.h (svalue::maybe_print_for_user): New decl.
191 (class constant_svalue): Support the type of the svalue being
193 (struct default_hash_traits<constant_svalue::key_t>): New.
195 2024-03-18 David Malcolm <dmalcolm@redhat.com>
197 * access-diagram.cc (remove_ssa_names): Support operands being
198 NULL_TREE, such as e.g. for COMPONENT_REF's operand 2.
200 2024-03-07 Jakub Jelinek <jakub@redhat.com>
202 * access-diagram.cc: Include diagnostic-core.h before including
203 diagnostic.h or diagnostic-path.h.
204 * sm-malloc.cc: Likewise.
205 * diagnostic-manager.cc: Likewise.
206 * call-summary.cc: Likewise.
207 * record-layout.cc: Likewise.
209 2024-02-29 David Malcolm <dmalcolm@redhat.com>
212 * analyzer.cc: Include "tree-dfa.h".
213 (get_ssa_default_def): New decl.
214 * analyzer.h (get_ssa_default_def): New.
215 * call-info.cc (call_info::call_info): New ctor taking an explicit
217 * call-info.h (call_info::call_info): Likewise.
218 * call-summary.cc (call_summary_replay::call_summary_replay):
219 Convert param from function * to const function &.
220 * call-summary.h (call_summary_replay::call_summary_replay):
222 * checker-event.h (state_change_event::get_dest_function):
223 Constify return value.
224 * engine.cc (point_and_state::validate): Update for conversion to
226 (exploded_node::on_stmt): Likewise.
227 (call_summary_edge_info::call_summary_edge_info): Likewise.
228 Pass in called_fn to call_info ctor.
229 (exploded_node::replay_call_summaries): Update for conversion to
230 const function &. Convert per_function_data from * to &.
231 (exploded_node::replay_call_summary): Update for conversion to
233 (exploded_graph::add_function_entry): Likewise.
234 (toplevel_function_p): Likewise.
235 (add_tainted_args_callback): Likewise.
236 (exploded_graph::build_initial_worklist): Likewise.
237 (exploded_graph::maybe_create_dynamic_call): Likewise.
238 (maybe_update_for_edge): Likewise.
239 (exploded_graph::on_escaped_function): Likewise.
240 * exploded-graph.h (exploded_node::replay_call_summaries):
242 (exploded_node::replay_call_summary): Likewise.
243 (exploded_graph::add_function_entry): Likewise.
244 * program-point.cc (function_point::from_function_entry):
246 (program_point::from_function_entry): Likewise.
247 * program-point.h (function_point::from_function_entry): Likewise.
248 (program_point::from_function_entry): Likewise.
249 * program-state.cc (program_state::push_frame): Likewise.
250 (program_state::get_current_function): Constify return type.
251 * program-state.h (program_state::push_frame): Update for
252 conversion to const function &.
253 (program_state::get_current_function): Likewise.
254 * region-model-manager.cc
255 (region_model_manager::get_frame_region): Likewise.
256 * region-model-manager.h
257 (region_model_manager::get_frame_region): Likewise.
258 * region-model.cc (region_model::called_from_main_p): Likewise.
259 (region_model::update_for_gcall): Likewise.
260 (region_model::push_frame): Likewise.
261 (region_model::get_current_function): Constify return type.
262 (region_model::pop_frame): Update for conversion to
264 (selftest::test_stack_frames): Likewise.
265 (selftest::test_get_representative_path_var): Likewise.
266 (selftest::test_state_merging): Likewise.
267 (selftest::test_alloca): Likewise.
268 * region-model.h (region_model::push_frame): Likewise.
269 (region_model::get_current_function): Likewise.
270 * region.cc (frame_region::dump_to_pp): Likewise.
271 (frame_region::get_region_for_local): Likewise.
272 * region.h (class frame_region): Likewise.
273 * sm-signal.cc (signal_unsafe_call::describe_state_change):
275 (update_model_for_signal_handler): Likewise.
276 (signal_delivery_edge_info_t::update_model): Likewise.
277 (register_signal_handler::impl_transition): Likewise.
278 * state-purge.cc (class gimple_op_visitor): Likewise.
279 (state_purge_map::state_purge_map): Likewise.
280 (state_purge_map::get_or_create_data_for_decl): Likewise.
281 (state_purge_per_ssa_name::state_purge_per_ssa_name): Likewise.
282 (state_purge_per_ssa_name::add_to_worklist): Likewise.
283 (state_purge_per_ssa_name::process_point): Likewise.
284 (state_purge_per_decl::add_to_worklist): Likewise.
285 (state_purge_annotator::print_needed): Likewise.
287 (state_purge_map::get_or_create_data_for_decl): Likewise.
288 (class state_purge_per_tree): Likewise.
289 (class state_purge_per_ssa_name): Likewise.
290 (class state_purge_per_decl): Likewise.
291 * supergraph.cc (supergraph::dump_dot_to_pp): Likewise.
293 (supergraph::get_node_for_function_entry): Likewise.
294 (supergraph::get_node_for_function_exit): Likewise.
296 2024-02-27 David Malcolm <dmalcolm@redhat.com>
301 (string_literal_spatial_item::add_column_for_byte): Use %wu for
302 printing unsigned HOST_WIDE_INT.
304 2024-02-27 David Malcolm <dmalcolm@redhat.com>
307 * constraint-manager.cc (bound::ensure_closed): Assert that
308 m_constant has integral type.
309 (range::add_bound): Bail out on floating point constants.
311 2024-02-21 David Malcolm <dmalcolm@redhat.com>
314 * analyzer.h (get_string_cst_size): New decl.
315 * region-model-manager.cc (get_string_cst_size): New.
316 (region_model_manager::maybe_get_char_from_string_cst): Treat
317 single-byte accesses within string_cst but beyond
318 TREE_STRING_LENGTH as being 0.
319 * region-model.cc (string_cst_has_null_terminator): Likewise.
321 2024-02-21 David Malcolm <dmalcolm@redhat.com>
324 * ranges.cc (symbolic_byte_range::intersection): Handle empty ranges.
325 (selftest::test_intersects): Add test coverage for empty ranges.
327 2024-02-19 David Malcolm <dmalcolm@redhat.com>
330 * varargs.cc (representable_in_integral_type_p): New.
331 (va_arg_compatible_types_p): Add "arg_sval" param. Handle integer
333 (kf_va_arg::impl_call_pre): Pass arg_sval to
334 va_arg_compatible_types_p.
336 2024-02-19 Andrew Pinski <quic_apinski@quicinc.com>
339 * region-model-manager.cc (maybe_undo_optimize_bit_field_compare): Reject
342 2024-02-15 David Malcolm <dmalcolm@redhat.com>
345 * region.cc (offset_region::get_byte_size_sval): Delete.
346 (offset_region::get_bit_size_sval): Delete.
347 * region.h (region::get_byte_size): Add comment clarifying that
348 this relates to the size of the access, rather than the size
349 that's valid to access.
350 (region::get_bit_size): Likewise.
351 (region::get_byte_size_sval): Likewise.
352 (region::get_bit_size_sval): Likewise.
353 (offset_region::get_byte_size_sval): Delete.
354 (offset_region::get_bit_size_sval): Delete.
356 2024-02-13 David Malcolm <dmalcolm@redhat.com>
358 * pending-diagnostic.cc (diagnostic_emission_context::warn):
359 Update for renaming of emit_diagnostic_valist overload to
360 emit_diagnostic_valist_meta.
361 (diagnostic_emission_context::inform): Likewise.
363 2024-01-31 David Malcolm <dmalcolm@redhat.com>
366 * region-model.cc (region_model::on_stmt_pre): Add gcc_unreachable
367 for debug statements.
369 (state_purge_per_ssa_name::state_purge_per_ssa_name): Skip any
370 debug stmts in the FOR_EACH_IMM_USE_FAST list.
371 * supergraph.cc (supergraph::supergraph): Don't add debug stmts
374 2024-01-31 David Malcolm <dmalcolm@redhat.com>
377 * checker-event.cc (state_change_event::get_desc): Don't assume
380 2024-01-30 David Malcolm <dmalcolm@redhat.com>
383 * region-model.cc (is_round_up): New.
384 (is_multiple_p): New.
385 (is_dubious_capacity): New.
386 (region_model::check_region_size): Move usage of size_visitor into
389 2024-01-30 David Malcolm <dmalcolm@redhat.com>
392 (dubious_allocation_size::dubious_allocation_size): Add
393 "capacity_sval" param. Drop unused ctor.
394 (dubious_allocation_size::maybe_add_sarif_properties): New.
395 (dubious_allocation_size::m_capacity_sval): New field.
396 (region_model::check_region_size): Pass capacity svalue to
397 dubious_allocation_size ctor.
399 2024-01-25 David Malcolm <dmalcolm@redhat.com>
402 * store.cc (binding_cluster::maybe_get_compound_binding): When
403 populating default_map, express the bit-range of the default key
404 for REG relative to REG, rather than to the base region.
406 2024-01-24 David Malcolm <dmalcolm@redhat.com>
409 * engine.cc (impl_region_model_context::on_liveness_change): Pass
410 m_ext_state to sm_state_map::on_liveness_change.
411 * program-state.cc (sm_state_map::on_svalue_leak): Guard removal
412 of map entry based on can_purge_p.
413 (sm_state_map::on_liveness_change): Add ext_state param. Add
414 workaround for bad interaction between state purging and
415 alt-inherited sm-state.
416 * program-state.h (sm_state_map::on_liveness_change): Add
419 (taint_state_machine::has_alt_get_inherited_state_p): New.
420 (taint_state_machine::can_purge_p): Return false for "has_lb" and
422 * sm.h (state_machine::has_alt_get_inherited_state_p): New vfunc.
424 2024-01-18 David Malcolm <dmalcolm@redhat.com>
427 * region-model.cc (svalue_byte_range_has_null_terminator_1): The
428 initial byte of an all-zeroes SVAL is a zero byte. Remove
429 gcc_unreachable from SK_CONSTANT for constants that aren't
430 STRING_CST or INTEGER_CST.
432 2024-01-18 David Malcolm <dmalcolm@redhat.com>
435 * region-model.cc (fragment::dump_to_pp): New.
436 (fragment::has_null_terminator): Convert to...
437 (svalue_byte_range_has_null_terminator_1): ...this new function,
438 updating to use a byte_range relative to the start of the svalue.
439 (svalue_byte_range_has_null_terminator): New.
440 (fragment::string_cst_has_null_terminator): Convert to...
441 (string_cst_has_null_terminator): ...this, updating to use a
442 byte_range relative to the start of the svalue.
443 (iterable_cluster::dump_to_pp): New.
444 (region_model::scan_for_null_terminator): Add logging, moving body
446 (region_model::scan_for_null_terminator_1): ...this new function,
447 adding more logging, and updating to use
448 svalue_byte_range_has_null_terminator.
449 * region-model.h (region_model::scan_for_null_terminator_1): New
452 2024-01-16 David Malcolm <dmalcolm@redhat.com>
455 * analyzer.h (compare_constants): New decl.
456 * constraint-manager.cc (compare_constants): Make non-static.
457 * sm-taint.cc: Add include "fold-const.h".
458 (class concrete_range): New.
459 (get_possible_range): New.
460 (index_can_be_out_of_bounds_p): New.
461 (region_model::check_region_for_taint): Reject
462 -Wanalyzer-tainted-array-index if the type of the value makes it
463 impossible for it to be out-of-bounds of the array.
465 2024-01-16 David Malcolm <dmalcolm@redhat.com>
468 * region-model-manager.cc
469 (region_model_manager::maybe_fold_unaryop): Casting all zeroes
470 should give all zeroes.
472 2024-01-04 David Malcolm <dmalcolm@redhat.com>
474 * analyzer.opt.urls: New file, autogenerated by
475 regenerate-opt-urls.py.
477 2024-01-04 David Malcolm <dmalcolm@redhat.com>
479 * checker-event.cc: Include "diagnostic-format-sarif.h" and
480 "tree-logical-location.h".
481 (checker_event::maybe_add_sarif_properties): New.
482 (superedge_event::maybe_add_sarif_properties): New.
483 (superedge_event::superedge_event): Add comment.
484 * checker-event.h (checker_event::maybe_add_sarif_properties): New
486 (superedge_event::maybe_add_sarif_properties): New decl.
488 2024-01-04 David Malcolm <dmalcolm@redhat.com>
491 * checker-event.cc (class inlining_info): Move to...
492 * inlining-iterator.h (class inlining_info): ...here.
493 * sm-malloc.cc: Include "analyzer/inlining-iterator.h".
494 (maybe_complain_about_deref_before_check): Reject stmts that were
495 inlined from another function.
497 2024-01-04 David Malcolm <dmalcolm@redhat.com>
500 * access-diagram.cc (valid_region_spatial_item::add_boundaries):
501 Handle TYPE_DOMAIN being null.
502 (valid_region_spatial_item::add_array_elements_to_table):
505 2023-12-16 David Malcolm <dmalcolm@redhat.com>
507 * analyzer.cc: Include "tree-pretty-print.h" and
508 "diagnostic-event-id.h".
510 (diagnostic_event_id_to_json): New.
511 (bit_offset_to_json): New.
512 (byte_offset_to_json): New.
513 * analyzer.h (tree_to_json): New decl.
514 (diagnostic_event_id_to_json): New decl.
515 (bit_offset_to_json): New decl.
516 (byte_offset_to_json): New decl.
517 * bounds-checking.cc: Include "diagnostic-format-sarif.h".
518 (out_of_bounds::maybe_add_sarif_properties): New.
519 (concrete_out_of_bounds::maybe_add_sarif_properties): New.
520 (concrete_past_the_end::maybe_add_sarif_properties): New.
521 (symbolic_past_the_end::maybe_add_sarif_properties): New.
522 * region-model.cc (region_to_value_map::to_json): New.
523 (region_model::to_json): New.
524 * region-model.h (region_to_value_map::to_json): New decl.
525 (region_model::to_json): New decl.
526 * store.cc (bit_range::to_json): New.
527 (byte_range::to_json): New.
528 * store.h (bit_range::to_json): New decl.
529 (byte_range::to_json): New decl.
531 2023-12-16 David Malcolm <dmalcolm@redhat.com>
535 (out_of_bounds::oob_region_creation_event_capacity): Rename
536 "capacity" to "byte_capacity". Layout fix.
537 (out_of_bounds::::add_region_creation_events): Rename
538 "capacity" to "byte_capacity".
539 (class concrete_out_of_bounds): Rename m_out_of_bounds_range to
540 m_out_of_bounds_bits and convert from a byte_range to a bit_range.
541 (concrete_out_of_bounds::get_out_of_bounds_bytes): New.
542 (concrete_past_the_end::concrete_past_the_end): Rename param
543 "byte_bound" to "bit_bound". Initialize m_byte_bound.
544 (concrete_past_the_end::subclass_equal_p): Update for renaming
545 of m_byte_bound to m_bit_bound.
546 (concrete_past_the_end::m_bit_bound): New field.
547 (concrete_buffer_overflow::concrete_buffer_overflow): Convert
548 param "range" from byte_range to bit_range. Rename param
549 "byte_bound" to "bit_bound".
550 (concrete_buffer_overflow::emit): Update for bits vs bytes.
551 (concrete_buffer_overflow::describe_final_event): Split
553 (concrete_buffer_overflow::describe_final_event_as_bytes): ...this
554 (concrete_buffer_overflow::describe_final_event_as_bits): ...and
556 (concrete_buffer_over_read::concrete_buffer_over_read): Convert
557 param "range" from byte_range to bit_range. Rename param
558 "byte_bound" to "bit_bound".
559 (concrete_buffer_over_read::emit): Update for bits vs bytes.
560 (concrete_buffer_over_read::describe_final_event): Split into...
561 (concrete_buffer_over_read::describe_final_event_as_bytes):
563 (concrete_buffer_over_read::describe_final_event_as_bits): ...and
565 (concrete_buffer_underwrite::concrete_buffer_underwrite): Convert
566 param "range" from byte_range to bit_range.
567 (concrete_buffer_underwrite::describe_final_event): Split into...
568 (concrete_buffer_underwrite::describe_final_event_as_bytes):
570 (concrete_buffer_underwrite::describe_final_event_as_bits): ...and
572 (concrete_buffer_under_read::concrete_buffer_under_read): Convert
573 param "range" from byte_range to bit_range.
574 (concrete_buffer_under_read::describe_final_event): Split into...
575 (concrete_buffer_under_read::describe_final_event_as_bytes):
577 (concrete_buffer_under_read::describe_final_event_as_bits): ...and
579 (region_model::check_region_bounds): Use bits for concrete values,
580 and rename locals to indicate whether we're dealing with bits or
581 bytes. Specifically, replace "num_bytes_sval" with
582 "num_bits_sval", and get it from reg's "get_bit_size_sval".
583 Replace "num_bytes_tree" with "num_bits_tree". Rename "capacity"
584 to "byte_capacity". Rename "cst_capacity_tree" to
585 "cst_byte_capacity_tree". Replace "offset" and
586 "num_bytes_unsigned" with "bit_offset" and "num_bits_unsigned"
587 respectively, converting from byte_offset_t to bit_offset_t.
588 Replace "out" and "read_bytes" with "bits_outside" and "read_bits"
589 respectively, converting from byte_range to bit_range. Convert
590 "buffer" from byte_range to bit_range. Replace "byte_bound" with
592 * region.cc (region::get_bit_size_sval): New.
593 (offset_region::get_bit_offset): New.
594 (offset_region::get_bit_size_sval): New.
595 (sized_region::get_bit_size_sval): New.
596 (bit_range_region::get_bit_size_sval): New.
597 * region.h (region::get_bit_size_sval): New vfunc.
598 (offset_region::get_bit_offset): New decl.
599 (offset_region::get_bit_size_sval): New decl.
600 (sized_region::get_bit_size_sval): New decl.
601 (bit_range_region::get_bit_size_sval): New decl.
602 * store.cc (bit_range::intersects_p): New, based on
603 byte_range::intersects_p.
604 (bit_range::exceeds_p): New, based on byte_range::exceeds_p.
605 (bit_range::falls_short_of_p): New, based on
606 byte_range::falls_short_of_p.
607 (byte_range::intersects_p): Delete.
608 (byte_range::exceeds_p): Delete.
609 (byte_range::falls_short_of_p): Delete.
610 * store.h (bit_range::intersects_p): New overload.
611 (bit_range::exceeds_p): New.
612 (bit_range::falls_short_of_p): New.
613 (byte_range::intersects_p): Delete.
614 (byte_range::exceeds_p): Delete.
615 (byte_range::falls_short_of_p): Delete.
617 2023-12-14 David Malcolm <dmalcolm@redhat.com>
620 * infinite-loop.cc (infinite_loop::infinite_loop): Pass eedges
621 via rvalue reference rather than by value.
622 (starts_infinite_loop_p): Move eedges when constructing an
623 infinite_loop instance.
624 * sm-file.cc (fileptr_state_machine::fileptr_state_machine): Use
625 initializer list for states.
627 (sensitive_state_machine::sensitive_state_machine): Likewise.
628 * sm-signal.cc (signal_state_machine::signal_state_machine):
630 * sm-taint.cc (taint_state_machine::taint_state_machine):
632 * varargs.cc (va_list_state_machine::va_list_state_machine): Likewise.
634 2023-12-11 David Malcolm <dmalcolm@redhat.com>
637 * engine.cc (feasibility_state::feasibility_state): Initialize
640 2023-12-11 Andrew Pinski <apinski@marvell.com>
642 * region-model-manager.cc (maybe_undo_optimize_bit_field_compare): Remove
643 the check for type being unsigned_char_type_node.
645 2023-12-08 David Malcolm <dmalcolm@redhat.com>
647 * sm-taint.cc (taint_state_machine::alt_get_inherited_state): Fix
648 handling of TRUNC_MOD_EXPR.
650 2023-12-08 David Malcolm <dmalcolm@redhat.com>
652 * region-model.cc (contains_uninit_p): Only check for
653 svalues that the infoleak warning can handle.
655 2023-12-08 David Malcolm <dmalcolm@redhat.com>
658 * store.h (concrete_binding::concrete_binding): Strengthen
659 assertion to require size to be be positive, rather than just
661 (concrete_binding::mark_deleted): Use size rather than start bit
663 (concrete_binding::mark_empty): Likewise.
664 (concrete_binding::is_deleted): Likewise.
665 (concrete_binding::is_empty): Likewise.
667 2023-12-07 Alexandre Oliva <oliva@adacore.com>
669 * region-model.cc (has_nondefault_case_for_value_p): Take
670 enumerate type as a parameter.
671 (region_model::apply_constraints_for_gswitch): Cope with
672 integral promotion type casts.
674 2023-12-07 David Malcolm <dmalcolm@redhat.com>
678 * analyzer.opt (-param=analyzer-max-svalue-depth=): Increase from
680 (Wanalyzer-symbol-too-complex): New.
681 * diagnostic-manager.cc
682 (null_assignment_sm_context::clear_all_per_svalue_state): New.
683 * engine.cc (impl_sm_context::clear_all_per_svalue_state): New.
684 * program-state.cc (sm_state_map::clear_all_per_svalue_state):
686 * program-state.h (sm_state_map::clear_all_per_svalue_state): New
688 * region-model-manager.cc
689 (region_model_manager::reject_if_too_complex): Add
690 -Wanalyzer-symbol-too-complex.
691 * sm-taint.cc (taint_state_machine::on_condition): Handle
692 comparisons against UNKNOWN.
693 * sm.h (sm_context::clear_all_per_svalue_state): New.
695 2023-12-06 David Malcolm <dmalcolm@redhat.com>
697 * engine.cc (dump_analyzer_json): Use
698 flag_diagnostics_json_formatting.
700 2023-12-01 David Malcolm <dmalcolm@redhat.com>
702 * analyzer.h (class saved_diagnostic): New forward decl.
703 * bounds-checking.cc: Update for changes to
704 pending_diagnostic::emit.
705 * call-details.cc: Likewise.
706 * diagnostic-manager.cc: Include "diagnostic-format-sarif.h".
707 (saved_diagnostic::maybe_add_sarif_properties): New.
708 (class pending_diagnostic_metadata): New.
709 (diagnostic_manager::emit_saved_diagnostic): Create a
710 pending_diagnostic_metadata and a diagnostic_emission_context.
711 Pass the latter to the pending_diagnostic::emit vfunc.
712 * diagnostic-manager.h
713 (saved_diagnostic::maybe_add_sarif_properties): New decl.
714 * engine.cc: Update for changes to pending_diagnostic::emit.
715 * infinite-loop.cc: Likewise.
716 * infinite-recursion.cc: Likewise.
717 * kf-analyzer.cc: Likewise.
719 * pending-diagnostic.cc
720 (diagnostic_emission_context::get_pending_diagnostic): New.
721 (diagnostic_emission_context::warn): New.
722 (diagnostic_emission_context::inform): New.
723 * pending-diagnostic.h (class diagnostic_emission_context): New.
724 (pending_diagnostic::emit): Update params.
725 (pending_diagnostic::maybe_add_sarif_properties): New vfunc.
726 * region.cc: Don't include "diagnostic-metadata.h".
727 * region-model.cc: Include "diagnostic-format-sarif.h". Update
728 for changes to pending_diagnostic::emit.
729 (exposure_through_uninit_copy::maybe_add_sarif_properties): New.
730 * sm-fd.cc: Update for changes to pending_diagnostic::emit.
731 * sm-file.cc: Likewise.
732 * sm-malloc.cc: Likewise.
733 * sm-pattern-test.cc: Likewise.
734 * sm-sensitive.cc: Likewise.
735 * sm-signal.cc: Likewise.
736 * sm-taint.cc: Likewise.
737 * store.cc: Don't include "diagnostic-metadata.h".
738 * varargs.cc: Update for changes to pending_diagnostic::emit.
740 2023-11-19 David Malcolm <dmalcolm@redhat.com>
742 * analyzer.h: Include "rich-location.h".
744 2023-11-19 David Malcolm <dmalcolm@redhat.com>
747 * analyzer.h (register_known_functions): Add region_model_manager
749 * analyzer.opt (Wanalyzer-undefined-behavior-strtok): New.
751 (call_summary_replay::convert_region_from_summary_1): Handle
753 * engine.cc (impl_run_checkers): Pass model manager to
754 register_known_functions.
755 * kf.cc (class undefined_function_behavior): New.
756 (class kf_strtok): New.
757 (register_known_functions): Add region_model_manager param.
758 Use it to register "strtok".
759 * region-model-manager.cc
760 (region_model_manager::get_or_create_conjured_svalue): Add "idx"
762 * region-model-manager.h
763 (region_model_manager::get_or_create_conjured_svalue): Add "idx"
765 (region_model_manager::get_root_region): New accessor.
766 * region-model.cc (region_model::scan_for_null_terminator): Handle
768 (region_model::get_representative_path_var_1): Handle RK_PRIVATE.
769 * region-model.h (region_model::called_from_main_p): Make public.
770 * region.cc (region::get_memory_space): Handle RK_PRIVATE.
771 (region::can_have_initial_svalue_p): Handle MEMSPACE_PRIVATE.
772 (private_region::dump_to_pp): New.
773 * region.h (MEMSPACE_PRIVATE): New.
775 (class private_region): New.
776 (is_a_helper <const private_region *>::test): New.
777 * store.cc (store::replay_call_summary_cluster): Handle
779 * svalue.h (struct conjured_svalue::key_t): Add "idx" param to
780 ctor and "m_idx" field.
781 (class conjured_svalue::conjured_svalue): Likewise.
783 2023-11-18 David Malcolm <dmalcolm@redhat.com>
786 * analyzer.opt (Wanalyzer-infinite-loop): New option.
787 (fdump-analyzer-infinite-loop): New option.
788 * checker-event.h (start_cfg_edge_event::get_desc): Drop "final".
789 (start_cfg_edge_event::maybe_describe_condition): Convert from
790 private to protected.
791 * checker-path.h (checker_path::get_logger): New.
792 * diagnostic-manager.cc (process_worklist_item): Update for
793 new context param of maybe_update_for_edge.
795 (impl_region_model_context::impl_region_model_context): Add
796 out_could_have_done_work param to both ctors and use it to
797 initialize mm_out_could_have_done_work.
798 (impl_region_model_context::maybe_did_work): New vfunc
800 (exploded_node::on_stmt): Add out_could_have_done_work param and
802 (exploded_node::on_stmt_pre): Treat setjmp and longjmp as "doing
804 (exploded_node::on_longjmp): Likewise.
805 (exploded_edge::exploded_edge): Add "could_do_work" param and use
806 it to initialize m_could_do_work_p.
807 (exploded_edge::dump_dot_label): Add result of could_do_work_p.
808 (exploded_graph::add_function_entry): Mark edge as doing no work.
809 (exploded_graph::add_edge): Add "could_do_work" param and pass to
811 (add_tainted_args_callback): Treat as doing no work.
812 (exploded_graph::process_worklist): Likewise when merging nodes.
813 (maybe_process_run_of_before_supernode_enodes::item): Likewise.
814 (exploded_graph::maybe_create_dynamic_call): Likewise.
815 (exploded_graph::process_node): Likewise for phi nodes.
816 Pass in a "could_have_done_work" bool when handling stmts and use
817 when creating edges. Assume work is done at bifurcation.
818 (exploded_path::feasible_p): Update for new context param of
819 maybe_update_for_edge.
820 (feasibility_state::feasibility_state): New ctor.
821 (feasibility_state::operator=): New.
822 (feasibility_state::maybe_update_for_edge): Add ctxt param and use
823 it. Fix missing newline when logging state.
824 (impl_run_checkers): Call exploded_graph::detect_infinite_loops.
826 (impl_region_model_context::impl_region_model_context): Add
827 out_could_have_done_work param to both ctors.
828 (impl_region_model_context::maybe_did_work): New decl.
829 (impl_region_model_context::checking_for_infinite_loop_p): New.
830 (impl_region_model_context::on_unusable_in_infinite_loop): New.
831 (impl_region_model_context::m_out_could_have_done_work): New
833 (exploded_node::on_stmt): Add "out_could_have_done_work" param.
834 (exploded_edge::exploded_edge): Add "could_do_work" param.
835 (exploded_edge::could_do_work_p): New accessor.
836 (exploded_edge::m_could_do_work_p): New field.
837 (exploded_graph::add_edge): Add "could_do_work" param.
838 (exploded_graph::detect_infinite_loops): New decl.
839 (feasibility_state::feasibility_state): New ctor.
840 (feasibility_state::operator=): New decl.
841 (feasibility_state::maybe_update_for_edge): Add ctxt param.
842 * infinite-loop.cc: New file.
843 * program-state.cc (program_state::on_edge): Log the rejected
844 constraint when region_model::maybe_update_for_edge fails.
845 * region-model.cc (region_model::on_assignment): Treat any writes
846 other than to the stack as "doing work".
847 (region_model::on_stmt_pre): Treat all asm stmts as "doing work".
848 (region_model::on_call_post): Likewise for all calls to functions
849 with unknown side effects.
850 (region_model::handle_phi): Add svals_changing_meaning param.
851 Mark widening svalue in phi nodes as changing meaning.
852 (unusable_in_infinite_loop_constraint_p): New.
853 (region_model::add_constraint): If we're checking for an infinite
854 loop, bail out on unusable svalues, or if we don't have a definite
855 true/false for the constraint.
856 (region_model::update_for_phis): Gather all svalues changing
857 meaning in phi nodes, and purge constraints involving them.
858 (region_model::replay_call_summary): Treat all call summaries as
860 (region_model::can_merge_with_p): Purge constraints involving
861 svalues that change meaning.
862 (model_merger::on_widening_reuse): New.
863 (test_iteration_1): Likewise.
864 (selftest::test_iteration_1): Remove assertion that model6 "knows"
866 * region-model.h (region_model::handle_phi): Add
867 svals_changing_meaning param
868 (region_model_context::maybe_did_work): New pure virtual func.
869 (region_model_context::checking_for_infinite_loop_p): Likewise.
870 (region_model_context::on_unusable_in_infinite_loop): Likewise.
871 (noop_region_model_context::maybe_did_work): Implement.
872 (noop_region_model_context::checking_for_infinite_loop_p):
874 (noop_region_model_context::on_unusable_in_infinite_loop):
876 (region_model_context_decorator::maybe_did_work): Implement.
877 (region_model_context_decorator::checking_for_infinite_loop_p):
879 (region_model_context_decorator::on_unusable_in_infinite_loop):
881 (model_merger::on_widening_reuse): New decl.
882 (model_merger::m_svals_changing_meaning): New field.
883 * sm-signal.cc (register_signal_handler::impl_transition): Assume
884 the edge "does work".
885 * supergraph.cc (supernode::get_start_location): Use CFG edge's
886 goto_locus if available.
887 (supernode::get_end_location): Likewise.
888 (cfg_superedge::dump_label_to_pp): Dump edges with a "goto_locus"
889 * supergraph.h (cfg_superedge::get_goto_locus): New.
890 * svalue.cc (svalue::can_merge_p): Call on_widening_reuse for
892 (involvement_visitor::visit_widening_svalue): New.
893 (svalue::involves_p): Update assertion to allow widening svalues.
895 2023-11-14 David Malcolm <dmalcolm@redhat.com>
898 * sm-taint.cc: Remove "experimental" from comment.
899 * sm.cc (make_checkers): Always add taint state machine.
901 2023-11-04 David Malcolm <dmalcolm@redhat.com>
903 * bounds-checking.cc: Update for changes to diagnostic_context.
905 2023-11-02 David Malcolm <dmalcolm@redhat.com>
908 * access-diagram.cc (class x_aligned_x_ruler_widget): Eliminate
909 unused field "m_col_widths".
910 (access_diagram_impl::add_valid_vs_invalid_ruler): Update for
913 (check_one_function_attr_null_terminated_string_arg): Remove
914 unused variables "cd_unchecked", "strlen_sval", and
916 * region-model.h (region_model_context_decorator::warn): Add
919 2023-10-31 David Malcolm <dmalcolm@redhat.com>
921 * record-layout.cc: New file, based on material in region-model.cc.
922 * record-layout.h: Likewise.
923 * region-model.cc: Include "analyzer/record-layout.h".
924 (class record_layout): Move to record-layout.cc and .h
926 2023-10-26 David Malcolm <dmalcolm@redhat.com>
929 (region_model::check_external_function_for_access_attr): Split
930 out, replacing with...
931 (region_model::check_function_attr_access): ...this new function
933 (region_model::check_function_attrs): ...this new function.
934 (region_model::check_one_function_attr_null_terminated_string_arg):
936 (region_model::check_function_attr_null_terminated_string_arg):
938 (region_model::handle_unrecognized_call): Update for renaming of
939 check_external_function_for_access_attr to check_function_attrs.
940 (region_model::check_for_null_terminated_string_arg): Add return
941 value to one overload. Make both overloads const.
942 * region-model.h: Include "stringpool.h" and "attribs.h".
943 (region_model::check_for_null_terminated_string_arg): Add return
944 value to one overload. Make both overloads const.
945 (region_model::check_external_function_for_access_attr): Delete
947 (region_model::check_function_attr_access): New decl.
948 (region_model::check_function_attr_null_terminated_string_arg):
950 (region_model::check_one_function_attr_null_terminated_string_arg):
952 (region_model::check_function_attrs): New decl.
954 2023-10-09 David Malcolm <dmalcolm@redhat.com>
956 * access-diagram.cc (boundaries::add): Explicitly state
957 "boundaries::" scope for "kind" enum.
959 2023-10-08 David Malcolm <dmalcolm@redhat.com>
962 * access-diagram.cc (boundaries::boundaries): Add logger param
963 (boundaries::add): Add logging.
964 (boundaries::get_hard_boundaries_in_range): New.
965 (boundaries::m_logger): New field.
966 (boundaries::get_table_x_for_offset): Make public.
967 (class svalue_spatial_item): New.
968 (class compound_svalue_spatial_item): New.
969 (add_ellipsis_to_gaps): New.
970 (valid_region_spatial_item::valid_region_spatial_item): Add theme
971 param. Initialize m_boundaries, m_existing_sval, and
972 m_existing_sval_spatial_item.
973 (valid_region_spatial_item::add_boundaries): Set m_boundaries.
974 Add boundaries for any m_existing_sval_spatial_item.
975 (valid_region_spatial_item::add_array_elements_to_table): Rewrite
976 creation of min/max index in terms of
977 maybe_add_array_index_to_table. Rewrite ellipsis code using
978 add_ellipsis_to_gaps. Add index values for any hard boundaries
979 within the valid region.
980 (valid_region_spatial_item::maybe_add_array_index_to_table): New,
981 based on code formerly in add_array_elements_to_table.
982 (valid_region_spatial_item::make_table): Make use of
983 m_existing_sval_spatial_item, if any.
984 (valid_region_spatial_item::m_boundaries): New field.
985 (valid_region_spatial_item::m_existing_sval): New field.
986 (valid_region_spatial_item::m_existing_sval_spatial_item): New
988 (class svalue_spatial_item): Rename to...
989 (class written_svalue_spatial_item): ...this.
990 (class string_region_spatial_item): Rename to..
991 (class string_literal_spatial_item): ...this. Add "kind".
992 (string_literal_spatial_item::add_boundaries): Use m_kind to
993 determine kind of boundary. Update for renaming of m_actual_bits
995 (string_literal_spatial_item::make_table): Likewise. Support not
996 displaying a row for byte indexes, and not displaying a row for
998 (string_literal_spatial_item::add_column_for_byte): Make byte index
1000 (svalue_spatial_item::make): Convert to...
1001 (make_written_svalue_spatial_item): ...this.
1002 (make_existing_svalue_spatial_item): New.
1003 (access_diagram_impl::access_diagram_impl): Pass theme to
1004 m_valid_region_spatial_item ctor. Update for renaming of
1005 m_svalue_spatial_item.
1006 (access_diagram_impl::find_boundaries): Pass logger to boundaries.
1007 Update for renaming of...
1008 (access_diagram_impl::m_svalue_spatial_item): Rename to...
1009 (access_diagram_impl::m_written_svalue_spatial_item): ...this.
1011 2023-10-03 David Malcolm <dmalcolm@redhat.com>
1013 * analyzer-logging.cc (logger::log_va_partial): Use text_info
1015 * analyzer.cc (make_label_text): Likewise.
1016 (make_label_text_n): Likewise.
1017 * pending-diagnostic.cc (evdesc::event_desc::formatted_print):
1020 2023-10-02 David Malcolm <dmalcolm@redhat.com>
1022 * program-point.cc: Update for grouping of source printing fields
1023 within diagnostic_context.
1025 2023-09-15 David Malcolm <dmalcolm@redhat.com>
1027 * analyzer.cc (get_stmt_location): Handle null stmt.
1028 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic): Copy
1030 (saved_diagnostic::operator==): Compare m_loc.
1031 (saved_diagnostic::calc_best_epath): Only use m_stmt_finder if
1033 (dedupe_key::dedupe_key): Initialize m_loc.
1034 (dedupe_key::operator==): Compare m_loc.
1035 (dedupe_key::get_location): Use m_loc if it's known.
1036 (dedupe_key::m_loc): New field.
1037 (diagnostic_manager::emit_saved_diagnostic): Only call
1038 get_emission_location if m_loc is unknown, preferring to use m_loc
1040 * diagnostic-manager.h (saved_diagnostic::m_loc): New field.
1041 (pending_location::pending_location): Initialize m_loc. Add
1042 overload taking a location_t rather than a stmt/stmt_finder.
1043 (pending_location::m_loc): New field.
1045 2023-09-15 David Malcolm <dmalcolm@redhat.com>
1047 * analyzer.h (struct pending_location): New forward decl.
1048 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
1049 Replace params "enode", "snode", "stmt", and "stmt_finder" with
1051 (diagnostic_manager::add_diagnostic): Likewise for both overloads.
1052 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic):
1054 (struct pending_location): New.
1055 (diagnostic_manager::add_diagnostic): Replace params "enode",
1056 "snode", "stmt", and "stmt_finder" with "ploc".
1057 * engine.cc (impl_region_model_context::warn): Update call to
1058 add_diagnostic for above change.
1059 (impl_sm_context::warn): Likewise.
1060 (impl_region_model_context::on_state_leak): Likewise.
1061 * infinite-recursion.cc
1062 (exploded_graph::detect_infinite_recursion): Likewise.
1064 2023-09-15 David Malcolm <dmalcolm@redhat.com>
1066 * region-model.cc (region_model::get_gassign_result): Handle
1067 volatile ops by using a conjured_svalue.
1069 2023-09-14 David Malcolm <dmalcolm@redhat.com>
1071 * checker-event.h (checker_event::get_thread_id): New.
1072 * checker-path.h (class checker_path): Implement thread-related
1073 vfuncs via a single simple_diagnostic_thread instance named
1076 2023-09-14 David Malcolm <dmalcolm@redhat.com>
1078 * diagnostic-manager.cc (compatible_epath_p): Fix missing return.
1080 2023-09-14 David Malcolm <dmalcolm@redhat.com>
1082 * diagnostic-manager.cc (process_worklist_item): Use
1083 std::unique_ptr rather than plain rejected_constraint *.
1084 * engine.cc (exploded_path::feasible_p): Likewise.
1085 (feasibility_state::maybe_update_for_edge): Likewise.
1086 * exploded-graph.h (feasibility_problem::feasibility_problem):
1088 (feasibility_problem::~feasibility_problem): Delete.
1089 (feasibility_problem::m_rc): Use std::unique_ptr.
1090 (feasibility_state::maybe_update_for_edge): Likewise.
1091 * feasible-graph.cc (feasible_graph::add_feasibility_problem):
1093 * feasible-graph.h (class infeasible_node): Likewise.
1094 (feasible_graph::add_feasibility_problem): Likewise.
1095 * region-model.cc (region_model::add_constraint): Likewise.
1096 (region_model::maybe_update_for_edge): Likewise.
1097 (region_model::apply_constraints_for_gcond): Likewise.
1098 (region_model::apply_constraints_for_gswitch): Likewise.
1099 (region_model::apply_constraints_for_exception): Likewise.
1100 * region-model.h (class region_model): Likewise for decls.
1102 2023-09-09 benjamin priour <vultkayn@gcc.gnu.org>
1106 (region_model::add_constraints_from_binop): binop_svalues around
1107 LT_EXPR, LE_EXPR, GT_EXPR, GE_EXPR are now unwrapped.
1109 2023-09-07 David Malcolm <dmalcolm@redhat.com>
1112 * program-point.cc (program_point::on_edge): Don't reject
1113 EDGE_ABNORMAL for computed gotos.
1114 * region-model.cc (region_model::maybe_update_for_edge): Handle
1115 computed goto statements.
1116 (region_model::apply_constraints_for_ggoto): New.
1117 * region-model.h (region_model::apply_constraints_for_ggoto): New decl.
1118 * supergraph.cc (supernode::get_label): New.
1119 * supergraph.h (supernode::get_label): New decl.
1121 2023-09-07 benjamin priour <vultkayn@gcc.gnu.org>
1122 David Malcolm <dmalcolm@redhat.com>
1125 * diagnostic-manager.cc
1126 (compatible_epaths_p): New function.
1127 (saved_diagnostic::supercedes_p): Now calls the above
1128 to determine if the diagnostics do overlap and the superseding
1131 2023-09-07 David Malcolm <dmalcolm@redhat.com>
1133 * region-model.h: fix -Wunused-parameter warnings
1135 2023-09-06 David Malcolm <dmalcolm@redhat.com>
1138 * kf.cc (class kf_strstr): New.
1139 (kf_strstr::impl_call_post): New.
1140 (register_known_functions): Register it.
1142 2023-09-06 David Malcolm <dmalcolm@redhat.com>
1145 * kf.cc (class kf_strncpy): New.
1146 (kf_strncpy::impl_call_post): New.
1147 (register_known_functions): Register it.
1148 * region-model.cc (region_model::read_bytes): Handle unknown
1151 2023-09-06 David Malcolm <dmalcolm@redhat.com>
1153 * kf.cc (kf_calloc::impl_call_pre): Pass ctxt to zero_fill_region.
1154 (kf_memset::impl_call_pre): Move responsibility for calling
1155 check_region_for_write to fill_region.
1156 * region-model.cc (region_model::on_assignment): Pass ctxt to
1158 (region_model::fill_region): Add "ctxt" param, using it to call
1159 check_region_for_write.
1160 (region_model::zero_fill_region): Likewise.
1161 * region-model.h (region_model::fill_region): Add "ctxt" param.
1162 (region_model::zero_fill_region): Likewise.
1164 2023-09-01 benjamin priour <priour.be@gmail.com>
1168 * analyzer.h (is_placement_new_p): New declaration.
1170 (call_details::deref_ptr_arg): New function.
1171 Dereference the argument at given index if possible.
1172 * call-details.h: Declaration of the above function.
1173 * kf-lang-cp.cc (is_placement_new_p): Returns true if the gcall
1174 is recognized as a placement new.
1175 (kf_operator_delete::impl_call_post): Unbinding a region and its
1176 descendents now poisons with POISON_KIND_DELETED.
1177 (register_known_functions_lang_cp): Known function "operator
1178 delete" is now registered only once independently of its number of
1180 * region-model.cc (region_model::eval_condition): Now
1181 recursively calls itself if any of the operand is wrapped in a
1183 * sm-malloc.cc (malloc_state_machine::on_stmt):
1184 Add placement new recognition.
1185 * svalue.cc (poison_kind_to_str): Wording for the new PK.
1186 * svalue.h (enum poison_kind): Add value POISON_KIND_DELETED.
1188 2023-08-31 Francois-Xavier Coudert <fxcoudert@gcc.gnu.org>
1190 * kf.cc: Change spelling to macOS.
1192 2023-08-30 Eric Feng <ef2648@columbia.edu>
1195 * engine.cc (impl_region_model_context::warn): New optional
1197 * exploded-graph.h (class impl_region_model_context): Likewise.
1198 * region-model.cc (region_model::pop_frame): New callback
1199 feature for region_model::pop_frame.
1200 * region-model.h (struct append_regions_cb_data): Likewise.
1201 (class region_model): Likewise.
1202 (class region_model_context): New optional parameter.
1203 (class region_model_context_decorator): Likewise.
1205 2023-08-30 Francois-Xavier Coudert <fxcoudert@gcc.gnu.org>
1207 * region-model.cc: Define INCLUDE_ALGORITHM.
1209 2023-08-29 David Malcolm <dmalcolm@redhat.com>
1212 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
1213 selftest::analyzer_ranges_cc_tests.
1214 * analyzer-selftests.h (selftest::run_analyzer_selftests): New
1216 * analyzer.opt (Wanalyzer-overlapping-buffers): New option.
1217 * call-details.cc: Include "analyzer/ranges.h" and "make-unique.h".
1218 (class overlapping_buffers): New.
1219 (call_details::complain_about_overlap): New.
1220 * call-details.h (call_details::complain_about_overlap): New decl.
1221 * kf.cc (kf_memcpy_memmove::impl_call_pre): Call
1222 cd.complain_about_overlap for memcpy and memcpy_chk.
1223 (kf_strcat::impl_call_pre): Call cd.complain_about_overlap.
1224 (kf_strcpy::impl_call_pre): Likewise.
1225 * ranges.cc: New file.
1226 * ranges.h: New file.
1228 2023-08-29 David Malcolm <dmalcolm@redhat.com>
1231 * kf.cc (kf_strdup::impl_call_pre): Set size of
1232 dynamically-allocated buffer. Simulate copying the string from
1233 the source region to the new buffer.
1235 2023-08-27 benjamin priour <vultkayn@gcc.gnu.org>
1238 * analyzer.h (class known_function): Add virtual casts
1239 to builtin_known_function.
1240 (class builtin_known_function): New subclass of known_function
1242 * kf.cc (class kf_alloca): Now derived from
1243 builtin_known_function.
1244 (class kf_calloc): Likewise.
1245 (class kf_free): Likewise.
1246 (class kf_malloc): Likewise.
1247 (class kf_memcpy_memmove): Likewise.
1248 (class kf_memset): Likewise.
1249 (class kf_realloc): Likewise.
1250 (class kf_strchr): Likewise.
1251 (class kf_sprintf): Likewise.
1252 (class kf_strcat): Likewise.
1253 (class kf_strcpy): Likewise.
1254 (class kf_strdup): Likewise.
1255 (class kf_strlen): Likewise.
1256 (class kf_strndup): Likewise.
1257 (register_known_functions): Builtins are now registered as
1258 known_functions by name rather than by their BUILTIN_CODE.
1259 * known-function-manager.cc (get_normal_builtin): New overload.
1260 * known-function-manager.h: New overload declaration.
1261 * region-model.cc (region_model::get_builtin_kf): New function.
1262 * region-model.h (class region_model): Add declaration of
1264 * sm-fd.cc: For called recognized as builtins, use the
1265 attributes of that builtin as defined in gcc/builtins.def
1266 rather than the user's.
1267 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
1269 2023-08-25 David Malcolm <dmalcolm@redhat.com>
1271 * access-diagram.cc (class string_region_spatial_item): Remove
1272 assumption that the string is written to the start of the cluster.
1274 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1278 (call_details::check_for_null_terminated_string_arg): Split into
1279 overloads, one taking just an arg_idx, the other a new
1280 "include_terminator" param.
1281 * call-details.h: Likewise.
1282 * kf.cc (class kf_strcat): New.
1283 (kf_strcpy::impl_call_pre): Update for change to
1284 check_for_null_terminated_string_arg.
1285 (register_known_functions): Register kf_strcat.
1287 (region_model::check_for_null_terminated_string_arg): Split into
1288 overloads, one taking just an arg_idx, the other a new
1289 "include_terminator" param. When returning an svalue, handle
1290 "include_terminator" being false by subtracting one.
1292 (region_model::check_for_null_terminated_string_arg): Split into
1293 overloads, one taking just an arg_idx, the other a new
1294 "include_terminator" param.
1296 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1299 * region-model.cc (fragment::has_null_terminator): Handle
1302 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1305 * region-model-manager.cc
1306 (region_model_manager::get_or_create_initial_value): Simplify
1307 INIT_VAL(ELEMENT_REG(STRING_REG), CONSTANT_SVAL) to
1308 CONSTANT_SVAL(STRING[N]).
1310 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1313 * region-model.cc (fragment::has_null_terminator): Move STRING_CST
1314 handling to fragment::string_cst_has_null_terminator; also use it to
1315 handle INIT_VAL(STRING_REG).
1316 (fragment::string_cst_has_null_terminator): New, from above.
1318 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1320 * kf.cc (kf_memcpy_memmove::impl_call_pre): Reimplement using
1321 region_model::copy_bytes.
1322 * region-model.cc (region_model::read_bytes): New.
1323 (region_model::copy_bytes): New.
1324 * region-model.h (region_model::read_bytes): New decl.
1325 (region_model::copy_bytes): New decl.
1327 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1330 * region-model.cc (region_model::get_string_size): Delete both.
1331 * region-model.h (region_model::get_string_size): Delete both
1334 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1337 * kf.cc (kf_strcpy::impl_call_pre): Reimplement using
1338 check_for_null_terminated_string_arg.
1339 * region-model.cc (region_model::get_store_bytes): Shortcut
1340 reading all of a string_region.
1341 (region_model::scan_for_null_terminator): Use get_store_value for
1342 the bytes rather than "unknown" when returning an unknown length.
1343 (region_model::write_bytes): New.
1344 * region-model.h (region_model::write_bytes): New decl.
1346 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1349 * region-model.cc (iterable_cluster::iterable_cluster): Add
1350 symbolic binding keys to m_symbolic_bindings.
1351 (iterable_cluster::has_symbolic_bindings_p): New.
1352 (iterable_cluster::m_symbolic_bindings): New field.
1353 (region_model::scan_for_null_terminator): Treat clusters with
1354 symbolic bindings as having unknown strlen.
1356 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1358 * engine.cc (impl_path_context::impl_path_context): Add logger
1360 (impl_path_context::bifurcate): Add log message.
1361 (impl_path_context::terminate_path): Likewise.
1362 (impl_path_context::m_logger): New field.
1363 (exploded_graph::process_node): Pass logger to path_ctxt ctor.
1365 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1368 * kf-analyzer.cc (class kf_analyzer_get_strlen): Move to kf.cc.
1369 (register_known_analyzer_functions): Use make_kf_strlen.
1370 * kf.cc (class kf_strlen::impl_call_pre): Replace with
1371 implementation of kf_analyzer_get_strlen from kf-analyzer.cc.
1372 Handle "UNKNOWN" return from check_for_null_terminated_string_arg
1373 by falling back to a conjured svalue.
1374 (make_kf_strlen): New.
1375 (register_known_functions): Use make_kf_strlen.
1376 * known-function-manager.h (make_kf_strlen): New decl.
1378 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1381 * call-details.cc (call_details::call_details): New ctor.
1382 * call-details.h (call_details::call_details): New ctor decl.
1383 (struct call_arg_details): Move here from region-model.cc.
1384 * region-model.cc (region_model::check_call_format_attr): New.
1385 (region_model::check_call_args): Call it.
1386 (struct call_arg_details): Move it to call-details.h.
1387 * region-model.h (region_model::check_call_format_attr): New decl.
1389 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1391 * kf.cc (class kf_fopen): New.
1392 (register_known_functions): Register it.
1394 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1397 * analyzer.opt (Wanalyzer-unterminated-string): Delete.
1399 (call_details::check_for_null_terminated_string_arg): Convert
1400 return type from void to const svalue *. Add param "out_sval".
1402 (call_details::check_for_null_terminated_string_arg): Likewise.
1403 * kf-analyzer.cc (kf_analyzer_get_strlen::impl_call_pre): Wire up
1404 to result of check_for_null_terminated_string_arg.
1405 * region-model.cc (get_strlen): Delete.
1406 (class unterminated_string_arg): Delete.
1407 (struct fragment): New.
1408 (class iterable_cluster): New.
1409 (region_model::get_store_bytes): New.
1410 (get_tree_for_byte_offset): New.
1411 (region_model::scan_for_null_terminator): New.
1412 (region_model::check_for_null_terminated_string_arg): Convert
1413 return type from void to const svalue *. Add param "out_sval".
1414 Reimplement in terms of scan_for_null_terminator, dropping the
1415 special-case for -Wanalyzer-unterminated-string.
1416 * region-model.h (region_model::get_store_bytes): New decl.
1417 (region_model::scan_for_null_terminator): New decl.
1418 (region_model::check_for_null_terminated_string_arg): Convert
1419 return type from void to const svalue *. Add param "out_sval".
1420 * store.cc (concrete_binding::get_byte_range): New.
1421 * store.h (concrete_binding::get_byte_range): New decl.
1422 (store_manager::get_concrete_binding): New overload.
1424 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1426 * region-model.cc (region_model_context_decorator::add_event):
1427 Handle m_inner being NULL.
1428 * region-model.h (class region_model_context_decorator): Likewise.
1429 (annotating_context::warn): Likewise.
1431 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1433 * diagnostic-manager.cc (saved_diagnostic::add_event): New.
1434 (saved_diagnostic::add_any_saved_events): New.
1435 (diagnostic_manager::add_event): New.
1436 (dedupe_winners::emit_best): New.
1437 (diagnostic_manager::emit_saved_diagnostic): Make "sd" param
1438 non-const. Call saved_diagnostic::add_any_saved_events.
1439 * diagnostic-manager.h (saved_diagnostic::add_event): New decl.
1440 (saved_diagnostic::add_any_saved_events): New decl.
1441 (saved_diagnostic::m_saved_events): New field.
1442 (diagnostic_manager::add_event): New decl.
1443 (diagnostic_manager::emit_saved_diagnostic): Make "sd" param
1445 * engine.cc (impl_region_model_context::add_event): New.
1446 * exploded-graph.h (impl_region_model_context::add_event): New decl.
1448 (noop_region_model_context::add_event): New.
1449 (region_model_context_decorator::add_event): New.
1450 * region-model.h (region_model_context::add_event): New vfunc.
1451 (noop_region_model_context::add_event): New decl.
1452 (region_model_context_decorator::add_event): New decl.
1454 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1457 (class check_external_function_for_access_attr::annotating_ctxt):
1458 Convert to an annotating_context.
1459 * region-model.h (class note_adding_context): Rename to...
1460 (class annotating_context): ...this, updating the "warn" method.
1461 (note_adding_context::make_note): Replace with...
1462 (annotating_context::add_annotations): ...this.
1464 2023-08-14 benjamin priour <vultkayn@gcc.gnu.org>
1467 * analyzer.opt: Add new option.
1468 * diagnostic-manager.cc
1469 (diagnostic_manager::prune_path): Call prune_system_headers.
1470 (prune_frame): New function that deletes all events in a frame.
1471 (diagnostic_manager::prune_system_headers): New function.
1472 * diagnostic-manager.h: Add prune_system_headers declaration.
1474 2023-08-11 David Malcolm <dmalcolm@redhat.com>
1477 * analyzer.opt (Wanalyzer-unterminated-string): New.
1479 (call_details::check_for_null_terminated_string_arg): New.
1481 (call_details::check_for_null_terminated_string_arg): New decl.
1482 * kf-analyzer.cc (class kf_analyzer_get_strlen): New.
1483 (register_known_analyzer_functions): Register it.
1484 * kf.cc (kf_error::impl_call_pre): Check that format arg is a
1485 valid null-terminated string.
1486 (kf_putenv::impl_call_pre): Likewise for the sole param.
1487 (kf_strchr::impl_call_pre): Likewise for the first param.
1488 (kf_strcpy::impl_call_pre): Likewise for the second param.
1489 (kf_strdup::impl_call_pre): Likewise for the sole param.
1490 * region-model.cc (get_strlen): New.
1491 (struct call_arg_details): New.
1492 (inform_about_expected_null_terminated_string_arg): New.
1493 (class unterminated_string_arg): New.
1494 (region_model::check_for_null_terminated_string_arg): New.
1496 (region_model::check_for_null_terminated_string_arg): New decl.
1498 2023-08-11 Eric Feng <ef2648@columbia.edu>
1501 * call-details.h: New function.
1502 * region-model.cc (region_model::get_or_create_region_for_heap_alloc):
1503 New optional parameters.
1504 * region-model.h (class region_model): New optional parameters.
1505 * sm-malloc.cc (on_realloc_with_move): New function.
1506 (region_model::transition_ptr_sval_non_null): New function.
1508 2023-08-09 David Malcolm <dmalcolm@redhat.com>
1510 * analyzer.h (class pure_known_function_with_default_return): New
1512 * call-details.cc (const_fn_p): Move here from region-model.cc.
1513 (maybe_get_const_fn_result): Likewise.
1514 (get_result_size_in_bytes): Likewise.
1515 (call_details::set_any_lhs_with_defaults): New function, based on
1516 code in region_model::on_call_pre.
1517 * call-details.h (call_details::set_any_lhs_with_defaults): New
1519 * diagnostic-manager.cc
1520 (diagnostic_manager::emit_saved_diagnostic): Log the index of the
1522 * kf.cc (pure_known_function_with_default_return::impl_call_pre):
1524 (kf_memset::impl_call_pre): Set the LHS to the first param.
1525 (kf_putenv::impl_call_pre): Call cd.set_any_lhs_with_defaults.
1526 (kf_sprintf::impl_call_pre): Call cd.set_any_lhs_with_defaults.
1527 (class kf_stack_restore): Derive from
1528 pure_known_function_with_default_return.
1529 (class kf_stack_save): Likewise.
1530 (kf_strlen::impl_call_pre): Call cd.set_any_lhs_with_defaults.
1531 * region-model-reachability.cc (reachable_regions::handle_sval):
1532 Remove logic for symbolic regions for pointers.
1533 * region-model.cc (region_model::canonicalize): Remove purging of
1534 dynamic extents workaround for surplus values from
1535 region_model::on_call_pre's default LHS code.
1536 (const_fn_p): Move to call-details.cc.
1537 (maybe_get_const_fn_result): Likewise.
1538 (get_result_size_in_bytes): Likewise.
1539 (region_model::update_for_nonzero_return): Call
1540 cd.set_any_lhs_with_defaults.
1541 (region_model::on_call_pre): Remove the assignment to the LHS of a
1542 default return value, instead requiring all known_function
1543 implementations to write to any LHS of the call. Use
1544 cd.set_any_lhs_with_defaults on the non-kf paths.
1545 * sm-fd.cc (kf_socket::outcome_of_socket::update_model): Use
1546 cd.set_any_lhs_with_defaults when failing to get at fd state.
1547 (kf_bind::outcome_of_bind::update_model): Likewise.
1548 (kf_listen::outcome_of_listen::update_model): Likewise.
1549 (kf_accept::outcome_of_accept::update_model): Likewise.
1550 (kf_connect::outcome_of_connect::update_model): Likewise.
1551 (kf_read::impl_call_pre): Use cd.set_any_lhs_with_defaults.
1552 * sm-file.cc (class kf_stdio_output_fn): Derive from
1553 pure_known_function_with_default_return.
1554 (class kf_ferror): Likewise.
1555 (class kf_fileno): Likewise.
1556 (kf_fgets::impl_call_pre): Use cd.set_any_lhs_with_defaults.
1557 (kf_read::impl_call_pre): Likewise.
1558 (class kf_getc): Derive from
1559 pure_known_function_with_default_return.
1560 (class kf_getchar): Likewise.
1561 * varargs.cc (kf_va_arg::impl_call_pre): Use
1562 cd.set_any_lhs_with_defaults.
1564 2023-08-04 David Malcolm <dmalcolm@redhat.com>
1567 * bounds-checking.cc (region_model::check_region_bounds): Handle
1568 symbolic base regions.
1569 * call-details.cc: Include "stringpool.h" and "attribs.h".
1570 (call_details::lookup_function_attribute): New function.
1571 * call-details.h (call_details::lookup_function_attribute): New
1573 * region-model-manager.cc
1574 (region_model_manager::maybe_fold_binop): Add reference to
1576 * region-model-reachability.cc (reachable_regions::handle_sval):
1577 Add symbolic regions for pointers that are conjured svalues for
1579 * region-model.cc (region_model::canonicalize): Purge dynamic
1580 extents for regions that aren't referenced.
1581 (get_result_size_in_bytes): New function.
1582 (region_model::on_call_pre): Use get_result_size_in_bytes and
1583 potentially set the dynamic extents of the region pointed to by
1585 (region_model::deref_rvalue): Add param "add_nonnull_constraint"
1586 and use it to conditionalize adding the constraint.
1587 (pending_diagnostic_subclass::dubious_allocation_size): Add "stmt"
1588 param to both ctors and use it to initialize new "m_stmt" field.
1589 (pending_diagnostic_subclass::operator==): Use m_stmt; don't use
1591 (pending_diagnostic_subclass::m_stmt): New field.
1592 (region_model::check_region_size): Generalize to any kind of
1593 pointer svalue by using deref_rvalue rather than checking for
1594 region_svalue. Pass stmt to dubious_allocation_size ctor.
1595 * region-model.h (region_model::deref_rvalue): Add param
1596 "add_nonnull_constraint".
1597 * svalue.cc (conjured_svalue::lhs_value_p): New function.
1598 * svalue.h (conjured_svalue::lhs_value_p): New decl.
1600 2023-08-04 David Malcolm <dmalcolm@redhat.com>
1602 * svalue.cc (region_svalue::dump_to_pp): Support NULL type.
1603 (constant_svalue::dump_to_pp): Likewise.
1604 (initial_svalue::dump_to_pp): Likewise.
1605 (conjured_svalue::dump_to_pp): Likewise. Fix missing print of the
1608 2023-08-03 David Malcolm <dmalcolm@redhat.com>
1611 * region.cc (int_size_in_bits): Fail on zero-sized types.
1613 2023-08-02 Eric Feng <ef2648@columbia.edu>
1616 * analyzer-language.cc (run_callbacks): New function.
1617 (on_finish_translation_unit): New function.
1618 * analyzer-language.h (GCC_ANALYZER_LANGUAGE_H): New include.
1619 (class translation_unit): New vfuncs.
1621 2023-07-26 David Malcolm <dmalcolm@redhat.com>
1624 * region-model-manager.cc
1625 (region_model_manager::region_model_manager): Update for
1626 generalizing region ids to also cover svalues.
1627 (region_model_manager::get_or_create_constant_svalue): Likewise.
1628 (region_model_manager::get_or_create_unknown_svalue): Likewise.
1629 (region_model_manager::create_unique_svalue): Likewise.
1630 (region_model_manager::get_or_create_initial_value): Likewise.
1631 (region_model_manager::get_or_create_setjmp_svalue): Likewise.
1632 (region_model_manager::get_or_create_poisoned_svalue): Likewise.
1633 (region_model_manager::get_ptr_svalue): Likewise.
1634 (region_model_manager::get_or_create_unaryop): Likewise.
1635 (region_model_manager::get_or_create_binop): Likewise.
1636 (region_model_manager::get_or_create_sub_svalue): Likewise.
1637 (region_model_manager::get_or_create_repeated_svalue): Likewise.
1638 (region_model_manager::get_or_create_bits_within): Likewise.
1639 (region_model_manager::get_or_create_unmergeable): Likewise.
1640 (region_model_manager::get_or_create_widening_svalue): Likewise.
1641 (region_model_manager::get_or_create_compound_svalue): Likewise.
1642 (region_model_manager::get_or_create_conjured_svalue): Likewise.
1643 (region_model_manager::get_or_create_asm_output_svalue): Likewise.
1644 (region_model_manager::get_or_create_const_fn_result_svalue):
1646 (region_model_manager::get_region_for_fndecl): Likewise.
1647 (region_model_manager::get_region_for_label): Likewise.
1648 (region_model_manager::get_region_for_global): Likewise.
1649 (region_model_manager::get_field_region): Likewise.
1650 (region_model_manager::get_element_region): Likewise.
1651 (region_model_manager::get_offset_region): Likewise.
1652 (region_model_manager::get_sized_region): Likewise.
1653 (region_model_manager::get_cast_region): Likewise.
1654 (region_model_manager::get_frame_region): Likewise.
1655 (region_model_manager::get_symbolic_region): Likewise.
1656 (region_model_manager::get_region_for_string): Likewise.
1657 (region_model_manager::get_bit_range): Likewise.
1658 (region_model_manager::get_var_arg_region): Likewise.
1659 (region_model_manager::get_region_for_unexpected_tree_code):
1661 (region_model_manager::get_or_create_region_for_heap_alloc):
1663 (region_model_manager::create_region_for_alloca): Likewise.
1664 (region_model_manager::log_stats): Likewise.
1665 * region-model-manager.h (region_model_manager::get_num_regions):
1667 (region_model_manager::get_num_symbols): ...this.
1668 (region_model_manager::alloc_region_id): Replace with...
1669 (region_model_manager::alloc_symbol_id): ...this.
1670 (region_model_manager::m_next_region_id): Replace with...
1671 (region_model_manager::m_next_symbol_id): ...this.
1672 * region-model.cc (selftest::test_get_representative_tree): Update
1673 for generalizing region ids to also cover svalues.
1674 (selftest::test_binop_svalue_folding): Likewise.
1675 (selftest::test_state_merging): Likewise.
1676 * region.cc (region::cmp_ids): Delete, in favor of
1678 (region::region): Update for introduction of symbol base class.
1679 (frame_region::get_region_for_local): Likewise.
1680 (root_region::root_region): Likewise.
1681 (symbolic_region::symbolic_region): Likewise.
1682 * region.h: Replace include of "analyzer/complexity.h" with
1683 "analyzer/symbol.h".
1684 (class region): Make a subclass of symbol.
1685 (region::get_id): Delete in favor of symbol::get_id.
1686 (region::cmp_ids): Delete in favor of symbol::cmp_ids.
1687 (region::get_complexity): Delete in favor of
1688 symbol::get_complexity.
1689 (region::region): Use symbol::id_t for "id" param.
1690 (region::m_complexity): Move field to symbol base class.
1691 (region::m_id): Likewise.
1692 (space_region::space_region): Use symbol::id_t for "id" param.
1693 (frame_region::frame_region): Likewise.
1694 (globals_region::globals_region): Likewise.
1695 (code_region::code_region): Likewise.
1696 (function_region::function_region): Likewise.
1697 (label_region::label_region): Likewise.
1698 (stack_region::stack_region): Likewise.
1699 (heap_region::heap_region): Likewise.
1700 (thread_local_region::thread_local_region): Likewise.
1701 (root_region::root_region): Likewise.
1702 (symbolic_region::symbolic_region): Likewise.
1703 (decl_region::decl_region): Likewise.
1704 (field_region::field_region): Likewise.
1705 (element_region::element_region): Likewise.
1706 (offset_region::offset_region): Likewise.
1707 (sized_region::sized_region): Likewise.
1708 (cast_region::cast_region): Likewise.
1709 (heap_allocated_region::heap_allocated_region): Likewise.
1710 (alloca_region::alloca_region): Likewise.
1711 (string_region::string_region): Likewise.
1712 (bit_range_region::bit_range_region): Likewise.
1713 (var_arg_region::var_arg_region): Likewise.
1714 (errno_region::errno_region): Likewise.
1715 (unknown_region::unknown_region): Likewise.
1716 * svalue.cc (sub_svalue::sub_svalue): Add symbol::id_t param.
1717 (repeated_svalue::repeated_svalue): Likewise.
1718 (bits_within_svalue::bits_within_svalue): Likewise.
1719 (compound_svalue::compound_svalue): Likewise.
1720 * svalue.h: Replace include of "analyzer/complexity.h" with
1721 "analyzer/symbol.h".
1722 (class svalue): Make a subclass of symbol.
1723 (svalue::get_complexity): Delete in favor of
1724 symbol::get_complexity.
1725 (svalue::svalue): Add symbol::id_t param. Update for new base
1727 (svalue::m_complexity): Delete in favor of
1728 symbol::m_complexity.
1729 (region_svalue::region_svalue): Add symbol::id_t param
1730 (constant_svalue::constant_svalue): Likewise.
1731 (unknown_svalue::unknown_svalue): Likewise.
1732 (poisoned_svalue::poisoned_svalue): Likewise.
1733 (setjmp_svalue::setjmp_svalue): Likewise.
1734 (initial_svalue::initial_svalue): Likewise.
1735 (unaryop_svalue::unaryop_svalue): Likewise.
1736 (binop_svalue::binop_svalue): Likewise.
1737 (sub_svalue::sub_svalue): Likewise.
1738 (repeated_svalue::repeated_svalue): Likewise.
1739 (bits_within_svalue::bits_within_svalue): Likewise.
1740 (unmergeable_svalue::unmergeable_svalue): Likewise.
1741 (placeholder_svalue::placeholder_svalue): Likewise.
1742 (widening_svalue::widening_svalue): Likewise.
1743 (compound_svalue::compound_svalue): Likewise.
1744 (conjured_svalue::conjured_svalue): Likewise.
1745 (asm_output_svalue::asm_output_svalue): Likewise.
1746 (const_fn_result_svalue::const_fn_result_svalue): Likewise.
1747 * symbol.cc: New file.
1748 * symbol.h: New file.
1750 2023-07-21 David Malcolm <dmalcolm@redhat.com>
1753 * region-model.cc (region_model::get_gassign_result): Only check
1754 for bad shift counts when dealing with an integral type.
1756 2023-07-21 David Malcolm <dmalcolm@redhat.com>
1759 PR middle-end/110612
1760 * access-diagram.cc (class spatial_item): Add virtual dtor.
1762 2023-07-21 David Malcolm <dmalcolm@redhat.com>
1765 * region.h (struct cast_region::key_t): Support "m_type" being
1766 null by using "m_original_region" for empty/deleted slots.
1768 2023-07-19 David Malcolm <dmalcolm@redhat.com>
1771 * region-model-manager.cc
1772 (region_model_manager::get_or_create_int_cst): Assert that we have
1773 an integral or pointer type.
1774 * sm-taint.cc (taint_state_machine::check_for_tainted_divisor):
1775 Don't check non-integral types.
1777 2023-06-29 benjamin priour <priour.be@gmail.com>
1780 * region-model-manager.cc
1781 (region_model_manager::get_or_create_initial_value): Take an
1782 optional boolean value to bypass poisoning checks
1783 * region-model-manager.h: Update declaration of the above function.
1784 * region-model.cc (region_model::get_store_value): No longer returns
1785 on OOB, but rather gives a boolean to get_or_create_initial_value.
1786 (region_model::check_region_access): Update docstring.
1787 (region_model::check_region_for_write): Update docstring.
1789 2023-06-24 David Malcolm <dmalcolm@redhat.com>
1791 * access-diagram.cc: Add #define INCLUDE_VECTOR.
1792 * bounds-checking.cc: Likewise.
1794 2023-06-22 David Malcolm <dmalcolm@redhat.com>
1797 * access-diagram.cc: New file.
1798 * access-diagram.h: New file.
1799 * analyzer.h (class region_offset): Add default ctor.
1800 (region_offset::make_byte_offset): New decl.
1801 (region_offset::concrete_p): New.
1802 (region_offset::get_concrete_byte_offset): New.
1803 (region_offset::calc_symbolic_bit_offset): New decl.
1804 (region_offset::calc_symbolic_byte_offset): New decl.
1805 (region_offset::dump_to_pp): New decl.
1806 (region_offset::dump): New decl.
1807 (operator<, operator<=, operator>, operator>=): New decls for
1810 (-param=analyzer-text-art-string-ellipsis-threshold=): New.
1811 (-param=analyzer-text-art-string-ellipsis-head-len=): New.
1812 (-param=analyzer-text-art-string-ellipsis-tail-len=): New.
1813 (-param=analyzer-text-art-ideal-canvas-width=): New.
1814 (fanalyzer-debug-text-art): New.
1815 * bounds-checking.cc: Include "intl.h", "diagnostic-diagram.h",
1816 and "analyzer/access-diagram.h".
1817 (class out_of_bounds::oob_region_creation_event_capacity): New.
1818 (out_of_bounds::out_of_bounds): Add "model" and "sval_hint"
1820 (out_of_bounds::mark_interesting_stuff): Use the base region.
1821 (out_of_bounds::add_region_creation_events): Use
1822 oob_region_creation_event_capacity.
1823 (out_of_bounds::get_dir): New pure vfunc.
1824 (out_of_bounds::maybe_show_notes): New.
1825 (out_of_bounds::maybe_show_diagram): New.
1826 (out_of_bounds::make_access_diagram): New.
1827 (out_of_bounds::m_model): New field.
1828 (out_of_bounds::m_sval_hint): New field.
1829 (out_of_bounds::m_region_creation_event_id): New field.
1830 (concrete_out_of_bounds::concrete_out_of_bounds): Update for new
1832 (concrete_past_the_end::concrete_past_the_end): Likewise.
1833 (concrete_past_the_end::add_region_creation_events): Use
1834 oob_region_creation_event_capacity.
1835 (concrete_buffer_overflow::concrete_buffer_overflow): Update for
1837 (concrete_buffer_overflow::emit): Replace call to
1838 maybe_describe_array_bounds with maybe_show_notes.
1839 (concrete_buffer_overflow::get_dir): New.
1840 (concrete_buffer_over_read::concrete_buffer_over_read): Update for
1842 (concrete_buffer_over_read::emit): Replace call to
1843 maybe_describe_array_bounds with maybe_show_notes.
1844 (concrete_buffer_overflow::get_dir): New.
1845 (concrete_buffer_underwrite::concrete_buffer_underwrite): Update
1847 (concrete_buffer_underwrite::emit): Replace call to
1848 maybe_describe_array_bounds with maybe_show_notes.
1849 (concrete_buffer_underwrite::get_dir): New.
1850 (concrete_buffer_under_read::concrete_buffer_under_read): Update
1852 (concrete_buffer_under_read::emit): Replace call to
1853 maybe_describe_array_bounds with maybe_show_notes.
1854 (concrete_buffer_under_read::get_dir): New.
1855 (symbolic_past_the_end::symbolic_past_the_end): Update for new
1857 (symbolic_buffer_overflow::symbolic_buffer_overflow): Likewise.
1858 (symbolic_buffer_overflow::emit): Call maybe_show_notes.
1859 (symbolic_buffer_overflow::get_dir): New.
1860 (symbolic_buffer_over_read::symbolic_buffer_over_read): Update for
1862 (symbolic_buffer_over_read::emit): Call maybe_show_notes.
1863 (symbolic_buffer_over_read::get_dir): New.
1864 (region_model::check_symbolic_bounds): Add "sval_hint" param. Pass
1865 it and sized_offset_reg to diagnostics.
1866 (region_model::check_region_bounds): Add "sval_hint" param, passing
1868 * diagnostic-manager.cc
1869 (diagnostic_manager::emit_saved_diagnostic): Pass logger to
1870 pending_diagnostic::emit.
1871 * engine.cc: Add logger param to pending_diagnostic::emit
1873 * infinite-recursion.cc: Likewise.
1874 * kf-analyzer.cc: Likewise.
1875 * kf.cc: Likewise. Add nullptr for new param of
1876 check_region_for_write.
1877 * pending-diagnostic.h: Likewise in decl.
1878 * region-model-manager.cc
1879 (region_model_manager::get_or_create_int_cst): Convert param from
1880 poly_int64 to const poly_wide_int_ref &.
1881 (region_model_manager::maybe_fold_binop): Support type being NULL
1882 when checking for floating-point types.
1883 Check for (X + Y) - X => Y. Be less strict about types when folding
1884 associative ops. Check for (X + Y) * CST => (X * CST) + (Y * CST).
1885 * region-model-manager.h
1886 (region_model_manager::get_or_create_int_cst): Convert param from
1887 poly_int64 to const poly_wide_int_ref &.
1888 * region-model.cc: Add logger param to pending_diagnostic::emit
1890 (region_model::check_external_function_for_access_attr): Update
1891 for new param of check_region_for_write.
1892 (region_model::deref_rvalue): Use nullptr rather than NULL.
1893 (region_model::get_capacity): Handle RK_STRING.
1894 (region_model::check_region_access): Add "sval_hint" param; pass it to
1895 check_region_bounds.
1896 (region_model::check_region_for_write): Add "sval_hint" param;
1897 pass it to check_region_access.
1898 (region_model::check_region_for_read): Add NULL for new param to
1899 check_region_access.
1900 (region_model::set_value): Pass rhs_sval to
1901 check_region_for_write.
1902 (region_model::get_representative_path_var_1): Handle SK_CONSTANT
1903 in the check for infinite recursion.
1904 * region-model.h (region_model::check_region_for_write): Add
1906 (region_model::check_region_access): Likewise.
1907 (region_model::check_symbolic_bounds): Likewise.
1908 (region_model::check_region_bounds): Likewise.
1909 * region.cc (region_offset::make_byte_offset): New.
1910 (region_offset::calc_symbolic_bit_offset): New.
1911 (region_offset::calc_symbolic_byte_offset): New.
1912 (region_offset::dump_to_pp): New.
1913 (region_offset::dump): New.
1914 (struct linear_op): New.
1915 (operator<, operator<=, operator>, operator>=): New, for
1917 (region::get_next_offset): New.
1918 (region::get_relative_symbolic_offset): Use ptrdiff_type_node.
1919 (field_region::get_relative_symbolic_offset): Likewise.
1920 (element_region::get_relative_symbolic_offset): Likewise.
1921 (bit_range_region::get_relative_symbolic_offset): Likewise.
1922 * region.h (region::get_next_offset): New decl.
1923 * sm-fd.cc: Add logger param to pending_diagnostic::emit
1925 * sm-file.cc: Likewise.
1926 * sm-malloc.cc: Likewise.
1927 * sm-pattern-test.cc: Likewise.
1928 * sm-sensitive.cc: Likewise.
1929 * sm-signal.cc: Likewise.
1930 * sm-taint.cc: Likewise.
1931 * store.cc (bit_range::contains_p): Allow "out" to be null.
1932 * store.h (byte_range::get_start_bit_offset): New.
1933 (byte_range::get_next_bit_offset): New.
1934 * varargs.cc: Add logger param to pending_diagnostic::emit
1937 2023-06-10 Tim Lange <mail@tim-lange.me>
1940 * constraint-manager.cc (class sval_finder): Visitor to find
1941 childs in svalue trees.
1942 (constraint_manager::sval_constrained_p): Add new function to
1943 check whether a sval might be part of an constraint.
1944 * constraint-manager.h: Add sval_constrained_p function.
1945 * region-model.cc (class size_visitor): Reverse behavior to not
1946 emit a warning on not explicitly considered cases.
1947 (region_model::check_region_size):
1948 Adapt to size_visitor changes.
1950 2023-06-09 David Malcolm <dmalcolm@redhat.com>
1953 * region-model.cc (region_model::get_initial_value_for_global):
1954 Move code to region::calc_initial_value_at_main.
1955 * region.cc (region::get_initial_value_at_main): New function.
1956 (region::calc_initial_value_at_main): New function, based on code
1957 in region_model::get_initial_value_for_global.
1958 (region::region): Initialize m_cached_init_sval_at_main.
1959 (decl_region::get_svalue_for_constructor): Add a cache, splitting
1961 (decl_region::calc_svalue_for_constructor): ...this new function.
1962 * region.h (region::get_initial_value_at_main): New decl.
1963 (region::calc_initial_value_at_main): New decl.
1964 (region::m_cached_init_sval_at_main): New field.
1965 (decl_region::decl_region): Initialize m_ctor_svalue.
1966 (decl_region::calc_svalue_for_constructor): New decl.
1967 (decl_region::m_ctor_svalue): New field.
1969 2023-06-08 Benjamin Priour <vultkayn@gcc.gnu.org>
1971 * bounds-checking.cc (region_model::check_symbolic_bounds): Returns whether the BASE_REG
1972 region access was OOB.
1973 (region_model::check_region_bounds): Likewise.
1974 * region-model.cc (region_model::get_store_value): Creates an
1975 unknown svalue on OOB-read access to REG.
1976 (region_model::check_region_access): Returns whether an unknown svalue needs be created.
1977 (region_model::check_region_for_read): Passes check_region_access return value.
1978 * region-model.h: Update prior function definitions.
1980 2023-06-02 David Malcolm <dmalcolm@redhat.com>
1983 * kf.cc (class kf_atomic_exchange): New.
1984 (class kf_atomic_exchange_n): New.
1985 (class kf_atomic_fetch_op): New.
1986 (class kf_atomic_op_fetch): New.
1987 (class kf_atomic_load): New.
1988 (class kf_atomic_load_n): New.
1989 (class kf_atomic_store_n): New.
1990 (register_atomic_builtins): New function.
1991 (register_known_functions): Call register_atomic_builtins.
1993 2023-06-02 David Malcolm <dmalcolm@redhat.com>
1995 * store.cc (store::eval_alias_1): Regions in different memory
1998 2023-05-18 Bernhard Reutner-Fischer <aldot@gcc.gnu.org>
2000 * region-model-manager.cc (get_code_for_cast): Use _P defines from
2002 (region_model_manager::get_or_create_cast): Ditto.
2003 (region_model_manager::get_region_for_global): Ditto.
2004 * region-model.cc (region_model::get_lvalue_1): Ditto.
2005 * region.cc (decl_region::maybe_get_constant_value): Ditto.
2007 2023-03-22 David Malcolm <dmalcolm@redhat.com>
2010 * program-point.cc: Include "analyzer/inlining-iterator.h".
2011 (program_point::effectively_intraprocedural_p): New function.
2012 * program-point.h (program_point::effectively_intraprocedural_p):
2014 * sm-malloc.cc (deref_before_check::emit): Use it when rejecting
2015 interprocedural cases, so that we reject interprocedural cases
2016 that have become intraprocedural due to inlining.
2018 2023-03-18 David Malcolm <dmalcolm@redhat.com>
2021 * region-model.cc (region_model::on_longjmp): Pass false for
2022 new "eval_return_svalue" param of pop_frame.
2023 (region_model::pop_frame): Add new "eval_return_svalue" param and
2024 use it to suppress the call to get_rvalue on the result when
2025 needed by on_longjmp.
2026 * region-model.h (region_model::pop_frame): Add new
2027 "eval_return_svalue" param.
2029 2023-03-10 David Malcolm <dmalcolm@redhat.com>
2032 * region-model.cc (region_model::mark_region_as_unknown): Gather a
2033 set of maybe-live svalues and call on_maybe_live_values with it.
2034 * store.cc (binding_map::remove_overlapping_bindings): Add new
2035 "maybe_live_values" param; add any removed svalues to it.
2036 (binding_cluster::clobber_region): Add NULL as new param of
2037 remove_overlapping_bindings.
2038 (binding_cluster::mark_region_as_unknown): Add "maybe_live_values"
2039 param and pass it to remove_overlapping_bindings.
2040 (binding_cluster::maybe_get_compound_binding): Add NULL for new
2041 param of binding_map::remove_overlapping_bindings.
2042 (binding_cluster::remove_overlapping_bindings): Add
2043 "maybe_live_values" param and pass to
2044 binding_map::remove_overlapping_bindings.
2045 (store::set_value): Capture a set of maybe-live svalues, and call
2046 on_maybe_live_values with it.
2047 (store::on_maybe_live_values): New.
2048 (store::mark_region_as_unknown): Add "maybe_live_values" param
2049 and pass it to binding_cluster::mark_region_as_unknown.
2050 (store::remove_overlapping_bindings): Pass NULL for new param of
2051 binding_cluster::remove_overlapping_bindings.
2052 * store.h (binding_map::remove_overlapping_bindings): Add
2053 "maybe_live_values" param.
2054 (binding_cluster::mark_region_as_unknown): Likewise.
2055 (binding_cluster::remove_overlapping_bindings): Likewise.
2056 (store::mark_region_as_unknown): Likewise.
2057 (store::on_maybe_live_values): New decl.
2059 2023-03-10 David Malcolm <dmalcolm@redhat.com>
2063 * sm-malloc.cc (deref_before_check::deref_before_check):
2064 Initialize new field m_deref_expr. Assert that arg is non-NULL.
2065 (deref_before_check::emit): Reject cases where the spelling of the
2066 thing that was dereferenced differs from that of what is checked,
2067 or if the dereference expression was not found. Remove code to
2069 (deref_before_check::describe_state_change): Remove code to handle
2071 (deref_before_check::describe_final_event): Likewise.
2072 (deref_before_check::sufficiently_similar_p): New.
2073 (deref_before_check::m_deref_expr): New field.
2074 (malloc_state_machine::maybe_complain_about_deref_before_check):
2075 Don't warn if the diag_ptr is NULL.
2077 2023-03-03 David Malcolm <dmalcolm@redhat.com>
2079 * kf.cc (class kf_sprintf): New.
2080 (register_known_functions): Register it.
2082 2023-03-02 David Malcolm <dmalcolm@redhat.com>
2085 * region-model.cc (region_model::get_rvalue_1): Handle VAR_DECLs
2086 with a DECL_HARD_REGISTER by returning UNKNOWN.
2088 2023-03-02 Hans-Peter Nilsson <hp@axis.com>
2090 * kf.cc (register_known_functions): Add __errno function for newlib.
2092 2023-03-01 David Malcolm <dmalcolm@redhat.com>
2095 * region-model.cc (region_model::on_call_pre): Flatten logic by
2096 returning early. Consolidate logic for detecting const and pure
2097 functions. When considering whether an unhandled built-in
2098 function has side-effects, consider all kinds of builtin, rather
2099 than just BUILT_IN_NORMAL, and don't require
2100 gimple_builtin_call_types_compatible_p.
2102 2023-03-01 David Malcolm <dmalcolm@redhat.com>
2105 * infinite-recursion.cc (contains_unknown_p): New.
2106 (sufficiently_different_region_binding_p): New function, splitting
2107 out inner loop from...
2108 (sufficiently_different_p): ...here. Extend detection of unknown
2109 svalues to also include svalues that contain unknown. Treat
2110 changes in frames below the entry to the recursion as being
2111 sufficiently different to reject being an infinite recursion.
2113 2023-02-21 David Malcolm <dmalcolm@redhat.com>
2116 * analyzer.opt (fanalyzer-suppress-followups): New option.
2117 * engine.cc (impl_region_model_context::warn): Terminate the path
2118 if the diagnostic's terminate_path_p vfunc returns true and
2119 -fanalyzer-suppress-followups is true (the default).
2120 (impl_sm_context::warn): Likewise, for both overloads.
2121 * pending-diagnostic.h (pending_diagnostic::terminate_path_p): New
2123 * program-state.cc (program_state::on_edge): Terminate the path if
2124 the ctxt requests it during updating the edge.
2125 * region-model.cc (poisoned_value_diagnostic::terminate_path_p):
2127 * sm-malloc.cc (null_deref::terminate_path_p): New vfunc.
2128 (null_arg::terminate_path_p): New vfunc.
2130 2023-02-16 David Malcolm <dmalcolm@redhat.com>
2133 * constraint-manager.cc (bounded_range::dump_to_pp): Use
2134 bounded_range::singleton_p.
2135 (constraint_manager::add_bounded_ranges): Handle singleton ranges
2136 by adding an EQ_EXPR constraint.
2137 (constraint_manager::impossible_derived_conditions_p): New.
2138 (constraint_manager::eval_condition): Reject EQ_EXPR when it would
2139 imply impossible derived conditions.
2140 (selftest::test_bits): New.
2141 (selftest::run_constraint_manager_tests): Run it.
2142 * constraint-manager.h (bounded_range::singleton_p): New.
2143 (constraint_manager::impossible_derived_conditions_p): New decl.
2144 * region-model.cc (region_model::get_rvalue_1): Handle
2145 BIT_AND_EXPR, BIT_IOR_EXPR, and BIT_XOR_EXPR.
2147 2023-02-15 David Malcolm <dmalcolm@redhat.com>
2152 * diagnostic-manager.cc (epath_finder::get_best_epath): Add
2153 "target_stmt" param.
2154 (epath_finder::explore_feasible_paths): Likewise.
2155 (epath_finder::process_worklist_item): Likewise.
2156 (saved_diagnostic::calc_best_epath): Pass m_stmt to
2157 epath_finder::get_best_epath.
2158 * engine.cc (feasibility_state::maybe_update_for_edge): Move
2159 per-stmt logic to...
2160 (feasibility_state::update_for_stmt): ...this new function.
2161 * exploded-graph.h (feasibility_state::update_for_stmt): New decl.
2162 * feasible-graph.cc (feasible_node::get_state_at_stmt): New.
2163 * feasible-graph.h: Include "analyzer/exploded-graph.h".
2164 (feasible_node::get_state_at_stmt): New decl.
2165 * infinite-recursion.cc
2166 (infinite_recursion_diagnostic::check_valid_fpath_p): Update for
2167 vfunc signature change.
2168 * pending-diagnostic.h (pending_diagnostic::check_valid_fpath_p):
2169 Convert first param to a reference. Add stmt param.
2170 * region-model.cc: Include "analyzer/feasible-graph.h".
2171 (poisoned_value_diagnostic::poisoned_value_diagnostic): Add
2173 (poisoned_value_diagnostic::check_valid_fpath_p): New.
2174 (poisoned_value_diagnostic::m_check_expr): New field.
2175 (region_model::check_for_poison): Attempt to supply a check_expr
2177 (region_model::deref_rvalue): Add NULL for new check_expr param
2178 of poisoned_value_diagnostic.
2179 (region_model::get_or_create_region_for_heap_alloc): Don't reuse
2180 regions that are marked as TOUCHED.
2182 2023-02-10 David Malcolm <dmalcolm@redhat.com>
2185 * sm-malloc.cc (deref_before_check::emit): Reject the warning if
2186 the check occurs within a macro defintion.
2188 2023-02-09 David Malcolm <dmalcolm@redhat.com>
2191 * state-purge.cc (get_candidate_for_purging): Add ADDR_EXPR
2194 2023-02-08 David Malcolm <dmalcolm@redhat.com>
2197 * state-purge.cc (state_purge_per_decl::process_point_backwards):
2198 Don't stop processing the decl if it's fully overwritten by
2199 this stmt if it's also used by this stmt.
2201 2023-02-07 David Malcolm <dmalcolm@redhat.com>
2204 * sm-fd.cc (class kf_read): New.
2205 (register_known_fd_functions): Register "read".
2206 * sm-file.cc (class kf_fread): Update comment.
2208 2023-02-02 David Malcolm <dmalcolm@redhat.com>
2211 * sm-fd.cc (fd_state_machine::check_for_fd_attrs): Add missing
2213 (fd_state_machine::on_listen): Don't issue phase-mismatch or
2214 type-mismatch warnings for the "invalid" state.
2216 2023-02-01 David Malcolm <dmalcolm@redhat.com>
2219 * pending-diagnostic.cc (fixup_location_in_macro_p): Add "alloca"
2220 to macros that we shouldn't unwind inside.
2222 2023-01-26 David Malcolm <dmalcolm@redhat.com>
2225 * analyzer.h (class feasible_node): New forward decl.
2226 * diagnostic-manager.cc (epath_finder::get_best_epath): Add "pd"
2228 (epath_finder::explore_feasible_paths): Likewise.
2229 (epath_finder::process_worklist_item): Likewise. Use it to call
2230 pending_diagnostic::check_valid_fpath_p on the final fpath to
2231 give pending_diagnostic a way to add additional restrictions on
2233 (saved_diagnostic::calc_best_epath): Pass pending_diagnostic to
2234 epath_finder::get_best_epath.
2235 * infinite-recursion.cc: Include "analyzer/feasible-graph.h".
2236 (infinite_recursion_diagnostic::check_valid_fpath_p): New.
2237 (infinite_recursion_diagnostic::fedge_uses_conjured_svalue_p): New.
2238 (infinite_recursion_diagnostic::expr_uses_conjured_svalue_p): New.
2239 * pending-diagnostic.h (pending_diagnostic::check_valid_fpath_p):
2242 2023-01-19 David Malcolm <dmalcolm@redhat.com>
2245 * analyzer.h (class checker_event): New forward decl.
2246 (class state_change_event): Indent.
2247 (class warning_event): New forward decl.
2248 * checker-event.cc (state_change_event::state_change_event): Add
2250 (warning_event::get_desc): Update for new param of
2251 evdesc::final_event ctor.
2252 * checker-event.h (state_change_event::state_change_event): Add
2254 (state_change_event::get_exploded_node): New accessor.
2255 (state_change_event::m_enode): New field.
2256 (warning_event::warning_event): New "enode" param.
2257 (warning_event::get_exploded_node): New accessor.
2258 (warning_event::m_enode): New field.
2259 * diagnostic-manager.cc
2260 (state_change_event_creator::on_global_state_change): Pass
2261 src_node to state_change_event ctor.
2262 (state_change_event_creator::on_state_change): Likewise.
2263 (null_assignment_sm_context::set_next_state): Pass NULL for
2264 new param of state_change_event ctor.
2265 * infinite-recursion.cc
2266 (infinite_recursion_diagnostic::add_final_event): Update for new
2267 param of warning_event ctor.
2268 * pending-diagnostic.cc (pending_diagnostic::add_final_event):
2269 Pass enode to warning_event ctor.
2270 * pending-diagnostic.h (evdesc::final_event): Add reference to
2272 * sm-malloc.cc: Include "analyzer/checker-event.h" and
2273 "analyzer/exploded-graph.h".
2274 (deref_before_check::deref_before_check): Initialize new fields.
2275 (deref_before_check::emit): Reject warnings in which we were
2276 unable to determine the enodes of the dereference and the check.
2277 Reject warnings interprocedural warnings. Reject warnings in which
2278 the dereference doesn't dominate the check.
2279 (deref_before_check::describe_state_change): Set m_deref_enode.
2280 (deref_before_check::describe_final_event): Set m_check_enode.
2281 (deref_before_check::m_deref_enode): New field.
2282 (deref_before_check::m_check_enode): New field.
2284 2023-01-13 David Malcolm <dmalcolm@redhat.com>
2287 * region-model.cc (has_nondefault_case_for_value_p): New.
2288 (has_nondefault_cases_for_all_enum_values_p): New.
2289 (region_model::apply_constraints_for_gswitch): Skip
2290 implicitly-created "default" when switching on an enum
2291 and all enum values have non-default cases.
2292 (rejected_default_case::dump_to_pp): New.
2293 * region-model.h (region_model_context::possibly_tainted_p): New
2295 (class rejected_default_case): New.
2296 * sm-taint.cc (region_model_context::possibly_tainted_p): New.
2297 * supergraph.cc (switch_cfg_superedge::dump_label_to_pp): Dump
2298 when implicitly_created_default_p.
2299 (switch_cfg_superedge::implicitly_created_default_p): New.
2301 (switch_cfg_superedge::implicitly_created_default_p): New decl.
2303 2023-01-11 David Malcolm <dmalcolm@redhat.com>
2306 * kf.cc (class kf_strdup): New.
2307 (class kf_strndup): New.
2308 (register_known_functions): Register them.
2309 * region-model.cc (region_model::on_call_pre): Use
2310 &HEAP_ALLOCATED_REGION for the default result of an external
2311 function with the "malloc" attribute, rather than CONJURED_SVALUE.
2312 (region_model::get_or_create_region_for_heap_alloc): Allow
2313 "size_in_bytes" to be NULL.
2314 * store.cc (store::set_value): When handling *UNKNOWN = VAL,
2315 mark VAL as "maybe bound".
2317 2022-12-16 David Malcolm <dmalcolm@redhat.com>
2320 * kf.cc (kf_memcpy_memmove::impl_call_pre): Pass in source region
2321 to region_model::check_for_poison.
2322 * region-model-asm.cc (region_model::on_asm_stmt): Pass NULL
2323 region to region_model::check_for_poison.
2324 * region-model.cc (region_model::check_for_poison): Add
2325 "src_region" param, and pass it to poisoned_value_diagnostic.
2326 (region_model::on_assignment): Pass NULL region to
2327 region_model::check_for_poison.
2328 (region_model::get_rvalue): Likewise.
2329 * region-model.h (region_model::check_for_poison): Add
2331 * sm-fd.cc (fd_state_machine::on_accept): Pass in source region
2332 to region_model::check_for_poison.
2333 * varargs.cc (kf_va_copy::impl_call_pre): Pass NULL region to
2334 region_model::check_for_poison.
2335 (kf_va_arg::impl_call_pre): Pass in source region to
2336 region_model::check_for_poison.
2338 2022-12-14 David Malcolm <dmalcolm@redhat.com>
2341 * region.cc (decl_region::get_svalue_for_initializer): Bail out to
2342 avoid calling binding_key::make with an empty region.
2343 * store.cc (binding_map::apply_ctor_val_to_range): Likewise.
2344 (binding_map::apply_ctor_pair_to_child_region): Likewise.
2345 (binding_cluster::bind): Likewise.
2346 (binding_cluster::purge_region): Likewise.
2347 (binding_cluster::maybe_get_compound_binding): Likewise.
2348 (binding_cluster::maybe_get_simple_value): Likewise.
2350 2022-12-09 David Malcolm <dmalcolm@redhat.com>
2352 * analyzer.h (class known_function): Expand comment.
2353 * region-model-impl-calls.cc: Rename to...
2355 * known-function-manager.h (class known_function_manager): Add
2358 2022-12-09 David Malcolm <dmalcolm@redhat.com>
2362 (call_summary_replay::convert_region_from_summary_1): Convert
2363 heap_regs_in_use from auto_sbitmap to auto_bitmap.
2364 * region-model-manager.cc
2365 (region_model_manager::get_or_create_region_for_heap_alloc):
2366 Convert from sbitmap to bitmap.
2367 * region-model-manager.h: Likewise.
2369 (region_model::get_or_create_region_for_heap_alloc): Convert from
2370 auto_sbitmap to auto_bitmap.
2371 (region_model::get_referenced_base_regions): Likewise.
2372 * region-model.h: Include "bitmap.h" rather than "sbitmap.h".
2373 (region_model::get_referenced_base_regions): Convert from
2374 auto_sbitmap to auto_bitmap.
2376 2022-12-09 David Malcolm <dmalcolm@redhat.com>
2378 * region-model-impl-calls.cc (class kf_memcpy): Rename to...
2379 (class kf_memcpy_memmove): ...this.
2380 (kf_memcpy::impl_call_pre): Rename to...
2381 (kf_memcpy_memmove::impl_call_pre): ...this, and check the src for
2383 (register_known_functions): Update for above renaming, and
2384 register BUILT_IN_MEMMOVE and BUILT_IN_MEMMOVE_CHK.
2386 2022-12-06 David Malcolm <dmalcolm@redhat.com>
2389 * region-model.cc (region_model::get_store_value): Return an
2390 unknown value for empty regions.
2391 (region_model::set_value): Bail on empty regions.
2392 * region.cc (region::empty_p): New.
2393 * region.h (region::empty_p): New decl.
2394 * state-purge.cc (same_binding_p): Bail if either region is empty.
2395 * store.cc (binding_key::make): Assert that a concrete binding's
2396 bit_size must be > 0.
2397 (binding_cluster::mark_region_as_unknown): Bail on empty regions.
2398 (binding_cluster::get_binding): Likewise.
2399 (binding_cluster::remove_overlapping_bindings): Likewise.
2400 (binding_cluster::on_unknown_fncall): Don't conjure values for
2402 (store::fill_region): Bail on empty regions.
2403 * store.h (class concrete_binding): Update comment to reflect that
2404 the range of bits must be non-empty.
2405 (concrete_binding::concrete_binding): Assert that bit range is
2408 2022-12-06 David Malcolm <dmalcolm@redhat.com>
2411 * region-model-manager.cc
2412 (region_model_manager::get_or_create_null_ptr): New.
2413 * region-model-manager.h
2414 (region_model_manager::get_or_create_null_ptr): New decl.
2415 * region-model.cc (region_model::on_top_level_param): Add
2416 "nonnull" param and make use of it.
2417 (region_model::push_frame): When handling a top-level entrypoint
2418 to the analysis, determine which params __attribute__((nonnull))
2419 applies to, and pass to on_top_level_param.
2420 * region-model.h (region_model::on_top_level_param): Add "nonnull"
2423 2022-12-06 David Malcolm <dmalcolm@redhat.com>
2425 * analyzer.h (register_known_analyzer_functions): New decl.
2426 (register_known_functions_lang_cp): New decl.
2427 * call-details.cc: New file, split out from
2428 region-model-impl-calls.cc.
2429 * call-details.h: New file, split out from region-model.h.
2430 * call-info.cc: Include "analyzer/call-details.h".
2431 * call-summary.h: Likewise.
2432 * kf-analyzer.cc: New file, split out from
2433 region-model-impl-calls.cc.
2434 * kf-lang-cp.cc: Likewise.
2435 * known-function-manager.cc: Include "analyzer/call-details.h".
2436 * region-model-impl-calls.cc: Move definitions of call_details's
2437 member functions to call-details.cc. Move class kf_analyzer_* to
2438 kf-analyzer.cc. Move kf_operator_new and kf_operator_delete to
2439 kf-lang-cp.cc. Refresh #includes accordingly.
2440 (register_known_functions): Replace registration of __analyzer_*
2441 functions with a call to register_known_analyzer_functions.
2442 Replace registration of C++ support functions with a call to
2443 register_known_functions_lang_cp.
2444 * region-model.h (class call_details): Move to new call-details.h.
2445 * sm-fd.cc: Include "analyzer/call-details.h".
2446 * sm-file.cc: Likewise.
2447 * sm-malloc.cc: Likewise.
2448 * varargs.cc: Likewise.
2450 2022-12-02 David Malcolm <dmalcolm@redhat.com>
2452 * analyzer.h (struct event_loc_info): New forward decl.
2453 * bounds-checking.cc: Use event_loc_info throughout to bundle the
2454 loc, fndecl, depth triples.
2455 * call-info.cc: Likewise.
2456 * checker-event.cc: Likewise.
2457 * checker-event.h (struct event_loc_info): New decl. Use it
2458 throughout to bundle the loc, fndecl, depth triples.
2459 * checker-path.cc: Likewise.
2460 * checker-path.h: Likewise.
2461 * diagnostic-manager.cc: Likewise.
2462 * engine.cc: Likewise.
2463 * infinite-recursion.cc: Likewise.
2464 * pending-diagnostic.cc: Likewise.
2465 * pending-diagnostic.h: Likewise.
2466 * region-model.cc: Likewise.
2467 * sm-signal.cc: Likewise.
2468 * varargs.cc: Likewise.
2470 2022-12-02 David Malcolm <dmalcolm@redhat.com>
2473 * analyzer.cc (make_label_text_n): Convert param "n" from int to
2474 unsigned HOST_WIDE_INT.
2475 * analyzer.h (make_label_text_n): Likewise for decl.
2476 * bounds-checking.cc: Include "analyzer/checker-event.h" and
2477 "analyzer/checker-path.h".
2478 (out_of_bounds::add_region_creation_events): New.
2479 (concrete_past_the_end::describe_region_creation_event): Replace
2481 (concrete_past_the_end::add_region_creation_events): ...this.
2482 (symbolic_past_the_end::describe_region_creation_event): Delete.
2483 * checker-event.cc (region_creation_event::region_creation_event):
2484 Update for dropping all member data.
2485 (region_creation_event::get_desc): Delete, splitting out into
2486 region_creation_event_memory_space::get_desc,
2487 region_creation_event_capacity::get_desc, and
2488 region_creation_event_debug::get_desc.
2489 (region_creation_event_memory_space::get_desc): New.
2490 (region_creation_event_capacity::get_desc): New.
2491 (region_creation_event_allocation_size::get_desc): New.
2492 (region_creation_event_debug::get_desc): New.
2493 * checker-event.h: Include "analyzer/program-state.h".
2494 (enum rce_kind): Delete.
2495 (class region_creation_event): Drop all member data.
2496 (region_creation_event::region_creation_event): Make protected.
2497 (region_creation_event::get_desc): Delete.
2498 (class region_creation_event_memory_space): New.
2499 (class region_creation_event_capacity): New.
2500 (class region_creation_event_allocation_size): New.
2501 (class region_creation_event_debug): New.
2502 * checker-path.cc (checker_path::add_region_creation_events): Add
2503 "pd" param. Call pending_diangnostic::add_region_creation_events.
2504 Update for conversion of RCE_DEBUG to region_creation_event_debug.
2505 * checker-path.h (checker_path::add_region_creation_events): Add
2507 * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
2508 Pass pending_diagnostic to
2509 emission_path::add_region_creation_events.
2510 (diagnostic_manager::build_emission_path): Pass path_builder to
2511 add_event_on_final_node.
2512 (diagnostic_manager::add_event_on_final_node): Add "pb" param.
2513 Pass pending_diagnostic to
2514 emission_path::add_region_creation_events.
2515 (diagnostic_manager::add_events_for_eedge): Pass
2516 pending_diagnostic to emission_path::add_region_creation_events.
2517 * diagnostic-manager.h
2518 (diagnostic_manager::add_event_on_final_node): Add "pb" param.
2519 * pending-diagnostic.cc
2520 (pending_diagnostic::add_region_creation_events): New.
2521 * pending-diagnostic.h (struct region_creation): Delete.
2522 (pending_diagnostic::describe_region_creation_event): Delete.
2523 (pending_diagnostic::add_region_creation_events): New vfunc.
2524 * region-model.cc: Include "analyzer/checker-event.h" and
2525 "analyzer/checker-path.h".
2526 (dubious_allocation_size::dubious_allocation_size): Initialize
2527 m_has_allocation_event.
2528 (dubious_allocation_size::describe_region_creation_event): Delete.
2529 (dubious_allocation_size::describe_final_event): Update for
2530 replacement of m_allocation_event with m_has_allocation_event.
2531 (dubious_allocation_size::add_region_creation_events): New.
2532 (dubious_allocation_size::m_allocation_event): Replace with...
2533 (dubious_allocation_size::m_has_allocation_event): ...this.
2535 2022-12-02 David Malcolm <dmalcolm@redhat.com>
2538 * region-model-manager.cc
2539 (region_model_manager::maybe_fold_binop): Fold (0 - VAL) to -VAL.
2540 * region-model.cc (region_model::eval_condition): Handle e.g.
2541 "-X <= 0" as equivalent to X >= 0".
2543 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2546 * bounds-checking.cc
2547 (symbolic_past_the_end::describe_final_event): Delete, moving to
2548 symbolic_buffer_overflow::describe_final_event and
2549 symbolic_buffer_over_read::describe_final_event, eliminating
2550 composition of text strings via "byte_str" and "m_dir_str".
2551 (symbolic_past_the_end::m_dir_str): Delete field.
2552 (symbolic_buffer_overflow::symbolic_buffer_overflow): Drop
2554 (symbolic_buffer_overflow::describe_final_event): New, as noted
2556 (symbolic_buffer_over_read::symbolic_buffer_overflow): Drop
2558 (symbolic_buffer_over_read::describe_final_event): New, as noted
2561 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2563 * bounds-checking.cc (class out_of_bounds): Split out from...
2564 (class concrete_out_of_bounds): New abstract subclass.
2565 (class past_the_end): Rename to...
2566 (class concrete_past_the_end): ...this, and make a subclass of
2567 concrete_out_of_bounds.
2568 (class buffer_overflow): Rename to...
2569 (class concrete_buffer_overflow): ...this, and make a subclass of
2570 concrete_past_the_end.
2571 (class buffer_over_read): Rename to...
2572 (class concrete_buffer_over_read): ...this, and make a subclass of
2573 concrete_past_the_end.
2574 (class buffer_underwrite): Rename to...
2575 (class concrete_buffer_underwrite): ...this, and make a subclass
2576 of concrete_out_of_bounds.
2577 (class buffer_under_read): Rename to...
2578 (class concrete_buffer_under_read): ...this, and make a subclass
2579 of concrete_out_of_bounds.
2580 (class symbolic_past_the_end): Convert to a subclass of
2582 (symbolic_buffer_overflow::get_kind): New.
2583 (symbolic_buffer_over_read::get_kind): New.
2584 (region_model::check_region_bounds): Update for renamings.
2585 * engine.cc (impl_sm_context::set_next_state): Eliminate
2586 "new_ctxt", passing NULL to get_rvalue instead.
2587 (impl_sm_context::warn): Likewise.
2589 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2592 * bounds-checking.cc (out_of_bounds::get_memory_space): New.
2593 (buffer_overflow::emit): Use it.
2594 (class buffer_overread): Rename to...
2595 (class buffer_over_read): ...this.
2596 (buffer_over_read::emit): Specify which memory space the read is
2597 from, where known. Change "overread" to "over-read".
2598 (class buffer_underflow): Rename to...
2599 (class buffer_underwrite): ...this.
2600 (buffer_underwrite::emit): Specify which memory space the write is
2601 to, where known. Change "underflow" to "underwrite".
2602 (class buffer_underread): Rename to...
2603 (class buffer_under_read): Rename to...
2604 (buffer_under_read::emit): Specify which memory space the read is
2605 from, where known. Change "underread" to "under-read".
2606 (symbolic_past_the_end::get_memory_space): New.
2607 (symbolic_buffer_overflow::emit): Use it.
2608 (class symbolic_buffer_overread): Rename to...
2609 (class symbolic_buffer_over_read): ...this.
2610 (symbolic_buffer_over_read::emit): Specify which memory space the
2611 read is from, where known. Change "overread" to "over-read".
2612 (region_model::check_symbolic_bounds): Update for class renaming.
2613 (region_model::check_region_bounds): Likewise.
2615 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2618 * bounds-checking.cc (out_of_bounds::maybe_describe_array_bounds):
2620 (buffer_overflow::emit): Call maybe_describe_array_bounds.
2621 (buffer_overread::emit): Likewise.
2622 (buffer_underflow::emit): Likewise.
2623 (buffer_underread::emit): Likewise.
2625 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2628 * bounds-checking.cc (buffer_overflow::emit): Use inform_n.
2629 Update wording to clarify that we're talking about the size of
2630 the bad access, rather than its position.
2631 (buffer_overread::emit): Likewise.
2633 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2635 * bounds-checking.cc: New file, taken from region-model.cc.
2636 * region-model.cc (class out_of_bounds): Move to
2638 (class past_the_end): Likewise.
2639 (class buffer_overflow): Likewise.
2640 (class buffer_overread): Likewise.
2641 (class buffer_underflow): Likewise.
2642 (class buffer_underread): Likewise.
2643 (class symbolic_past_the_end): Likewise.
2644 (class symbolic_buffer_overflow): Likewise.
2645 (class symbolic_buffer_overread): Likewise.
2646 (region_model::check_symbolic_bounds): Likewise.
2647 (maybe_get_integer_cst_tree): Likewise.
2648 (region_model::check_region_bounds): Likewise.
2649 * region-model.h: Add comment.
2651 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2654 * sm-fd.cc (fd_state_machine::on_bind): Handle m_constant_fd in
2655 the "success" outcome.
2656 (fd_state_machine::on_connect): Likewise.
2657 * sm-fd.dot: Add "constant_fd" state and its transitions.
2659 2022-11-30 David Malcolm <dmalcolm@redhat.com>
2661 * region-model-impl-calls.cc (class kf_fgets): Move to sm-file.cc.
2662 (kf_fgets::impl_call_pre): Likewise.
2663 (class kf_fread): Likewise.
2664 (kf_fread::impl_call_pre): Likewise.
2665 (class kf_getchar): Likewise.
2666 (class kf_stdio_output_fn): Likewise.
2667 (register_known_functions): Move registration of
2668 BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
2669 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
2670 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
2671 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
2672 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
2673 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF,
2674 "getchar", "fgets", "fgets_unlocked", and "fread" to
2675 register_known_file_functions.
2676 * sm-file.cc (class kf_stdio_output_fn): Move here from
2677 region-model-impl-calls.cc.
2678 (class kf_fgets): Likewise.
2679 (class kf_fread): Likewise.
2680 (class kf_getchar): Likewise.
2681 (register_known_file_functions): Move registration of
2682 BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
2683 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
2684 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
2685 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
2686 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
2687 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF,
2688 "fgets", "fgets_unlocked", "fread", and "getchar" to here from
2689 register_known_functions.
2691 2022-11-30 David Malcolm <dmalcolm@redhat.com>
2694 * analyzer.h (register_known_file_functions): New decl.
2695 * program-state.cc (sm_state_map::replay_call_summary): Rejct
2696 attempts to store sm-state for caller_sval that can't have
2698 * region-model-impl-calls.cc (register_known_functions): Call
2699 register_known_file_functions.
2700 * sm-fd.cc (class kf_isatty): New.
2701 (register_known_fd_functions): Register it.
2702 * sm-file.cc (class kf_ferror): New.
2703 (class kf_fileno): New.
2704 (class kf_getc): New.
2705 (register_known_file_functions): New.
2707 2022-11-30 David Malcolm <dmalcolm@redhat.com>
2710 * region-model-manager.cc
2711 (region_model_manager::maybe_fold_binop): For POINTER_PLUS_EXPR,
2712 PLUS_EXPR and MINUS_EXPR, eliminate requirement that the final
2713 type matches that of arg0 in favor of a cast.
2715 2022-11-24 Martin Liska <mliska@suse.cz>
2717 * varargs.cc: Fix Clang warnings.
2719 2022-11-24 David Malcolm <dmalcolm@redhat.com>
2723 (call_summary_replay::convert_region_from_summary_1): Update for
2724 change to creation of heap-allocated regions.
2725 * program-state.cc (test_program_state_1): Likewise.
2726 (test_program_state_merging): Likewise.
2727 * region-model-impl-calls.cc (kf_calloc::impl_call_pre): Likewise.
2728 (kf_malloc::impl_call_pre): Likewise.
2729 (kf_operator_new::impl_call_pre): Likewise.
2730 (kf_realloc::impl_call_postsuccess_with_move::update_model): Likewise.
2731 * region-model-manager.cc
2732 (region_model_manager::create_region_for_heap_alloc): Convert
2734 (region_model_manager::get_or_create_region_for_heap_alloc):
2735 ...this, reusing an existing region if it's unreferenced in the
2737 * region-model-manager.h (region_model_manager::get_num_regions): New.
2738 (region_model_manager::create_region_for_heap_alloc): Convert to...
2739 (region_model_manager::get_or_create_region_for_heap_alloc): ...this.
2740 * region-model.cc (region_to_value_map::can_merge_with_p): Reject
2741 merger when the values are different.
2742 (region_model::create_region_for_heap_alloc): Convert to...
2743 (region_model::get_or_create_region_for_heap_alloc): ...this.
2744 (region_model::get_referenced_base_regions): New.
2745 (selftest::test_state_merging): Update for change to creation of
2746 heap-allocated regions.
2747 (selftest::test_malloc_constraints): Likewise.
2748 (selftest::test_malloc): Likewise.
2749 * region-model.h: Include "sbitmap.h".
2750 (region_model::create_region_for_heap_alloc): Convert to...
2751 (region_model::get_or_create_region_for_heap_alloc): ...this.
2752 (region_model::get_referenced_base_regions): New decl.
2753 * store.cc (store::canonicalize): Don't purge a heap-allocated region
2754 that's been marked as escaping.
2756 2022-11-24 David Malcolm <dmalcolm@redhat.com>
2758 * checker-path.cc (checker_path::inject_any_inlined_call_events):
2759 Don't dump the address of the block when -fdump-noaddr.
2761 2022-11-24 David Malcolm <dmalcolm@redhat.com>
2763 * region-model.h (region_model::on_socket): Delete decl.
2764 (region_model::on_bind): Likewise.
2765 (region_model::on_listen): Likewise.
2766 (region_model::on_accept): Likewise.
2767 (region_model::on_connect): Likewise.
2768 * sm-fd.cc (kf_socket::outcome_of_socket::update_model): Move body
2769 of region_model::on_socket into here, ...
2770 (region_model::on_socket): ...eliminating this function.
2771 (kf_bind::outcome_of_bind::update_model): Likewise for on_bind...
2772 (region_model::on_bind): ...eliminating this function.
2773 (kf_listen::outcome_of_listen::update_model): Likewise fo
2775 (region_model::on_listen): ...eliminating this function.
2776 (kf_accept::outcome_of_accept::update_model): Likewise fo
2778 (region_model::on_accept): ...eliminating this function.
2779 (kf_connect::outcome_of_connect::update_model): Likewise fo
2781 (region_model::on_connect): ...eliminating this function.
2783 2022-11-24 David Malcolm <dmalcolm@redhat.com>
2785 * analyzer.h (register_known_fd_functions): New decl.
2786 * region-model-impl-calls.cc (class kf_accept): Move to sm-fd.cc.
2787 (class kf_bind): Likewise.
2788 (class kf_connect): Likewise.
2789 (class kf_listen): Likewise.
2790 (class kf_pipe): Likewise.
2791 (class kf_socket): Likewise.
2792 (register_known_functions): Remove registration of the above
2793 functions, instead calling register_known_fd_functions.
2794 * sm-fd.cc: Include "analyzer/call-info.h".
2795 (class kf_socket): Move here from region-model-impl-calls.cc.
2796 (class kf_bind): Likewise.
2797 (class kf_listen): Likewise.
2798 (class kf_accept): Likewise.
2799 (class kf_connect): Likewise.
2800 (class kf_pipe): Likewise.
2801 (register_known_fd_functions): New.
2803 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2806 * known-function-manager.cc (known_function_manager::get_match):
2807 Don't look up fndecls by name when they're not in the root
2810 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2813 * sm-fd.cc (fd_state_machine::check_for_new_socket_fd): Don't
2814 complain when old state is "fd-constant".
2815 (fd_state_machine::on_listen): Likewise.
2816 (fd_state_machine::on_accept): Likewise.
2818 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2821 * region-model-impl-calls.cc (register_known_functions): Register
2822 "___errno" and "__error" as synonyms for "__errno_location".
2824 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2826 * analyzer.h (class internal_known_function): New.
2827 (register_varargs_builtins): New decl.
2828 * engine.cc (exploded_node::on_stmt_pre): Remove
2829 "out_terminate_path" param from call to region_model::on_stmt_pre.
2830 (feasibility_state::maybe_update_for_edge): Likewise.
2831 * known-function-manager.cc: Include "basic-block.h", "gimple.h",
2832 and "analyzer/region-model.h".
2833 (known_function_manager::known_function_manager): Initialize
2835 (known_function_manager::~known_function_manager): Clean up
2837 (known_function_manager::get_by_identifier): Make const.
2838 (known_function_manager::add): New overloaded definitions for
2839 enum built_in_function and enum internal_fn.
2840 (known_function_manager::get_by_fndecl): Delete.
2841 (known_function_manager::get_match): New.
2842 (known_function_manager::get_internal_fn): New.
2843 (known_function_manager::get_normal_builtin): New.
2844 * known-function-manager.h
2845 (known_function_manager::get_by_identifier): Make private and
2846 add const qualifier.
2847 (known_function_manager::get_by_fndecl): Delete.
2848 (known_function_manager::add): Add overloaded decls for
2849 enum built_in_function name and enum internal_fn.
2850 (known_function_manager::get_match): New decl.
2851 (known_function_manager::get_internal_fn): New decl.
2852 (known_function_manager::get_normal_builtin): New decl.
2853 (known_function_manager::m_combined_fns_arr): New field.
2854 * region-model-impl-calls.cc (call_details::arg_is_size_p): New.
2855 (class kf_alloca): New.
2856 (region_model::impl_call_alloca): Convert to...
2857 (kf_alloca::impl_call_pre): ...this.
2858 (kf_analyzer_dump_capacity::matches_call_types_p): Rewrite check
2859 to use call_details::arg_is_pointer_p.
2860 (region_model::impl_call_builtin_expect): Convert to...
2861 (class kf_expect): ...this.
2862 (class kf_calloc): New, adding check that both arguments are
2864 (region_model::impl_call_calloc): Convert to...
2865 (kf_calloc::impl_call_pre): ...this.
2866 (kf_connect::matches_call_types_p): Rewrite check to use
2867 call_details::arg_is_pointer_p.
2868 (region_model::impl_call_error): Convert to...
2869 (class kf_error): ...this, and...
2870 (kf_error::impl_call_pre): ...this.
2871 (class kf_fgets): New, adding checks that args 0 and 2 are
2873 (region_model::impl_call_fgets): Convert to...
2874 (kf_fgets::impl_call_pre): ...this.
2875 (class kf_fread): New, adding checks on the argument types.
2876 (region_model::impl_call_fread): Convert to...
2877 (kf_fread::impl_call_pre): ...this.
2878 (class kf_free): New, adding check that the argument is a pointer.
2879 (region_model::impl_call_free): Convert to...
2880 (kf_free::impl_call_post): ...this.
2881 (class kf_getchar): New.
2882 (class kf_malloc): New, adding check that the argument is a
2884 (region_model::impl_call_malloc): Convert to...
2885 (kf_malloc::impl_call_pre): ...this.
2886 (class kf_memcpy): New, adding checks on arguments.
2887 (region_model::impl_call_memcpy): Convert to...
2888 (kf_memcpy::impl_call_pre): ...this.
2889 (class kf_memset): New.
2890 (region_model::impl_call_memset): Convert to...
2891 (kf_memset::impl_call_pre): ...this.
2892 (kf_pipe::matches_call_types_p): Rewrite check to use
2893 call_details::arg_is_pointer_p.
2894 (kf_putenv::matches_call_types_p): Likewise.
2895 (class kf_realloc): New, adding checks on the argument types.
2896 (region_model::impl_call_realloc): Convert to...
2897 (kf_realloc::impl_call_post): ...this.
2898 (class kf_strchr): New.
2899 (region_model::impl_call_strchr): Convert to...
2900 (kf_strchr::impl_call_post): ...this.
2901 (class kf_stack_restore): New.
2902 (class kf_stack_save): New.
2903 (class kf_stdio_output_fn): New.
2904 (class kf_strcpy): New,
2905 (region_model::impl_call_strcpy): Convert to...
2906 (kf_strcpy::impl_call_pre): ...this.
2907 (class kf_strlen): New.
2908 (region_model::impl_call_strlen): Convert to...
2909 (kf_strlen::impl_call_pre): ...this.
2910 (class kf_ubsan_bounds): New.
2911 (region_model::impl_deallocation_call): Reimplement to avoid call
2913 (register_known_functions): Add handlers for IFN_BUILTIN_EXPECT
2914 and IFN_UBSAN_BOUNDS. Add handlers for BUILT_IN_ALLOCA,
2915 BUILT_IN_ALLOCA_WITH_ALIGN, BUILT_IN_CALLOC, BUILT_IN_EXPECT,
2916 BUILT_IN_EXPECT_WITH_PROBABILITY, BUILT_IN_FPRINTF,
2917 BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
2918 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
2919 BUILT_IN_FREE, BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED,
2920 BUILT_IN_MALLOC, BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK,
2921 BUILT_IN_MEMSET, BUILT_IN_MEMSET_CHK, BUILT_IN_PRINTF,
2922 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
2923 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
2924 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_REALLOC, BUILT_IN_STACK_RESTORE,
2925 BUILT_IN_STACK_SAVE, BUILT_IN_STRCHR, BUILT_IN_STRCPY,
2926 BUILT_IN_STRCPY_CHK, BUILT_IN_STRLEN, BUILT_IN_VFPRINTF, and
2927 BUILT_IN_VPRINTF. Call register_varargs_builtins. Add handlers
2928 for "getchar", "memset", "fgets", "fgets_unlocked", "fread",
2929 "error", and "error_at_line".
2930 * region-model.cc (region_model::on_stmt_pre): Drop
2931 "out_terminate_path" param.
2932 (region_model::get_known_function): Reimplement by calling
2933 known_function_manager::get_match, passing new "cd" param.
2934 Add overload taking enum internal_fn.
2935 (region_model::on_call_pre): Drop "out_terminate_path" param.
2936 Remove special-case handling of internal fns IFN_BUILTIN_EXPECT,
2937 IFN_UBSAN_BOUNDS, and IFN_VA_ARG, of built-in fns BUILT_IN_ALLOCA,
2938 BUILT_IN_ALLOCA_WITH_ALIGN, BUILT_IN_CALLOC, BUILT_IN_EXPECT,
2939 BUILT_IN_EXPECT_WITH_PROBABILITY, BUILT_IN_FREE, BUILT_IN_MALLOC,
2940 BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_MEMSET,
2941 BUILT_IN_MEMSET_CHK, BUILT_IN_REALLOC, BUILT_IN_STRCHR,
2942 BUILT_IN_STRCPY, BUILT_IN_STRCPY_CHK, BUILT_IN_STRLEN,
2943 BUILT_IN_STACK_SAVE, BUILT_IN_STACK_RESTORE, BUILT_IN_FPRINTF,
2944 BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED,
2945 BUILT_IN_FPUTC, BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS,
2946 BUILT_IN_FPUTS_UNLOCKED, BUILT_IN_FWRITE,
2947 BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
2948 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR,
2949 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED,
2950 BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF, BUILT_IN_VA_START, and
2951 BUILT_IN_VA_COPY, and of named functions "malloc", "calloc",
2952 "alloca", "realloc", "error", "error_at_line", "fgets",
2953 "fgets_unlocked", "fread", "getchar", "memset", "strchr", and
2954 "strlen". Replace all this special-casing with calls to
2955 get_known_function for internal fns and for fn decls.
2956 (region_model::on_call_post): Remove special-casing handling for
2957 "free" and "strchr", and for BUILT_IN_REALLOC, BUILT_IN_STRCHR,
2958 and BUILT_IN_VA_END. Replace by consolidating on usage of
2960 * region-model.h (call_details::arg_is_size_p): New.
2961 (region_model::on_stmt_pre): Drop "out_terminate_path" param.
2962 (region_model::on_call_pre): Likewise.
2963 (region_model::impl_call_alloca): Delete.
2964 (region_model::impl_call_builtin_expect): Delete.
2965 (region_model::impl_call_calloc): Delete.
2966 (region_model::impl_call_error): Delete.
2967 (region_model::impl_call_fgets): Delete.
2968 (region_model::impl_call_fread): Delete.
2969 (region_model::impl_call_free): Delete.
2970 (region_model::impl_call_malloc): Delete.
2971 (region_model::impl_call_memcpy): Delete.
2972 (region_model::impl_call_memset): Delete.
2973 (region_model::impl_call_realloc): Delete.
2974 (region_model::impl_call_strchr): Delete.
2975 (region_model::impl_call_strcpy): Delete.
2976 (region_model::impl_call_strlen): Delete.
2977 (region_model::impl_call_va_start): Delete.
2978 (region_model::impl_call_va_copy): Delete.
2979 (region_model::impl_call_va_arg): Delete.
2980 (region_model::impl_call_va_end): Delete.
2981 (region_model::check_region_for_write): Public.
2982 (region_model::get_known_function): Add "cd" param. Add
2983 overloaded decl taking enum internal_fn.
2984 * sm-malloc.cc: Update comments.
2985 * varargs.cc (class kf_va_start): New.
2986 (region_model::impl_call_va_start): Convert to...
2987 (kf_va_start::impl_call_pre): ...this.
2988 (class kf_va_copy): New.
2989 (region_model::impl_call_va_copy): Convert to...
2990 (kf_va_copy::impl_call_pre): ...this.
2991 (class kf_va_arg): New.
2992 (region_model::impl_call_va_arg): Convert to...
2993 (kf_va_arg::impl_call_pre): ...this.
2994 (class kf_va_end): New.
2995 (region_model::impl_call_va_end): Delete.
2996 (register_varargs_builtins): New.
2998 2022-11-22 David Malcolm <dmalcolm@redhat.com>
3001 * region-model.cc (region_model::update_for_int_cst_return):
3002 Require that the return type be an integer type.
3003 (region_model::update_for_nonzero_return): Likewise.
3005 2022-11-22 David Malcolm <dmalcolm@redhat.com>
3008 * region-model-impl-calls.cc (kf_accept::matches_call_types_p):
3009 Require that args 1 and 2 be pointers.
3010 (kf_bind::matches_call_types_p): Require that arg 1 be a pointer.
3011 * region-model.h (call_details::arg_is_pointer_p): New
3013 2022-11-22 David Malcolm <dmalcolm@redhat.com>
3017 (call_summary_replay::convert_region_from_summary_1): Handle
3018 RK_THREAD_LOCAL and RK_ERRNO in switch.
3019 * region-model.cc (region_model::get_representative_path_var_1):
3022 2022-11-19 David Malcolm <dmalcolm@redhat.com>
3025 * engine.cc (dynamic_call_info_t::update_model): Update the model
3026 by pushing or pop a frame, rather than by clobbering it with the
3027 model from the exploded_node's state.
3029 2022-11-18 David Malcolm <dmalcolm@redhat.com>
3031 * analyzer.cc (is_pipe_call_p): Delete.
3032 * analyzer.h (is_pipe_call_p): Delete.
3033 * region-model-impl-calls.cc (call_details::get_location): New.
3034 (class kf_analyzer_break): New, adapted from
3035 region_model::on_stmt_pre.
3036 (region_model::impl_call_analyzer_describe): Convert to...
3037 (class kf_analyzer_describe): ...this.
3038 (region_model::impl_call_analyzer_dump_capacity): Convert to...
3039 (class kf_analyzer_dump_capacity): ...this.
3040 (region_model::impl_call_analyzer_dump_escaped): Convert to...
3041 (class kf_analyzer_dump_escaped): ...this.
3042 (class kf_analyzer_dump_exploded_nodes): New.
3043 (region_model::impl_call_analyzer_dump_named_constant): Convert
3045 (class kf_analyzer_dump_named_constant): ...this.
3046 (class dump_path_diagnostic): Move here from region-model.cc.
3047 (class kf_analyzer_dump_path) New, adapted from
3048 region_model::on_stmt_pre.
3049 (class kf_analyzer_dump_region_model): Likewise.
3050 (region_model::impl_call_analyzer_eval): Convert to...
3051 (class kf_analyzer_eval): ...this.
3052 (region_model::impl_call_analyzer_get_unknown_ptr): Convert to...
3053 (class kf_analyzer_get_unknown_ptr): ...this.
3054 (class known_function_accept): Rename to...
3055 (class kf_accept): ...this.
3056 (class known_function_bind): Rename to...
3057 (class kf_bind): ...this.
3058 (class known_function_connect): Rename to...
3059 (class kf_connect): ...this.
3060 (region_model::impl_call_errno_location): Convert to...
3061 (class kf_errno_location): ...this.
3062 (class known_function_listen): Rename to...
3063 (class kf_listen): ...this.
3064 (region_model::impl_call_pipe): Convert to...
3065 (class kf_pipe): ...this.
3066 (region_model::impl_call_putenv): Convert to...
3067 (class kf_putenv): ...this.
3068 (region_model::impl_call_operator_new): Convert to...
3069 (class kf_operator_new): ...this.
3070 (region_model::impl_call_operator_delete): Convert to...
3071 (class kf_operator_delete): ...this.
3072 (class known_function_socket): Rename to...
3073 (class kf_socket): ...this.
3074 (register_known_functions): Rename param to KFM. Break out
3075 existing known functions into a "POSIX" section, and add "pipe",
3076 "pipe2", and "putenv". Add debugging functions
3077 "__analyzer_break", "__analyzer_describe",
3078 "__analyzer_dump_capacity", "__analyzer_dump_escaped",
3079 "__analyzer_dump_exploded_nodes",
3080 "__analyzer_dump_named_constant", "__analyzer_dump_path",
3081 "__analyzer_dump_region_model", "__analyzer_eval",
3082 "__analyzer_get_unknown_ptr". Add C++ support functions
3083 "operator new", "operator new []", "operator delete", and
3084 "operator delete []".
3085 * region-model.cc (class dump_path_diagnostic): Move to
3086 region-model-impl-calls.cc.
3087 (region_model::on_stmt_pre): Eliminate special-casing of
3088 "__analyzer_describe", "__analyzer_dump_capacity",
3089 "__analyzer_dump_escaped", "__analyzer_dump_named_constant",
3090 "__analyzer_dump_path", "__analyzer_dump_region_model",
3091 "__analyzer_eval", "__analyzer_break",
3092 "__analyzer_dump_exploded_nodes", "__analyzer_get_unknown_ptr",
3093 "__errno_location", "pipe", "pipe2", "putenv", "operator new",
3094 "operator new []", "operator delete", "operator delete []"
3095 "pipe" and "pipe2", handling them instead via the known_functions
3097 * region-model.h (call_details::get_location): New decl.
3098 (region_model::impl_call_analyzer_describe): Delete decl.
3099 (region_model::impl_call_analyzer_dump_capacity): Delete decl.
3100 (region_model::impl_call_analyzer_dump_escaped): Delete decl.
3101 (region_model::impl_call_analyzer_dump_named_constant): Delete decl.
3102 (region_model::impl_call_analyzer_eval): Delete decl.
3103 (region_model::impl_call_analyzer_get_unknown_ptr): Delete decl.
3104 (region_model::impl_call_errno_location): Delete decl.
3105 (region_model::impl_call_pipe): Delete decl.
3106 (region_model::impl_call_putenv): Delete decl.
3107 (region_model::impl_call_operator_new): Delete decl.
3108 (region_model::impl_call_operator_delete): Delete decl.
3109 * sm-fd.cc: Update comments.
3111 2022-11-16 David Malcolm <dmalcolm@redhat.com>
3114 * analyzer-language.cc: Include "diagnostic.h".
3115 (maybe_stash_named_constant): Add logger param and use it to log
3116 the name being looked up, and the result.
3117 (stash_named_constants): New, splitting out from...
3118 (on_finish_translation_unit): ...this function. Call
3119 get_or_create_logfile and use the result to create a logger
3120 instance, passing it to stash_named_constants.
3121 * analyzer.h (get_or_create_any_logfile): New decl.
3122 * engine.cc (dump_fout, owns_dump_fout): New globals, split out
3124 (get_or_create_any_logfile): New function, split out from...
3125 (run_checkers): ...here, so that the logfile can be opened by
3126 on_finish_translation_unit. Clear the globals when closing the
3129 2022-11-16 David Malcolm <dmalcolm@redhat.com>
3131 * analyzer.h (known_function::matches_call_types_p): New vfunc.
3132 (known_function::impl_call_pre): Provide base implementation.
3133 (known_function::impl_call_post): New vfunc.
3134 (register_known_functions): New.
3135 * engine.cc (impl_run_checkers): Call register_known_functions.
3136 * region-model-impl-calls.cc (region_model::impl_call_accept):
3138 (class known_function_accept): ...this.
3139 (region_model::impl_call_bind): Convert to...
3140 (class known_function_bind): ...this.
3141 (region_model::impl_call_connect): Convert to...
3142 (class known_function_connect): ...this.
3143 (region_model::impl_call_listen): Convert to...
3144 (class known_function_listen): ...this.
3145 (region_model::impl_call_socket): Convert to...
3146 (class known_function_socket): ...this.
3147 (register_known_functions): New.
3148 * region-model.cc (region_model::on_call_pre): Remove special
3149 case for "bind" in favor of the known_function-handling dispatch.
3150 Add call to known_function::matches_call_types_p to latter.
3151 (region_model::on_call_post): Remove special cases for "accept",
3152 "bind", "connect", "listen", and "socket" in favor of dispatch
3153 to known_function::impl_call_post.
3154 * region-model.h (region_model::impl_call_accept): Delete decl.
3155 (region_model::impl_call_bind): Delete decl.
3156 (region_model::impl_call_connect): Delete decl.
3157 (region_model::impl_call_listen): Delete decl.
3158 (region_model::impl_call_socket): Delete decl.
3159 * sm-fd.cc: Update comments.
3161 2022-11-16 David Malcolm <dmalcolm@redhat.com>
3163 * checker-event.cc: New file, split out from...
3164 * checker-path.cc: ...this file.
3166 2022-11-15 David Malcolm <dmalcolm@redhat.com>
3169 * analyzer-language.cc (on_finish_translation_unit): Stash named
3170 constants "SOCK_STREAM" and "SOCK_DGRAM".
3171 * analyzer.opt (Wanalyzer-fd-phase-mismatch): New.
3172 (Wanalyzer-fd-type-mismatch): New.
3173 * engine.cc (impl_region_model_context::get_state_map_by_name):
3174 Add "out_sm_context" param. Allow out_sm_idx to be NULL.
3176 (impl_region_model_context::get_state_map_by_name):
3177 Add "out_sm_context" param.
3178 * region-model-impl-calls.cc (region_model::impl_call_accept): New.
3179 (region_model::impl_call_bind): New.
3180 (region_model::impl_call_connect): New.
3181 (region_model::impl_call_listen): New.
3182 (region_model::impl_call_socket): New.
3183 * region-model.cc (region_model::on_call_pre): Special-case
3185 (region_model::on_call_post): Special-case "accept", "bind",
3186 "connect", "listen", and "socket".
3187 * region-model.h (region_model::impl_call_accept): New decl.
3188 (region_model::impl_call_bind): New decl.
3189 (region_model::impl_call_connect): New decl.
3190 (region_model::impl_call_listen): New decl.
3191 (region_model::impl_call_socket): New decl.
3192 (region_model::on_socket): New decl.
3193 (region_model::on_bind): New decl.
3194 (region_model::on_listen): New decl.
3195 (region_model::on_accept): New decl.
3196 (region_model::on_connect): New decl.
3197 (region_model::add_constraint): Make public.
3198 (region_model::check_for_poison): Make public.
3199 (region_model_context::get_state_map_by_name): Add out_sm_context param.
3200 (region_model_context::get_fd_map): Likewise.
3201 (region_model_context::get_malloc_map): Likewise.
3202 (region_model_context::get_taint_map): Likewise.
3203 (noop_region_model_context::get_state_map_by_name): Likewise.
3204 (region_model_context_decorator::get_state_map_by_name): Likewise.
3205 * sm-fd.cc: Include "analyzer/supergraph.h" and
3206 "analyzer/analyzer-language.h".
3207 (enum expected_phase): New enum.
3208 (fd_state_machine::m_new_datagram_socket): New.
3209 (fd_state_machine::m_new_stream_socket): New.
3210 (fd_state_machine::m_new_unknown_socket): New.
3211 (fd_state_machine::m_bound_datagram_socket): New.
3212 (fd_state_machine::m_bound_stream_socket): New.
3213 (fd_state_machine::m_bound_unknown_socket): New.
3214 (fd_state_machine::m_listening_stream_socket): New.
3215 (fd_state_machine::m_m_connected_stream_socket): New.
3216 (fd_state_machine::m_SOCK_STREAM): New.
3217 (fd_state_machine::m_SOCK_DGRAM): New.
3218 (fd_diagnostic::describe_state_change): Handle socket states.
3219 (fd_diagnostic::get_meaning_for_state_change): Likewise.
3220 (class fd_phase_mismatch): New.
3221 (enum expected_type): New enum.
3222 (class fd_type_mismatch): New.
3223 (fd_state_machine::fd_state_machine): Initialize new states and
3224 stashed named constants.
3225 (fd_state_machine::is_socket_fd_p): New.
3226 (fd_state_machine::is_datagram_socket_fd_p): New.
3227 (fd_state_machine::is_stream_socket_fd_p): New.
3228 (fd_state_machine::on_close): Handle the socket states.
3229 (fd_state_machine::check_for_open_fd): Complain about fncalls on
3230 sockets in the wrong phase. Support socket FDs.
3231 (add_constraint_ge_zero): New.
3232 (fd_state_machine::get_state_for_socket_type): New.
3233 (fd_state_machine::on_socket): New.
3234 (fd_state_machine::check_for_socket_fd): New.
3235 (fd_state_machine::check_for_new_socket_fd): New.
3236 (fd_state_machine::on_bind): New.
3237 (fd_state_machine::on_listen): New.
3238 (fd_state_machine::on_accept): New.
3239 (fd_state_machine::on_connect): New.
3240 (fd_state_machine::can_purge_p): Don't purge socket values.
3241 (get_fd_state): New.
3242 (region_model::mark_as_valid_fd): Use get_fd_state.
3243 (region_model::on_socket): New.
3244 (region_model::on_bind): New.
3245 (region_model::on_listen): New.
3246 (region_model::on_accept): New.
3247 (region_model::on_connect): New.
3248 * sm-fd.dot: Update to reflect sm-fd.cc changes.
3250 2022-11-15 David Malcolm <dmalcolm@redhat.com>
3253 * analyzer-language.cc: New file.
3254 * analyzer-language.h: New file.
3255 * analyzer.h (get_stashed_constant_by_name): New decl.
3256 (log_stashed_constants): New decl.
3257 * engine.cc (impl_run_checkers): Call log_stashed_constants.
3258 * region-model-impl-calls.cc
3259 (region_model::impl_call_analyzer_dump_named_constant): New.
3260 * region-model.cc (region_model::on_stmt_pre): Handle
3261 __analyzer_dump_named_constant.
3263 (region_model::impl_call_analyzer_dump_named_constant): New decl.
3264 * sm-fd.cc (fd_state_machine::m_O_ACCMODE): New.
3265 (fd_state_machine::m_O_RDONLY): New.
3266 (fd_state_machine::m_O_WRONLY): New.
3267 (fd_state_machine::fd_state_machine): Initialize the new fields.
3268 (fd_state_machine::get_access_mode_from_flag): Use the new fields,
3269 rather than using the host values.
3271 2022-11-13 David Malcolm <dmalcolm@redhat.com>
3274 * analyzer.opt (Wanalyzer-tainted-assertion): New.
3275 * checker-path.cc (checker_path::fixup_locations): Pass false to
3276 pending_diagnostic::fixup_location.
3277 * diagnostic-manager.cc (get_emission_location): Pass true to
3278 pending_diagnostic::fixup_location.
3279 * pending-diagnostic.cc (pending_diagnostic::fixup_location): Add
3281 * pending-diagnostic.h (pending_diagnostic::fixup_location): Add
3283 * sm-taint.cc (taint_state_machine::m_tainted_control_flow): New.
3284 (taint_diagnostic::describe_state_change): Drop "final".
3285 (class tainted_assertion): New.
3286 (taint_state_machine::taint_state_machine): Initialize
3287 m_tainted_control_flow.
3288 (taint_state_machine::alt_get_inherited_state): Support
3289 comparisons being tainted, based on their arguments.
3290 (is_assertion_failure_handler_p): New.
3291 (taint_state_machine::on_stmt): Complain about calls to assertion
3292 failure handlers guarded by an attacker-controller conditional.
3293 Detect attacker-controlled gcond conditionals and gswitch index
3295 (taint_state_machine::check_control_flow_arg_for_taint): New.
3297 2022-11-11 David Malcolm <dmalcolm@redhat.com>
3299 * sm-fd.dot: Fix typo in comment.
3300 * sm-file.dot: New file.
3301 * varargs.cc: Fix typo in comment.
3302 * varargs.dot: New file.
3304 2022-11-11 David Malcolm <dmalcolm@redhat.com>
3306 * checker-path.h: Split out checker_event and its subclasses to...
3307 * checker-event.h: ...this new header.
3309 2022-11-11 David Malcolm <dmalcolm@redhat.com>
3312 * analyzer.opt (Wanalyzer-infinite-recursion): New.
3313 * call-string.cc (call_string::count_occurrences_of_function):
3315 * call-string.h (call_string::count_occurrences_of_function): New
3317 * checker-path.cc (function_entry_event::function_entry_event):
3319 (checker_path::add_final_event): Delete.
3320 * checker-path.h (function_entry_event::function_entry_event): New
3322 (function_entry_event::get_desc): Drop "final".
3323 (checker_path::add_final_event): Delete.
3324 * diagnostic-manager.cc
3325 (diagnostic_manager::emit_saved_diagnostic): Create the final
3326 event via a new pending_diagnostic::add_final_event vfunc, rather
3327 than checker_path::add_final_event.
3328 (diagnostic_manager::add_events_for_eedge): Create function entry
3329 events via a new pending_diagnostic::add_function_entry_event
3331 * engine.cc (exploded_graph::process_node): When creating a new
3332 PK_BEFORE_SUPERNODE node, call
3333 exploded_graph::detect_infinite_recursion on it after adding the
3335 * exploded-graph.h (exploded_graph::detect_infinite_recursion):
3337 (exploded_graph::find_previous_entry_to): New decl.
3338 * infinite-recursion.cc: New file.
3339 * pending-diagnostic.cc
3340 (pending_diagnostic::add_function_entry_event): New.
3341 (pending_diagnostic::add_final_event): New.
3342 * pending-diagnostic.h
3343 (pending_diagnostic::add_function_entry_event): New vfunc.
3344 (pending_diagnostic::add_final_event): New vfunc.
3346 2022-11-10 David Malcolm <dmalcolm@redhat.com>
3349 * analyzer.opt (Wanalyzer-deref-before-check): New warning.
3350 * diagnostic-manager.cc
3351 (null_assignment_sm_context::set_next_state): Only add state
3352 change events for transition to "null" state.
3353 (null_assignment_sm_context::is_transition_to_null): New.
3354 * engine.cc (impl_region_model_context::on_pop_frame): New.
3355 * exploded-graph.h (impl_region_model_context::on_pop_frame): New
3357 * program-state.cc (sm_state_map::clear_any_state): New.
3358 (sm_state_map::can_merge_with_p): New.
3359 (program_state::can_merge_with_p): Replace requirement that
3360 sm-states be equal in favor of an attempt to merge them.
3361 * program-state.h (sm_state_map::clear_any_state): New decl.
3362 (sm_state_map::can_merge_with_p): New decl.
3363 * region-model.cc (region_model::eval_condition): Make const.
3364 (region_model::pop_frame): Call ctxt->on_pop_frame.
3365 * region-model.h (region_model::eval_condition): Make const.
3366 (region_model_context::on_pop_frame): New vfunc.
3367 (noop_region_model_context::on_pop_frame): New.
3368 (region_model_context_decorator::on_pop_frame): New.
3369 * sm-malloc.cc (enum resource_state): Add RS_ASSUMED_NON_NULL.
3370 (allocation_state::dump_to_pp): Drop "final".
3371 (struct assumed_non_null_state): New subclass.
3372 (malloc_state_machine::m_assumed_non_null): New.
3373 (assumed_non_null_p): New.
3374 (class deref_before_check): New.
3375 (assumed_non_null_state::dump_to_pp): New.
3376 (malloc_state_machine::get_or_create_assumed_non_null_state_for_frame):
3378 (malloc_state_machine::maybe_assume_non_null): New.
3379 (malloc_state_machine::on_stmt): Transition from start state to
3380 "assumed-non-null" state for pointers passed to
3381 __attribute__((nonnull)) arguments, and for pointers explicitly
3382 dereferenced. Call maybe_complain_about_deref_before_check for
3383 pointers explicitly compared against NULL.
3384 (malloc_state_machine::maybe_complain_about_deref_before_check):
3386 (malloc_state_machine::on_deallocator_call): Also transition
3387 "assumed-non-null" states to "freed".
3388 (malloc_state_machine::on_pop_frame): New.
3389 (malloc_state_machine::maybe_get_merged_states_nonequal): New.
3390 * sm-malloc.dot: Update for changes to sm-malloc.cc.
3391 * sm.h (state_machine::on_pop_frame): New.
3392 (state_machine::maybe_get_merged_state): New.
3393 (state_machine::maybe_get_merged_states_nonequal): New.
3395 2022-11-09 David Malcolm <dmalcolm@redhat.com>
3397 * checker-path.cc (checker_event::debug): New.
3398 (checker_path::add_event): Move here from checker-path.h. Add
3400 * checker-path.h (checker_event::debug): New decl.
3401 (checker_path::checker_path): Add logger param.
3402 (checker_path::add_event): Move definition from here to
3404 (checker_path::m_logger): New field.
3405 * diagnostic-manager.cc
3406 (diagnostic_manager::emit_saved_diagnostic): Pass logger to
3408 (diagnostic_manager::add_events_for_eedge): Log scope when
3409 processing a run of stmts.
3411 2022-11-08 David Malcolm <dmalcolm@redhat.com>
3414 * region-model-impl-calls.cc: Update comment.
3415 * region-model.cc (region_model::check_symbolic_bounds): Fix
3416 layout of "void" return. Replace usage of
3417 eval_condition_without_cm with eval_condition.
3418 (region_model::eval_condition): Take over body of...
3419 (region_model::eval_condition_without_cm): ...this subroutine,
3420 dropping the latter. Eliminating this distinction avoids issues
3421 where constraints were not considered when recursing.
3422 (region_model::compare_initial_and_pointer): Update comment.
3423 (region_model::symbolic_greater_than): Replace usage of
3424 eval_condition_without_cm with eval_condition.
3426 (region_model::eval_condition_without_cm): Delete decl.
3428 2022-11-08 David Malcolm <dmalcolm@redhat.com>
3430 * region-model-impl-calls.cc
3431 (region_model::impl_call_errno_location): New.
3432 * region-model-manager.cc
3433 (region_model_manager::region_model_manager): Initialize
3434 m_thread_local_region and m_errno_region.
3435 * region-model-manager.h (region_model_manager::get_errno_region):
3437 (region_model_manager::m_thread_local_region): New.
3438 (region_model_manager::m_errno_region): New.
3439 * region-model.cc (region_model::on_call_pre): Special-case
3441 (region_model::set_errno): New.
3442 * region-model.h (impl_call_errno_location): New decl.
3443 (region_model::set_errno): New decl.
3444 * region.cc (thread_local_region::dump_to_pp): New.
3445 (errno_region::dump_to_pp): New.
3446 * region.h (enum memory_space): Add MEMSPACE_THREAD_LOCAL.
3447 (enum region_kind): Add RK_THREAD_LOCAL and RK_ERRNO.
3448 (class thread_local_region): New.
3449 (is_a_helper <const thread_local_region *>::test): New.
3450 (class errno_region): New.
3451 (is_a_helper <const errno_region *>::test): New.
3452 * store.cc (binding_cluster::escaped_p): New.
3453 (store::escaped_p): Treat errno as always having escaped.
3454 (store::replay_call_summary_cluster): Handle RK_THREAD_LOCAL and
3456 * store.h (binding_cluster::escaped_p): Remove definition.
3458 2022-11-08 David Malcolm <dmalcolm@redhat.com>
3460 * call-info.cc (success_call_info::get_desc): Delete.
3461 (failed_call_info::get_desc): Likewise.
3462 (succeed_or_fail_call_info::get_desc): New.
3463 * call-info.h (class succeed_or_fail_call_info): New.
3464 (class success_call_info): Convert to a subclass of
3465 succeed_or_fail_call_info.
3466 (class failed_call_info): Likewise.
3468 2022-11-08 David Malcolm <dmalcolm@redhat.com>
3470 * region-model-impl-calls.cc (region_model::impl_call_strchr):
3471 Move to on_call_post. Handle both outcomes using bifurcation,
3472 rather than just the "not found" case.
3473 * region-model.cc (region_model::on_call_pre): Move
3474 BUILT_IN_STRCHR and "strchr" to...
3475 (region_model::on_call_post): ...here.
3477 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3479 * analyzer.h: Use std::unique_ptr for state machines from plugins.
3480 * engine.cc: Likewise.
3482 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3484 * analyzer.h: Use std::unique_ptr for known functions.
3485 * engine.cc: Likewise.
3486 * known-function-manager.cc: Likewise.
3487 * known-function-manager.h: Likewise.
3489 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3491 * analysis-plan.cc: Define INCLUDE_MEMORY before including
3493 * analyzer-pass.cc: Likewise.
3494 * analyzer-selftests.cc: Likewise.
3495 * analyzer.cc: Likewise.
3496 * analyzer.h: Use std::unique_ptr in bifurcation code.
3497 * call-string.cc: Define INCLUDE_MEMORY before including system.h.
3498 * complexity.cc: Likewise.
3499 * engine.cc: Use std::unique_ptr in bifurcation code.
3500 * exploded-graph.h: Likewise.
3501 * known-function-manager.cc: Define INCLUDE_MEMORY before
3503 * region-model-impl-calls.cc: Use std::unique_ptr in bifurcation
3505 * region-model.cc: Likewise.
3506 * region-model.h: Likewise.
3507 * supergraph.cc: Define INCLUDE_MEMORY before including system.h.
3509 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3511 * call-info.cc: Use std::unique_ptr for checker_event.
3512 * checker-path.cc: Likewise.
3513 * checker-path.h: Likewise.
3514 * diagnostic-manager.cc: Likewise.
3515 * engine.cc: Likewise.
3516 * pending-diagnostic.cc: Likewise.
3517 * sm-signal.cc: Likewise.
3518 * varargs.cc: Likewise.
3520 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3522 * diagnostic-manager.cc: Include "make-unique.h".
3523 Use std::unique_ptr for feasibility_problems and exploded_path.
3524 Delete explicit saved_diagnostic dtor.
3525 * diagnostic-manager.h: Likewise.
3526 * engine.cc: Likewise.
3527 * exploded-graph.h: Likewise.
3528 * feasible-graph.cc: Likewise.
3529 * feasible-graph.h: Likewise.
3531 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3533 * checker-path.cc (rewind_event::rewind_event): Update for usage of
3534 std::unique_ptr on custom_edge_info.
3535 * engine.cc (exploded_node::on_longjmp): Likewise.
3536 (exploded_edge::exploded_edge): Likewise.
3537 (exploded_edge::~exploded_edge): Delete.
3538 (exploded_graph::add_function_entry): Update for usage of
3539 std::unique_ptr on custom_edge_info.
3540 (exploded_graph::add_edge): Likewise.
3541 (add_tainted_args_callback): Likewise.
3542 (exploded_graph::maybe_create_dynamic_call): Likewise.
3543 (exploded_graph::process_node): Likewise.
3544 * exploded-graph.h (exploded_edge::~exploded_edge): Delete.
3545 (exploded_edge::m_custom_info): Use std::unique_ptr.
3546 (exploded_edge::add_edge): Likewise.
3547 * sm-signal.cc (register_signal_handler::impl_transition): Use
3550 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3552 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic): Make
3554 (saved_diagnostic::~saved_diagnostic): Remove explicit delete of
3556 (diagnostic_manager::add_diagnostic): Make stmt_finder const.
3557 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic):
3559 (saved_diagnostic::m_stmt_finder): Convert to std::unique_ptr.
3560 (diagnostic_manager::add_diagnostic): Make stmt_finder const.
3561 * engine.cc (impl_sm_context::impl_sm_context): Likewise.
3562 (impl_sm_context::m_stmt_finder): Likewise.
3563 (leak_stmt_finder::clone): Convert return type to std::unique_ptr.
3564 * exploded-graph.h (stmt_finder::clone): Likewise.
3566 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3568 * call-info.cc: Add define of INCLUDE_MEMORY.
3569 * call-summary.cc: Likewise.
3570 * checker-path.cc: Likewise.
3571 * constraint-manager.cc: Likewise.
3572 * diagnostic-manager.cc: Likewise.
3573 (saved_diagnostic::saved_diagnostic): Use std::unique_ptr for
3574 param d and field m_d.
3575 (saved_diagnostic::~saved_diagnostic): Remove explicit delete of m_d.
3576 (saved_diagnostic::add_note): Use std::unique_ptr for
3578 (saved_diagnostic::get_pending_diagnostic): Update for conversion
3579 of m_sd.m_d to unique_ptr.
3580 (diagnostic_manager::add_diagnostic): Use std::unique_ptr for
3581 param d. Remove explicit deletion.
3582 (diagnostic_manager::add_note): Use std::unique_ptr for param pn.
3583 (diagnostic_manager::emit_saved_diagnostic): Update for conversion
3584 of m_sd.m_d to unique_ptr.
3585 (null_assignment_sm_context::warn): Use std::unique_ptr for
3586 param d. Remove explicit deletion.
3587 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Use
3588 std::unique_ptr for param d.
3589 (saved_diagnostic::add_note): Likewise for param pn.
3590 (saved_diagnostic::m_d): Likewise.
3591 (diagnostic_manager::add_diagnostic): Use std::unique_ptr for
3593 (diagnostic_manager::add_note): Use std::unique_ptr for param pn.
3594 * engine.cc: Include "make-unique.h".
3595 (impl_region_model_context::warn): Update to use std::unique_ptr
3596 for param, removing explicit deletion.
3597 (impl_region_model_context::add_note): Likewise.
3598 (impl_sm_context::warn): Update to use std::unique_ptr
3600 (impl_region_model_context::on_state_leak): Likewise for result of
3602 (exploded_node::on_longjmp): Use make_unique when creating
3604 (exploded_graph::process_node): Likewise.
3605 * exploded-graph.h (impl_region_model_context::warn): Update to
3606 use std::unique_ptr for param.
3607 (impl_region_model_context::add_note): Likewise.
3608 * feasible-graph.cc: Add define of INCLUDE_MEMORY.
3609 * pending-diagnostic.cc: Likewise.
3610 * pending-diagnostic.h: Include analyzer.sm.h"
3611 * program-point.cc: Add define of INCLUDE_MEMORY.
3612 * program-state.cc: Likewise.
3613 * region-model-asm.cc: Likewise.
3614 * region-model-impl-calls.cc: Likewise. Include "make-unique.h".
3615 (region_model::impl_call_putenv): Use make_unique when creating
3617 * region-model-manager.cc: Add define of INCLUDE_MEMORY.
3618 * region-model-reachability.cc: Likewise.
3619 * region-model.cc: Likewise. Include "make-unique.h".
3620 (region_model::get_gassign_result): Use make_unique when creating
3622 (region_model::check_for_poison): Likewise.
3623 (region_model::on_stmt_pre): Likewise.
3624 (region_model::check_symbolic_bounds): Likewise.
3625 (region_model::check_region_bounds): Likewise.
3626 (annotating_ctxt: make_note): Use std::unique_ptr for result.
3627 (region_model::deref_rvalue): Use make_unique when creating
3629 (region_model::check_for_writable_region): Likewise.
3630 (region_model::check_region_size): Likewise.
3631 (region_model::check_dynamic_size_for_floats): Likewise.
3632 (region_model::maybe_complain_about_infoleak): Likewise.
3633 (noop_region_model_context::add_note): Use std::unique_ptr for
3634 param. Remove explicit deletion.
3635 * region-model.h: Include "analyzer/pending-diagnostic.h".
3636 (region_model_context::warn): Convert param to std::unique_ptr.
3637 (region_model_context::add_note): Likewise.
3638 (noop_region_model_context::warn): Likewise.
3639 (noop_region_model_context::add_note): Likewise.
3640 (region_model_context_decorator::warn): Likewise.
3641 (region_model_context_decorator::add_note): Likewise.
3642 (note_adding_context::warn): Likewise.
3643 (note_adding_context::make_note): Likewise for return type.
3644 (test_region_model_context::warn): Convert param to
3646 * region.cc: Add define of INCLUDE_MEMORY.
3647 * sm-fd.cc: Likewise. Include "make-unique.h".
3648 (fd_state_machine::check_for_fd_attrs): Use make_unique when
3649 creating pending_diagnostics.
3650 (fd_state_machine::on_open): Likewise.
3651 (fd_state_machine::on_creat): Likewise.
3652 (fd_state_machine::check_for_dup): Likewise.
3653 (fd_state_machine::on_close): Likewise.
3654 (fd_state_machine::check_for_open_fd): Likewise.
3655 (fd_state_machine::on_leak): Likewise, converting return type to
3657 * sm-file.cc: Add define of INCLUDE_MEMORY. Include
3659 (fileptr_state_machine::on_stmt): Use make_unique when creating
3661 (fileptr_state_machine::on_leak): Likewise, converting return type
3663 * sm-malloc.cc: Add define of INCLUDE_MEMORY. Include
3665 (malloc_state_machine::on_stmt): Use make_unique when creating
3667 (malloc_state_machine::handle_free_of_non_heap): Likewise.
3668 (malloc_state_machine::on_deallocator_call): Likewise.
3669 (malloc_state_machine::on_realloc_call): Likewise.
3670 (malloc_state_machine::on_leak): Likewise, converting return type
3672 * sm-pattern-test.cc: Add define of INCLUDE_MEMORY. Include
3674 (pattern_test_state_machine::on_condition): Use make_unique when
3675 creating pending_diagnostic.
3676 * sm-sensitive.cc: Add define of INCLUDE_MEMORY. Include
3678 (sensitive_state_machine::warn_for_any_exposure): Use make_unique
3679 when creating pending_diagnostic.
3680 * sm-signal.cc: Add define of INCLUDE_MEMORY. Include
3682 (signal_state_machine::on_stmt): Use make_unique when creating
3684 * sm-taint.cc: Add define of INCLUDE_MEMORY. Include
3686 (taint_state_machine::check_for_tainted_size_arg): Use make_unique
3687 when creating pending_diagnostic.
3688 (taint_state_machine::check_for_tainted_divisor): Likewise.
3689 (region_model::check_region_for_taint): Likewise.
3690 (region_model::check_dynamic_size_for_taint): Likewise.
3691 * sm.cc: Add define of INCLUDE_MEMORY. Include
3692 "analyzer/pending-diagnostic.h".
3693 (state_machine::on_leak): Move here from sm.h, changing return
3694 type to std::unique_ptr.
3695 * sm.h (state_machine::on_leak): Change return type to
3696 std::unique_ptr. Move defn of base impl to sm.cc
3697 (sm_context::warn): Convert param d to std_unique_ptr.
3698 * state-purge.cc: Add define of INCLUDE_MEMORY.
3699 * store.cc: Likewise.
3700 * svalue.cc: Likewise.
3701 * trimmed-graph.cc: Likewise.
3702 * varargs.cc: Likewise. Include "make-unique.h".
3703 (va_list_state_machine::check_for_ended_va_list): Use make_unique
3704 when creating pending_diagnostic.
3705 (va_list_state_machine::on_leak): Likewise, converting return type
3707 (region_model::impl_call_va_arg): Use make_unique when creating
3710 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3713 * analyzer.cc (is_pipe_call_p): New.
3714 * analyzer.h (is_pipe_call_p): New decl.
3715 * region-model.cc (region_model::on_call_pre): Use it.
3716 (region_model::on_call_post): Likewise.
3718 2022-10-26 David Malcolm <dmalcolm@redhat.com>
3720 * sm-fd.cc (fd_state_machine::on_open): Transition to "unchecked"
3721 when the mode is symbolic, rather than just on integer constants.
3722 (fd_state_machine::check_for_open_fd): Don't complain about
3723 unchecked values in the start state.
3725 2022-10-26 David Malcolm <dmalcolm@redhat.com>
3727 * sm-fd.dot: New file.
3729 2022-10-24 David Malcolm <dmalcolm@redhat.com>
3732 * varargs.cc (get_va_copy_arg): Fix the non-pointer case.
3734 2022-10-24 David Malcolm <dmalcolm@redhat.com>
3737 * region-model.cc (region_model::eval_condition_without_cm):
3738 Ensure that constants are on the right-hand side before checking
3741 2022-10-24 David Malcolm <dmalcolm@redhat.com>
3743 * engine.cc (impl_region_model_context::get_malloc_map): Replace
3745 (impl_region_model_context::get_state_map_by_name): ...this.
3746 (impl_region_model_context::get_fd_map): Delete.
3747 (impl_region_model_context::get_taint_map): Delete.
3748 * exploded-graph.h (impl_region_model_context::get_fd_map):
3750 (impl_region_model_context::get_malloc_map): Delete.
3751 (impl_region_model_context::get_taint_map): Delete.
3752 (impl_region_model_context::get_state_map_by_name): New.
3753 * region-model.h (region_model_context::get_state_map_by_name):
3755 (region_model_context::get_fd_map): Convert from vfunc to
3757 (region_model_context::get_malloc_map): Likewise.
3758 (region_model_context::get_taint_map): Likewise.
3759 (noop_region_model_context::get_state_map_by_name): New.
3760 (noop_region_model_context::get_fd_map): Delete.
3761 (noop_region_model_context::get_malloc_map): Delete.
3762 (noop_region_model_context::get_taint_map): Delete.
3763 (region_model_context_decorator::get_state_map_by_name): New.
3764 (region_model_context_decorator::get_fd_map): Delete.
3765 (region_model_context_decorator::get_malloc_map): Delete.
3766 (region_model_context_decorator::get_taint_map): Delete.
3768 2022-10-24 David Malcolm <dmalcolm@redhat.com>
3771 * engine.cc (impl_region_model_context::get_fd_map): New.
3772 * exploded-graph.h (impl_region_model_context::get_fd_map): New
3774 * region-model-impl-calls.cc (region_model::impl_call_pipe): New.
3775 * region-model.cc (region_model::update_for_int_cst_return): New,
3777 (region_model::update_for_zero_return): ...this. Reimplement in
3778 terms of the former.
3779 (region_model::on_call_pre): Handle "pipe" and "pipe2".
3780 (region_model::on_call_post): Likewise.
3781 * region-model.h (region_model::impl_call_pipe): New decl.
3782 (region_model::update_for_int_cst_return): New decl.
3783 (region_model::mark_as_valid_fd): New decl.
3784 (region_model_context::get_fd_map): New pure virtual fn.
3785 (noop_region_model_context::get_fd_map): New.
3786 (region_model_context_decorator::get_fd_map): New.
3787 * sm-fd.cc: Include "analyzer/program-state.h".
3788 (fd_state_machine::describe_state_change): Handle transitions from
3789 start state to valid states.
3790 (fd_state_machine::mark_as_valid_fd): New.
3791 (fd_state_machine::on_stmt): Add missing return for "creat".
3792 (region_model::mark_as_valid_fd): New.
3794 2022-10-19 David Malcolm <dmalcolm@redhat.com>
3797 * varargs.cc (get_BT_VALIST_ARG): Rename to...
3798 (get_va_copy_arg): ...this, and update logic for determining level
3799 of indirection of va_copy's argument to use type of argument,
3800 rather than looking at va_list_type_node, to correctly handle
3801 __builtin_ms_va_copy.
3802 (get_stateful_BT_VALIST_ARG): Rename to...
3803 (get_stateful_va_copy_arg): ...this.
3804 (va_list_state_machine::on_va_copy): Update for renaming.
3805 (region_model::impl_call_va_copy): Likewise.
3807 2022-10-13 David Malcolm <dmalcolm@redhat.com>
3810 * svalue.cc (constant_svalue::maybe_fold_bits_within): Only
3811 attempt to extract individual bits when tree_fits_uhwi_p.
3813 2022-10-07 David Malcolm <dmalcolm@redhat.com>
3816 * region-model.cc (selftest::get_bit): New function.
3817 (selftest::test_bits_within_svalue_folding): New.
3818 (selfftest::analyzer_region_model_cc_tests): Call it.
3819 * svalue.cc (constant_svalue::maybe_fold_bits_within): Handle the
3820 case of extracting a single bit.
3822 2022-10-06 David Malcolm <dmalcolm@redhat.com>
3825 * store.cc (store::replay_call_summary_cluster): Eliminate
3826 special-casing of RK_HEAP_ALLOCATED in favor of sharing code with
3827 RK_DECL, avoiding an ICE due to attempting to bind a
3828 compound_svalue into a binding_cluster when an svalue in the
3829 summary cluster converts to a compound_svalue in the caller.
3831 2022-10-06 David Malcolm <dmalcolm@redhat.com>
3833 * call-summary.cc (call_summary_replay::dump_to_pp): Bulletproof
3834 against NULL caller regions/svalues.
3836 2022-10-05 David Malcolm <dmalcolm@redhat.com>
3838 * analysis-plan.cc: Simplify includes.
3839 * analyzer-pass.cc: Likewise.
3840 * analyzer-selftests.cc: Likewise.
3841 * analyzer.cc: Likewise.
3842 * analyzer.h: Add includes of "json.h" and "tristate.h".
3843 * call-info.cc: Simplify includes.
3844 * call-string.cc: Likewise.
3845 * call-summary.cc: Likewise.
3846 * checker-path.cc: Likewise.
3847 * complexity.cc: Likewise.
3848 * constraint-manager.cc: Likewise.
3849 * diagnostic-manager.cc: Likewise.
3850 * engine.cc: Likewise.
3851 * feasible-graph.cc: Likewise.
3852 * known-function-manager.cc: Likewise.
3853 * pending-diagnostic.cc: Likewise.
3854 * program-point.cc: Likewise.
3855 * program-state.cc: Likewise.
3856 * region-model-asm.cc: Likewise.
3857 * region-model-impl-calls.cc: Likewise.
3858 * region-model-manager.cc: Likewise.
3859 * region-model-reachability.cc: Likewise.
3860 * region-model.cc: Likewise.
3861 * region-model.h: Include "selftest.h".
3862 * region.cc: Simplify includes.
3863 * sm-fd.cc: Likewise.
3864 * sm-file.cc: Likewise.
3865 * sm-malloc.cc: Likewise.
3866 * sm-pattern-test.cc: Likewise.
3867 * sm-sensitive.cc: Likewise.
3868 * sm-signal.cc: Likewise.
3869 * sm-taint.cc: Likewise.
3871 * state-purge.cc: Likewise.
3872 * store.cc: Likewise.
3873 * store.h: Likewise.
3874 * supergraph.cc: Likewise.
3875 * svalue.cc: Likewise.
3876 * svalue.h: Likewise.
3877 * trimmed-graph.cc: Likewise.
3878 * varargs.cc: Likewise.
3880 2022-10-05 David Malcolm <dmalcolm@redhat.com>
3884 (call_summary_replay::convert_svalue_from_summary_1): Handle NULL
3885 results from convert_svalue_from_summary in SK_UNARY_OP and
3887 * engine.cc (impl_region_model_context::on_unknown_change): Bail
3888 out on svalues that can't have associated state.
3889 * region-model-impl-calls.cc
3890 (region_model::impl_call_analyzer_get_unknown_ptr): New.
3891 * region-model.cc (region_model::on_stmt_pre): Handle
3892 "__analyzer_get_unknown_ptr".
3894 (region_model::impl_call_analyzer_get_unknown_ptr): New decl.
3895 * store.cc (store::replay_call_summary_cluster): Avoid trying to
3896 create binding clusters for base regions that shouldn't have them.
3898 2022-10-05 Martin Liska <mliska@suse.cz>
3900 * call-summary.cc (call_summary_replay::call_summary_replay):
3901 Remove unused variable and arguments.
3902 * call-summary.h: Likewise.
3903 * engine.cc (exploded_node::on_stmt): Likewise.
3904 (exploded_node::replay_call_summaries): Likewise.
3905 (exploded_node::replay_call_summary): Likewise.
3906 * exploded-graph.h (class exploded_node): Likewise.
3908 2022-10-05 David Malcolm <dmalcolm@redhat.com>
3911 * analyzer-logging.h: Include "diagnostic-core.h".
3912 * analyzer.h: Include "function.h".
3913 (class call_summary): New forward decl.
3914 (class call_summary_replay): New forward decl.
3915 (struct per_function_data): New forward decl.
3916 (struct interesting_t): New forward decl.
3917 (custom_edge_info::update_state): New vfunc.
3918 * call-info.cc (custom_edge_info::update_state): New.
3919 * call-summary.cc: New file.
3920 * call-summary.h: New file.
3921 * constraint-manager.cc: Include "analyzer/call-summary.h".
3922 (class replay_fact_visitor): New.
3923 (constraint_manager::replay_call_summary): New.
3924 * constraint-manager.h (constraint_manager::replay_call_summary):
3926 * engine.cc: Include "analyzer/call-summary.h".
3927 (exploded_node::on_stmt): Handle call summaries.
3928 (class call_summary_edge_info): New.
3929 (exploded_node::replay_call_summaries): New.
3930 (exploded_node::replay_call_summary): New.
3931 (per_function_data::~per_function_data): New.
3932 (per_function_data::add_call_summary): Move here from header and
3934 (exploded_graph::process_node): Call update_state rather than
3935 update_model when handling bifurcation
3936 (viz_callgraph_node::dump_dot): Use a regular label rather
3937 than an HTML table; add summaries to dump.
3938 * exploded-graph.h: Include "alloc-pool.h", "fibonacci_heap.h",
3939 "supergraph.h", "sbitmap.h", "shortest-paths.h", "analyzer/sm.h",
3940 "analyzer/program-state.h", and "analyzer/diagnostic-manager.h".
3941 (exploded_node::replay_call_summaries): New decl.
3942 (exploded_node::replay_call_summary): New decl.
3943 (per_function_data::~per_function_data): New decl.
3944 (per_function_data::add_call_summary): Move implemention from
3946 (per_function_data::m_summaries): Update type of element.
3947 * known-function-manager.h: Include "analyzer/analyzer-logging.h".
3948 * program-point.h: Include "pretty-print.h" and
3949 "analyzer/call-string.h".
3950 * program-state.cc: Include "analyzer/call-summary.h".
3951 (sm_state_map::replay_call_summary): New.
3952 (program_state::replay_call_summary): New.
3953 * program-state.h (sm_state_map::replay_call_summary): New decl.
3954 (program_state::replay_call_summary): New decl.
3955 * region-model-manager.cc
3956 (region_model_manager::get_or_create_asm_output_svalue): New
3958 * region-model-manager.h
3959 (region_model_manager::get_or_create_asm_output_svalue): New
3961 * region-model.cc: Include "analyzer/call-summary.h".
3962 (region_model::maybe_update_for_edge): Remove call to
3963 region_model::update_for_call_summary on
3964 SUPEREDGE_INTRAPROCEDURAL_CALL.
3965 (region_model::update_for_call_summary): Delete.
3966 (region_model::replay_call_summary): New.
3967 * region-model.h (region_model::replay_call_summary): New decl.
3968 (region_model::update_for_call_summary): Delete decl.
3969 * store.cc: Include "analyzer/call-summary.h".
3970 (store::replay_call_summary): New.
3971 (store::replay_call_summary_cluster): New.
3972 * store.h: Include "tristate.h".
3973 (is_a_helper <const ana::concrete_binding *>::test): New.
3974 (store::replay_call_summary): New decl.
3975 (store::replay_call_summary_cluster): New decl.
3976 * supergraph.cc (get_ultimate_function_for_cgraph_edge): Remove
3978 (supergraph_call_edge): Make stmt param const.
3979 * supergraph.h: Include "ordered-hash-map.h", "cfg.h",
3980 "basic-block.h", "gimple.h", "gimple-iterator.h", and "digraph.h".
3981 (supergraph_call_edge): Make stmt param const.
3982 (get_ultimate_function_for_cgraph_edge): New decl.
3983 * svalue.cc (compound_svalue::compound_svalue): Assert that we're
3984 not nesting compound_svalues.
3985 * svalue.h: Include "json.h", "analyzer/store.h", and
3986 "analyzer/program-point.h".
3987 (asm_output_svalue::get_num_outputs): New accessor.
3989 2022-10-05 David Malcolm <dmalcolm@redhat.com>
3991 * region-model.h: Include "analyzer/region-model-manager.h"
3992 (class region_model_manager): Move decl to...
3993 * region-model-manager.h: ...this new file.
3995 2022-10-05 David Malcolm <dmalcolm@redhat.com>
3997 * region-model-manager.cc
3998 (region_model_manager::maybe_fold_unaryop): Fold -(-(VAL)) to VAL.
4000 2022-10-05 David Malcolm <dmalcolm@redhat.com>
4002 * region-model-manager.cc
4003 (region_model_manager::get_or_create_widening_svalue): Use a
4004 function_point rather than a program_point.
4005 * region-model.cc (selftest::test_widening_constraints): Likewise.
4007 (region_model_manager::get_or_create_widening_svalue): Likewise.
4008 (model_merger::get_function_point): New.
4009 * svalue.cc (svalue::can_merge_p): Use a function_point rather
4010 than a program_point.
4011 (svalue::can_merge_p): Likewise.
4012 * svalue.h (widening_svalue::key_t): Likewise.
4013 (widening_svalue::widening_svalue): Likewise.
4015 2022-09-12 Martin Liska <mliska@suse.cz>
4017 * region-model.cc (region_model::maybe_complain_about_infoleak):
4018 Remove unused fields.
4020 2022-09-11 Tim Lange <mail@tim-lange.me>
4023 * region-model.cc (region_model::check_region_bounds):
4024 Bail out if 0 bytes were accessed.
4025 * store.cc (byte_range::dump_to_pp):
4026 Add special case for empty ranges.
4027 (byte_range::exceeds_p): Restrict to non-empty ranges.
4028 (byte_range::falls_short_of_p): Restrict to non-empty ranges.
4029 * store.h (bit_range::empty_p): New function.
4030 (bit_range::get_last_byte_offset): Restrict to non-empty ranges.
4031 (byte_range::empty_p): New function.
4032 (byte_range::get_last_byte_offset): Restrict to non-empty ranges.
4034 2022-09-09 David Malcolm <dmalcolm@redhat.com>
4036 * analyzer.opt (Wanalyzer-exposure-through-uninit-copy): New.
4037 * checker-path.cc (region_creation_event::region_creation_event):
4038 Add "capacity" and "kind" params.
4039 (region_creation_event::get_desc): Generalize to different kinds
4041 (checker_path::add_region_creation_event): Convert to...
4042 (checker_path::add_region_creation_events): ...this.
4043 * checker-path.h (enum rce_kind): New.
4044 (region_creation_event::region_creation_event): Add "capacity" and
4046 (region_creation_event::m_capacity): New field.
4047 (region_creation_event::m_rce_kind): New field.
4048 (checker_path::add_region_creation_event): Convert to...
4049 (checker_path::add_region_creation_events): ...this.
4050 * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
4051 Update for multiple region creation events.
4052 (diagnostic_manager::add_event_on_final_node): Likewise.
4053 (diagnostic_manager::add_events_for_eedge): Likewise.
4054 * region-model-impl-calls.cc (call_details::get_logger): New.
4055 * region-model.cc: Define INCLUDE_MEMORY before including
4056 "system.h". Include "gcc-rich-location.h".
4057 (class record_layout): New.
4058 (class exposure_through_uninit_copy): New.
4059 (contains_uninit_p): New.
4060 (region_model::maybe_complain_about_infoleak): New.
4061 * region-model.h (call_details::get_logger): New decl.
4062 (region_model::maybe_complain_about_infoleak): New decl.
4063 (region_model::mark_as_tainted): New decl.
4064 * sm-taint.cc (region_model::mark_as_tainted): New.
4066 2022-09-09 David Malcolm <dmalcolm@redhat.com>
4068 * analyzer.h (class known_function_manager): New forward decl.
4069 (class known_function): New.
4070 (plugin_analyzer_init_iface::register_known_function): New.
4071 * engine.cc: Include "analyzer/known-function-manager.h".
4072 (plugin_analyzer_init_impl::plugin_analyzer_init_impl): Add
4074 (plugin_analyzer_init_impl::register_state_machine): Add
4076 (plugin_analyzer_init_impl::register_known_function): New.
4077 (plugin_analyzer_init_impl::m_known_fn_mgr): New.
4078 (impl_run_checkers): Update plugin callback invocation to use
4079 eng's known_function_manager.
4080 * known-function-manager.cc: New file.
4081 * known-function-manager.h: New file.
4082 * region-model-manager.cc
4083 (region_model_manager::region_model_manager): Pass logger to
4084 m_known_fn_mgr's ctor.
4085 * region-model.cc (region_model::update_for_zero_return): New.
4086 (region_model::update_for_nonzero_return): New.
4087 (maybe_simplify_upper_bound): New.
4088 (region_model::maybe_get_copy_bounds): New.
4089 (region_model::get_known_function): New.
4090 (region_model::on_call_pre): Handle plugin-supplied known
4092 * region-model.h: Include "analyzer/known-function-manager.h".
4093 (region_model_manager::get_known_function_manager): New.
4094 (region_model_manager::m_known_fn_mgr): New.
4095 (call_details::get_model): New accessor.
4096 (region_model::maybe_get_copy_bounds): New decl.
4097 (region_model::update_for_zero_return): New decl.
4098 (region_model::update_for_nonzero_return): New decl.
4099 (region_model::get_known_function): New decl.
4100 (region_model::get_known_function_manager): New.
4102 2022-09-08 Tim Lange <mail@tim-lange.me>
4105 * analyzer.h (region_offset): Eliminate m_is_symbolic member.
4106 * region-model-impl-calls.cc (region_model::impl_call_realloc):
4107 Refine implementation to be more precise.
4108 * region-model.cc (class symbolic_past_the_end):
4109 Abstract diagnostic class to complain about accesses past the end
4110 with symbolic values.
4111 (class symbolic_buffer_overflow):
4112 Concrete diagnostic class to complain about buffer overflows with
4114 (class symbolic_buffer_overread):
4115 Concrete diagnostic class to complain about buffer overreads with
4117 (region_model::check_symbolic_bounds): New function.
4118 (maybe_get_integer_cst_tree): New helper function.
4119 (region_model::check_region_bounds):
4120 Add call to check_symbolic_bounds if offset is not concrete.
4121 (region_model::eval_condition_without_cm):
4122 Add support for EQ_EXPR and GT_EXPR with binaryop_svalues.
4123 (is_positive_svalue): New hleper function.
4124 (region_model::symbolic_greater_than):
4125 New function to handle GT_EXPR comparisons with symbolic values.
4126 (region_model::structural_equality): New function to compare
4127 whether two svalues are structured the same, i.e. evaluate to
4129 (test_struct): Reflect changes to region::calc_offset.
4130 (test_var): Likewise.
4131 (test_array_2): Likewise and add selftest with symbolic i.
4132 * region-model.h (class region_model): Add check_symbolic_bounds,
4133 symbolic_greater_than and structural_equality.
4134 * region.cc (region::get_offset):
4135 Reflect changes to region::calc_offset.
4136 (region::calc_offset):
4137 Compute the symbolic offset if the offset is not concrete.
4138 (region::get_relative_symbolic_offset): New function to return the
4139 symbolic offset in bytes relative to its parent.
4140 (field_region::get_relative_symbolic_offset): Likewise.
4141 (element_region::get_relative_symbolic_offset): Likewise.
4142 (offset_region::get_relative_symbolic_offset): Likewise.
4143 (bit_range_region::get_relative_symbolic_offset): Likewise.
4144 * region.h: Add get_relative_symbolic_offset.
4145 * store.cc (binding_key::make):
4146 Reflect changes to region::calc_offset.
4147 (binding_map::apply_ctor_val_to_range): Likewise.
4148 (binding_map::apply_ctor_pair_to_child_region): Likewise.
4149 (binding_cluster::bind_compound_sval): Likewise.
4150 (binding_cluster::get_any_binding): Likewise.
4151 (binding_cluster::maybe_get_compound_binding): Likewise.
4153 2022-09-05 Tim Lange <mail@tim-lange.me>
4155 * region-model-impl-calls.cc (region_model::impl_call_strcpy):
4156 Handle the constant string case.
4157 * region-model.cc (region_model::get_string_size):
4158 New function to get the string size from a region or svalue.
4159 * region-model.h (class region_model): Add get_string_size.
4161 2022-09-05 Tim Lange <mail@tim-lange.me>
4163 * region.cc (cast_region::get_relative_concrete_offset):
4164 New overloaded method.
4165 * region.h: Add cast_region::get_relative_concrete_offset.
4167 2022-08-22 Martin Liska <mliska@suse.cz>
4169 * region-model.cc: Add missing final keyword.
4171 2022-08-18 Tim Lange <mail@tim-lange.me>
4174 * analyzer.opt: Add Wanalyzer-imprecise-floating-point-arithmetic.
4175 * region-model.cc (is_any_cast_p): Formatting.
4176 (region_model::check_region_size): Ensure precondition.
4177 (class imprecise_floating_point_arithmetic): New abstract
4178 diagnostic class for all floating-point related warnings.
4179 (class float_as_size_arg): Concrete diagnostic class to complain
4180 about floating-point operands inside the size argument.
4181 (class contains_floating_point_visitor):
4182 New visitor to find floating-point operands inside svalues.
4183 (region_model::check_dynamic_size_for_floats): New function.
4184 (region_model::set_dynamic_extents):
4185 Call to check_dynamic_size_for_floats.
4186 * region-model.h (class region_model):
4187 Add region_model::check_dynamic_size_for_floats.
4189 2022-08-16 Martin Liska <mliska@suse.cz>
4191 * region-model.cc: Fix -Winconsistent-missing-override clang
4193 * region.h: Likewise.
4195 2022-08-15 David Malcolm <dmalcolm@redhat.com>
4198 * region-model.cc (buffer_overread::emit): Fix copy&paste error in
4199 direction of the access in the note.
4201 2022-08-15 David Malcolm <dmalcolm@redhat.com>
4204 * region-model.cc (region_model::on_call_pre): Use check_call_args
4205 when ensuring that we call get_arg_svalue on all args. Remove
4206 redundant call from handling for stdio builtins.
4208 2022-08-15 Immad Mir <mirimmad@outlook.com>
4211 * sm-fd.cc (check_for_dup): exit early if first
4212 argument is invalid for all dup functions.
4214 2022-08-12 Tim Lange <mail@tim-lange.me>
4217 * analyzer.opt: Add Wanalyzer-out-of-bounds.
4218 * region-model.cc (class out_of_bounds): Diagnostics base class
4219 for all out-of-bounds diagnostics.
4220 (class past_the_end): Base class derived from out_of_bounds for
4221 the buffer_overflow and buffer_overread diagnostics.
4222 (class buffer_overflow): Buffer overflow diagnostics.
4223 (class buffer_overread): Buffer overread diagnostics.
4224 (class buffer_underflow): Buffer underflow diagnostics.
4225 (class buffer_underread): Buffer overread diagnostics.
4226 (region_model::check_region_bounds): New function to check region
4227 bounds for out-of-bounds accesses.
4228 (region_model::check_region_access):
4229 Add call to check_region_bounds.
4230 (region_model::get_representative_tree): New function that accepts
4231 a region instead of an svalue.
4232 * region-model.h (class region_model):
4233 Add region_model::check_region_bounds.
4234 * region.cc (region::symbolic_p): New predicate.
4235 (offset_region::get_byte_size_sval): Only return the remaining
4236 byte size on offset_regions.
4237 * region.h: Add region::symbolic_p.
4238 * store.cc (byte_range::intersects_p):
4239 Add new function equivalent to bit_range::intersects_p.
4240 (byte_range::exceeds_p): New function.
4241 (byte_range::falls_short_of_p): New function.
4242 * store.h (struct byte_range): Add byte_range::intersects_p,
4243 byte_range::exceeds_p and byte_range::falls_short_of_p.
4245 2022-08-12 Tim Lange <mail@tim-lange.me>
4248 * region-model-impl-calls.cc (region_model::impl_call_realloc):
4249 Use the result of get_copied_size as the size for the
4250 sized_regions in realloc.
4251 (success_with_move::get_copied_size): New function.
4253 2022-08-11 Immad Mir <mirimmad@outlook.com>
4256 * sm-fd.cc (check_for_dup): handle the m_start
4257 state when transitioning the state of LHS
4258 of dup, dup2 and dup3 call.
4260 2022-08-09 David Malcolm <dmalcolm@redhat.com>
4263 * region-model.cc (region_model::on_call_pre): Ensure that we call
4264 get_arg_svalue on all arguments.
4266 2022-08-05 David Malcolm <dmalcolm@redhat.com>
4269 * analyzer.opt (Wanalyzer-jump-through-null): New option.
4270 * engine.cc (class jump_through_null): New.
4271 (exploded_graph::process_node): Complain about jumps through NULL
4274 2022-08-02 Immad Mir <mirimmad@outlook.com>
4277 * sm-fd.cc (fd_state_machine::on_open): Add
4278 creat, dup, dup2 and dup3 functions.
4280 (fd_state_machine::valid_to_unchecked_state): New.
4281 (fd_state_machine::on_creat): New.
4282 (fd_state_machine::on_dup): New.
4284 2022-07-28 David Malcolm <dmalcolm@redhat.com>
4287 * analyzer.opt (Wanalyzer-putenv-of-auto-var): New.
4288 * region-model-impl-calls.cc (class putenv_of_auto_var): New.
4289 (region_model::impl_call_putenv): New.
4290 * region-model.cc (region_model::on_call_pre): Handle putenv.
4291 * region-model.h (region_model::impl_call_putenv): New decl.
4293 2022-07-28 David Malcolm <dmalcolm@redhat.com>
4295 * sm-malloc.cc (free_of_non_heap::emit): Add comment about CWE.
4296 * sm-taint.cc (tainted_size::emit): Likewise.
4298 2022-07-28 David Malcolm <dmalcolm@redhat.com>
4300 * region.h: Add notes to the comment describing the region
4303 2022-07-27 Immad Mir <mirimmad@outlook.com>
4307 (fd_diagnostic::get_meaning_for_state_change): New.
4309 2022-07-26 David Malcolm <dmalcolm@redhat.com>
4312 * store.cc (store::set_value): Don't strip away casts if the
4313 region has NULL type.
4315 2022-07-26 David Malcolm <dmalcolm@redhat.com>
4317 * region.h (code_region::get_element): Remove stray decl.
4318 (function_region::get_element): Likewise.
4320 2022-07-25 Martin Liska <mliska@suse.cz>
4322 * sm-fd.cc: Run dos2unix and fix coding style issues.
4324 2022-07-23 Immad Mir <mirimmad@outlook.com>
4326 * sm-fd.cc (fd_param_diagnostic): New diagnostic class.
4327 (fd_access_mode_mismatch): Change inheritance from fd_diagnostic
4328 to fd_param_diagnostic. Add new overloaded constructor.
4329 (fd_use_after_close): Likewise.
4330 (unchecked_use_of_fd): Likewise and also change name to fd_use_without_check.
4331 (double_close): Change name to fd_double_close.
4332 (enum access_directions): New.
4333 (fd_state_machine::on_stmt): Handle calls to function with the
4334 new three function attributes.
4335 (fd_state_machine::check_for_fd_attrs): New.
4336 (fd_state_machine::on_open): Use the new overloaded constructors
4337 of diagnostic classes.
4339 2022-07-22 David Malcolm <dmalcolm@redhat.com>
4342 * varargs.cc (region_model::impl_call_va_start): Avoid iterating
4343 through non-existant variadic arguments by initializing the
4344 impl_region to "UNKNOWN" if the va_start occurs in the top-level
4345 function to the analysis.
4347 2022-07-22 David Malcolm <dmalcolm@redhat.com>
4350 * store.cc (binding_cluster::binding_cluster): Remove overzealous
4351 assertion; we're checking for tracked_p in
4352 store::get_or_create_cluster.
4354 2022-07-22 Tim Lange <mail@tim-lange.me>
4357 * region-model.cc (capacity_compatible_with_type): Always return true
4358 if alloc_size is zero.
4360 2022-07-21 David Malcolm <dmalcolm@redhat.com>
4363 * varargs.cc (region_model::impl_call_va_arg): When determining if
4364 we're doing interprocedural analysis, use the stack depth of the
4365 frame in which va_start was called, rather than the current stack
4368 2022-07-21 David Malcolm <dmalcolm@redhat.com>
4370 * sm-taint.cc (tainted_array_index::emit): Bulletproof against
4372 (tainted_array_index::describe_final_event): Likewise.
4373 (tainted_size::emit): Likewise.
4374 (tainted_size::describe_final_event): Likewise.
4376 2022-07-21 David Malcolm <dmalcolm@redhat.com>
4379 * region.cc (decl_region::get_svalue_for_initializer): Bail out on
4382 2022-07-20 David Malcolm <dmalcolm@redhat.com>
4385 * sm-taint.cc (taint_state_machine::on_condition): Potentially
4386 update the state of the RHS as well as the LHS.
4388 2022-07-20 David Malcolm <dmalcolm@redhat.com>
4391 * region.h (string_region::tracked_p): New.
4392 * store.cc (binding_cluster::binding_cluster): Move here from
4393 store.h. Add assertion that base_region is tracked_p.
4394 * store.h (binding_cluster::binding_cluster): Move to store.cc.
4396 2022-07-19 David Malcolm <dmalcolm@redhat.com>
4399 * constraint-manager.h (bounded_ranges::get_count): New.
4400 (bounded_ranges::get_range): New.
4401 * engine.cc (impl_region_model_context::on_bounded_ranges): New.
4402 * exploded-graph.h (impl_region_model_context::on_bounded_ranges):
4404 * region-model.cc (region_model::apply_constraints_for_gswitch):
4405 Potentially call ctxt->on_bounded_ranges.
4406 * region-model.h (region_model_context::on_bounded_ranges): New
4408 (noop_region_model_context::on_bounded_ranges): New.
4409 (region_model_context_decorator::on_bounded_ranges): New.
4410 * sm-taint.cc: Include "analyzer/constraint-manager.h".
4411 (taint_state_machine::on_bounded_ranges): New.
4412 * sm.h (state_machine::on_bounded_ranges): New.
4414 2022-07-19 David Malcolm <dmalcolm@redhat.com>
4416 * engine.cc (exploded_graph::process_node): Show any description
4417 of the out-edge when logging it for consideration.
4419 2022-07-15 David Malcolm <dmalcolm@redhat.com>
4422 * sm-taint.cc (taint_state_machine::on_condition): Handle range
4423 checks optimized by build_range_check.
4425 2022-07-15 Jonathan Wakely <jwakely@redhat.com>
4427 * call-info.cc (call_info::print): Adjust to new label_text API.
4428 * checker-path.cc (checker_event::dump): Likewise.
4429 (region_creation_event::get_desc): Likewise.
4430 (state_change_event::get_desc): Likewise.
4431 (superedge_event::should_filter_p): Likewise.
4432 (start_cfg_edge_event::get_desc): Likewise.
4433 (call_event::get_desc): Likewise.
4434 (return_event::get_desc): Likewise.
4435 (warning_event::get_desc): Likewise.
4436 (checker_path::dump): Likewise.
4437 (checker_path::debug): Likewise.
4438 * diagnostic-manager.cc (diagnostic_manager::prune_for_sm_diagnostic):
4440 (diagnostic_manager::prune_interproc_events): Likewise.
4441 * engine.cc (feasibility_state::maybe_update_for_edge):
4443 * program-state.cc (sm_state_map::to_json): Likewise.
4444 * region-model-impl-calls.cc (region_model::impl_call_analyzer_describe): Likewise.
4445 (region_model::impl_call_analyzer_dump_capacity): Likewise.
4446 * region.cc (region::to_json): Likewise.
4447 * sm-malloc.cc (inform_nonnull_attribute): Likewise.
4448 * store.cc (binding_map::to_json): Likewise.
4449 (store::to_json): Likewise.
4450 * supergraph.cc (superedge::dump): Likewise.
4451 * svalue.cc (svalue::to_json): Likewise.
4453 2022-07-07 David Malcolm <dmalcolm@redhat.com>
4455 * checker-path.cc (start_cfg_edge_event::get_desc): Update for
4456 superedge::get_description returning a label_text.
4457 * engine.cc (feasibility_state::maybe_update_for_edge): Likewise.
4458 * supergraph.cc (superedge::dump): Likewise.
4459 (superedge::get_description): Convert return type from char * to
4461 * supergraph.h (superedge::get_description): Likewise.
4463 2022-07-07 David Malcolm <dmalcolm@redhat.com>
4465 * call-info.cc (call_info::print): Update for removal of
4466 label_text::maybe_free in favor of automatic memory management.
4467 * checker-path.cc (checker_event::dump): Likewise.
4468 (checker_event::prepare_for_emission): Likewise.
4469 (state_change_event::get_desc): Likewise.
4470 (superedge_event::should_filter_p): Likewise.
4471 (start_cfg_edge_event::get_desc): Likewise.
4472 (warning_event::get_desc): Likewise.
4473 (checker_path::dump): Likewise.
4474 (checker_path::debug): Likewise.
4475 * diagnostic-manager.cc
4476 (diagnostic_manager::prune_for_sm_diagnostic): Likewise.
4477 (diagnostic_manager::prune_interproc_events): Likewise.
4478 * program-state.cc (sm_state_map::to_json): Likewise.
4479 * region.cc (region::to_json): Likewise.
4480 * sm-malloc.cc (inform_nonnull_attribute): Likewise.
4481 * store.cc (binding_map::to_json): Likewise.
4482 (store::to_json): Likewise.
4483 * svalue.cc (svalue::to_json): Likewise.
4485 2022-07-07 David Malcolm <dmalcolm@redhat.com>
4488 * sm-taint.cc (taint_state_machine::on_stmt): Move handling of
4489 assignments from division to...
4490 (taint_state_machine::check_for_tainted_divisor): ...this new
4491 function. Reject warning when the divisor is known to be non-zero.
4492 * sm.cc: Include "analyzer/program-state.h".
4493 (sm_context::get_old_region_model): New.
4494 * sm.h (sm_context::get_old_region_model): New decl.
4496 2022-07-06 Immad Mir <mirimmad@outlook.com>
4499 * sm-fd.cc (fd_state_machine): Change ordering of initialization
4500 of state m_invalid so that the order of initializers is same as
4501 the ordering of the fields in the class decl.
4503 2022-07-06 Immad Mir <mirimmad@outlook.com>
4505 * sm-fd.cc (use_after_close): save the "close" event and
4506 show it where possible.
4508 2022-07-06 David Malcolm <dmalcolm@redhat.com>
4511 * region-model.cc (within_short_circuited_stmt_p): Move extraction
4512 of assign_stmt to caller.
4513 (due_to_ifn_deferred_init_p): New.
4514 (region_model::check_for_poison): Move extraction of assign_stmt
4515 from within_short_circuited_stmt_p to here. Share logic with
4516 call to due_to_ifn_deferred_init_p.
4518 2022-07-02 Tim Lange <mail@tim-lange.me>
4521 * analyzer.opt: Added Wanalyzer-allocation-size.
4522 * checker-path.cc (region_creation_event::get_desc): Added call to new
4523 virtual function pending_diagnostic::describe_region_creation_event.
4524 * checker-path.h: Added region_creation_event::get_desc.
4525 * diagnostic-manager.cc (diagnostic_manager::add_event_on_final_node):
4527 * diagnostic-manager.h:
4528 Added diagnostic_manager::add_event_on_final_node.
4529 * pending-diagnostic.h (struct region_creation): New event_desc struct.
4530 (pending_diagnostic::describe_region_creation_event): Added virtual
4531 function to overwrite description of a region creation.
4532 * region-model.cc (class dubious_allocation_size): New class.
4533 (capacity_compatible_with_type): New helper function.
4534 (class size_visitor): New class.
4535 (struct_or_union_with_inheritance_p): New helper function.
4536 (is_any_cast_p): New helper function.
4537 (region_model::check_region_size): New function.
4538 (region_model::set_value): Added call to
4539 region_model::check_region_size.
4540 * region-model.h (class region_model): New function check_region_size.
4541 * svalue.cc (region_svalue::accept): Changed to post-order traversal.
4542 (initial_svalue::accept): Likewise.
4543 (unaryop_svalue::accept): Likewise.
4544 (binop_svalue::accept): Likewise.
4545 (sub_svalue::accept): Likewise.
4546 (repeated_svalue::accept): Likewise.
4547 (bits_within_svalue::accept): Likewise.
4548 (widening_svalue::accept): Likewise.
4549 (unmergeable_svalue::accept): Likewise.
4550 (compound_svalue::accept): Likewise.
4551 (conjured_svalue::accept): Likewise.
4552 (asm_output_svalue::accept): Likewise.
4553 (const_fn_result_svalue::accept): Likewise.
4555 2022-07-02 Immad Mir <mirimmad17@gmail.com>
4558 * analyzer.opt (Wanalyzer-fd-leak): New option.
4559 (Wanalyzer-fd-access-mode-mismatch): New option.
4560 (Wanalyzer-fd-use-without-check): New option.
4561 (Wanalyzer-fd-double-close): New option.
4562 (Wanalyzer-fd-use-after-close): New option.
4563 * sm.h (make_fd_state_machine): New decl.
4564 * sm.cc (make_checkers): Call make_fd_state_machine.
4565 * sm-fd.cc: New file.
4567 2022-06-24 David Malcolm <dmalcolm@redhat.com>
4569 * call-string.cc: Add includes of "analyzer/analyzer.h"
4570 and "analyzer/analyzer-logging.h".
4571 (call_string::call_string): Delete copy ctor.
4572 (call_string::operator=): Delete.
4573 (call_string::operator==): Delete.
4574 (call_string::hash): Delete.
4575 (call_string::push_call): Make const, returning the resulting
4577 (call_string::pop): Delete.
4578 (call_string::cmp_ptr_ptr): New.
4579 (call_string::validate): Assert that m_parent is non-NULL, or
4580 m_elements is empty.
4581 (call_string::call_string): Move default ctor here from
4582 call-string.h and reimplement. Add ctor taking a parent
4584 (call_string::~call_string): New.
4585 (call_string::recursive_log): New.
4586 * call-string.h (call_string::call_string): Move default ctor's
4587 defn to call-string.cc. Delete copy ctor. Add ctor taking a
4588 parent and an element.
4589 (call_string::operator=): Delete.
4590 (call_string::operator==): Delete.
4591 (call_string::hash): Delete.
4592 (call_string::push_call): Make const, returning the resulting
4594 (call_string::pop): Delete decl.
4595 (call_string::get_parent): New.
4596 (call_string::cmp_ptr_ptr): New decl.
4597 (call_string::get_top_of_stack): New.
4598 (struct call_string::hashmap_traits_t): New.
4599 (class call_string): Add friend class region_model_manager. Add
4600 DISABLE_COPY_AND_ASSIGN.
4601 (call_string::~call_string): New decl.
4602 (call_string::recursive_log): New decl.
4603 (call_string::m_parent): New field.
4604 (call_string::m_children): New field.
4605 * constraint-manager.cc (selftest::test_many_constants): Pass
4606 model manager to program_point::origin.
4607 * engine.cc (exploded_graph::exploded_graph): Likewise.
4608 (exploded_graph::add_function_entry): Likewise for
4609 program_point::from_function_entry.
4610 (add_tainted_args_callback): Likewise.
4611 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
4612 Update for change to program_point.get_call_string.
4613 (exploded_graph::process_node): Likewise.
4614 (class function_call_string_cluster): Convert m_cs from a
4615 call_string to a const call_string &.
4616 (struct function_call_string): Likewise.
4617 (pod_hash_traits<function_call_string>::hash): Use pointer_hash
4619 (pod_hash_traits<function_call_string>::equal): Update for change
4621 (root_cluster::add_node): Update for change to
4622 function_call_string.
4623 (viz_callgraph_node::dump_dot): Update for change to call_string.
4624 * exploded-graph.h (per_call_string_data::m_key): Convert to a
4626 (struct eg_call_string_hash_map_traits): Delete.
4627 (exploded_graph::call_string_data_map_t): Remove traits class.
4628 * program-point.cc: Move include of "analyzer/call-string.h" to
4629 after "analyzer/analyzer-logging.h".
4630 (program_point::print): Update for conversion of m_call_string to
4632 (program_point::to_json): Likewise.
4633 (program_point::push_to_call_stack): Update for immutability of
4635 (program_point::pop_from_call_stack): Likewise.
4636 (program_point::hash): Use pointer hashing for m_call_string.
4637 (program_point::get_function_at_depth): Update for change to
4639 (program_point::validate): Update for changes to call_string.
4640 (program_point::on_edge): Likewise.
4641 (program_point::origin): Move here from call-string.h. Add
4642 region_model_manager param and use it to get empty call string.
4643 (program_point::from_function_entry): Likewise.
4644 (selftest::test_function_point_ordering): Likewise.
4645 (selftest::test_function_point_ordering): Likewise.
4646 * program-point.h (program_point::program_point): Update for
4647 change to m_call_string.
4648 (program_point::get_call_string): Likewise.
4649 (program_point::get_stack_depth): Likewise.
4650 (program_point::origin): Add region_model_manager param, and move
4651 defn to call-string.cc.
4652 (program_point::from_function_entry): Likewise.
4653 (program_point::empty): Drop call_string.
4654 (program_point::deleted): Likewise.
4655 (program_point::program_point): New private ctor.
4656 (program_point::m_call_string): Convert from call_string to const
4658 * program-state.cc (selftest::test_program_state_merging): Update
4659 for call_string changes.
4660 (selftest::test_program_state_merging_2): Likewise.
4661 * region-model-manager.cc
4662 (region_model_manager::region_model_manager): Construct
4663 m_empty_call_string.
4664 (region_model_manager::log_stats): Log the call strings.
4665 * region-model.cc (assert_region_models_merge): Pass the
4666 region_model_manager when creating program_point instances.
4667 (selftest::test_state_merging): Likewise.
4668 (selftest::test_constraint_merging): Likewise.
4669 (selftest::test_widening_constraints): Likewise.
4670 (selftest::test_iteration_1): Likewise.
4671 * region-model.h (region_model_manager::get_empty_call_string):
4673 (region_model_manager::m_empty_call_string): New.
4674 * sm-signal.cc (register_signal_handler::impl_transition): Update
4675 for changes to call_string.
4677 2022-06-24 David Malcolm <dmalcolm@redhat.com>
4679 * call-string.cc (call_string::calc_recursion_depth): Whitespace
4681 (call_string::cmp): Likewise.
4682 (call_string::get_caller_node): Likewise.
4683 (call_string::validate): Likewise.
4684 * engine.cc (dynamic_call_info_t::add_events_to_path): Likewise.
4685 (exploded_graph::get_per_function_data): Likewise.
4686 (exploded_graph::maybe_create_dynamic_call): Likewise.
4687 (exploded_graph::maybe_create_dynamic_call): Likewise.
4688 (exploded_graph::process_node): Likewise.
4690 2022-06-16 David Malcolm <dmalcolm@redhat.com>
4692 * varargs.cc (va_arg_type_mismatch::emit): Associate the warning
4693 with CWE-686 ("Function Call With Incorrect Argument Type").
4695 2022-06-16 David Malcolm <dmalcolm@redhat.com>
4697 * varargs.cc: Include "diagnostic-metadata.h".
4698 (va_list_exhausted::emit): Associate the warning with
4699 CWE-685 ("Function Call With Incorrect Number of Arguments").
4701 2022-06-16 David Malcolm <dmalcolm@redhat.com>
4703 * sm-file.cc (double_fclose::emit): Associate the warning with
4704 CWE-1341 ("Multiple Releases of Same Resource or Handle").
4706 2022-06-15 David Malcolm <dmalcolm@redhat.com>
4709 * analyzer.opt (fanalyzer-undo-inlining): New option.
4710 * checker-path.cc: Include "diagnostic-core.h" and
4711 "inlining-iterator.h".
4712 (event_kind_to_string): Handle EK_INLINED_CALL.
4713 (class inlining_info): New class.
4714 (checker_event::checker_event): Move here from checker-path.h.
4715 Store original fndecl and depth, and calculate effective fndecl
4716 and depth based on inlining information.
4717 (checker_event::dump): Emit original depth as well as effective
4718 depth when they differ; likewise for fndecl.
4719 (region_creation_event::get_desc): Use m_effective_fndecl.
4720 (inlined_call_event::get_desc): New.
4721 (inlined_call_event::get_meaning): New.
4722 (checker_path::inject_any_inlined_call_events): New.
4723 * checker-path.h (enum event_kind): Add EK_INLINED_CALL.
4724 (checker_event::checker_event): Make protected, and move
4725 definition to checker-path.cc.
4726 (checker_event::get_fndecl): Use effective fndecl.
4727 (checker_event::get_stack_depth): Use effective stack depth.
4728 (checker_event::get_logical_location): Use effective stack depth.
4729 (checker_event::get_original_stack_depth): New.
4730 (checker_event::m_fndecl): Rename to...
4731 (checker_event::m_original_fndecl): ...this.
4732 (checker_event::m_depth): Rename to...
4733 (checker_event::m_original_depth): ...this.
4734 (checker_event::m_effective_fndecl): New field.
4735 (checker_event::m_effective_depth): New field.
4736 (class inlined_call_event): New checker_event subclass.
4737 (checker_path::inject_any_inlined_call_events): New decl.
4738 * diagnostic-manager.cc: Include "inlining-iterator.h".
4739 (diagnostic_manager::emit_saved_diagnostic): Call
4740 checker_path::inject_any_inlined_call_events.
4741 (diagnostic_manager::prune_for_sm_diagnostic): Handle
4743 * engine.cc (tainted_args_function_custom_event::get_desc): Use
4745 * inlining-iterator.h: New file.
4747 2022-06-15 David Malcolm <dmalcolm@redhat.com>
4749 * diagnostic-manager.cc (saved_diagnostic::dump_dot_id): New.
4750 (saved_diagnostic::dump_as_dot_node): New.
4751 * diagnostic-manager.h (saved_diagnostic::dump_dot_id): New decl.
4752 (saved_diagnostic::dump_as_dot_node): New decl.
4753 * engine.cc (exploded_node::dump_dot): Add nodes for saved
4756 2022-06-02 David Malcolm <dmalcolm@redhat.com>
4758 * checker-path.cc (checker_event::get_meaning): New.
4759 (function_entry_event::get_meaning): New.
4760 (state_change_event::get_desc): Add dump of meaning of the event
4761 to the -fanalyzer-verbose-state-changes output.
4762 (state_change_event::get_meaning): New.
4763 (cfg_edge_event::get_meaning): New.
4764 (call_event::get_meaning): New.
4765 (return_event::get_meaning): New.
4766 (start_consolidated_cfg_edges_event::get_meaning): New.
4767 (warning_event::get_meaning): New.
4768 * checker-path.h: Include "tree-logical-location.h".
4769 (checker_event::checker_event): Construct m_logical_loc.
4770 (checker_event::get_logical_location): New.
4771 (checker_event::get_meaning): New decl.
4772 (checker_event::m_logical_loc): New.
4773 (function_entry_event::get_meaning): New decl.
4774 (state_change_event::get_meaning): New decl.
4775 (cfg_edge_event::get_meaning): New decl.
4776 (call_event::get_meaning): New decl.
4777 (return_event::get_meaning): New decl.
4778 (start_consolidated_cfg_edges_event::get_meaning): New.
4779 (warning_event::get_meaning): New decl.
4780 * pending-diagnostic.h: Include "diagnostic-path.h".
4781 (pending_diagnostic::get_meaning_for_state_change): New vfunc.
4782 * sm-file.cc (file_diagnostic::get_meaning_for_state_change): New
4784 * sm-malloc.cc (malloc_diagnostic::get_meaning_for_state_change):
4787 (exposure_through_output_file::get_meaning_for_state_change):
4789 * sm-taint.cc (taint_diagnostic::get_meaning_for_state_change):
4792 (va_list_sm_diagnostic::get_meaning_for_state_change): Likewise.
4794 2022-05-23 David Malcolm <dmalcolm@redhat.com>
4796 * call-info.cc: Add "final" and "override" to all vfunc
4797 implementations that were missing them, as appropriate.
4798 * engine.cc: Likewise.
4799 * region-model.cc: Likewise.
4800 * sm-malloc.cc: Likewise.
4801 * supergraph.h: Likewise.
4802 * svalue.cc: Likewise.
4803 * varargs.cc: Likewise.
4805 2022-05-20 David Malcolm <dmalcolm@redhat.com>
4807 * analyzer-pass.cc: Replace uses of "FINAL" and "OVERRIDE" with
4808 "final" and "override".
4809 * call-info.h: Likewise.
4810 * checker-path.h: Likewise.
4811 * constraint-manager.cc: Likewise.
4812 * diagnostic-manager.cc: Likewise.
4813 * engine.cc: Likewise.
4814 * exploded-graph.h: Likewise.
4815 * feasible-graph.h: Likewise.
4816 * pending-diagnostic.h: Likewise.
4817 * region-model-impl-calls.cc: Likewise.
4818 * region-model.cc: Likewise.
4819 * region-model.h: Likewise.
4820 * region.h: Likewise.
4821 * sm-file.cc: Likewise.
4822 * sm-malloc.cc: Likewise.
4823 * sm-pattern-test.cc: Likewise.
4824 * sm-sensitive.cc: Likewise.
4825 * sm-signal.cc: Likewise.
4826 * sm-taint.cc: Likewise.
4827 * state-purge.h: Likewise.
4828 * store.cc: Likewise.
4829 * store.h: Likewise.
4830 * supergraph.h: Likewise.
4831 * svalue.h: Likewise.
4832 * trimmed-graph.h: Likewise.
4833 * varargs.cc: Likewise.
4835 2022-05-16 David Malcolm <dmalcolm@redhat.com>
4838 * analyzer.cc (make_label_text_n): New.
4839 * analyzer.h (class var_arg_region): New forward decl.
4840 (make_label_text_n): New decl.
4841 * analyzer.opt (Wanalyzer-va-arg-type-mismatch): New option.
4842 (Wanalyzer-va-list-exhausted): New option.
4843 (Wanalyzer-va-list-leak): New option.
4844 (Wanalyzer-va-list-use-after-va-end): New option.
4845 * checker-path.cc (call_event::get_desc): Split out decl access
4847 (call_event::get_caller_fndecl): ...this new function and...
4848 (call_event::get_callee_fndecl): ...this new function.
4849 * checker-path.h (call_event::get_desc): Drop "FINAL".
4850 (call_event::get_caller_fndecl): New decl.
4851 (call_event::get_callee_fndecl): New decl.
4852 (class call_event): Make fields protected.
4853 * diagnostic-manager.cc (null_assignment_sm_context::warn): New
4855 (null_assignment_sm_context::get_new_program_state): New.
4856 (diagnostic_manager::add_events_for_superedge): Move case
4857 SUPEREDGE_CALL to a new pending_diagnostic::add_call_event vfunc.
4858 * engine.cc (impl_sm_context::warn): Implement new override.
4859 (impl_sm_context::get_new_program_state): New.
4860 * pending-diagnostic.cc: Include "analyzer/diagnostic-manager.h",
4861 "cpplib.h", "digraph.h", "ordered-hash-map.h", "cfg.h",
4862 "basic-block.h", "gimple.h", "gimple-iterator.h", "cgraph.h"
4863 "analyzer/supergraph.h", "analyzer/program-state.h",
4864 "alloc-pool.h", "fibonacci_heap.h", "shortest-paths.h",
4865 "sbitmap.h", "analyzer/exploded-graph.h", "diagnostic-path.h",
4866 and "analyzer/checker-path.h".
4868 (fixup_location_in_macro_p): New.
4869 (pending_diagnostic::fixup_location): New.
4870 (pending_diagnostic::add_call_event): New.
4871 * pending-diagnostic.h (pending_diagnostic::fixup_location): Drop
4872 no-op inline implementation in favor of the more complex
4873 implementation above.
4874 (pending_diagnostic::add_call_event): New vfunc.
4875 * region-model-impl-calls.cc: Include "analyzer/sm.h",
4876 "diagnostic-path.h", and "analyzer/pending-diagnostic.h".
4877 * region-model-manager.cc
4878 (region_model_manager::get_var_arg_region): New.
4879 (region_model_manager::log_stats): Log m_var_arg_regions.
4880 * region-model.cc (region_model::on_call_pre): Handle IFN_VA_ARG,
4881 BUILT_IN_VA_START, and BUILT_IN_VA_COPY.
4882 (region_model::on_call_post): Handle BUILT_IN_VA_END.
4883 (region_model::get_representative_path_var_1): Handle RK_VAR_ARG.
4884 (region_model::push_frame): Push variadic arguments.
4885 * region-model.h (region_model_manager::get_var_arg_region): New
4887 (region_model_manager::m_var_arg_regions): New field.
4888 (region_model::impl_call_va_start): New decl.
4889 (region_model::impl_call_va_copy): New decl.
4890 (region_model::impl_call_va_arg): New decl.
4891 (region_model::impl_call_va_end): New decl.
4892 * region.cc (alloca_region::dump_to_pp): Dump the id.
4893 (var_arg_region::dump_to_pp): New.
4894 (var_arg_region::get_frame_region): New.
4895 * region.h (enum region_kind): Add RK_VAR_ARG.
4896 (region::dyn_cast_var_arg_region): New.
4897 (class var_arg_region): New.
4898 (is_a_helper <const var_arg_region *>::test): New.
4899 (struct default_hash_traits<var_arg_region::key_t>): New.
4900 * sm.cc (make_checkers): Call make_va_list_state_machine.
4901 * sm.h (sm_context::warn): New vfunc.
4902 (sm_context::get_old_svalue): Drop unused decl.
4903 (sm_context::get_new_program_state): New vfunc.
4904 (make_va_list_state_machine): New decl.
4905 * varargs.cc: New file.
4907 2022-05-16 Martin Liska <mliska@suse.cz>
4909 * engine.cc (exploded_node::get_dot_fillcolor): Use ARRAY_SIZE.
4910 * function-set.cc (test_stdio_example): Likewise.
4911 * sm-file.cc (get_file_using_fns): Likewise.
4912 * sm-malloc.cc (malloc_state_machine::unaffected_by_call_p): Likewise.
4913 * sm-signal.cc (get_async_signal_unsafe_fns): Likewise.
4915 2022-05-13 Richard Biener <rguenther@suse.de>
4917 * supergraph.cc: Re-order gimple-fold.h include.
4919 2022-05-11 David Malcolm <dmalcolm@redhat.com>
4921 * checker-path.cc (state_change_event::get_desc): Call maybe_free
4922 on label_text temporaries.
4923 * diagnostic-manager.cc
4924 (diagnostic_manager::prune_for_sm_diagnostic): Likewise.
4925 * engine.cc (exploded_graph::~exploded_graph): Fix leak of
4926 m_per_point_data and m_per_call_string_data values. Simplify
4927 cleanup of m_per_function_stats and m_per_point_data values.
4928 (feasibility_state::maybe_update_for_edge): Fix leak of result of
4929 superedge::get_description.
4930 * region-model-manager.cc
4931 (region_model_manager::~region_model_manager): Move cleanup of
4932 m_setjmp_values to match the ordering of the fields within
4933 region_model_manager. Fix leak of values within
4934 m_repeated_values_map, m_bits_within_values_map,
4935 m_asm_output_values_map, and m_const_fn_result_values_map.
4937 2022-04-28 David Malcolm <dmalcolm@redhat.com>
4940 * store.cc (binding_cluster::get_any_binding): Handle accessing
4941 sub_svalues of clusters where the base region has a symbolic
4944 2022-04-28 David Malcolm <dmalcolm@redhat.com>
4946 * diagnostic-manager.cc (epath_finder::process_worklist_item):
4947 Call dump_feasible_path when a path that reaches the the target
4949 (epath_finder::dump_feasible_path): New.
4950 * engine.cc (feasibility_state::dump_to_pp): New.
4951 * exploded-graph.h (feasibility_state::dump_to_pp): New decl.
4952 * feasible-graph.cc (feasible_graph::dump_feasible_path): New.
4953 * feasible-graph.h (feasible_graph::dump_feasible_path): New
4955 * program-point.cc (function_point::print): Fix missing trailing
4957 * program-point.h (program_point::print_source_line): Remove
4960 2022-04-25 David Malcolm <dmalcolm@redhat.com>
4965 (cmp_cst): Rename to...
4966 (cmp_csts_same_type): ...this. Convert all recursive calls to
4968 (cmp_csts_and_types): ....this new function.
4969 (svalue::cmp_ptr): Update for renaming of cmp_cst
4971 2022-04-14 David Malcolm <dmalcolm@redhat.com>
4974 * region-model-reachability.cc (reachable_regions::handle_parm):
4975 Use maybe_get_deref_base_region rather than just region_svalue, to
4976 handle pointer arithmetic also.
4977 * svalue.cc (svalue::maybe_get_deref_base_region): New.
4978 * svalue.h (svalue::maybe_get_deref_base_region): New decl.
4980 2022-04-14 David Malcolm <dmalcolm@redhat.com>
4983 * svalue.cc (cmp_cst): When comparing VECTOR_CSTs, compare the
4984 types of the encoded elements before calling cmp_cst on them.
4986 2022-04-09 David Malcolm <dmalcolm@redhat.com>
4989 * region-model-manager.cc
4990 (region_model_manager::get_unknown_symbolic_region): New,
4992 (region_model_manager::get_field_region): ...here.
4993 (region_model_manager::get_element_region): Use it here.
4994 (region_model_manager::get_offset_region): Likewise.
4995 (region_model_manager::get_sized_region): Likewise.
4996 (region_model_manager::get_cast_region): Likewise.
4997 (region_model_manager::get_bit_range): Likewise.
4999 (region_model_manager::get_unknown_symbolic_region): New decl.
5000 * region.cc (symbolic_region::symbolic_region): Handle sval_ptr
5002 (symbolic_region::dump_to_pp): Handle having NULL type.
5004 2022-04-07 David Malcolm <dmalcolm@redhat.com>
5007 * store.cc (binding_map::remove_overlapping_bindings): Add
5008 "always_overlap" param, using it to generalize to the case where
5009 we want to remove all bindings. Update "uncertainty" logic to
5010 only record maybe-bound values for cases where there is a symbolic
5012 (binding_cluster::mark_region_as_unknown): Split param "reg" into
5013 "reg_to_bind" and "reg_for_overlap".
5014 (binding_cluster::maybe_get_compound_binding): Pass "false" to
5015 binding_map::remove_overlapping_bindings new "always_overlap" param.
5016 (binding_cluster::remove_overlapping_bindings): Determine
5017 "always_overlap" and pass it to
5018 binding_map::remove_overlapping_bindings.
5019 (store::set_value): Pass uncertainty to remove_overlapping_bindings
5020 call. Update for new param of
5021 binding_cluster::mark_region_as_unknown, passing both the base
5022 region of the iter_cluster, and the lhs_reg.
5023 (store::mark_region_as_unknown): Update for new param of
5024 binding_cluster::mark_region_as_unknown, passing "reg" for both.
5025 (store::remove_overlapping_bindings): Add param "uncertainty", and
5026 pass it on to call to
5027 binding_cluster::remove_overlapping_bindings.
5028 * store.h (binding_map::remove_overlapping_bindings): Add
5029 "always_overlap" param.
5030 (binding_cluster::mark_region_as_unknown): Split param "reg" into
5031 "reg_to_bind" and "reg_for_overlap".
5032 (store::remove_overlapping_bindings): Add param "uncertainty".
5034 2022-03-29 David Malcolm <dmalcolm@redhat.com>
5037 * region-model-manager.cc (dump_untracked_region): Skip decls in
5040 2022-03-29 David Malcolm <dmalcolm@redhat.com>
5043 * analyzer.h (class conjured_purge): New forward decl.
5044 * region-model-asm.cc (region_model::on_asm_stmt): Add
5045 conjured_purge param to calls binding_cluster::on_asm and
5046 region_model_manager::get_or_create_conjured_svalue.
5047 * region-model-impl-calls.cc
5048 (call_details::get_or_create_conjured_svalue): Likewise for call
5049 to region_model_manager::get_or_create_conjured_svalue.
5050 (region_model::impl_call_fgets): Remove call to
5051 region_model::purge_state_involving, as this is now done
5052 implicitly by call_details::get_or_create_conjured_svalue.
5053 (region_model::impl_call_fread): Likewise.
5054 (region_model::impl_call_strchr): Pass conjured_purge param to
5055 call to region_model_manager::get_or_create_conjured_svalue.
5056 * region-model-manager.cc (conjured_purge::purge): New.
5057 (region_model_manager::get_or_create_conjured_svalue): Add
5058 param "p". Use it to purge state when reusing an existing
5060 * region-model.cc (region_model::on_call_pre): Replace call to
5061 region_model::purge_state_involving with passing conjured_purge
5062 to region_model_manager::get_or_create_conjured_svalue.
5063 (region_model::handle_unrecognized_call): Pass conjured_purge to
5064 store::on_unknown_fncall.
5066 (region_model_manager::get_or_create_conjured_svalue): Add param
5068 * store.cc (binding_cluster::on_unknown_fncall): Likewise. Pass
5069 it on to region_model_manager::get_or_create_conjured_svalue.
5070 (binding_cluster::on_asm): Likewise.
5071 (store::on_unknown_fncall): Add param "p" and pass it on to
5072 binding_cluster::on_unknown_fncall.
5073 * store.h (binding_cluster::on_unknown_fncall): Add param p.
5074 (binding_cluster::on_asm): Likewise.
5075 (store::on_unknown_fncall): Likewise.
5076 * svalue.h (class conjured_purge): New.
5078 2022-03-29 David Malcolm <dmalcolm@redhat.com>
5081 * region.cc (ipa_ref_requires_tracking): Drop "context_fndecl",
5082 instead using the ref->referring to get the cgraph node of the
5084 (symnode_requires_tracking_p): Likewise.
5086 2022-03-26 David Malcolm <dmalcolm@redhat.com>
5089 * store.cc (binding_cluster::make_unknown_relative_to): Reject
5090 attempts to create a cluster for untracked base regions.
5091 (store::set_value): Likewise.
5092 (store::fill_region): Likewise.
5093 (store::mark_region_as_unknown): Likewise.
5095 2022-03-25 David Malcolm <dmalcolm@redhat.com>
5098 * analyzer.opt (-fdump-analyzer-untracked): New option.
5099 * engine.cc (impl_run_checkers): Handle it.
5100 * region-model-asm.cc (region_model::on_asm_stmt): Don't attempt
5101 to clobber regions with !tracked_p ().
5102 * region-model-manager.cc (dump_untracked_region): New.
5103 (region_model_manager::dump_untracked_regions): New.
5104 (frame_region::dump_untracked_regions): New.
5105 * region-model.h (region_model_manager::dump_untracked_regions):
5107 * region.cc (ipa_ref_requires_tracking): New.
5108 (symnode_requires_tracking_p): New.
5109 (decl_region::calc_tracked_p): New.
5110 * region.h (region::tracked_p): New vfunc.
5111 (frame_region::dump_untracked_regions): New decl.
5112 (class decl_region): Note that this is also used fo SSA names.
5113 (decl_region::decl_region): Initialize m_tracked.
5114 (decl_region::tracked_p): New.
5115 (decl_region::calc_tracked_p): New decl.
5116 (decl_region::m_tracked): New.
5117 * store.cc (store::get_or_create_cluster): Assert that we
5118 don't try to create clusters for base regions that aren't
5120 (store::mark_as_escaped): Don't mark base regions that we're not
5123 2022-03-23 David Malcolm <dmalcolm@redhat.com>
5126 * engine.cc (impl_run_checkers): Create the engine after the
5127 supergraph, and pass the supergraph to the engine.
5128 * region-model.cc (region_model::get_lvalue_1): Pass ctxt to
5129 frame_region::get_region_for_local.
5130 (region_model::update_for_return_gcall): Pass the lvalue for the
5131 result to pop_frame as a tree, rather than as a region.
5132 (region_model::pop_frame): Update for above change, determining
5133 the destination region after the frame is popped and thus with
5134 respect to the caller frame rather than the called frame.
5135 Likewise, set the value of the region to the return value after
5136 the frame is popped.
5137 (engine::engine): Add supergraph pointer.
5138 (selftest::test_stack_frames): Set the DECL_CONTECT of PARM_DECLs.
5139 (selftest::test_get_representative_path_var): Likewise.
5140 (selftest::test_state_merging): Likewise.
5141 * region-model.h (region_model::pop_frame): Convert first param
5142 from a const region * to a tree.
5143 (engine::engine): Add param "sg".
5144 (engine::m_sg): New field.
5145 * region.cc: Include "analyzer/sm.h" and
5146 "analyzer/program-state.h".
5147 (frame_region::get_region_for_local): Add "ctxt" param.
5148 Add assertions that VAR_DECLs are locals, and that expr is for the
5150 * region.h (frame_region::get_region_for_local): Add "ctxt" param.
5152 2022-03-23 David Malcolm <dmalcolm@redhat.com>
5155 * sm-taint.cc (taint_diagnostic::subclass_equal_p): Check
5156 m_has_bounds as well as m_arg.
5157 (tainted_allocation_size::subclass_equal_p): Chain up to base
5158 class implementation. Also check m_mem_space.
5159 (tainted_allocation_size::emit): Add note showing stack-based vs
5160 heap-based allocations.
5162 2022-03-23 David Malcolm <dmalcolm@redhat.com>
5165 * diagnostic-manager.cc (diagnostic_manager::add_diagnostic):
5166 Convert return type from "void" to "bool", reporting success vs
5167 failure to caller, for both overloads.
5168 * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
5170 * engine.cc (impl_region_model_context::warn): Propagate return
5171 value from diagnostic_manager::add_diagnostic.
5173 2022-03-18 David Malcolm <dmalcolm@redhat.com>
5178 * analyzer.h (class state_purge_per_decl): New forward decl.
5179 * engine.cc (impl_run_checkers): Pass region_model_manager to
5180 state_purge_map ctor.
5181 * program-point.cc (function_point::final_stmt_p): New.
5182 (function_point::get_next): New.
5183 * program-point.h (function_point::final_stmt_p): New decl.
5184 (function_point::get_next): New decl.
5185 * program-state.cc (program_state::prune_for_point): Generalize to
5186 purge local decls as well as SSA names.
5187 (program_state::can_purge_base_region_p): New.
5188 * program-state.h (program_state::can_purge_base_region_p): New
5190 * region-model.cc (struct append_ssa_names_cb_data): Rename to...
5191 (struct append_regions_cb_data): ...this.
5192 (region_model::get_ssa_name_regions_for_current_frame): Rename
5194 (region_model::get_regions_for_current_frame): ...this, updating
5195 for other renamings.
5196 (region_model::append_ssa_names_cb): Rename to...
5197 (region_model::append_regions_cb): ...this, and drop the requirement
5198 that the subregion be a SSA name.
5199 * region-model.h (struct append_ssa_names_cb_data): Rename decl
5201 (struct append_regions_cb_data): ...this.
5202 (region_model::get_ssa_name_regions_for_current_frame): Rename
5204 (region_model::get_regions_for_current_frame): ...this.
5205 (region_model::append_ssa_names_cb): Rename decl to...
5206 (region_model::append_regions_cb): ...this.
5207 * state-purge.cc: Include "tristate.h", "selftest.h",
5208 "analyzer/store.h", "analyzer/region-model.h", and
5210 (get_candidate_for_purging): New.
5211 (class gimple_op_visitor): New.
5215 (state_purge_map::state_purge_map): Add "mgr" param. Update for
5216 renamings. Find uses of local variables.
5217 (state_purge_map::~state_purge_map): Update for renaming of m_map
5218 to m_ssa_map. Clean up m_decl_map.
5219 (state_purge_map::get_or_create_data_for_decl): New.
5220 (state_purge_per_ssa_name::state_purge_per_ssa_name): Update for
5221 inheriting from state_purge_per_tree.
5222 (state_purge_per_ssa_name::add_to_worklist): Likewise.
5223 (state_purge_per_decl::state_purge_per_decl): New.
5224 (state_purge_per_decl::add_needed_at): New.
5225 (state_purge_per_decl::add_pointed_to_at): New.
5226 (state_purge_per_decl::process_worklists): New.
5227 (state_purge_per_decl::add_to_worklist): New.
5228 (same_binding_p): New.
5229 (fully_overwrites_p): New.
5230 (state_purge_per_decl::process_point_backwards): New.
5231 (state_purge_per_decl::process_point_forwards): New.
5232 (state_purge_per_decl::needed_at_point_p): New.
5233 (state_purge_annotator::print_needed): Generalize to print local
5234 decls as well as SSA names.
5235 * state-purge.h (class state_purge_map): Update leading comment.
5236 (state_purge_map::map_t): Rename to...
5237 (state_purge_map::ssa_map_t): ...this.
5238 (state_purge_map::iterator): Rename to...
5239 (state_purge_map::ssa_iterator): ...this.
5240 (state_purge_map::decl_map_t): New typedef.
5241 (state_purge_map::decl_iterator): New typedef.
5242 (state_purge_map::state_purge_map): Add "mgr" param.
5243 (state_purge_map::get_data_for_ssa_name): Update for renaming.
5244 (state_purge_map::get_any_data_for_decl): New.
5245 (state_purge_map::get_or_create_data_for_decl): New decl.
5246 (state_purge_map::begin): Rename to...
5247 (state_purge_map::begin_ssas): ...this.
5248 (state_purge_map::end): Rename to...
5249 (state_purge_map::end_ssa): ...this.
5250 (state_purge_map::begin_decls): New.
5251 (state_purge_map::end_decls): New.
5252 (state_purge_map::m_map): Rename to...
5253 (state_purge_map::m_ssa_map): ...this.
5254 (state_purge_map::m_decl_map): New field.
5255 (class state_purge_per_tree): New class.
5256 (class state_purge_per_ssa_name): Inherit from state_purge_per_tree.
5257 (state_purge_per_ssa_name::get_function): Move to base class.
5258 (state_purge_per_ssa_name::point_set_t): Likewise.
5259 (state_purge_per_ssa_name::m_fun): Likewise.
5260 (class state_purge_per_decl): New.
5262 2022-03-17 David Malcolm <dmalcolm@redhat.com>
5264 * state-purge.cc (state_purge_annotator::add_node_annotations):
5265 Avoid duplicate before-supernode annotations when returning from
5266 an interprocedural call. Show after-supernode annotations.
5268 2022-03-17 David Malcolm <dmalcolm@redhat.com>
5270 * program-point.cc (program_point::get_next): Fix missing
5273 2022-03-16 David Malcolm <dmalcolm@redhat.com>
5276 * diagnostic-manager.cc (get_emission_location): New.
5277 (diagnostic_manager::diagnostic_manager): Initialize
5278 m_num_disabled_diagnostics.
5279 (diagnostic_manager::add_diagnostic): Reject diagnostics that
5280 will eventually be rejected due to being disabled.
5281 (diagnostic_manager::emit_saved_diagnostics): Log the number
5282 of disabled diagnostics.
5283 (diagnostic_manager::emit_saved_diagnostic): Split out logic for
5284 determining emission location to get_emission_location.
5285 * diagnostic-manager.h
5286 (diagnostic_manager::m_num_disabled_diagnostics): New field.
5287 * engine.cc (stale_jmp_buf::get_controlling_option): New.
5288 (stale_jmp_buf::emit): Use it.
5289 * pending-diagnostic.h
5290 (pending_diagnostic::get_controlling_option): New vfunc.
5292 (poisoned_value_diagnostic::get_controlling_option): New.
5293 (poisoned_value_diagnostic::emit): Use it.
5294 (shift_count_negative_diagnostic::get_controlling_option): New.
5295 (shift_count_negative_diagnostic::emit): Use it.
5296 (shift_count_overflow_diagnostic::get_controlling_option): New.
5297 (shift_count_overflow_diagnostic::emit): Use it.
5298 (dump_path_diagnostic::get_controlling_option): New.
5299 (dump_path_diagnostic::emit): Use it.
5300 (write_to_const_diagnostic::get_controlling_option): New.
5301 (write_to_const_diagnostic::emit): Use it.
5302 (write_to_string_literal_diagnostic::get_controlling_option): New.
5303 (write_to_string_literal_diagnostic::emit): Use it.
5304 * sm-file.cc (double_fclose::get_controlling_option): New.
5305 (double_fclose::emit): Use it.
5306 (file_leak::get_controlling_option): New.
5307 (file_leak::emit): Use it.
5308 * sm-malloc.cc (mismatching_deallocation::get_controlling_option):
5310 (mismatching_deallocation::emit): Use it.
5311 (double_free::get_controlling_option): New.
5312 (double_free::emit): Use it.
5313 (possible_null_deref::get_controlling_option): New.
5314 (possible_null_deref::emit): Use it.
5315 (possible_null_arg::get_controlling_option): New.
5316 (possible_null_arg::emit): Use it.
5317 (null_deref::get_controlling_option): New.
5318 (null_deref::emit): Use it.
5319 (null_arg::get_controlling_option): New.
5320 (null_arg::emit): Use it.
5321 (use_after_free::get_controlling_option): New.
5322 (use_after_free::emit): Use it.
5323 (malloc_leak::get_controlling_option): New.
5324 (malloc_leak::emit): Use it.
5325 (free_of_non_heap::get_controlling_option): New.
5326 (free_of_non_heap::emit): Use it.
5327 * sm-pattern-test.cc (pattern_match::get_controlling_option): New.
5328 (pattern_match::emit): Use it.
5330 (exposure_through_output_file::get_controlling_option): New.
5331 (exposure_through_output_file::emit): Use it.
5332 * sm-signal.cc (signal_unsafe_call::get_controlling_option): New.
5333 (signal_unsafe_call::emit): Use it.
5334 * sm-taint.cc (tainted_array_index::get_controlling_option): New.
5335 (tainted_array_index::emit): Use it.
5336 (tainted_offset::get_controlling_option): New.
5337 (tainted_offset::emit): Use it.
5338 (tainted_size::get_controlling_option): New.
5339 (tainted_size::emit): Use it.
5340 (tainted_divisor::get_controlling_option): New.
5341 (tainted_divisor::emit): Use it.
5342 (tainted_allocation_size::get_controlling_option): New.
5343 (tainted_allocation_size::emit): Use it.
5345 2022-03-15 David Malcolm <dmalcolm@redhat.com>
5347 * store.cc (store::store): Presize m_cluster_map.
5349 2022-03-10 David Malcolm <dmalcolm@redhat.com>
5352 * constraint-manager.cc (constraint_manager::add_constraint):
5353 Refresh the EC IDs when adding constraints implied by offsets.
5355 2022-03-10 David Malcolm <dmalcolm@redhat.com>
5358 * analyzer.h (class pending_note): New forward decl.
5359 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
5361 (saved_diagnostic::operator==): Compare m_notes.
5362 (saved_diagnostic::add_note): New.
5363 (saved_diagnostic::emit_any_notes): New.
5364 (diagnostic_manager::add_note): New.
5365 (diagnostic_manager::emit_saved_diagnostic): Call emit_any_notes
5366 after emitting the warning.
5367 * diagnostic-manager.h (saved_diagnostic::add_note): New decl.
5368 (saved_diagnostic::emit_any_notes): New decl.
5369 (saved_diagnostic::m_notes): New field.
5370 (diagnostic_manager::add_note): New decl.
5371 * engine.cc (impl_region_model_context::add_note): New.
5372 * exploded-graph.h (impl_region_model_context::add_note): New
5374 * pending-diagnostic.h (class pending_note): New.
5375 (class pending_note_subclass): New template.
5376 * region-model.cc (class reason_attr_access): New.
5377 (check_external_function_for_access_attr): Add class
5378 annotating_ctxt and use it when checking region.
5379 (noop_region_model_context::add_note): New.
5380 * region-model.h (region_model_context::add_note): New vfunc.
5381 (noop_region_model_context::add_note): New decl.
5382 (class region_model_context_decorator): New.
5383 (class note_adding_context): New.
5385 2022-03-10 David Malcolm <dmalcolm@redhat.com>
5389 (region_model::check_external_function_for_access_attr): New.
5390 (region_model::handle_unrecognized_call): Call it.
5392 (region_model::check_external_function_for_access_attr): New decl.
5393 (region_model::handle_unrecognized_call): New decl.
5395 2022-03-10 David Malcolm <dmalcolm@redhat.com>
5397 * sm-taint.cc (taint_state_machine::check_for_tainted_size_arg):
5398 Avoid generating duplicate saved_diagnostics by only handling the
5399 rdwr_map entry for the ptrarg, not the duplicate entry for the
5402 2022-03-07 David Malcolm <dmalcolm@redhat.com>
5405 * engine.cc (returning_from_function_p): New.
5406 (impl_region_model_context::on_state_leak): Use it when rejecting
5407 leaks at the return from "main".
5409 2022-03-07 Jakub Jelinek <jakub@redhat.com>
5411 * store.cc: Fix up duplicated word issue in a comment.
5412 * analyzer.cc: Likewise.
5413 * engine.cc: Likewise.
5414 * sm-taint.cc: Likewise.
5416 2022-03-04 David Malcolm <dmalcolm@redhat.com>
5419 * analyzer.opt (-param=analyzer-max-svalue-depth=): Reduce from 13
5422 2022-02-23 David Malcolm <dmalcolm@redhat.com>
5425 * analyzer.h (class const_fn_result_svalue): New decl.
5426 * region-model-impl-calls.cc (call_details::get_manager): New.
5427 * region-model-manager.cc
5428 (region_model_manager::get_or_create_const_fn_result_svalue): New.
5429 (region_model_manager::log_stats): Log
5430 m_const_fn_result_values_map.
5431 * region-model.cc (const_fn_p): New.
5432 (maybe_get_const_fn_result): New.
5433 (region_model::on_call_pre): Handle fndecls with
5434 __attribute__((const)) by calling the above rather than making
5436 * region-model.h (visitor::visit_const_fn_result_svalue): New.
5437 (region_model_manager::get_or_create_const_fn_result_svalue): New
5439 (region_model_manager::const_fn_result_values_map_t): New typedef.
5440 (region_model_manager::m_const_fn_result_values_map): New field.
5441 (call_details::get_manager): New decl.
5442 * svalue.cc (svalue::cmp_ptr): Handle SK_CONST_FN_RESULT.
5443 (const_fn_result_svalue::dump_to_pp): New.
5444 (const_fn_result_svalue::dump_input): New.
5445 (const_fn_result_svalue::accept): New.
5446 * svalue.h (enum svalue_kind): Add SK_CONST_FN_RESULT.
5447 (svalue::dyn_cast_const_fn_result_svalue): New.
5448 (class const_fn_result_svalue): New.
5449 (is_a_helper <const const_fn_result_svalue *>::test): New.
5450 (template <> struct default_hash_traits<const_fn_result_svalue::key_t>):
5453 2022-02-17 David Malcolm <dmalcolm@redhat.com>
5456 * region-model.cc: Include "calls.h".
5457 (region_model::on_call_pre): Use flags_from_decl_or_type to
5458 generalize check for DECL_PURE_P to also check for ECF_CONST.
5460 2022-02-16 David Malcolm <dmalcolm@redhat.com>
5463 * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
5464 Add region creation events for globals of interest.
5465 (null_assignment_sm_context::get_old_program_state): New.
5466 (diagnostic_manager::add_events_for_eedge): Move check for
5467 changing dynamic extents from PK_BEFORE_STMT case to after the
5468 switch on the dst_point's kind so that we can emit them for the
5469 final stmt in a basic block.
5470 * engine.cc (impl_sm_context::get_old_program_state): New.
5471 * sm-malloc.cc (malloc_state_machine::get_default_state): Rewrite
5472 detection of m_non_heap to use get_memory_space.
5473 (free_of_non_heap::free_of_non_heap): Add freed_reg param.
5474 (free_of_non_heap::subclass_equal_p): Update for changes to
5476 (free_of_non_heap::emit): Drop m_kind in favor of
5478 (free_of_non_heap::describe_state_change): Remove logic for
5480 (free_of_non_heap::mark_interesting_stuff): Add region-creation of
5482 (free_of_non_heap::get_memory_space): New.
5483 (free_of_non_heap::kind): Drop enum.
5484 (free_of_non_heap::m_freed_reg): New field.
5485 (free_of_non_heap::m_kind): Drop field.
5486 (malloc_state_machine::on_stmt): Drop transition to m_non_heap.
5487 (malloc_state_machine::handle_free_of_non_heap): New function,
5488 split out from on_deallocator_call and on_realloc_call, adding
5489 detection of the freed region.
5490 (malloc_state_machine::on_deallocator_call): Use it.
5491 (malloc_state_machine::on_realloc_call): Likewise.
5492 * sm.h (sm_context::get_old_program_state): New vfunc.
5494 2022-02-15 David Malcolm <dmalcolm@redhat.com>
5497 * region-model-manager.cc
5498 (region_model_manager::maybe_fold_sub_svalue): Only call
5499 get_or_create_cast if type is non-NULL.
5501 2022-02-15 David Malcolm <dmalcolm@redhat.com>
5504 * exploded-graph.h (impl_region_model_context::get_stmt): New.
5505 * region-model.cc: Include "gimple-ssa.h", "tree-phinodes.h",
5506 "tree-ssa-operands.h", and "ssa-iterators.h".
5507 (within_short_circuited_stmt_p): New.
5508 (region_model::check_for_poison): Don't warn about uninit values
5509 if within_short_circuited_stmt_p.
5510 * region-model.h (region_model_context::get_stmt): New vfunc.
5511 (noop_region_model_context::get_stmt): New.
5513 2022-02-11 David Malcolm <dmalcolm@redhat.com>
5516 * region-model.cc (region_model::check_for_poison): Ignore
5517 uninitialized uses of empty types.
5519 2022-02-10 David Malcolm <dmalcolm@redhat.com>
5522 * region-model-manager.cc
5523 (region_model_manager::maybe_fold_sub_svalue): Generalize getting
5524 individual chars of a STRING_CST from element_region to any
5525 subregion which is a concrete access of a single byte from its
5527 * region.cc (region::get_relative_concrete_byte_range): New.
5528 * region.h (region::get_relative_concrete_byte_range): New decl.
5530 2022-02-09 David Malcolm <dmalcolm@redhat.com>
5533 * region-model.cc (selftest::test_bit_range_regions): New.
5534 (selftest::analyzer_region_model_cc_tests): Call it.
5535 * region.h (bit_range_region::key_t::hash): Fix hashing of m_bits
5536 to avoid using uninitialized data.
5538 2022-02-07 David Malcolm <dmalcolm@redhat.com>
5541 * sm-taint.cc (tainted_allocation_size::tainted_allocation_size):
5542 Remove overzealous assertion.
5543 (tainted_allocation_size::emit): Likewise.
5544 (region_model::check_dynamic_size_for_taint): Likewise.
5546 2022-02-07 David Malcolm <dmalcolm@redhat.com>
5549 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
5550 Reimplement in terms of a get_store_value followed by a set_value.
5552 2022-02-03 David Malcolm <dmalcolm@redhat.com>
5555 * engine.cc (exploded_graph::process_node): Use the node for any
5556 diagnostics, avoiding ICE if a bifurcation update adds a
5557 saved_diagnostic, such as for a tainted realloc size.
5558 * region-model-impl-calls.cc
5559 (region_model::impl_call_realloc::success_no_move::update_model):
5560 Require the old pointer to be non-NULL to be able successfully
5561 grow in place. Use model->deref_rvalue rather than maybe_get_region
5562 to support the old pointer being symbolic.
5563 (region_model::impl_call_realloc::success_with_move::update_model):
5564 Likewise. Add a constraint that the new pointer != the old pointer.
5565 Use a sized_region when setting the value of the new region.
5566 Handle the case where we don't know the dynamic size of the old
5567 region by marking the new region as unknown.
5568 * sm-taint.cc (tainted_allocation_size::tainted_allocation_size):
5569 Update assertion to also allow for MEMSPACE_UNKNOWN.
5570 (tainted_allocation_size::emit): Likewise.
5571 (region_model::check_dynamic_size_for_taint): Likewise.
5573 2022-02-03 David Malcolm <dmalcolm@redhat.com>
5575 * region-model-impl-calls.cc (region_model::impl_call_calloc): Use
5576 a sized_region when calling zero_fill_region.
5578 2022-02-02 David Malcolm <dmalcolm@redhat.com>
5580 * region-model.cc (region_model::on_return): Replace usage of
5581 copy_region with get_rvalue/set_value pair.
5582 (region_model::pop_frame): Likewise.
5583 (selftest::test_compound_assignment): Likewise.
5584 * region-model.h (region_model::copy_region): Delete decl.
5585 * region.cc (region_model::copy_region): Delete.
5587 2022-02-02 David Malcolm <dmalcolm@redhat.com>
5589 * region.cc (region::calc_offset): Consolidate effectively
5592 2022-02-02 David Malcolm <dmalcolm@redhat.com>
5594 * analyzer.h (class bit_range_region): New forward decl.
5595 * region-model-manager.cc (region_model_manager::get_bit_range):
5597 (region_model_manager::log_stats): Handle m_bit_range_regions.
5598 * region-model.cc (region_model::get_lvalue_1): Handle
5600 * region-model.h (region_model_manager::get_bit_range): New decl.
5601 (region_model_manager::m_bit_range_regions): New field.
5602 * region.cc (region::get_base_region): Handle RK_BIT_RANGE.
5603 (region::base_region_p): Likewise.
5604 (region::calc_offset): Likewise.
5605 (bit_range_region::dump_to_pp): New.
5606 (bit_range_region::get_byte_size): New.
5607 (bit_range_region::get_bit_size): New.
5608 (bit_range_region::get_byte_size_sval): New.
5609 (bit_range_region::get_relative_concrete_offset): New.
5610 * region.h (enum region_kind): Add RK_BIT_RANGE.
5611 (region::dyn_cast_bit_range_region): New vfunc.
5612 (class bit_range_region): New.
5613 (is_a_helper <const bit_range_region *>::test): New.
5614 (default_hash_traits<bit_range_region::key_t>): New.
5616 2022-02-02 David Malcolm <dmalcolm@redhat.com>
5619 * region-model.cc (region_model::on_call_pre): Handle
5622 2022-01-27 David Malcolm <dmalcolm@redhat.com>
5624 * checker-path.cc (event_kind_to_string): Handle
5626 (region_creation_event::region_creation_event): New.
5627 (region_creation_event::get_desc): New.
5628 (checker_path::add_region_creation_event): New.
5629 * checker-path.h (enum event_kind): Add EK_REGION_CREATION.
5630 (class region_creation_event): New subclass.
5631 (checker_path::add_region_creation_event): New decl.
5632 * diagnostic-manager.cc
5633 (diagnostic_manager::emit_saved_diagnostic): Pass NULL for new
5634 param to add_events_for_eedge when handling trailing eedge.
5635 (diagnostic_manager::build_emission_path): Create an interesting_t
5636 instance, allow the pending diagnostic to populate it, and pass it
5637 to the calls to add_events_for_eedge.
5638 (diagnostic_manager::add_events_for_eedge): Add "interest" param.
5639 Use it to add region_creation_events for on-stack regions created
5640 within at function entry, and when pertinent dynamically-sized
5641 regions are created.
5642 (diagnostic_manager::prune_for_sm_diagnostic): Add case for
5644 * diagnostic-manager.h (diagnostic_manager::add_events_for_eedge):
5645 Add "interest" param.
5646 * pending-diagnostic.cc: Include "selftest.h", "tristate.h",
5647 "analyzer/call-string.h", "analyzer/program-point.h",
5648 "analyzer/store.h", and "analyzer/region-model.h".
5649 (interesting_t::add_region_creation): New.
5650 (interesting_t::dump_to_pp): New.
5651 * pending-diagnostic.h (struct interesting_t): New.
5652 (pending_diagnostic::mark_interesting_stuff): New vfunc.
5654 (poisoned_value_diagnostic::poisoned_value_diagnostic): Add
5655 (poisoned_value_diagnostic::operator==): Compare m_pkind and
5656 m_src_region fields.
5657 (poisoned_value_diagnostic::mark_interesting_stuff): New.
5658 (poisoned_value_diagnostic::m_src_region): New.
5659 (region_model::check_for_poison): Call
5660 get_region_for_poisoned_expr for uninit values and pass the resul
5662 (region_model::get_region_for_poisoned_expr): New.
5663 (region_model::deref_rvalue): Pass NULL for
5664 poisoned_value_diagnostic's src_region.
5665 * region-model.h (region_model::get_region_for_poisoned_expr): New
5667 * region.h (frame_region::get_fndecl): New.
5669 2022-01-27 Martin Liska <mliska@suse.cz>
5672 * constraint-manager.cc (bounded_ranges_manager::log_stats):
5673 Cast to long for format purpose.
5674 * region-model-manager.cc (log_uniq_map): Likewise.
5676 2022-01-26 David Malcolm <dmalcolm@redhat.com>
5679 * region-model.cc (region_model::check_call_args): New.
5680 (region_model::on_call_pre): Call it when ignoring stdio builtins.
5681 * region-model.h (region_model::check_call_args): New decl
5683 2022-01-26 David Malcolm <dmalcolm@redhat.com>
5686 * constraint-manager.cc (range::add_bound): Fix tests for
5687 discarding redundant constraints. Perform test for rejecting
5688 unsatisfiable constraints earlier so that they don't update
5689 the object on failure.
5690 (selftest::test_range): New.
5691 (selftest::test_constant_comparisons): Add test coverage for
5692 existing constraints becoming narrower until they are
5694 (selftest::run_constraint_manager_tests): Call test_range.
5696 2022-01-22 David Malcolm <dmalcolm@redhat.com>
5699 * region-model-manager.cc
5700 (region_model_manager::get_or_create_cast): Bail out if the types
5701 are the same. Don't attempt to handle casts involving vector
5704 2022-01-20 David Malcolm <dmalcolm@redhat.com>
5707 * constraint-manager.cc (bound::ensure_closed): Convert param to
5709 (range::constrained_to_single_element): Likewise.
5710 (range::add_bound): New.
5711 (constraint_manager::add_constraint): Handle SVAL + OFFSET
5712 compared to a constant.
5713 (constraint_manager::get_ec_bounds): Rewrite in terms of
5715 (constraint_manager::eval_condition): Reject if range::add_bound
5717 (selftest::test_constant_comparisons): Add test coverage for
5718 various impossible combinations of integer comparisons.
5719 * constraint-manager.h (enum bound_kind): New.
5720 (struct bound): Likewise.
5721 (bound::ensure_closed): Convert to param to enum bound_kind.
5722 (struct range): Convert to...
5723 (class range): ...this, making fields private.
5724 (range::add_bound): New decls.
5725 * region-model.cc (region_model::add_constraint): Fail if
5726 constraint_manager::add_constraint fails.
5728 2022-01-18 David Malcolm <dmalcolm@redhat.com>
5731 * region-model-manager.cc
5732 (region_model_manager::get_or_create_constant_svalue): Assert that
5733 we have a CONSTANT_CLASS_P.
5734 (region_model_manager::maybe_fold_unaryop): Only fold a constant
5735 when fold_unary's result is a constant or a cast of a constant.
5737 2022-01-18 David Malcolm <dmalcolm@redhat.com>
5740 * region-model-manager.cc
5741 (region_model_manager::maybe_fold_sub_svalue): Avoid casting to
5742 NULL type when folding access to repeated svalue.
5744 2022-01-17 Martin Liska <mliska@suse.cz>
5746 * analyzer.cc (is_special_named_call_p): Rename .c names to .cc.
5747 (is_named_call_p): Likewise.
5748 * region-model-asm.cc (deterministic_p): Likewise.
5749 * region.cc (field_region::get_relative_concrete_offset): Likewise.
5750 * sm-malloc.cc (method_p): Likewise.
5751 * supergraph.cc (superedge::dump_dot): Likewise.
5753 2022-01-14 David Malcolm <dmalcolm@redhat.com>
5755 * sm-taint.cc (taint_state_machine::combine_states): Handle combination
5756 of has_ub and has_lb.
5758 2022-01-14 David Malcolm <dmalcolm@redhat.com>
5761 * sm-taint.cc (taint_state_machine::alt_get_inherited_state):
5762 Remove gcc_unreachable from default case for unary ops.
5764 2022-01-14 David Malcolm <dmalcolm@redhat.com>
5766 * engine.cc: Include "stringpool.h", "attribs.h", and
5768 (mark_params_as_tainted): New.
5769 (class tainted_args_function_custom_event): New.
5770 (class tainted_args_function_info): New.
5771 (exploded_graph::add_function_entry): Handle functions with
5772 "tainted_args" attribute.
5773 (class tainted_args_field_custom_event): New.
5774 (class tainted_args_callback_custom_event): New.
5775 (class tainted_args_call_info): New.
5776 (add_tainted_args_callback): New.
5777 (add_any_callbacks): New.
5778 (exploded_graph::build_initial_worklist): Likewise.
5779 (exploded_graph::build_initial_worklist): Find callbacks that are
5780 reachable from global initializers, calling add_any_callbacks on
5783 2022-01-12 David Malcolm <dmalcolm@redhat.com>
5786 * engine.cc (impl_sm_context::impl_sm_context): Add
5787 "unknown_side_effects" param and use it to initialize
5788 new m_unknown_side_effects field.
5789 (impl_sm_context::unknown_side_effects_p): New.
5790 (impl_sm_context::m_unknown_side_effects): New.
5791 (exploded_node::on_stmt): Pass unknown_side_effects to sm_ctxt
5793 * sm-taint.cc: Include "stringpool.h" and "attribs.h".
5794 (tainted_size::tainted_size): Drop "dir" param.
5795 (tainted_size::get_kind): Drop "FINAL".
5796 (tainted_size::emit): Likewise.
5797 (tainted_size::m_dir): Drop unused field.
5798 (class tainted_access_attrib_size): New subclass.
5799 (taint_state_machine::on_stmt): Call check_for_tainted_size_arg on
5800 external functions with unknown side effects.
5801 (taint_state_machine::check_for_tainted_size_arg): New.
5802 (region_model::check_region_for_taint): Drop "dir" param from
5804 * sm.h (sm_context::unknown_side_effects_p): New.
5806 2022-01-11 David Malcolm <dmalcolm@redhat.com>
5809 * diagnostic-manager.cc
5810 (class auto_disable_complexity_checks): Rename to...
5811 (class auto_checking_feasibility): ...this, updating
5812 the calls accordingly.
5813 (epath_finder::explore_feasible_paths): Update for renaming.
5814 * region-model-manager.cc
5815 (region_model_manager::region_model_manager): Update for change from
5816 m_check_complexity to m_checking_feasibility.
5817 (region_model_manager::reject_if_too_complex): Likewise.
5818 (region_model_manager::get_or_create_unknown_svalue): Handle
5819 m_checking_feasibility.
5820 (region_model_manager::create_unique_svalue): New.
5821 (region_model_manager::maybe_fold_binop): Handle BIT_AND_EXPR and
5822 BIT_IOR_EXPRs on booleans where we know the result.
5823 * region-model.cc (test_binop_svalue_folding): Add test coverage
5825 * region-model.h (region_model_manager::create_unique_svalue): New
5827 (region_model_manager::enable_complexity_check): Replace with...
5828 (region_model_manager::begin_checking_feasibility): ...this.
5829 (region_model_manager::disable_complexity_check): Replace with...
5830 (region_model_manager::end_checking_feasibility): ...this.
5831 (region_model_manager::m_check_complexity): Replace with...
5832 (region_model_manager::m_checking_feasibility): ...this.
5833 (region_model_manager::m_managed_dynamic_svalues): New field.
5835 2022-01-08 David Malcolm <dmalcolm@redhat.com>
5837 * engine.cc (impl_run_checkers): Pass logger to engine ctor.
5838 * region-model-manager.cc
5839 (region_model_manager::region_model_manager): Add logger param and
5840 use it to initialize m_logger.
5841 * region-model.cc (engine::engine): New.
5842 * region-model.h (region_model_manager::region_model_manager):
5844 (region_model_manager::get_logger): New.
5845 (region_model_manager::m_logger): New field.
5846 (engine::engine): New.
5847 * store.cc (store_manager::get_logger): New.
5848 (store::set_value): Log scope. Log when marking a cluster as
5849 unknown due to possible aliasing.
5850 * store.h (store_manager::get_logger): New decl.
5852 2022-01-08 David Malcolm <dmalcolm@redhat.com>
5854 * region-model-impl-calls.cc (cmp_decls): New.
5855 (cmp_decls_ptr_ptr): New.
5856 (region_model::impl_call_analyzer_dump_escaped): New.
5857 * region-model.cc (region_model::on_stmt_pre): Handle
5858 __analyzer_dump_escaped.
5859 * region-model.h (region_model::impl_call_analyzer_dump_escaped):
5861 * store.h (binding_cluster::get_base_region): New accessor.
5863 2022-01-08 David Malcolm <dmalcolm@redhat.com>
5865 * region.cc (region::is_named_decl_p): New.
5866 * region.h (region::is_named_decl_p): New decl.
5868 2022-01-06 David Malcolm <dmalcolm@redhat.com>
5871 * store.cc (store::eval_alias_1): Refactor handling of decl
5872 regions, adding a test for may_be_aliased, rejecting those for
5873 which it returns false.
5875 2021-12-12 Jonathan Wakely <jwakely@redhat.com>
5877 * engine.cc: Define INCLUDE_MEMORY instead of INCLUDE_UNIQUE_PTR.
5879 2021-12-06 David Malcolm <dmalcolm@redhat.com>
5882 * constraint-manager.cc (equiv_class::contains_non_constant_p):
5884 (constraint_manager::canonicalize): Call it when determining
5886 (selftest::test_purging): New selftest.
5887 (selftest::run_constraint_manager_tests): Likewise.
5888 * constraint-manager.h (equiv_class::contains_non_constant_p):
5891 2021-12-01 David Malcolm <dmalcolm@redhat.com>
5894 * region-model-reachability.cc (reachable_regions::handle_parm):
5895 Treat all svalues within a compound parm has reachable, and those
5898 2021-11-29 David Malcolm <dmalcolm@redhat.com>
5901 * store.cc (binding_cluster::can_merge_p): For the "key is bound"
5902 vs "key is not bound" merger case, check that the bound svalue
5903 is mergeable before merging it to "unknown", rejecting the merger
5906 2021-11-19 David Malcolm <dmalcolm@redhat.com>
5909 * engine.cc (exploded_graph::get_or_create_node): Pass in
5910 m_ext_state to program_state::can_merge_with_p.
5911 (exploded_graph::process_worklist): Likewise.
5912 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
5914 (exploded_graph::process_node): Add missing call to detect_leaks
5915 when handling phi nodes.
5916 * program-state.cc (program_state::can_merge_with_p): Add
5917 "ext_state" param. Pass it and state ptrs to
5918 region_model::can_merge_with_p.
5919 (selftest::test_program_state_merging): Update for new ext_state
5920 param of program_state::can_merge_with_p.
5921 (selftest::test_program_state_merging_2): Likewise.
5922 * program-state.h (program_state::can_purge_p): Make const.
5923 (program_state::can_merge_with_p): Add "ext_state" param.
5924 * region-model.cc: Include "analyzer/program-state.h".
5925 (region_model::can_merge_with_p): Add params "ext_state",
5926 "state_a", and "state_b", use them when creating model_merger
5928 (model_merger::mergeable_svalue_p): New.
5929 * region-model.h (region_model::can_merge_with_p): Add params
5930 "ext_state", "state_a", and "state_b".
5931 (model_merger::model_merger) Likewise, initializing new fields.
5932 (model_merger::mergeable_svalue_p): New decl.
5933 (model_merger::m_ext_state): New field.
5934 (model_merger::m_state_a): New field.
5935 (model_merger::m_state_b): New field.
5936 * svalue.cc (svalue::can_merge_p): Call
5937 model_merger::mergeable_svalue_p on both states and reject the
5940 2021-11-17 David Malcolm <dmalcolm@redhat.com>
5943 * region-model-impl-calls.cc (region_model::impl_call_strchr): New.
5944 * region-model-manager.cc
5945 (region_model_manager::maybe_fold_unaryop): Simplify cast to
5946 pointer type of an existing pointer to a region.
5947 * region-model.cc (region_model::on_call_pre): Handle
5948 BUILT_IN_STRCHR and "strchr".
5949 (write_to_const_diagnostic::emit): Add auto_diagnostic_group. Add
5950 alternate wordings for functions and labels.
5951 (write_to_const_diagnostic::describe_final_event): Add alternate
5952 wordings for functions and labels.
5953 (region_model::check_for_writable_region): Handle RK_FUNCTION and
5955 * region-model.h (region_model::impl_call_strchr): New decl.
5957 2021-11-16 David Malcolm <dmalcolm@redhat.com>
5960 * constraint-manager.cc (bounded_range::operator==): Require the
5961 types to be the same for equality.
5963 2021-11-13 David Malcolm <dmalcolm@redhat.com>
5965 * analyzer.opt (Wanalyzer-tainted-allocation-size): New.
5966 (Wanalyzer-tainted-divisor): New.
5967 (Wanalyzer-tainted-offset): New.
5968 (Wanalyzer-tainted-size): New.
5969 * engine.cc (impl_region_model_context::get_taint_map): New.
5970 * exploded-graph.h (impl_region_model_context::get_taint_map):
5972 * program-state.cc (sm_state_map::get_state): Call
5973 alt_get_inherited_state.
5974 (sm_state_map::impl_set_state): Modify states within
5976 (program_state::impl_call_analyzer_dump_state): Undo casts.
5977 (selftest::test_program_state_1): Update for new context param of
5978 create_region_for_heap_alloc.
5979 (selftest::test_program_state_merging): Likewise.
5980 * region-model-impl-calls.cc (region_model::impl_call_alloca):
5982 (region_model::impl_call_calloc): Likewise.
5983 (region_model::impl_call_malloc): Likewise.
5984 (region_model::impl_call_operator_new): Likewise.
5985 (region_model::impl_call_realloc): Likewise.
5986 * region-model.cc (region_model::check_region_access): Call
5987 check_region_for_taint.
5988 (region_model::get_representative_path_var_1): Handle binops.
5989 (region_model::create_region_for_heap_alloc): Add "ctxt" param and
5990 pass it to set_dynamic_extents.
5991 (region_model::create_region_for_alloca): Likewise.
5992 (region_model::set_dynamic_extents): Add "ctxt" param and use it
5993 to call check_dynamic_size_for_taint.
5994 (selftest::test_state_merging): Update for new context param of
5995 create_region_for_heap_alloc.
5996 (selftest::test_malloc_constraints): Likewise.
5997 (selftest::test_malloc): Likewise.
5998 (selftest::test_alloca): Likewise for create_region_for_alloca.
5999 * region-model.h (region_model::create_region_for_heap_alloc): Add
6001 (region_model::create_region_for_alloca): Likewise.
6002 (region_model::set_dynamic_extents): Likewise.
6003 (region_model::check_dynamic_size_for_taint): New decl.
6004 (region_model::check_region_for_taint): New decl.
6005 (region_model_context::get_taint_map): New vfunc.
6006 (noop_region_model_context::get_taint_map): New.
6007 * sm-taint.cc: Remove include of "diagnostic-event-id.h"; add
6008 includes of "gimple-iterator.h", "tristate.h", "selftest.h",
6009 "ordered-hash-map.h", "cgraph.h", "cfg.h", "digraph.h",
6010 "analyzer/supergraph.h", "analyzer/call-string.h",
6011 "analyzer/program-point.h", "analyzer/store.h",
6012 "analyzer/region-model.h", and "analyzer/program-state.h".
6013 (enum bounds): Move to top of file.
6014 (class taint_diagnostic): New.
6015 (class tainted_array_index): Convert to subclass of taint_diagnostic.
6016 (tainted_array_index::emit): Add CWE-129. Reword warning to use
6017 "attacker-controlled" rather than "tainted".
6018 (tainted_array_index::describe_state_change): Move to
6019 taint_diagnostic::describe_state_change.
6020 (tainted_array_index::describe_final_event): Reword to use
6021 "attacker-controlled" rather than "tainted".
6022 (class tainted_offset): New.
6023 (class tainted_size): New.
6024 (class tainted_divisor): New.
6025 (class tainted_allocation_size): New.
6026 (taint_state_machine::alt_get_inherited_state): New.
6027 (taint_state_machine::on_stmt): In assignment handling, remove
6028 ARRAY_REF handling in favor of check_region_for_taint. Add
6029 detection of tainted divisors.
6030 (taint_state_machine::get_taint): New.
6031 (taint_state_machine::combine_states): New.
6032 (region_model::check_region_for_taint): New.
6033 (region_model::check_dynamic_size_for_taint): New.
6034 * sm.h (state_machine::alt_get_inherited_state): New.
6036 2021-11-12 David Malcolm <dmalcolm@redhat.com>
6038 * engine.cc (exploded_node::on_stmt_pre): Return when handling
6039 "__analyzer_dump_state".
6041 2021-11-11 Richard Biener <rguenther@suse.de>
6043 * supergraph.cc: Include bitmap.h.
6045 2021-11-04 David Malcolm <dmalcolm@redhat.com>
6047 * program-state.cc (sm_state_map::dump): Use default_tree_printer
6050 2021-09-16 Maxim Blinov <maxim.blinov@embecosm.com>
6053 * engine.cc (INCLUDE_UNIQUE_PTR): Define.
6055 2021-09-08 David Malcolm <dmalcolm@redhat.com>
6058 * analyzer.h (compat_types_p): New decl.
6059 * constraint-manager.cc
6060 (constraint_manager::get_or_add_equiv_class): Guard against NULL
6061 type when checking for pointer types.
6062 * region-model-impl-calls.cc (region_model::impl_call_realloc):
6063 Guard against NULL lhs type/region. Guard against the size value
6064 not being of a compatible type for dynamic extents.
6065 * region-model.cc (compat_types_p): Make non-static.
6067 2021-08-30 David Malcolm <dmalcolm@redhat.com>
6070 * analyzer.h (class custom_edge_info): New class, adapted from
6071 exploded_edge::custom_info_t. Make member functions const.
6072 Make update_model return bool, converting edge param from
6073 reference to a pointer, and adding a ctxt param.
6074 (class path_context): New class.
6075 * call-info.cc: New file.
6076 * call-info.h: New file.
6077 * engine.cc: Include "analyzer/call-info.h" and <memory>.
6078 (impl_region_model_context::impl_region_model_context): Update for
6079 new m_path_ctxt field.
6080 (impl_region_model_context::bifurcate): New.
6081 (impl_region_model_context::terminate_path): New.
6082 (impl_region_model_context::get_malloc_map): New.
6083 (impl_sm_context::impl_sm_context): Update for new m_path_ctxt
6085 (impl_sm_context::get_fndecl_for_call): Likewise.
6086 (impl_sm_context::set_next_state): Likewise.
6087 (impl_sm_context::warn): Likewise.
6088 (impl_sm_context::is_zero_assignment): Likewise.
6089 (impl_sm_context::get_path_context): New.
6090 (impl_sm_context::m_path_ctxt): New.
6091 (impl_region_model_context::on_condition): Update for new
6092 path_ctxt param. Handle m_enode_for_diag being NULL.
6093 (impl_region_model_context::on_phi): Update for new path_ctxt
6095 (exploded_node::on_stmt): Add path_ctxt param, updating ctor calls
6096 to use it as necessary. Use it to bail out after sm-handling,
6098 (exploded_node::detect_leaks): Update for new path_ctxt param.
6099 (dynamic_call_info_t::update_model): Update for conversion of
6100 exploded_edge::custom_info_t to custom_edge_info.
6101 (dynamic_call_info_t::add_events_to_path): Likewise.
6102 (rewind_info_t::update_model): Likewise.
6103 (rewind_info_t::add_events_to_path): Likewise.
6104 (exploded_edge::exploded_edge): Likewise.
6105 (exploded_graph::add_edge): Likewise.
6106 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
6107 Update for new path_ctxt param.
6108 (class impl_path_context): New.
6109 (exploded_graph::process_node): Update for new path_ctxt param.
6110 Create an impl_path_context and pass it to exploded_node::on_stmt.
6111 Use it to terminate iterating stmts if terminate_path is called
6112 on it. After processing a run of stmts, query path_ctxt to
6113 potentially terminate the analysis path, and/or to "bifurcate" the
6114 analysis into multiple additional paths.
6115 (feasibility_state::maybe_update_for_edge): Update for new
6116 update_model ctxt param.
6118 (impl_region_model_context::impl_region_model_context): Add
6120 (impl_region_model_context::bifurcate): New.
6121 (impl_region_model_context::terminate_path): New
6122 (impl_region_model_context::get_ext_state): New.
6123 (impl_region_model_context::get_malloc_map): New.
6124 (impl_region_model_context::m_path_ctxt): New field.
6125 (exploded_node::on_stmt): Add path_ctxt param.
6126 (class exploded_edge::custom_info_t): Move to analyzer.h, renaming
6127 to custom_edge_info, and making the changes as noted in analyzer.h
6129 (exploded_edge::exploded_edge): Update for these changes to
6130 exploded_edge::custom_info_t.
6131 (exploded_edge::m_custom_info): Likewise.
6132 (class dynamic_call_info_t): Likewise.
6133 (class rewind_info_t): Likewise.
6134 (exploded_graph::add_edge): Likewise.
6135 * program-state.cc (program_state::on_edge): Update for new
6137 (program_state::push_call): Likewise.
6138 (program_state::returning_call): Likewise.
6139 (program_state::prune_for_point): Likewise.
6140 * region-model-impl-calls.cc: Include "analyzer/call-info.h".
6141 (call_details::get_fndecl_for_call): New.
6142 (region_model::impl_call_realloc): Reimplement.
6143 * region-model.cc (region_model::on_call_pre): Move call to
6144 impl_call_realloc to...
6145 (region_model::on_call_post): ...here. Consolidate creation
6146 of call_details instance.
6147 (noop_region_model_context::bifurcate): New.
6148 (noop_region_model_context::terminate_path): New.
6149 * region-model.h (call_details::get_call_stmt): New.
6150 (call_details::get_fndecl_for_call): New.
6151 (region_model::on_realloc_with_move): New.
6152 (region_model_context::bifurcate): New.
6153 (region_model_context::terminate_path): New.
6154 (region_model_context::get_ext_state): New.
6155 (region_model_context::get_malloc_map): New.
6156 (noop_region_model_context::bifurcate): New.
6157 (noop_region_model_context::terminate_path): New.
6158 (noop_region_model_context::get_ext_state): New.
6159 (noop_region_model_context::get_malloc_map): New.
6160 * sm-malloc.cc: Include "analyzer/program-state.h".
6161 (malloc_state_machine::on_realloc_call): Reimplement.
6162 (malloc_state_machine::on_realloc_with_move): New.
6163 (region_model::on_realloc_with_move): New.
6164 * sm-signal.cc (class signal_delivery_edge_info_t): Update for
6165 conversion from exploded_edge::custom_info_t to custom_edge_info.
6166 * sm.h (sm_context::get_path_context): New.
6167 * svalue.cc (svalue::maybe_get_constant): Call
6168 unwrap_any_unmergeable.
6170 2021-08-25 Ankur Saini <arsenic@sourceware.org>
6173 * engine.cc (exploded_graph::maybe_create_dynamic_call): Don't create
6174 calls if max recursion limit is reached.
6176 2021-08-23 David Malcolm <dmalcolm@redhat.com>
6178 * analyzer.h (struct rejected_constraint): Convert to...
6179 (class rejected_constraint): ...this.
6180 (class bounded_ranges): New forward decl.
6181 (class bounded_ranges_manager): New forward decl.
6182 * constraint-manager.cc: Include "analyzer/analyzer-logging.h" and
6183 "tree-pretty-print.h".
6184 (can_plus_one_p): New.
6186 (can_minus_one_p): New.
6188 (bounded_range::bounded_range): New.
6190 (bounded_range::dump_to_pp): New.
6191 (bounded_range::dump): New.
6192 (bounded_range::to_json): New.
6193 (bounded_range::set_json_attr): New.
6194 (bounded_range::contains_p): New.
6195 (bounded_range::intersects_p): New.
6196 (bounded_range::operator==): New.
6197 (bounded_range::cmp): New.
6198 (bounded_ranges::bounded_ranges): New.
6199 (bounded_ranges::bounded_ranges): New.
6200 (bounded_ranges::bounded_ranges): New.
6201 (bounded_ranges::canonicalize): New.
6202 (bounded_ranges::validate): New.
6203 (bounded_ranges::operator==): New.
6204 (bounded_ranges::dump_to_pp): New.
6205 (bounded_ranges::dump): New.
6206 (bounded_ranges::to_json): New.
6207 (bounded_ranges::eval_condition): New.
6208 (bounded_ranges::contain_p): New.
6209 (bounded_ranges::cmp): New.
6210 (bounded_ranges_manager::~bounded_ranges_manager): New.
6211 (bounded_ranges_manager::get_or_create_empty): New.
6212 (bounded_ranges_manager::get_or_create_point): New.
6213 (bounded_ranges_manager::get_or_create_range): New.
6214 (bounded_ranges_manager::get_or_create_union): New.
6215 (bounded_ranges_manager::get_or_create_intersection): New.
6216 (bounded_ranges_manager::get_or_create_inverse): New.
6217 (bounded_ranges_manager::consolidate): New.
6218 (bounded_ranges_manager::get_or_create_ranges_for_switch): New.
6219 (bounded_ranges_manager::create_ranges_for_switch): New.
6220 (bounded_ranges_manager::make_case_label_ranges): New.
6221 (bounded_ranges_manager::log_stats): New.
6222 (bounded_ranges_constraint::print): New.
6223 (bounded_ranges_constraint::to_json): New.
6224 (bounded_ranges_constraint::operator==): New.
6225 (bounded_ranges_constraint::add_to_hash): New.
6226 (constraint_manager::constraint_manager): Update for new field
6227 m_bounded_ranges_constraints.
6228 (constraint_manager::operator=): Likewise.
6229 (constraint_manager::hash): Likewise.
6230 (constraint_manager::operator==): Likewise.
6231 (constraint_manager::print): Likewise.
6232 (constraint_manager::dump_to_pp): Likewise.
6233 (constraint_manager::to_json): Likewise.
6234 (constraint_manager::add_unknown_constraint): Update the lhs_ec_id
6235 if necessary in existing constraints when combining equivalence
6236 classes. Add similar code for handling
6237 m_bounded_ranges_constraints.
6238 (constraint_manager::add_constraint_internal): Add comment.
6239 (constraint_manager::add_bounded_ranges): New.
6240 (constraint_manager::eval_condition): Use new field
6241 m_bounded_ranges_constraints.
6242 (constraint_manager::purge): Update bounded_ranges_constraint
6244 (constraint_manager::canonicalize): Update for new field.
6245 (merger_fact_visitor::on_ranges): New.
6246 (constraint_manager::for_each_fact): Use new field
6247 m_bounded_ranges_constraints.
6248 (constraint_manager::validate): Fix off-by-one error needed due
6249 to bug fixed above in add_unknown_constraint. Validate the EC IDs
6250 in m_bounded_ranges_constraints.
6251 (constraint_manager::get_range_manager): New.
6252 (selftest::assert_dump_bounded_range_eq): New.
6253 (ASSERT_DUMP_BOUNDED_RANGE_EQ): New.
6254 (selftest::test_bounded_range): New.
6255 (selftest::assert_dump_bounded_ranges_eq): New.
6256 (ASSERT_DUMP_BOUNDED_RANGES_EQ): New.
6257 (selftest::test_bounded_ranges): New.
6258 (selftest::run_constraint_manager_tests): Call the new selftests.
6259 * constraint-manager.h (struct bounded_range): New.
6260 (struct bounded_ranges): New.
6261 (template <> struct default_hash_traits<bounded_ranges::key_t>): New.
6262 (class bounded_ranges_manager): New.
6263 (fact_visitor::on_ranges): New pure virtual function.
6264 (class bounded_ranges_constraint): New.
6265 (constraint_manager::add_bounded_ranges): New decl.
6266 (constraint_manager::get_range_manager): New decl.
6267 (constraint_manager::m_bounded_ranges_constraints): New field.
6268 * diagnostic-manager.cc (epath_finder::process_worklist_item):
6269 Transfer ownership of rc to add_feasibility_problem.
6270 * engine.cc (feasibility_problem::dump_to_pp): Use get_model.
6271 * feasible-graph.cc (infeasible_node::dump_dot): Update for
6272 conversion of m_rc to a pointer.
6273 (feasible_graph::add_feasibility_problem): Pass RC by pointer and
6275 * feasible-graph.h (infeasible_node::infeasible_node): Pass RC by
6276 pointer and take ownership.
6277 (infeasible_node::~infeasible_node): New.
6278 (infeasible_node::m_rc): Convert to a pointer.
6279 (feasible_graph::add_feasibility_problem): Pass RC by pointer and
6281 * region-model-manager.cc: Include
6282 "analyzer/constraint-manager.h".
6283 (region_model_manager::region_model_manager): Initializer new
6285 (region_model_manager::~region_model_manager): Delete it.
6286 (region_model_manager::log_stats): Call log_stats on it.
6287 * region-model.cc (region_model::add_constraint): Use new subclass
6288 rejected_op_constraint.
6289 (region_model::apply_constraints_for_gswitch): Reimplement using
6290 bounded_ranges_manager.
6291 (rejected_constraint::dump_to_pp): Convert to...
6292 (rejected_op_constraint::dump_to_pp): ...this.
6293 (rejected_ranges_constraint::dump_to_pp): New.
6294 * region-model.h (struct purge_stats): Add field
6295 m_num_bounded_ranges_constraints.
6296 (region_model_manager::get_range_manager): New.
6297 (region_model_manager::m_range_mgr): New.
6298 (region_model::get_range_manager): New.
6299 (struct rejected_constraint): Split into...
6300 (class rejected_constraint):...this new abstract base class,
6302 (class rejected_op_constraint): ...this new concrete subclass.
6303 (class rejected_ranges_constraint): New.
6304 * supergraph.cc: Include "tree-cfg.h".
6305 (supergraph::supergraph): Drop idx param from add_cfg_edge.
6306 (supergraph::add_cfg_edge): Drop idx param.
6307 (switch_cfg_superedge::switch_cfg_superedge): Move here from
6308 header. Populate m_case_labels with all cases which go to DST.
6309 (switch_cfg_superedge::dump_label_to_pp): Reimplement to use
6311 (switch_cfg_superedge::get_case_label): Delete.
6312 * supergraph.h (supergraphadd_cfg_edge): Drop "idx" param.
6313 (switch_cfg_superedge::switch_cfg_superedge): Drop idx param and
6314 move implementation to supergraph.cc.
6315 (switch_cfg_superedge::get_case_label): Delete.
6316 (switch_cfg_superedge::get_case_labels): New.
6317 (switch_cfg_superedge::m_idx): Delete.
6318 (switch_cfg_superedge::m_case_labels): New field.
6320 2021-08-23 David Malcolm <dmalcolm@redhat.com>
6323 * sm-file.cc (file_diagnostic::describe_state_change): Handle
6324 change.m_expr being NULL.
6326 2021-08-23 David Malcolm <dmalcolm@redhat.com>
6329 * analyzer.cc (maybe_reconstruct_from_def_stmt): Bail if fn is
6330 NULL, and assert that it's non-NULL before passing it to
6331 build_call_array_loc.
6333 2021-08-23 David Malcolm <dmalcolm@redhat.com>
6336 * region-model.cc (region_model::eval_condition_without_cm):
6337 Refactor comparison against zero, adding a check for
6338 POINTER_PLUS_EXPR of non-NULL.
6340 2021-08-23 David Malcolm <dmalcolm@redhat.com>
6342 * store.cc (bit_range::intersects_p): New overload.
6343 (bit_range::operator-): New.
6344 (binding_cluster::maybe_get_compound_binding): Handle the partial
6346 (selftest::test_bit_range_intersects_p): Add test coverage for
6347 new overload of bit_range::intersects_p.
6348 * store.h (bit_range::intersects_p): New overload.
6349 (bit_range::operator-): New.
6351 2021-08-23 Ankur Saini <arsenic@sourceware.org>
6354 * diagnostic-manager.cc
6355 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Fix typo.
6357 2021-08-21 Ankur Saini <arsenic@sourceware.org>
6360 * diagnostic-manager.cc
6361 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Use
6362 caller_model only when the supergraph_edge doesn't exixt.
6363 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
6365 * engine.cc (exploded_graph::create_dynamic_call): Rename to...
6366 (exploded_graph::maybe_create_dynamic_call): ...this, return call
6368 (exploded_graph::process_node): Handle calls which were not dynamically
6370 * exploded-graph.h (exploded_graph::create_dynamic_call): Rename to...
6371 (exploded_graph::maybe_create_dynamic_call): ...this.
6372 * region-model.cc (region_model::update_for_gcall): New param, use it
6373 to push call to frame.
6374 (region_model::update_for_call_superedge): Pass callee function to
6376 * region-model.h (region_model::update_for_gcall): New param.
6378 2021-08-18 Ankur Saini <arsenic@sourceware.org>
6381 * region-model.cc (region_model::get_rvalue_1): Add case for
6384 2021-08-18 Ankur Saini <arsenic@sourceware.org>
6387 * analysis-plan.cc (analysis_plan::use_summary_p): Don't use call
6388 summaries if there is no callgraph edge
6389 * checker-path.cc (call_event::call_event): Handle calls events that
6390 are not represented by a supergraph call edge
6391 (return_event::return_event): Likewise.
6392 (call_event::get_desc): Work with new call_event structure.
6393 (return_event::get_desc): Likeise.
6394 * checker-path.h (call_event::m_src_snode): New field.
6395 (call_event::m_dest_snode): New field.
6396 (return_event::m_src_snode): New field.
6397 (return_event::m_dest_snode): New field.
6398 * diagnostic-manager.cc
6399 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>:
6400 Refactor to work with edges without callgraph edge.
6401 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
6403 * engine.cc (dynamic_call_info_t::update_model): New function.
6404 (dynamic_call_info_t::add_events_to_path): New function.
6405 (exploded_graph::create_dynamic_call): New function.
6406 (exploded_graph::process_node): Work with dynamically discovered calls.
6407 * exploded-graph.h (class dynamic_call_info_t): New class.
6408 (exploded_graph::create_dynamic_call): New decl.
6409 * program-point.cc (program_point::push_to_call_stack): New function.
6410 (program_point::pop_from_call_stack): New function.
6411 * program-point.h (program_point::push_to_call_stack): New decl.
6412 (program_point::pop_from_call_stack): New decl.
6413 * program-state.cc (program_state::push_call): New function.
6414 (program_state::returning_call): New function.
6415 * program-state.h (program_state::push_call): New decl.
6416 (program_state::returning_call): New decl.
6417 * region-model.cc (region_model::update_for_gcall) New function.
6418 (region_model::update_for_return_gcall): New function.
6419 (egion_model::update_for_call_superedge): Get the underlying gcall and
6421 (region_model::update_for_return_superedge): Likewise.
6422 * region-model.h (region_model::update_for_gcall): New decl.
6423 (region_model::update_for_return_gcall): New decl.
6424 * state-purge.cc (state_purge_per_ssa_name::process_point): Update to
6425 work with calls without underlying cgraph edge.
6426 * supergraph.cc (supergraph::supergraph) Split snodes at every callsite.
6427 * supergraph.h (supernode::get_returning_call) New accessor.
6429 2021-08-04 David Malcolm <dmalcolm@redhat.com>
6432 * analyzer.cc (maybe_reconstruct_from_def_stmt): Add GIMPLE_ASM
6434 * analyzer.h (class asm_output_svalue): New forward decl.
6435 (class reachable_regions): New forward decl.
6436 * complexity.cc (complexity::from_vec_svalue): New.
6437 * complexity.h (complexity::from_vec_svalue): New decl.
6438 * engine.cc (feasibility_state::maybe_update_for_edge): Handle
6439 asm stmts by calling on_asm_stmt.
6440 * region-model-asm.cc: New file.
6441 * region-model-manager.cc
6442 (region_model_manager::maybe_fold_asm_output_svalue): New.
6443 (region_model_manager::get_or_create_asm_output_svalue): New.
6444 (region_model_manager::log_stats): Log m_asm_output_values_map.
6445 * region-model.cc (region_model::on_stmt_pre): Handle GIMPLE_ASM.
6446 * region-model.h (visitor::visit_asm_output_svalue): New.
6447 (region_model_manager::get_or_create_asm_output_svalue): New decl.
6448 (region_model_manager::maybe_fold_asm_output_svalue): New decl.
6449 (region_model_manager::asm_output_values_map_t): New typedef.
6450 (region_model_manager::m_asm_output_values_map): New field.
6451 (region_model::on_asm_stmt): New.
6452 * store.cc (binding_cluster::on_asm): New.
6453 * store.h (binding_cluster::on_asm): New decl.
6454 * svalue.cc (svalue::cmp_ptr): Handle SK_ASM_OUTPUT.
6455 (asm_output_svalue::dump_to_pp): New.
6456 (asm_output_svalue::dump_input): New.
6457 (asm_output_svalue::input_idx_to_asm_idx): New.
6458 (asm_output_svalue::accept): New.
6459 * svalue.h (enum svalue_kind): Add SK_ASM_OUTPUT.
6460 (svalue::dyn_cast_asm_output_svalue): New.
6461 (class asm_output_svalue): New.
6462 (is_a_helper <const asm_output_svalue *>::test): New.
6463 (struct default_hash_traits<asm_output_svalue::key_t>): New.
6465 2021-08-03 Jakub Jelinek <jakub@redhat.com>
6468 * sm-malloc.cc (known_allocator_p): Only check DECL_FUNCTION_CODE on
6469 BUILT_IN_NORMAL builtins.
6471 2021-07-29 Ankur Saini <arsenic@sourceware.org>
6473 * call-string.cc (call_string::element_t::operator==): New operator.
6474 (call_String::element_t::operator!=): New operator.
6475 (call_string::element_t::get_caller_function): New function.
6476 (call_string::element_t::get_callee_function): New function.
6477 (call_string::call_string): Refactor to Initialise m_elements.
6478 (call_string::operator=): Refactor to work with m_elements.
6479 (call_string::operator==): Likewise.
6480 (call_string::to_json): Likewise.
6481 (call_string::hash): Refactor to hash e.m_caller.
6482 (call_string::push_call): Refactor to work with m_elements.
6483 (call_string::push_call): New overload to push call via supernodes.
6484 (call_string::pop): Refactor to work with m_elements.
6485 (call_string::calc_recursion_depth): Likewise.
6486 (call_string::cmp): Likewise.
6487 (call_string::validate): Likewise.
6488 (call_string::operator[]): Likewise.
6489 * call-string.h (class supernode): New forward decl.
6490 (struct call_string::element_t): New struct.
6491 (call_string::call_string): Refactor to initialise m_elements.
6492 (call_string::bool empty_p): Refactor to work with m_elements.
6493 (call_string::get_callee_node): New decl.
6494 (call_string::get_caller_node): New decl.
6495 (m_elements): Replaces m_return_edges.
6496 * program-point.cc (program_point::get_function_at_depth): Refactor to
6497 work with new call-string format.
6498 (program_point::validate): Likewise.
6499 (program_point::on_edge): Likewise.
6501 2021-07-28 David Malcolm <dmalcolm@redhat.com>
6503 * region-model.cc (region_model::on_call_pre): Treat
6504 IFN_UBSAN_BOUNDS, BUILT_IN_STACK_SAVE, and BUILT_IN_STACK_RESTORE
6505 as no-ops, rather than handling them as unknown functions.
6507 2021-07-28 David Malcolm <dmalcolm@redhat.com>
6509 * region-model-impl-calls.cc (region_model::impl_call_alloca):
6510 Drop redundant return value.
6511 (region_model::impl_call_builtin_expect): Likewise.
6512 (region_model::impl_call_calloc): Likewise.
6513 (region_model::impl_call_malloc): Likewise.
6514 (region_model::impl_call_memset): Likewise.
6515 (region_model::impl_call_operator_new): Likewise.
6516 (region_model::impl_call_operator_delete): Likewise.
6517 (region_model::impl_call_strlen): Likewise.
6518 * region-model.cc (region_model::on_call_pre): Fix return value of
6519 known functions that don't have unknown side-effects.
6520 * region-model.h (region_model::impl_call_alloca): Drop redundant
6522 (region_model::impl_call_builtin_expect): Likewise.
6523 (region_model::impl_call_calloc): Likewise.
6524 (region_model::impl_call_malloc): Likewise.
6525 (region_model::impl_call_memset): Likewise.
6526 (region_model::impl_call_strlen): Likewise.
6527 (region_model::impl_call_operator_new): Likewise.
6528 (region_model::impl_call_operator_delete): Likewise.
6530 2021-07-28 Siddhesh Poyarekar <siddhesh@gotplt.org>
6532 * analyzer.cc (is_named_call_p, is_std_named_call_p): Make
6533 first argument a const_tree.
6534 * analyzer.h (is_named_call_p, -s_std_named_call_p): Likewise.
6535 * sm-malloc.cc (known_allocator_p): New function.
6536 (malloc_state_machine::on_stmt): Use it.
6538 2021-07-28 Siddhesh Poyarekar <siddhesh@gotplt.org>
6541 (malloc_state_machine::get_or_create_deallocator): Recognize
6544 2021-07-26 David Malcolm <dmalcolm@redhat.com>
6546 * region-model.cc (region_model::on_call_pre): Always set conjured
6547 LHS, not just for SSA names.
6549 2021-07-23 David Malcolm <dmalcolm@redhat.com>
6551 * diagnostic-manager.cc
6552 (class auto_disable_complexity_checks): New.
6553 (epath_finder::explore_feasible_paths): Use it to disable
6554 complexity checks whilst processing the worklist.
6555 * region-model-manager.cc
6556 (region_model_manager::region_model_manager): Initialize
6558 (region_model_manager::reject_if_too_complex): Bail if
6559 m_check_complexity is false.
6561 (region_model_manager::enable_complexity_check): New.
6562 (region_model_manager::disable_complexity_check): New.
6563 (region_model_manager::m_check_complexity): New.
6565 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6568 * sm-file.cc (file_leak::emit): Handle m_arg being NULL.
6569 (file_leak::describe_final_event): Handle ev.m_expr being NULL.
6571 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6574 * store.cc (binding_cluster::purge_state_involving): Don't change
6575 m_map whilst iterating through it.
6577 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6579 * region-model.cc (region_model::handle_phi): Add "old_state"
6581 (region_model::update_for_phis): Update so that all of the phi
6582 stmts are effectively handled simultaneously, rather than in
6584 * region-model.h (region_model::handle_phi): Add "old_state"
6586 * state-purge.cc (self_referential_phi_p): Replace with...
6587 (name_used_by_phis_p): ...this new function.
6588 (state_purge_per_ssa_name::process_point): Update to use the
6589 above, so that all phi stmts at a basic block are effectively
6590 considered simultaneously, and only consider the phi arguments for
6591 the pertinent in-edge.
6592 * supergraph.cc (cfg_superedge::get_phi_arg_idx): New.
6593 (cfg_superedge::get_phi_arg): Use the above.
6594 * supergraph.h (cfg_superedge::get_phi_arg_idx): New decl.
6596 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6598 * state-purge.cc (state_purge_annotator::add_node_annotations):
6599 Rather than erroneously always using the NULL in-edge, determine
6600 each relevant in-edge, and print the appropriate data for each
6601 in-edge. Use print_needed to print the data as comma-separated
6603 (print_vec_of_names): Add "within_table" param and use it.
6604 (state_purge_annotator::add_stmt_annotations): Factor out
6605 collation and printing code into...
6606 (state_purge_annotator::print_needed): ...this new function.
6607 * state-purge.h (state_purge_annotator::print_needed): New decl.
6609 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6611 * program-point.cc (function_point::print): Show src BB index at
6614 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6616 * svalue.cc (infix_p): New.
6617 (binop_svalue::dump_to_pp): Use it to print MIN_EXPR and MAX_EXPR
6618 in prefix form, rather than infix.
6620 2021-07-19 David Malcolm <dmalcolm@redhat.com>
6623 * constraint-manager.cc (constraint_manager::add_constraint): Use
6624 can_have_associated_state_p rather than testing for unknown.
6625 (constraint_manager::get_or_add_equiv_class): Likewise.
6626 * program-state.cc (sm_state_map::set_state): Likewise.
6627 (sm_state_map::impl_set_state): Add assertion.
6628 * region-model-manager.cc
6629 (region_model_manager::maybe_fold_unaryop): Handle poisoned
6631 (region_model_manager::maybe_fold_binop): Move handling of unknown
6633 (region_model_manager::get_or_create_binop): ...to here, and
6634 generalize to use can_have_associated_state_p.
6635 (region_model_manager::maybe_fold_sub_svalue): Use
6636 can_have_associated_state_p rather than testing for unknown.
6637 (region_model_manager::maybe_fold_repeated_svalue): Use unknown
6638 when the size or repeated value is "unknown"/"poisoned".
6639 * region-model.cc (region_model::purge_state_involving): Reject
6640 attempts to purge unknown/poisoned svalues, as these svalues
6641 should not have state associated with them.
6642 * svalue.cc (sub_svalue::sub_svalue): Assert that we're building
6643 on top of an svalue with can_have_associated_state_p.
6644 (repeated_svalue::repeated_svalue): Likewise.
6645 (bits_within_svalue::bits_within_svalue): Likewise.
6646 * svalue.h (svalue::can_have_associated_state_p): New.
6647 (unknown_svalue::can_have_associated_state_p): New.
6648 (poisoned_svalue::can_have_associated_state_p): New.
6649 (unaryop_svalue::unaryop_svalue): Assert that we're building on
6650 top of an svalue with can_have_associated_state_p.
6651 (binop_svalue::binop_svalue): Likewise.
6652 (widening_svalue::widening_svalue): Likewise.
6654 2021-07-16 David Malcolm <dmalcolm@redhat.com>
6656 * analyzer.h (enum access_direction): New.
6657 * engine.cc (exploded_node::on_longjmp): Update for new param of
6659 * program-state.cc (program_state::prune_for_point): Likewise.
6660 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
6661 Replace call to check_for_writable_region with call to
6662 check_region_for_write.
6663 (region_model::impl_call_memset): Likewise.
6664 (region_model::impl_call_strcpy): Likewise.
6665 * region-model-reachability.cc (reachable_regions::add): Update
6666 for new param of get_store_value.
6667 * region-model.cc (region_model::get_rvalue_1): Likewise, also for
6668 get_rvalue_for_bits.
6669 (region_model::get_store_value): Add ctxt param and use it to call
6670 check_region_for_read.
6671 (region_model::get_rvalue_for_bits): Add ctxt param and use it to
6672 call get_store_value.
6673 (region_model::check_region_access): New.
6674 (region_model::check_region_for_write): New.
6675 (region_model::check_region_for_read): New.
6676 (region_model::set_value): Update comment. Replace call to
6677 check_for_writable_region with call to check_region_for_write.
6678 * region-model.h (region_model::get_rvalue_for_bits): Add ctxt
6680 (region_model::get_store_value): Add ctxt param.
6681 (region_model::check_region_access): New decl.
6682 (region_model::check_region_for_write): New decl.
6683 (region_model::check_region_for_read): New decl.
6684 * region.cc (region_model::copy_region): Update call to
6686 * svalue.cc (initial_svalue::implicitly_live_p): Likewise.
6688 2021-07-16 David Malcolm <dmalcolm@redhat.com>
6690 * engine.cc (exploded_node::on_stmt_pre): Handle
6691 __analyzer_dump_state.
6692 * program-state.cc (extrinsic_state::get_sm_idx_by_name): New.
6693 (program_state::impl_call_analyzer_dump_state): New.
6694 * program-state.h (extrinsic_state::get_sm_idx_by_name): New decl.
6695 (program_state::impl_call_analyzer_dump_state): New decl.
6696 * region-model-impl-calls.cc
6697 (call_details::get_arg_string_literal): New.
6698 * region-model.h (call_details::get_arg_string_literal): New decl.
6700 2021-07-16 David Malcolm <dmalcolm@redhat.com>
6702 * program-state.cc (program_state::detect_leaks): Simplify using
6703 svalue::maybe_get_region.
6704 * region-model-impl-calls.cc (region_model::impl_call_fgets): Likewise.
6705 (region_model::impl_call_fread): Likewise.
6706 (region_model::impl_call_free): Likewise.
6707 (region_model::impl_call_operator_delete): Likewise.
6708 * region-model.cc (selftest::test_stack_frames): Likewise.
6709 (selftest::test_state_merging): Likewise.
6710 * svalue.cc (svalue::maybe_get_region): New.
6711 * svalue.h (svalue::maybe_get_region): New decl.
6713 2021-07-15 David Malcolm <dmalcolm@redhat.com>
6715 * svalue.h (is_a_helper <placeholder_svalue *>::test): Make
6716 param and template param const.
6717 (is_a_helper <widening_svalue *>::test): Likewise.
6718 (is_a_helper <compound_svalue *>::test): Likewise.
6719 (is_a_helper <conjured_svalue *>::test): Likewise.
6721 2021-07-15 David Malcolm <dmalcolm@redhat.com>
6726 * analyzer.cc (maybe_reconstruct_from_def_stmt): Split out
6727 GIMPLE_ASSIGN case into...
6728 (get_diagnostic_tree_for_gassign_1): New.
6729 (get_diagnostic_tree_for_gassign): New.
6730 * analyzer.h (get_diagnostic_tree_for_gassign): New decl.
6731 * analyzer.opt (Wanalyzer-write-to-string-literal): New.
6732 * constraint-manager.cc (class svalue_purger): New.
6733 (constraint_manager::purge_state_involving): New.
6734 * constraint-manager.h
6735 (constraint_manager::purge_state_involving): New.
6736 * diagnostic-manager.cc (saved_diagnostic::supercedes_p): New.
6737 (dedupe_winners::handle_interactions): New.
6738 (diagnostic_manager::emit_saved_diagnostics): Call it.
6739 * diagnostic-manager.h (saved_diagnostic::supercedes_p): New decl.
6740 * engine.cc (impl_region_model_context::warn): Convert return type
6741 to bool. Return false if the diagnostic isn't saved.
6742 (impl_region_model_context::purge_state_involving): New.
6743 (impl_sm_context::get_state): Use NULL ctxt when querying old
6745 (impl_sm_context::set_next_state): Use new sval when querying old
6747 (class dump_path_diagnostic): Move to region-model.cc
6748 (exploded_node::on_stmt): Move to on_stmt_pre and on_stmt_post.
6749 Remove call to purge_state_involving.
6750 (exploded_node::on_stmt_pre): New, based on the above. Move most
6751 of it to region_model::on_stmt_pre.
6752 (exploded_node::on_stmt_post): Likewise, moving to
6753 region_model::on_stmt_post.
6754 (class stale_jmp_buf): Fix parent class to use curiously recurring
6756 (feasibility_state::maybe_update_for_edge): Call on_call_pre and
6757 on_call_post on gcalls.
6758 * exploded-graph.h (impl_region_model_context::warn): Return bool.
6759 (impl_region_model_context::purge_state_involving): New decl.
6760 (exploded_node::on_stmt_pre): New decl.
6761 (exploded_node::on_stmt_post): New decl.
6762 * pending-diagnostic.h (pending_diagnostic::use_of_uninit_p): New.
6763 (pending_diagnostic::supercedes_p): New.
6764 * program-state.cc (sm_state_map::get_state): Inherit state for
6765 conjured_svalue as well as initial_svalue.
6766 (sm_state_map::purge_state_involving): Also support SK_CONJURED.
6767 * region-model-impl-calls.cc (call_details::get_uncertainty):
6768 Handle m_ctxt being NULL.
6769 (call_details::get_or_create_conjured_svalue): New.
6770 (region_model::impl_call_fgets): New.
6771 (region_model::impl_call_fread): New.
6772 * region-model-manager.cc
6773 (region_model_manager::get_or_create_initial_value): Return an
6774 uninitialized poisoned value for regions that can't have initial
6776 * region-model-reachability.cc
6777 (reachable_regions::mark_escaped_clusters): Handle ctxt being
6779 * region-model.cc (region_to_value_map::purge_state_involving): New.
6780 (poisoned_value_diagnostic::use_of_uninit_p): New.
6781 (poisoned_value_diagnostic::emit): Handle POISON_KIND_UNINIT.
6782 (poisoned_value_diagnostic::describe_final_event): Likewise.
6783 (region_model::check_for_poison): New.
6784 (region_model::on_assignment): Call it.
6785 (class dump_path_diagnostic): Move here from engine.cc.
6786 (region_model::on_stmt_pre): New, based on exploded_node::on_stmt.
6787 (region_model::on_call_pre): Move the setting of the LHS to a
6788 conjured svalue to before the checks for specific functions.
6789 Handle "fgets", "fgets_unlocked", and "fread".
6790 (region_model::purge_state_involving): New.
6791 (region_model::handle_unrecognized_call): Handle ctxt being NULL.
6792 (region_model::get_rvalue): Call check_for_poison.
6793 (selftest::test_stack_frames): Use NULL for context when getting
6794 uninitialized rvalue.
6795 (selftest::test_alloca): Likewise.
6796 * region-model.h (region_to_value_map::purge_state_involving): New
6798 (call_details::get_or_create_conjured_svalue): New decl.
6799 (region_model::on_stmt_pre): New decl.
6800 (region_model::purge_state_involving): New decl.
6801 (region_model::impl_call_fgets): New decl.
6802 (region_model::impl_call_fread): New decl.
6803 (region_model::check_for_poison): New decl.
6804 (region_model_context::warn): Return bool.
6805 (region_model_context::purge_state_involving): New.
6806 (noop_region_model_context::warn): Return bool.
6807 (noop_region_model_context::purge_state_involving): New.
6808 (test_region_model_context:: warn): Return bool.
6809 * region.cc (region::get_memory_space): New.
6810 (region::can_have_initial_svalue_p): New.
6811 (region::involves_p): New.
6812 * region.h (enum memory_space): New.
6813 (region::get_memory_space): New decl.
6814 (region::can_have_initial_svalue_p): New decl.
6815 (region::involves_p): New decl.
6816 * sm-malloc.cc (use_after_free::supercedes_p): New.
6817 * store.cc (binding_cluster::purge_state_involving): New.
6818 (store::purge_state_involving): New.
6819 * store.h (class symbolic_binding): New forward decl.
6820 (binding_key::dyn_cast_symbolic_binding): New.
6821 (symbolic_binding::dyn_cast_symbolic_binding): New.
6822 (binding_cluster::purge_state_involving): New.
6823 (store::purge_state_involving): New.
6824 * svalue.cc (svalue::can_merge_p): Reject attempts to merge
6825 poisoned svalues with other svalues, so that we identify
6826 paths in which a variable is conditionally uninitialized.
6827 (involvement_visitor::visit_conjured_svalue): New.
6828 (svalue::involves_p): Also handle SK_CONJURED.
6829 (poison_kind_to_str): Handle POISON_KIND_UNINIT.
6830 (poisoned_svalue::maybe_fold_bits_within): New.
6831 * svalue.h (enum poison_kind): Add POISON_KIND_UNINIT.
6832 (poisoned_svalue::maybe_fold_bits_within): New decl.
6834 2021-07-15 David Malcolm <dmalcolm@redhat.com>
6836 * analyzer.opt (fdump-analyzer-exploded-paths): New.
6837 * diagnostic-manager.cc
6838 (diagnostic_manager::emit_saved_diagnostic): Implement it.
6839 * engine.cc (exploded_path::dump_to_pp): Add ext_state param and
6840 use it to dump states if non-NULL.
6841 (exploded_path::dump): Likewise.
6842 (exploded_path::dump_to_file): New.
6843 * exploded-graph.h (exploded_path::dump_to_pp): Add ext_state
6845 (exploded_path::dump): Likewise.
6846 (exploded_path::dump): Likewise.
6847 (exploded_path::dump_to_file): New.
6849 2021-07-15 David Malcolm <dmalcolm@redhat.com>
6851 * analyzer.cc (fixup_tree_for_diagnostic_1): Use DECL_DEBUG_EXPR
6853 * engine.cc (readability): Likewise.
6855 2021-07-15 David Malcolm <dmalcolm@redhat.com>
6857 * state-purge.cc (self_referential_phi_p): New.
6858 (state_purge_per_ssa_name::process_point): Don't purge an SSA name
6859 at its def-stmt if the def-stmt is self-referential.
6861 2021-07-07 David Malcolm <dmalcolm@redhat.com>
6863 * diagnostic-manager.cc (null_assignment_sm_context::get_state):
6865 (null_assignment_sm_context::set_next_state): New overload.
6866 (null_assignment_sm_context::get_diagnostic_tree): New.
6867 * engine.cc (impl_sm_context::get_state): New overload.
6868 (impl_sm_context::set_next_state): New overload.
6869 (impl_sm_context::get_diagnostic_tree): New overload.
6870 (impl_region_model_context::on_condition): Convert params from
6871 tree to const svalue *.
6872 * exploded-graph.h (impl_region_model_context::on_condition):
6874 * region-model.cc (region_model::on_call_pre): Move handling of
6875 internal calls to before checking for get_fndecl_for_call.
6876 (region_model::add_constraints_from_binop): New.
6877 (region_model::add_constraint): Split out into a new overload
6878 working on const svalue * rather than tree. Call
6879 add_constraints_from_binop. Drop call to
6880 add_any_constraints_from_ssa_def_stmt.
6881 (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
6882 (region_model::add_any_constraints_from_gassign): Delete.
6883 (region_model::add_any_constraints_from_gcall): Delete.
6885 (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
6886 (region_model::add_any_constraints_from_gassign): Delete.
6887 (region_model::add_any_constraints_from_gcall): Delete.
6888 (region_model::add_constraint): Add overload decl.
6889 (region_model::add_constraints_from_binop): New decl.
6890 (region_model_context::on_condition): Convert params from tree to
6892 (noop_region_model_context::on_condition): Likewise.
6893 * sm-file.cc (fileptr_state_machine::condition): Likewise.
6894 * sm-malloc.cc (malloc_state_machine::on_condition): Likewise.
6895 * sm-pattern-test.cc: Include tristate.h, selftest.h,
6896 analyzer/call-string.h, analyzer/program-point.h,
6897 analyzer/store.h, and analyzer/region-model.h.
6898 (pattern_test_state_machine::on_condition): Convert params from tree to
6900 * sm-sensitive.cc (sensitive_state_machine::on_condition): Delete.
6901 * sm-signal.cc (signal_state_machine::on_condition): Delete.
6902 * sm-taint.cc (taint_state_machine::on_condition): Convert params
6903 from tree to const svalue *.
6904 * sm.cc: Include tristate.h, selftest.h, analyzer/call-string.h,
6905 analyzer/program-point.h, analyzer/store.h, and
6906 analyzer/region-model.h.
6907 (any_pointer_p): Add overload taking const svalue *sval.
6908 * sm.h (any_pointer_p): Add overload taking const svalue *sval.
6909 (state_machine::on_condition): Convert params from tree to
6910 const svalue *. Provide no-op default implementation.
6911 (sm_context::get_state): Add overload taking const svalue *sval.
6912 (sm_context::set_next_state): Likewise.
6913 (sm_context::on_transition): Likewise.
6914 (sm_context::get_diagnostic_tree): Likewise.
6915 * svalue.cc (svalue::all_zeroes_p): New.
6916 (constant_svalue::all_zeroes_p): New.
6917 (repeated_svalue::all_zeroes_p): Convert to vfunc.
6918 * svalue.h (svalue::all_zeroes_p): New decl.
6919 (constant_svalue::all_zeroes_p): New decl.
6920 (repeated_svalue::all_zeroes_p): Convert decl to vfunc.
6922 2021-06-30 David Malcolm <dmalcolm@redhat.com>
6925 * analyzer.h (class repeated_svalue): New forward decl.
6926 (class bits_within_svalue): New forward decl.
6927 (class sized_region): New forward decl.
6928 (get_field_at_bit_offset): New forward decl.
6929 * engine.cc (exploded_graph::get_or_create_node): Validate the
6931 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
6932 Validate the states at each stage.
6933 * program-state.cc (program_state::validate): Validate
6935 * region-model-impl-calls.cc (region_model::impl_call_memset):
6936 Replace special-case logic for handling constant sizes with
6937 a call to fill_region of a sized_region with the given fill value.
6938 * region-model-manager.cc (maybe_undo_optimize_bit_field_compare):
6940 (region_model_manager::maybe_fold_sub_svalue): Fold element-based
6941 subregions of an initial value into initial values of an element.
6942 Fold subvalues of repeated svalues.
6943 (region_model_manager::maybe_fold_repeated_svalue): New.
6944 (region_model_manager::get_or_create_repeated_svalue): New.
6945 (get_bit_range_for_field): New.
6946 (get_byte_range_for_field): New.
6947 (get_field_at_byte_range): New.
6948 (region_model_manager::maybe_fold_bits_within_svalue): New.
6949 (region_model_manager::get_or_create_bits_within): New.
6950 (region_model_manager::get_sized_region): New.
6951 (region_model_manager::log_stats): Update for addition of
6952 m_repeated_values_map, m_bits_within_values_map, and
6954 * region-model.cc (region_model::validate): New.
6955 (region_model::on_assignment): Drop enum binding_kind.
6956 (region_model::get_initial_value_for_global): Likewise.
6957 (region_model::get_rvalue_for_bits): Replace body with call to
6958 get_or_create_bits_within.
6959 (region_model::get_capacity): Handle RK_SIZED.
6960 (region_model::set_value): Drop enum binding_kind.
6961 (region_model::fill_region): New.
6962 (region_model::get_representative_path_var_1): Handle RK_SIZED.
6963 * region-model.h (visitor::visit_repeated_svalue): New.
6964 (visitor::visit_bits_within_svalue): New.
6965 (region_model_manager::get_or_create_repeated_svalue): New decl.
6966 (region_model_manager::get_or_create_bits_within): New decl.
6967 (region_model_manager::get_sized_region): New decl.
6968 (region_model_manager::maybe_fold_repeated_svalue): New decl.
6969 (region_model_manager::maybe_fold_bits_within_svalue): New decl.
6970 (region_model_manager::repeated_values_map_t): New typedef.
6971 (region_model_manager::m_repeated_values_map): New field.
6972 (region_model_manager::bits_within_values_map_t): New typedef.
6973 (region_model_manager::m_bits_within_values_map): New field.
6974 (region_model_manager::m_sized_regions): New field.
6975 (region_model::fill_region): New decl.
6976 * region.cc (region::get_base_region): Handle RK_SIZED.
6977 (region::base_region_p): Likewise.
6978 (region::get_byte_size_sval): New.
6979 (get_field_at_bit_offset): Make non-static.
6980 (region::calc_offset): Move implementation of cases to
6981 get_relative_concrete_offset vfunc implementations. Handle
6983 (region::get_relative_concrete_offset): New.
6984 (decl_region::get_svalue_for_initializer): Drop enum binding_kind.
6985 (field_region::get_relative_concrete_offset): New, from
6986 region::calc_offset.
6987 (element_region::get_relative_concrete_offset): Likewise.
6988 (offset_region::get_relative_concrete_offset): Likewise.
6989 (sized_region::accept): New.
6990 (sized_region::dump_to_pp): New.
6991 (sized_region::get_byte_size): New.
6992 (sized_region::get_bit_size): New.
6993 * region.h (enum region_kind): Add RK_SIZED.
6994 (region::dyn_cast_sized_region): New.
6995 (region::get_byte_size): Make virtual.
6996 (region::get_bit_size): Likewise.
6997 (region::get_byte_size_sval): New decl.
6998 (region::get_relative_concrete_offset): New decl.
6999 (field_region::get_relative_concrete_offset): New decl.
7000 (element_region::get_relative_concrete_offset): Likewise.
7001 (offset_region::get_relative_concrete_offset): Likewise.
7002 (class sized_region): New.
7003 * store.cc (binding_kind_to_string): Delete.
7004 (binding_key::make): Drop enum binding_kind.
7005 (binding_key::dump_to_pp): Delete.
7006 (binding_key::cmp_ptrs): Drop enum binding_kind.
7007 (bit_range::contains_p): New.
7008 (byte_range::dump): New.
7009 (byte_range::contains_p): New.
7010 (byte_range::cmp): New.
7011 (concrete_binding::dump_to_pp): Drop enum binding_kind.
7012 (concrete_binding::cmp_ptr_ptr): Likewise.
7013 (symbolic_binding::dump_to_pp): Likewise.
7014 (symbolic_binding::cmp_ptr_ptr): Likewise.
7015 (binding_map::apply_ctor_val_to_range): Likewise.
7016 (binding_map::apply_ctor_pair_to_child_region): Likewise.
7017 (binding_map::get_overlapping_bindings): New.
7018 (binding_map::remove_overlapping_bindings): New.
7019 (binding_cluster::validate): New.
7020 (binding_cluster::bind): Drop enum binding_kind.
7021 (binding_cluster::bind_compound_sval): Likewise.
7022 (binding_cluster::purge_region): Likewise.
7023 (binding_cluster::zero_fill_region): Reimplement in terms of...
7024 (binding_cluster::fill_region): New.
7025 (binding_cluster::mark_region_as_unknown): Drop enum binding_kind.
7026 (binding_cluster::get_binding): Likewise.
7027 (binding_cluster::get_binding_recursive): Likewise.
7028 (binding_cluster::get_any_binding): Likewise.
7029 (binding_cluster::maybe_get_compound_binding): Reimplement.
7030 (binding_cluster::get_overlapping_bindings): Delete.
7031 (binding_cluster::remove_overlapping_bindings): Reimplement in
7032 terms of binding_map::remove_overlapping_bindings.
7033 (binding_cluster::can_merge_p): Update for removal of
7035 (binding_cluster::on_unknown_fncall): Drop enum binding_kind.
7036 (binding_cluster::maybe_get_simple_value): Likewise.
7037 (store_manager::get_concrete_binding): Likewise.
7038 (store_manager::get_symbolic_binding): Likewise.
7039 (store::validate): New.
7040 (store::set_value): Drop enum binding_kind.
7041 (store::zero_fill_region): Reimplement in terms of...
7042 (store::fill_region): New.
7043 (selftest::test_binding_key_overlap): Drop enum binding_kind.
7044 * store.h (enum binding_kind): Delete.
7045 (binding_kind_to_string): Delete decl.
7046 (binding_key::make): Drop enum binding_kind.
7047 (binding_key::dump_to_pp): Make pure virtual.
7048 (binding_key::get_kind): Delete.
7049 (binding_key::mark_deleted): Delete.
7050 (binding_key::mark_empty): Delete.
7051 (binding_key::is_deleted): Delete.
7052 (binding_key::is_empty): Delete.
7053 (binding_key::binding_key): Delete.
7054 (binding_key::impl_hash): Delete.
7055 (binding_key::impl_eq): Delete.
7056 (binding_key::m_kind): Delete.
7057 (bit_range::get_last_bit_offset): New.
7058 (bit_range::contains_p): New.
7059 (byte_range::contains_p): New.
7060 (byte_range::operator==): New.
7061 (byte_range::get_start_byte_offset): New.
7062 (byte_range::get_next_byte_offset): New.
7063 (byte_range::get_last_byte_offset): New.
7064 (byte_range::as_bit_range): New.
7065 (byte_range::cmp): New.
7066 (concrete_binding::concrete_binding): Drop enum binding_kind.
7067 (concrete_binding::hash): Likewise.
7068 (concrete_binding::operator==): Likewise.
7069 (concrete_binding::mark_deleted): New.
7070 (concrete_binding::mark_empty): New.
7071 (concrete_binding::is_deleted): New.
7072 (concrete_binding::is_empty): New.
7073 (default_hash_traits<ana::concrete_binding>::empty_zero_p): Make false.
7074 (symbolic_binding::symbolic_binding): Drop enum binding_kind.
7075 (symbolic_binding::hash): Likewise.
7076 (symbolic_binding::operator==): Likewise.
7077 (symbolic_binding::mark_deleted): New.
7078 (symbolic_binding::mark_empty): New.
7079 (symbolic_binding::is_deleted): New.
7080 (symbolic_binding::is_empty): New.
7081 (binding_map::remove_overlapping_bindings): New decl.
7082 (binding_map::get_overlapping_bindings): New decl.
7083 (binding_cluster::validate): New decl.
7084 (binding_cluster::bind): Drop enum binding_kind.
7085 (binding_cluster::fill_region): New decl.
7086 (binding_cluster::get_binding): Drop enum binding_kind.
7087 (binding_cluster::get_binding_recursive): Likewise.
7088 (binding_cluster::get_overlapping_bindings): Delete.
7089 (store::validate): New decl.
7090 (store::set_value): Drop enum binding_kind.
7091 (store::fill_region): New decl.
7092 (store_manager::get_concrete_binding): Drop enum binding_kind.
7093 (store_manager::get_symbolic_binding): Likewise.
7094 * svalue.cc (svalue::cmp_ptr): Handle SK_REPEATED and
7096 (svalue::extract_bit_range): New.
7097 (svalue::maybe_fold_bits_within): New.
7098 (constant_svalue::maybe_fold_bits_within): New.
7099 (unknown_svalue::maybe_fold_bits_within): New.
7100 (unaryop_svalue::maybe_fold_bits_within): New.
7101 (repeated_svalue::repeated_svalue): New.
7102 (repeated_svalue::dump_to_pp): New.
7103 (repeated_svalue::accept): New.
7104 (repeated_svalue::all_zeroes_p): New.
7105 (repeated_svalue::maybe_fold_bits_within): New.
7106 (bits_within_svalue::bits_within_svalue): New.
7107 (bits_within_svalue::dump_to_pp): New.
7108 (bits_within_svalue::maybe_fold_bits_within): New.
7109 (bits_within_svalue::accept): New.
7110 (bits_within_svalue::implicitly_live_p): New.
7111 (compound_svalue::maybe_fold_bits_within): New.
7112 * svalue.h (enum svalue_kind): Add SK_REPEATED and SK_BITS_WITHIN.
7113 (svalue::dyn_cast_repeated_svalue): New.
7114 (svalue::dyn_cast_bits_within_svalue): New.
7115 (svalue::extract_bit_range): New decl.
7116 (svalue::maybe_fold_bits_within): New vfunc decl.
7117 (region_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
7118 (region_svalue::key_t::is_empty): Likewise.
7119 (default_hash_traits<region_svalue::key_t>::empty_zero_p): Make false.
7120 (constant_svalue::maybe_fold_bits_within): New.
7121 (unknown_svalue::maybe_fold_bits_within): New.
7122 (poisoned_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
7123 (poisoned_svalue::key_t::is_empty): Likewise.
7124 (default_hash_traits<poisoned_svalue::key_t>::empty_zero_p): Make
7126 (setjmp_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
7127 (setjmp_svalue::key_t::is_empty): Likewise.
7128 (default_hash_traits<setjmp_svalue::key_t>::empty_zero_p): Make
7130 (unaryop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
7131 (unaryop_svalue::key_t::is_empty): Likewise.
7132 (unaryop_svalue::maybe_fold_bits_within): New.
7133 (default_hash_traits<unaryop_svalue::key_t>::empty_zero_p): Make
7135 (binop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
7136 (binop_svalue::key_t::is_empty): Likewise.
7137 (default_hash_traits<binop_svalue::key_t>::empty_zero_p): Make
7139 (sub_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
7140 (sub_svalue::key_t::is_empty): Likewise.
7141 (default_hash_traits<sub_svalue::key_t>::empty_zero_p): Make
7143 (class repeated_svalue): New.
7144 (is_a_helper <const repeated_svalue *>::test): New.
7145 (struct default_hash_traits<repeated_svalue::key_t>): New.
7146 (class bits_within_svalue): New.
7147 (is_a_helper <const bits_within_svalue *>::test): New.
7148 (struct default_hash_traits<bits_within_svalue::key_t>): New.
7149 (widening_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
7150 (widening_svalue::key_t::is_empty): Likewise.
7151 (default_hash_traits<widening_svalue::key_t>::empty_zero_p): Make
7153 (compound_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
7154 (compound_svalue::key_t::is_empty): Likewise.
7155 (compound_svalue::maybe_fold_bits_within): New.
7156 (default_hash_traits<compound_svalue::key_t>::empty_zero_p): Make
7159 2021-06-28 David Malcolm <dmalcolm@redhat.com>
7161 * analyzer.h (byte_offset_t): New typedef.
7162 * store.cc (bit_range::dump_to_pp): Dump as a byte range if
7164 (bit_range::as_byte_range): New.
7165 (byte_range::dump_to_pp): New.
7166 * store.h (class byte_range): New forward decl.
7167 (struct bit_range): Add comment.
7168 (bit_range::as_byte_range): New decl.
7169 (struct byte_range): New.
7171 2021-06-22 David Malcolm <dmalcolm@redhat.com>
7174 * region-model.cc (compat_types_p): New function.
7175 (region_model::create_region_for_heap_alloc): Convert assertion to
7177 (region_model::create_region_for_alloca): Likewise.
7179 2021-06-18 David Malcolm <dmalcolm@redhat.com>
7181 * store.cc (binding_cluster::get_any_binding): Make symbolic reads
7182 from a cluster with concrete bindings return unknown.
7184 2021-06-18 David Malcolm <dmalcolm@redhat.com>
7186 * region-model-manager.cc
7187 (region_model_manager::get_or_create_int_cst): New.
7188 (region_model_manager::maybe_undo_optimize_bit_field_compare): Use
7189 it to simplify away a local tree.
7190 * region-model.cc (region_model::on_setjmp): Likewise.
7191 (region_model::on_longjmp): Likewise.
7192 * region-model.h (region_model_manager::get_or_create_int_cst):
7194 * store.cc (binding_cluster::zero_fill_region): Use it to simplify
7197 2021-06-18 David Malcolm <dmalcolm@redhat.com>
7199 * checker-path.cc (class custom_event): Make abstract to allow for
7200 custom vfuncs, splitting existing implementation into...
7201 (class precanned_custom_event): New subclass.
7202 (custom_event::get_desc): Move to...
7203 (precanned_custom_event::get_desc): ...subclass.
7204 * checker-path.h (class custom_event): Make abstract to allow for
7205 custom vfuncs, splitting existing implementation into...
7206 (class precanned_custom_event): New subclass.
7207 * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
7208 Use precanned_custom_event.
7210 (stale_jmp_buf::maybe_add_custom_events_for_superedge): Likewise.
7211 * sm-signal.cc (signal_delivery_edge_info_t::add_events_to_path):
7214 2021-06-15 David Malcolm <dmalcolm@redhat.com>
7218 * engine.cc: Include "target.h".
7219 (impl_run_checkers): Log BITS_BIG_ENDIAN, BYTES_BIG_ENDIAN, and
7221 * region-model-manager.cc
7222 (region_model_manager::maybe_fold_binop): Move support for masking
7223 via ARG0 & CST into...
7224 (region_model_manager::maybe_undo_optimize_bit_field_compare):
7225 ...this new function. Flatten by converting from nested
7226 conditionals to a series of early return statements to reject
7227 failures. Reject if type is not unsigned_char_type_node.
7228 Handle BYTES_BIG_ENDIAN when determining which bits are bound
7231 (region_model_manager::maybe_undo_optimize_bit_field_compare):
7233 * store.cc (bit_range::dump): New function.
7234 * store.h (bit_range::dump): New decl.
7236 2021-06-15 David Malcolm <dmalcolm@redhat.com>
7238 * engine.cc (exploded_node::on_stmt): Handle __analyzer_dump_capacity.
7239 (exploded_node::on_stmt): Drop m_sm_changes from on_stmt_flags.
7240 (state_change_requires_new_enode_p): New function...
7241 (exploded_graph::process_node): Call it, rather than querying
7242 flags.m_sm_changes, so that dynamic-extent differences can also
7243 trigger the splitting of nodes.
7244 * exploded-graph.h (struct on_stmt_flags): Drop field m_sm_changes.
7245 * program-state.cc (program_state::detect_leaks): Purge dead
7246 heap-allocated regions from dynamic extents.
7247 (selftest::test_program_state_1): Fix type of "size_in_bytes".
7248 (selftest::test_program_state_merging): Likewise.
7249 * region-model-impl-calls.cc
7250 (region_model::impl_call_analyzer_dump_capacity): New.
7251 (region_model::impl_call_free): Remove dynamic extents from the
7253 * region-model-reachability.h
7254 (reachable_regions::begin_mutable_base_regs): New.
7255 (reachable_regions::end_mutable_base_regs): New.
7256 * region-model.cc: Include "tree-object-size.h".
7257 (region_model::region_model): Support new field m_dynamic_extents.
7258 (region_model::operator=): Likewise.
7259 (region_model::operator==): Likewise.
7260 (region_model::dump_to_pp): Dump sizes of dynamic regions.
7261 (region_model::handle_unrecognized_call): Purge dynamic extents
7262 from any regions that have escaped mutably:.
7263 (region_model::get_capacity): New function.
7264 (region_model::add_constraint): Unset dynamic extents when a
7265 heap-allocated region's address is NULL.
7266 (region_model::unbind_region_and_descendents): Purge dynamic
7267 extents of unbound regions.
7268 (region_model::can_merge_with_p): Call
7269 m_dynamic_extents.can_merge_with_p.
7270 (region_model::create_region_for_heap_alloc): Assert that
7271 size_in_bytes's type is compatible with size_type_node. Update
7272 for renaming of record_dynamic_extents to set_dynamic_extents.
7273 (region_model::create_region_for_alloca): Likewise.
7274 (region_model::record_dynamic_extents): Rename to...
7275 (region_model::set_dynamic_extents): ...this. Assert that
7276 size_in_bytes's type is compatible with size_type_node. Add it
7277 to the m_dynamic_extents map.
7278 (region_model::get_dynamic_extents): New.
7279 (region_model::unset_dynamic_extents): New.
7280 (selftest::test_state_merging): Fix type of "size".
7281 (selftest::test_malloc_constraints): Likewise.
7282 (selftest::test_malloc): Verify dynamic extents.
7283 (selftest::test_alloca): Likewise.
7284 * region-model.h (region_to_value_map::is_empty): New.
7285 (region_model::dynamic_extents_t): New typedef.
7286 (region_model::impl_call_analyzer_dump_capacity): New decl.
7287 (region_model::get_dynamic_extents): New function.
7288 (region_model::get_dynamic_extents): New decl.
7289 (region_model::set_dynamic_extents): New decl.
7290 (region_model::unset_dynamic_extents): New decl.
7291 (region_model::get_capacity): New decl.
7292 (region_model::record_dynamic_extents): Rename to set_dynamic_extents.
7293 (region_model::m_dynamic_extents): New field.
7295 2021-06-15 David Malcolm <dmalcolm@redhat.com>
7297 * region-model.cc (region_to_value_map::operator=): New.
7298 (region_to_value_map::operator==): New.
7299 (region_to_value_map::dump_to_pp): New.
7300 (region_to_value_map::dump): New.
7301 (region_to_value_map::can_merge_with_p): New.
7302 * region-model.h (class region_to_value_map): New class.
7304 2021-06-13 Trevor Saunders <tbsaunde@tbsaunde.org>
7306 * call-string.cc (call_string::call_string): Use range based for
7307 to iterate over vec<>.
7308 (call_string::to_json): Likewise.
7309 (call_string::hash): Likewise.
7310 (call_string::calc_recursion_depth): Likewise.
7311 * checker-path.cc (checker_path::fixup_locations): Likewise.
7312 * constraint-manager.cc (equiv_class::equiv_class): Likewise.
7313 (equiv_class::to_json): Likewise.
7314 (equiv_class::hash): Likewise.
7315 (constraint_manager::to_json): Likewise.
7316 * engine.cc (impl_region_model_context::on_svalue_leak):
7318 (on_liveness_change): Likewise.
7319 (impl_region_model_context::on_unknown_change): Likewise.
7320 * program-state.cc (sm_state_map::set_state): Likewise.
7321 * region-model.cc (test_canonicalization_4): Likewise.
7323 2021-06-11 David Malcolm <dmalcolm@redhat.com>
7325 * engine.cc (worklist::key_t::cmp): Move sort by call_string to
7328 2021-06-09 David Malcolm <dmalcolm@redhat.com>
7330 * region-model.cc (region_model::get_lvalue_1): Make const.
7331 (region_model::get_lvalue): Likewise.
7332 (region_model::get_rvalue_1): Likewise.
7333 (region_model::get_rvalue): Likewise.
7334 (region_model::deref_rvalue): Likewise.
7335 (region_model::get_rvalue_for_bits): Likewise.
7336 * region-model.h (region_model::get_lvalue): Likewise.
7337 (region_model::get_rvalue): Likewise.
7338 (region_model::deref_rvalue): Likewise.
7339 (region_model::get_rvalue_for_bits): Likewise.
7340 (region_model::get_lvalue_1): Likewise.
7341 (region_model::get_rvalue_1): Likewise.
7343 2021-06-08 David Malcolm <dmalcolm@redhat.com>
7346 * region-model-manager.cc
7347 (region_model_manager::maybe_fold_binop): Add support for folding
7348 BIT_AND_EXPR of compound_svalue and a mask constant.
7349 * region-model.cc (region_model::get_rvalue_1): Implement
7350 BIT_FIELD_REF in terms of...
7351 (region_model::get_rvalue_for_bits): New function.
7352 * region-model.h (region_model::get_rvalue_for_bits): New decl.
7353 * store.cc (bit_range::from_mask): New function.
7354 (selftest::test_bit_range_intersects_p): New selftest.
7355 (selftest::assert_bit_range_from_mask_eq): New.
7356 (ASSERT_BIT_RANGE_FROM_MASK_EQ): New macro.
7357 (selftest::assert_no_bit_range_from_mask_eq): New.
7358 (ASSERT_NO_BIT_RANGE_FROM_MASK): New macro.
7359 (selftest::test_bit_range_from_mask): New selftest.
7360 (selftest::analyzer_store_cc_tests): Call the new selftests.
7361 * store.h (bit_range::intersects_p): New.
7362 (bit_range::from_mask): New decl.
7363 (concrete_binding::get_bit_range): New accessor.
7364 (store_manager::get_concrete_binding): New overload taking
7367 2021-06-08 David Malcolm <dmalcolm@redhat.com>
7369 * analyzer.h (int_size_in_bits): New decl.
7370 * region.cc (int_size_in_bits): New function.
7371 (region::get_bit_size): Reimplement in terms of the above.
7373 2021-06-08 David Malcolm <dmalcolm@redhat.com>
7375 * store.cc (concrete_binding::dump_to_pp): Move bulk of
7376 implementation to...
7377 (bit_range::dump_to_pp): ...this new function.
7378 (bit_range::cmp): New.
7379 (concrete_binding::overlaps_p): Update for use of bit_range.
7380 (concrete_binding::cmp_ptr_ptr): Likewise.
7381 * store.h (struct bit_range): New.
7382 (class concrete_binding): Replace fields m_start_bit_offset and
7383 m_size_in_bits with new field m_bit_range.
7385 2021-06-08 David Malcolm <dmalcolm@redhat.com>
7387 * svalue.h (conjured_svalue::iterator_t): Delete.
7389 2021-06-03 David Malcolm <dmalcolm@redhat.com>
7391 * store.h (store::get_direct_binding): Remove unused decl.
7392 (store::get_default_binding): Likewise.
7394 2021-06-03 David Malcolm <dmalcolm@redhat.com>
7396 * svalue.cc (poisoned_svalue::dump_to_pp): Dump type.
7397 (compound_svalue::dump_to_pp): Dump any type.
7399 2021-05-18 David Malcolm <dmalcolm@redhat.com>
7402 * sm-malloc.cc: Include "analyzer/function-set.h".
7403 (malloc_state_machine::on_stmt): Call unaffected_by_call_p and
7404 bail on the functions it recognizes.
7405 (malloc_state_machine::unaffected_by_call_p): New.
7407 2021-05-10 Martin Liska <mliska@suse.cz>
7409 * sm-file.cc (is_file_using_fn_p): Use startswith
7410 function instead of strncmp.
7412 2021-05-10 Martin Liska <mliska@suse.cz>
7414 * program-state.cc (program_state::operator=): Remove
7415 __cplusplus >= 201103.
7416 (program_state::program_state): Likewise.
7417 * program-state.h: Likewise.
7418 * region-model.h (class region_model): Remove dead code.
7420 2021-04-24 David Malcolm <dmalcolm@redhat.com>
7423 * sm-malloc.cc (free_of_non_heap::describe_state_change):
7424 Bulletproof against change.m_expr being NULL.
7426 2021-04-13 David Malcolm <dmalcolm@redhat.com>
7429 * supergraph.cc (saved_uids::make_uid_unique): New.
7430 (saved_uids::restore_uids): New.
7431 (supergraph::supergraph): Replace assignments to stmt->uid with
7432 calls to m_stmt_uids.make_uid_unique.
7433 (supergraph::~supergraph): New.
7434 * supergraph.h (class saved_uids): New.
7435 (supergraph::~supergraph): New decl.
7436 (supergraph::m_stmt_uids): New field.
7438 2021-04-10 David Malcolm <dmalcolm@redhat.com>
7441 * region-model.cc (region_model::on_assignment): Avoid NULL
7442 dereference if ctxt is NULL when assigning from a STRING_CST.
7444 2021-04-08 David Malcolm <dmalcolm@redhat.com>
7449 (impl_region_model_context::impl_region_model_context): Add
7450 uncertainty param and use it to initialize m_uncertainty.
7451 (impl_region_model_context::get_uncertainty): New.
7452 (impl_sm_context::get_fndecl_for_call): Add NULL for new
7453 uncertainty param when constructing impl_region_model_context.
7454 (impl_sm_context::get_state): Likewise.
7455 (impl_sm_context::set_next_state): Likewise.
7456 (impl_sm_context::warn): Likewise.
7457 (exploded_node::on_stmt): Add uncertainty param
7458 and use it when constructing impl_region_model_context.
7459 (exploded_node::on_edge): Add uncertainty param and pass
7461 (exploded_node::detect_leaks): Create uncertainty_t and pass to
7462 impl_region_model_context.
7463 (exploded_graph::get_or_create_node): Create uncertainty_t and
7464 pass to prune_for_point.
7465 (maybe_process_run_of_before_supernode_enodes): Create
7466 uncertainty_t and pass to impl_region_model_context.
7467 (exploded_graph::process_node): Create uncertainty_t instances and
7468 pass around as needed.
7470 (impl_region_model_context::impl_region_model_context): Add
7472 (impl_region_model_context::get_uncertainty): New decl.
7473 (impl_region_model_context::m_uncertainty): New field.
7474 (exploded_node::on_stmt): Add uncertainty param.
7475 (exploded_node::on_edge): Likewise.
7476 * program-state.cc (sm_state_map::on_liveness_change): Get
7477 uncertainty from context and use it to unset sm-state from
7478 svalues as appropriate.
7479 (program_state::on_edge): Add uncertainty param and use it when
7480 constructing impl_region_model_context. Fix indentation.
7481 (program_state::prune_for_point): Add uncertainty param and use it
7482 when constructing impl_region_model_context.
7483 (program_state::detect_leaks): Get any uncertainty from ctxt and
7484 use it to get maybe-live svalues for dest_state, rather than
7485 definitely-live ones; use this when determining which svalues
7487 (selftest::test_program_state_merging): Create uncertainty_t and
7488 pass to impl_region_model_context.
7489 * program-state.h (program_state::on_edge): Add uncertainty param.
7490 (program_state::prune_for_point): Likewise.
7491 * region-model-impl-calls.cc (call_details::get_uncertainty): New.
7492 (region_model::impl_call_memcpy): Pass uncertainty to
7493 mark_region_as_unknown call.
7494 (region_model::impl_call_memset): Likewise.
7495 (region_model::impl_call_strcpy): Likewise.
7496 * region-model-reachability.cc (reachable_regions::handle_sval):
7497 Also add sval to m_mutable_svals.
7498 * region-model.cc (region_model::on_assignment): Pass any
7499 uncertainty from ctxt to the store::set_value call.
7500 (region_model::handle_unrecognized_call): Get any uncertainty from
7501 ctxt and use it to record mutable svalues at the unknown call.
7502 (region_model::get_reachable_svalues): Add uncertainty param and
7503 use it to mark any maybe-bound svalues as being reachable.
7504 (region_model::set_value): Pass any uncertainty from ctxt to the
7505 store::set_value call.
7506 (region_model::mark_region_as_unknown): Add uncertainty param and
7507 pass it on to the store::mark_region_as_unknown call.
7508 (region_model::update_for_call_summary): Add uncertainty param and
7509 pass it on to the region_model::mark_region_as_unknown call.
7510 * region-model.h (call_details::get_uncertainty): New decl.
7511 (region_model::get_reachable_svalues): Add uncertainty param.
7512 (region_model::mark_region_as_unknown): Add uncertainty param.
7513 (region_model_context::get_uncertainty): New vfunc.
7514 (noop_region_model_context::get_uncertainty): New vfunc
7516 * store.cc (dump_svalue_set): New.
7517 (uncertainty_t::dump_to_pp): New.
7518 (uncertainty_t::dump): New.
7519 (binding_cluster::clobber_region): Pass NULL for uncertainty to
7520 remove_overlapping_bindings.
7521 (binding_cluster::mark_region_as_unknown): Add uncertainty param
7522 and pass it to remove_overlapping_bindings.
7523 (binding_cluster::remove_overlapping_bindings): Add uncertainty param.
7524 Use it to record any svalues that were in clobbered bindings.
7525 (store::set_value): Add uncertainty param. Pass it to
7526 binding_cluster::mark_region_as_unknown when handling symbolic
7528 (store::mark_region_as_unknown): Add uncertainty param and pass it
7529 to binding_cluster::mark_region_as_unknown.
7530 (store::remove_overlapping_bindings): Add uncertainty param and
7531 pass it to binding_cluster::remove_overlapping_bindings.
7532 * store.h (binding_cluster::mark_region_as_unknown): Add
7534 (binding_cluster::remove_overlapping_bindings): Likewise.
7535 (store::set_value): Likewise.
7536 (store::mark_region_as_unknown): Likewise.
7538 2021-04-05 David Malcolm <dmalcolm@redhat.com>
7541 * analyzer.cc (maybe_reconstruct_from_def_stmt): Fix NULL
7542 dereference on calls with zero arguments.
7543 * sm-malloc.cc (malloc_state_machine::on_stmt): When handling
7544 __attribute__((nonnull)), only call get_diagnostic_tree if the
7545 result will be used.
7547 2021-04-05 David Malcolm <dmalcolm@redhat.com>
7550 * diagnostic-manager.cc
7551 (diagnostic_manager::prune_interproc_events): Use signed integers
7552 when subtracting one from path->num_events ().
7553 (diagnostic_manager::consolidate_conditions): Likewise. Convert
7554 next_idx to a signed int.
7556 2021-04-01 David Malcolm <dmalcolm@redhat.com>
7558 * diagnostic-manager.cc (diagnostic_manager::add_diagnostic): Make
7559 enode param non-constant, and call add_diagnostic on it. Add
7560 enode index to log message.
7561 (diagnostic_manager::add_diagnostic): Make enode param
7563 * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
7564 Likewise for both decls.
7566 (impl_region_model_context::impl_region_model_context): Likewise
7568 (impl_sm_context::impl_sm_context): Likewise.
7569 (impl_sm_context::m_enode_for_diag): Likewise.
7570 (exploded_node::dump_dot): Don't pass the diagnostic manager
7571 to dump_saved_diagnostics.
7572 (exploded_node::dump_saved_diagnostics): Drop param. Iterate
7573 directly through all saved diagnostics for the enode, rather
7574 than all saved diagnostics in the diagnostic_manager and
7576 (exploded_node::on_stmt): Make non-const.
7577 (exploded_node::on_edge): Likewise.
7578 (exploded_node::on_longjmp): Likewise.
7579 (exploded_node::detect_leaks): Likewise.
7580 (exploded_graph::get_or_create_node): Make enode_for_diag param
7582 (exploded_graph_annotator::print_enode): Iterate
7583 directly through all saved diagnostics for the enode, rather
7584 than all saved diagnostics in the diagnostic_manager and
7587 (impl_region_model_context::impl_region_model_context): Make
7588 enode_for_diag param non-constant.
7589 (impl_region_model_context::m_enode_for_diag): Likewise.
7590 (exploded_node::dump_saved_diagnostics): Drop param.
7591 (exploded_node::on_stmt): Make non-const.
7592 (exploded_node::on_edge): Likewise.
7593 (exploded_node::on_longjmp): Likewise.
7594 (exploded_node::detect_leaks): Likewise.
7595 (exploded_node::add_diagnostic): New.
7596 (exploded_node::get_num_diagnostics): New.
7597 (exploded_node::get_saved_diagnostic): New.
7598 (exploded_node::m_saved_diagnostics): New.
7599 (exploded_graph::get_or_create_node): Make enode_for_diag param
7601 * feasible-graph.cc (feasible_node::dump_dot): Drop
7602 diagnostic_manager from call to dump_saved_diagnostics.
7603 * program-state.cc (program_state::on_edge): Convert enode param
7604 to non-const pointer.
7605 (program_state::prune_for_point): Likewise for enode_for_diag
7607 * program-state.h (program_state::on_edge): Convert enode param
7608 to non-const pointer.
7609 (program_state::prune_for_point): Likewise for enode_for_diag
7612 2021-03-31 David Malcolm <dmalcolm@redhat.com>
7615 * analyzer.cc (maybe_reconstruct_from_def_stmt): New.
7616 (fixup_tree_for_diagnostic_1): New.
7617 (fixup_tree_for_diagnostic): New.
7618 * analyzer.h (fixup_tree_for_diagnostic): New decl.
7619 * checker-path.cc (call_event::get_desc): Call
7620 fixup_tree_for_diagnostic and use it for the call_with_state call.
7621 (warning_event::get_desc): Likewise for the final_event and
7622 make_label_text calls.
7623 * engine.cc (impl_region_model_context::on_state_leak): Likewise
7624 for the on_leak and add_diagnostic calls.
7625 * region-model.cc (region_model::get_representative_tree):
7626 Likewise for the result.
7628 2021-03-30 David Malcolm <dmalcolm@redhat.com>
7630 * region.h (region::dump_to_pp): Remove old decl.
7632 2021-03-30 David Malcolm <dmalcolm@redhat.com>
7634 * sm-file.cc (fileptr_state_machine::on_stmt): Only call
7635 get_diagnostic_tree if the result will be used.
7636 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
7637 (malloc_state_machine::on_deallocator_call): Likewise.
7638 (malloc_state_machine::on_realloc_call): Likewise.
7639 (malloc_state_machine::on_realloc_call): Likewise.
7641 (sensitive_state_machine::warn_for_any_exposure): Likewise.
7642 * sm-taint.cc (taint_state_machine::on_stmt): Likewise.
7644 2021-03-25 David Malcolm <dmalcolm@redhat.com>
7649 * engine.cc (exploded_node::on_stmt): Clear sm-state involving
7650 an SSA name at the def-stmt of that SSA name.
7651 * program-state.cc (sm_state_map::purge_state_involving): New.
7652 * program-state.h (sm_state_map::purge_state_involving): New decl.
7653 * region-model.cc (selftest::test_involves_p): New.
7654 (selftest::analyzer_region_model_cc_tests): Call it.
7655 * svalue.cc (class involvement_visitor): New class
7656 (svalue::involves_p): New.
7657 * svalue.h (svalue::involves_p): New decl.
7659 2021-03-19 David Malcolm <dmalcolm@redhat.com>
7662 * diagnostic-manager.cc (class epath_finder): Add
7663 DISABLE_COPY_AND_ASSIGN.
7665 2021-03-15 Martin Liska <mliska@suse.cz>
7667 * sm-file.cc (get_file_using_fns): Add missing comma in initializer.
7669 2021-03-11 David Malcolm <dmalcolm@redhat.com>
7672 * analyzer.opt (-param=analyzer-max-infeasible-edges=): New param.
7673 (fdump-analyzer-feasibility): New flag.
7674 * diagnostic-manager.cc: Include "analyzer/trimmed-graph.h" and
7675 "analyzer/feasible-graph.h".
7676 (epath_finder::epath_finder): Convert m_sep to a pointer and
7677 only create it if !flag_analyzer_feasibility.
7678 (epath_finder::~epath_finder): New.
7679 (epath_finder::m_sep): Convert to a pointer.
7680 (epath_finder::get_best_epath): Add param "diag_idx" and use it
7681 when logging. Rather than finding the shortest path and then
7682 checking feasibility, instead use explore_feasible_paths unless
7683 !flag_analyzer_feasibility, in which case simply use the shortest
7684 path, and note if it is infeasible. Update for m_sep becoming a
7686 (class feasible_worklist): New.
7687 (epath_finder::explore_feasible_paths): New.
7688 (epath_finder::process_worklist_item): New.
7689 (class dump_eg_with_shortest_path): New.
7690 (epath_finder::dump_trimmed_graph): New.
7691 (epath_finder::dump_feasible_graph): New.
7692 (saved_diagnostic::saved_diagnostic): Add "idx" param, using it
7694 (saved_diagnostic::to_json): Dump m_idx.
7695 (saved_diagnostic::calc_best_epath): Pass m_idx to get_best_epath.
7696 Remove assertion that m_problem was set when m_best_epath is NULL.
7697 (diagnostic_manager::add_diagnostic): Pass an index when created
7698 saved_diagnostic instances.
7699 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add
7701 (saved_diagnostic::get_index): New accessor.
7702 (saved_diagnostic::m_idx): New field.
7703 * engine.cc (exploded_node::dump_dot): Call args.dump_extra_info.
7705 (exploded_node::dump_processed_stmts): ...this new function and...
7706 (exploded_node::dump_saved_diagnostics): ...this new function.
7707 Add index of each diagnostic.
7708 (exploded_edge::dump_dot): Move bulk of code to...
7709 (exploded_edge::dump_dot_label): ...this new function.
7710 * exploded-graph.h (eg_traits::dump_args_t::dump_extra_info): New
7712 (exploded_node::dump_processed_stmts): New decl.
7713 (exploded_node::dump_saved_diagnostics): New decl.
7714 (exploded_edge::dump_dot_label): New decl.
7715 * feasible-graph.cc: New file.
7716 * feasible-graph.h: New file.
7717 * trimmed-graph.cc: New file.
7718 * trimmed-graph.h: New file.
7720 2021-03-11 David Malcolm <dmalcolm@redhat.com>
7722 * diagnostic-manager.cc (epath_finder::epath_finder):
7723 Update shortest_paths init for new param.
7725 2021-03-10 David Malcolm <dmalcolm@redhat.com>
7728 * engine.cc (exploded_path::feasible_p): Move "snodes_visited" and
7729 "model" locals into a new class feasibility_state. Move heart
7730 of per-edge processing into
7731 feasibility_state::maybe_update_for_edge.
7732 (feasibility_state::feasibility_state): New.
7733 (feasibility_state::maybe_update_for_edge): New, based on loop
7734 body in exploded_path::feasible_p.
7735 * exploded-graph.h (class feasibility_state): New.
7737 2021-03-10 David Malcolm <dmalcolm@redhat.com>
7740 (callgraph_superedge::dyn_cast_callgraph_superedge): New.
7741 (call_superedge::dyn_cast_callgraph_superedge): Delete.
7742 (return_superedge::dyn_cast_callgraph_superedge): Delete.
7744 2021-03-02 Martin Liska <mliska@suse.cz>
7746 * diagnostic-manager.cc (diagnostic_manager::emit_saved_diagnostics):
7749 2021-02-26 David Malcolm <dmalcolm@redhat.com>
7751 * engine.cc (exploded_path::exploded_path): New copy-ctor.
7752 * exploded-graph.h (exploded_path::operator=): Drop decl.
7754 2021-02-26 David Malcolm <dmalcolm@redhat.com>
7757 * diagnostic-manager.cc (class epath_finder): New.
7758 (epath_finder::get_best_epath): New.
7759 (saved_diagnostic::saved_diagnostic): Update for replacement of
7760 m_state and m_epath_length with m_best_epath.
7761 (saved_diagnostic::~saved_diagnostic): Delete m_best_epath.
7762 (saved_diagnostic::to_json): Update "path_length" to be optional.
7763 (saved_diagnostic::calc_best_epath): New, based on
7764 dedupe_winners::add and parts of dedupe_key::dedupe_key.
7765 (saved_diagnostic::get_epath_length): New.
7766 (saved_diagnostic::add_duplicate): New.
7767 (dedupe_key::dedupe_key): Drop epath param. Move invocation of
7768 stmt_finder to saved_diagnostic::calc_best_epath.
7769 (class dedupe_candidate): Delete.
7770 (class dedupe_hash_map_traits): Update to use saved_diagnotic *
7771 rather than dedupe_candidate * as the value_type/compare_type.
7772 (dedupe_winners::~dedupe_winners): Don't delete the values.
7773 (dedupe_winners::add): Convert param from shortest_exploded_paths to
7774 epath_finder. Drop "eg" param. Drop dedupe_candidate, moving
7775 path generation and feasiblity checking to
7776 epath_finder::get_best_epath. Update winner-selection for move
7777 of epaths from dedupe_candidate to saved_diagnostic.
7778 (dedupe_winners::emit_best): Update for removal of class
7780 (dedupe_winners::map_t): Update to use saved_diagnotic * rather
7781 than dedupe_candidate * as the value_type/compare_type.
7782 (diagnostic_manager::emit_saved_diagnostics): Move
7783 shortest_exploded_paths instance into epath_finder and pass that
7785 (diagnostic_manager::emit_saved_diagnostic): Drop epath, stmt
7786 and num_dupes params, instead getting these from the
7787 saved_diagnostic. Use correct location in inform_n call.
7788 * diagnostic-manager.h (class epath_finder): New forward decl.
7789 (saved_diagnostic::status): Drop enum.
7790 (saved_diagnostic::set_feasible): Drop.
7791 (saved_diagnostic::set_infeasible): Drop.
7792 (saved_diagnostic::get_status): Drop.
7793 (saved_diagnostic::calc_best_epath): New decl.
7794 (saved_diagnostic::get_best_epath): New decl.
7795 (saved_diagnostic::get_epath_length): New decl.
7796 (saved_diagnostic::set_epath_length): Drop.
7797 (saved_diagnostic::get_epath_length): Drop inline implementation.
7798 (saved_diagnostic::add_duplicate): New.
7799 (saved_diagnostic::get_num_dupes): New.
7800 (saved_diagnostic::m_d): Document ownership.
7801 (saved_diagnostic::m_trailing_eedge): Make const.
7802 (saved_diagnostic::m_status): Drop field.
7803 (saved_diagnostic::m_epath_length): Drop field.
7804 (saved_diagnostic::m_best_epath): New field.
7805 (saved_diagnostic::m_problem): Document ownership.
7806 (saved_diagnostic::m_duplicates): New field.
7807 (diagnostic_manager::emit_saved_diagnostic): Drop params epath,
7808 stmt, and num_dupes.
7809 * engine.cc (exploded_graph_annotator::print_saved_diagnostic):
7810 Update for changes to saved_diagnostic class.
7811 * exploded-graph.h (exploded_path::feasible_p): Drop unused
7814 2021-02-25 David Malcolm <dmalcolm@redhat.com>
7817 * region-model-impl-calls.cc (region_model::impl_call_realloc): New.
7818 * region-model.cc (region_model::on_call_pre): Call it.
7819 * region-model.h (region_model::impl_call_realloc): New decl.
7820 * sm-malloc.cc (enum wording): Add WORDING_REALLOCATED.
7821 (malloc_state_machine::m_realloc): New field.
7822 (use_after_free::describe_state_change): Add case for
7823 WORDING_REALLOCATED.
7824 (use_after_free::describe_final_event): Likewise.
7825 (malloc_state_machine::malloc_state_machine): Initialize
7827 (malloc_state_machine::on_stmt): Handle realloc by calling...
7828 (malloc_state_machine::on_realloc_call): New.
7830 2021-02-22 David Malcolm <dmalcolm@redhat.com>
7833 * engine.cc (exploded_node::on_stmt): Provide terminate_path
7834 flag as a way for on_call_pre to terminate the current analysis
7836 * region-model-impl-calls.cc (call_details::num_args): New.
7837 (region_model::impl_call_error): New.
7838 * region-model.cc (region_model::on_call_pre): Add param
7839 "out_terminate_path". Handle "error" and "error_at_line".
7840 * region-model.h (call_details::num_args): New decl.
7841 (region_model::on_call_pre): Add param "out_terminate_path".
7842 (region_model::impl_call_error): New decl.
7844 2021-02-17 David Malcolm <dmalcolm@redhat.com>
7847 * constraint-manager.cc (dead_svalue_purger::should_purge_p):
7848 Update for change to svalue::live_p.
7849 * program-state.cc (sm_state_map::on_liveness_change): Likewise.
7850 (program_state::detect_leaks): Likewise.
7851 * region-model-reachability.cc (reachable_regions::init_cluster):
7852 When dealing with a symbolic region, if the underlying pointer is
7853 implicitly live, add the region to the reachable regions.
7854 * region-model.cc (region_model::compare_initial_and_pointer):
7855 Move logic for detecting initial values of params to
7856 initial_svalue::initial_value_of_param_p.
7857 * svalue.cc (svalue::live_p): Convert "live_svalues" from a
7858 reference to a pointer; support it being NULL.
7859 (svalue::implicitly_live_p): Convert first param from a
7860 refererence to a pointer.
7861 (region_svalue::implicitly_live_p): Likewise.
7862 (constant_svalue::implicitly_live_p): Likewise.
7863 (initial_svalue::implicitly_live_p): Likewise. Treat the initial
7864 values of params for the top level frame as still live.
7865 (initial_svalue::initial_value_of_param_p): New function, taken
7866 from a test in region_model::compare_initial_and_pointer.
7867 (unaryop_svalue::implicitly_live_p): Convert first param from a
7868 refererence to a pointer.
7869 (binop_svalue::implicitly_live_p): Likewise.
7870 (sub_svalue::implicitly_live_p): Likewise.
7871 (unmergeable_svalue::implicitly_live_p): Likewise.
7872 * svalue.h (svalue::live_p): Likewise.
7873 (svalue::implicitly_live_p): Likewise.
7874 (region_svalue::implicitly_live_p): Likewise.
7875 (constant_svalue::implicitly_live_p): Likewise.
7876 (initial_svalue::implicitly_live_p): Likewise.
7877 (initial_svalue::initial_value_of_param_p): New decl.
7878 (unaryop_svalue::implicitly_live_p): Convert first param from a
7879 refererence to a pointer.
7880 (binop_svalue::implicitly_live_p): Likewise.
7881 (sub_svalue::implicitly_live_p): Likewise.
7882 (unmergeable_svalue::implicitly_live_p): Likewise.
7884 2021-02-12 David Malcolm <dmalcolm@redhat.com>
7887 * engine.cc (readability): Add names for the various arbitrary
7888 values. Handle NOP_EXPR and INTEGER_CST.
7889 (readability_comparator): Combine the readability tests for
7890 tree and stack depth, rather than performing them sequentially.
7891 (impl_region_model_context::on_state_leak): Strip off top-level
7893 * region-model.cc (region_model::get_representative_path_var): Add
7894 type-checking, moving the bulk of the implementation to...
7895 (region_model::get_representative_path_var_1): ...here. Respect
7896 types in casts by recursing and re-adding the cast, rather than
7897 merely stripping them off. Use the correct type when handling
7899 (region_model::get_representative_tree): Strip off any top-level
7901 (region_model::get_representative_path_var): Add type-checking,
7902 moving the bulk of the implementation to...
7903 (region_model::get_representative_path_var_1): ...here.
7904 * region-model.h (region_model::get_representative_path_var_1):
7906 (region_model::get_representative_path_var_1): New decl.
7907 * store.cc (append_pathvar_with_type): New.
7908 (binding_cluster::get_representative_path_vars): Cast path_vars
7909 to the correct type when adding them to *OUT_PVS.
7911 2021-02-09 David Malcolm <dmalcolm@redhat.com>
7914 * sm-file.cc (is_file_using_fn_p): Support "_IO_"-prefixed
7917 2021-02-09 David Malcolm <dmalcolm@redhat.com>
7920 * store.cc (store::set_value): Treat a pointer written to *UNKNOWN
7923 2021-02-02 David Malcolm <dmalcolm@redhat.com>
7927 * engine.cc (toplevel_function_p): Simplify so that
7928 we only reject functions with a "__analyzer_" prefix.
7929 (add_any_callbacks): Delete.
7930 (exploded_graph::build_initial_worklist): Update for
7931 dropped param of toplevel_function_p.
7932 (exploded_graph::build_initial_worklist): Don't bother
7933 looking for callbacks that are reachable from global
7936 2021-02-01 David Malcolm <dmalcolm@redhat.com>
7939 * region-model-manager.cc
7940 (region_model_manager::get_or_create_initial_value):
7941 Fold the initial value of *UNKNOWN_PTR to an UNKNOWN value.
7942 (region_model_manager::get_field_region): Fold the value
7943 of UNKNOWN_PTR->FIELD to *UNKNOWN_PTR_OF_&FIELD_TYPE.
7945 2021-01-29 David Malcolm <dmalcolm@redhat.com>
7947 * checker-path.cc (event_kind_to_string): Handle
7948 EK_START_CONSOLIDATED_CFG_EDGES and
7949 EK_END_CONSOLIDATED_CFG_EDGES.
7950 (start_consolidated_cfg_edges_event::get_desc): New.
7951 (checker_path::cfg_edge_pair_at_p): New.
7952 * checker-path.h (enum event_kind): Add
7953 EK_START_CONSOLIDATED_CFG_EDGES and
7954 EK_END_CONSOLIDATED_CFG_EDGES.
7955 (class start_consolidated_cfg_edges_event): New class.
7956 (class end_consolidated_cfg_edges_event): New class.
7957 (checker_path::delete_events): New.
7958 (checker_path::replace_event): New.
7959 (checker_path::cfg_edge_pair_at_p): New decl.
7960 * diagnostic-manager.cc (diagnostic_manager::prune_path): Call
7961 consolidate_conditions.
7962 (same_line_as_p): New.
7963 (diagnostic_manager::consolidate_conditions): New.
7964 * diagnostic-manager.h
7965 (diagnostic_manager::consolidate_conditions): New decl.
7967 2021-01-18 David Malcolm <dmalcolm@redhat.com>
7969 * analyzer.h (is_std_named_call_p): New decl.
7970 * diagnostic-manager.cc (path_builder::get_sm): New.
7971 (state_change_event_creator::state_change_event_creator): Add "pb"
7973 (state_change_event_creator::on_global_state_change): Don't consider
7974 state changes affecting other state_machines.
7975 (state_change_event_creator::on_state_change): Likewise.
7976 (state_change_event_creator::m_pb): New field.
7977 (diagnostic_manager::add_events_for_eedge): Pass pb to visitor
7979 * region-model-impl-calls.cc
7980 (region_model::impl_deallocation_call): New.
7981 * region-model.cc: Include "attribs.h".
7982 (region_model::on_call_post): Handle fndecls referenced by
7983 __attribute__((deallocated_by(FOO))).
7984 * region-model.h (region_model::impl_deallocation_call): New decl.
7985 * sm-malloc.cc: Include "stringpool.h" and "attribs.h". Add
7987 (class api): Delete.
7988 (enum resource_state): Update comment for change from api to
7989 deallocator and deallocator_set.
7990 (allocation_state::allocation_state): Drop api param. Add
7991 "deallocators" and "deallocator".
7992 (allocation_state::m_api): Drop field in favor of...
7993 (allocation_state::m_deallocators): New field.
7994 (allocation_state::m_deallocator): New field.
7995 (enum wording): Add WORDING_DEALLOCATED.
7996 (struct deallocator): New.
7997 (struct standard_deallocator): New.
7998 (struct custom_deallocator): New.
7999 (struct deallocator_set): New.
8000 (struct custom_deallocator_set): New.
8001 (struct standard_deallocator_set): New.
8002 (struct deallocator_set_map_traits): New.
8003 (malloc_state_machine::m_malloc): Drop field
8004 (malloc_state_machine::m_scalar_new): Likewise.
8005 (malloc_state_machine::m_vector_new): Likewise.
8006 (malloc_state_machine::m_free): New field
8007 (malloc_state_machine::m_scalar_delete): Likewise.
8008 (malloc_state_machine::m_vector_delete): Likewise.
8009 (malloc_state_machine::deallocator_map_t): New typedef.
8010 (malloc_state_machine::m_deallocator_map): New field.
8011 (malloc_state_machine::deallocator_set_cache_t): New typedef.
8012 (malloc_state_machine::m_custom_deallocator_set_cache): New field.
8013 (malloc_state_machine::custom_deallocator_set_map_t): New typedef.
8014 (malloc_state_machine::m_custom_deallocator_set_map): New field.
8015 (malloc_state_machine::m_dynamic_sets): New field.
8016 (malloc_state_machine::m_dynamic_deallocators): New field.
8018 (deallocator::deallocator): New ctor.
8019 (deallocator::hash): New.
8020 (deallocator::dump_to_pp): New.
8021 (deallocator::cmp): New.
8022 (deallocator::cmp_ptr_ptr): New.
8023 (standard_deallocator::standard_deallocator): New ctor.
8024 (deallocator_set::deallocator_set): New ctor.
8025 (deallocator_set::dump): New.
8026 (custom_deallocator_set::custom_deallocator_set): New ctor.
8027 (custom_deallocator_set::contains_p): New.
8028 (custom_deallocator_set::maybe_get_single): New.
8029 (custom_deallocator_set::dump_to_pp): New.
8030 (standard_deallocator_set::standard_deallocator_set): New ctor.
8031 (standard_deallocator_set::contains_p): New.
8032 (standard_deallocator_set::maybe_get_single): New.
8033 (standard_deallocator_set::dump_to_pp): New.
8035 (class mismatching_deallocation): Update for conversion from api
8036 to deallocator_set and deallocator.
8037 (double_free::emit): Use %qs.
8038 (class use_after_free): Update for conversion from api to
8039 deallocator_set and deallocator.
8040 (malloc_leak::describe_state_change): Only emit "allocated here" on
8041 a start->nonnull transition, rather than on other transitions to
8043 (allocation_state::dump_to_pp): Update for conversion from api to
8045 (allocation_state::get_nonnull): Likewise.
8046 (malloc_state_machine::malloc_state_machine): Likewise.
8047 (malloc_state_machine::~malloc_state_machine): New.
8048 (malloc_state_machine::add_state): Update for conversion from api
8050 (malloc_state_machine::get_or_create_custom_deallocator_set): New.
8051 (malloc_state_machine::maybe_create_custom_deallocator_set): New.
8052 (malloc_state_machine::get_or_create_deallocator): New.
8053 (malloc_state_machine::on_stmt): Update for conversion from api
8054 to deallocator_set. Handle "__attribute__((malloc(FOO)))", and
8055 the special attribute set on FOO.
8056 (malloc_state_machine::on_allocator_call): Update for conversion
8057 from api to deallocator_set. Add "returns_nonnull" param and use
8058 it to affect which state to transition to.
8059 (malloc_state_machine::on_deallocator_call): Update for conversion
8060 from api to deallocator_set.
8062 2021-01-14 David Malcolm <dmalcolm@redhat.com>
8064 * engine.cc (strongly_connected_components::to_json): New.
8065 (worklist::to_json): New.
8066 (exploded_graph::to_json): JSON-ify the worklist.
8067 * exploded-graph.h (strongly_connected_components::to_json): New
8069 (worklist::to_json): New decl.
8070 * store.cc (store::to_json): Fix comment.
8071 * supergraph.cc (supernode::to_json): Fix reference to
8072 "returning_call" in comment. Add optional "fun" to JSON.
8073 (edge_kind_to_string): New.
8074 (superedge::to_json): Add "kind" to JSON.
8076 2021-01-14 David Malcolm <dmalcolm@redhat.com>
8079 * analyzer.h (region_offset::operator==): Make const.
8080 * pending-diagnostic.h (pending_diagnostic::equal_p): Likewise.
8081 * store.h (binding_cluster::for_each_value): Likewise.
8082 (binding_cluster::for_each_binding): Likewise.
8084 2021-01-12 David Malcolm <dmalcolm@redhat.com>
8087 * store.cc (binding_cluster::make_unknown_relative_to): Don't mark
8088 dereferenced unknown pointers as having escaped.
8090 2021-01-07 David Malcolm <dmalcolm@redhat.com>
8093 * region.cc (decl_region::get_svalue_for_initializer): Gracefully
8094 handle when LTO writes out DECL_INITIAL as error_mark_node.
8096 2021-01-07 David Malcolm <dmalcolm@redhat.com>
8099 * store.cc (binding_cluster::can_merge_p): Add "out_store" param
8100 and pass to calls to binding_cluster::make_unknown_relative_to.
8101 (binding_cluster::make_unknown_relative_to): Add "out_store"
8102 param. Use it to mark base regions that are pointed to by
8103 pointers that become unknown as having escaped.
8104 (store::can_merge_p): Pass out_store to
8105 binding_cluster::can_merge_p.
8106 * store.h (binding_cluster::can_merge_p): Add "out_store" param.
8107 (binding_cluster::make_unknown_relative_to): Likewise.
8108 * svalue.cc (region_svalue::implicitly_live_p): New vfunc.
8109 * svalue.h (region_svalue::implicitly_live_p): New vfunc decl.
8111 2021-01-07 David Malcolm <dmalcolm@redhat.com>
8114 * engine.cc (exploded_path::feasible_p): Add missing call to
8117 2021-01-06 David Malcolm <dmalcolm@redhat.com>
8120 * region-model-reachability.cc (reachable_regions::init_cluster):
8121 Convert symbolic region handling to a switch statement. Add cases
8122 to handle SK_UNKNOWN and SK_CONJURED.
8124 2021-01-05 David Malcolm <dmalcolm@redhat.com>
8127 * store.cc (binding_map::apply_ctor_to_region): When "index" is
8128 NULL, iterate through the fields for RECORD_TYPEs, rather than
8129 creating an INTEGER_CST index.
8131 2020-11-30 David Malcolm <dmalcolm@redhat.com>
8133 * analyzer-pass.cc: Include "analyzer/analyzer.h" for the
8134 declaration of sorry_no_analyzer; include "tree.h" and
8135 "function.h" as these are needed by it.
8137 2020-11-30 David Malcolm <dmalcolm@redhat.com>
8139 * analyzer-pass.cc (pass_analyzer::execute): Move sorry call to...
8140 (sorry_no_analyzer): New.
8141 * analyzer.h (class state_machine): New forward decl.
8142 (class logger): New forward decl.
8143 (class plugin_analyzer_init_iface): New.
8144 (sorry_no_analyzer): New decl.
8145 * checker-path.cc (checker_path::fixup_locations): New.
8146 * checker-path.h (checker_event::set_location): New.
8147 (checker_path::fixup_locations): New decl.
8148 * diagnostic-manager.cc
8149 (diagnostic_manager::emit_saved_diagnostic): Call
8150 checker_path::fixup_locations, and call fixup_location
8151 on the primary location.
8152 * engine.cc: Include "plugin.h".
8153 (class plugin_analyzer_init_impl): New.
8154 (impl_run_checkers): Invoke PLUGIN_ANALYZER_INIT callbacks.
8155 * pending-diagnostic.h (pending_diagnostic::fixup_location): New
8158 2020-11-18 David Malcolm <dmalcolm@redhat.com>
8161 * sm-malloc.cc (null_deref::emit): Use CWE-476 rather than
8162 CWE-690, as this isn't due to an unchecked return value.
8163 (null_arg::emit): Likewise.
8165 2020-11-12 David Malcolm <dmalcolm@redhat.com>
8167 * checker-path.h (checker_event::get_id_ptr): New.
8168 * diagnostic-manager.cc (path_builder::path_builder): Add "sd"
8169 param and use it to initialize new field "m_sd".
8170 (path_builder::get_pending_diagnostic): New.
8171 (path_builder::m_sd): New field.
8172 (diagnostic_manager::emit_saved_diagnostic): Pass sd to
8174 (diagnostic_manager::add_events_for_superedge): Call new
8175 maybe_add_custom_events_for_superedge vfunc.
8176 * engine.cc (stale_jmp_buf::stale_jmp_buf): Add "setjmp_point"
8177 param and use it to initialize new field "m_setjmp_point".
8178 Initialize new field "m_stack_pop_event".
8179 (stale_jmp_buf::maybe_add_custom_events_for_superedge): New vfunc
8181 (stale_jmp_buf::describe_final_event): New vfunc implementation.
8182 (stale_jmp_buf::m_setjmp_point): New field.
8183 (stale_jmp_buf::m_stack_pop_event): New field.
8184 (exploded_node::on_longjmp): Pass setjmp_point to stale_jmp_buf
8186 * pending-diagnostic.h
8187 (pending_diagnostic::maybe_add_custom_events_for_superedge): New
8190 2020-11-12 David Malcolm <dmalcolm@redhat.com>
8192 PR tree-optimization/97424
8193 * analyzer.opt (Wanalyzer-shift-count-negative): New.
8194 (Wanalyzer-shift-count-overflow): New.
8195 * region-model.cc (class shift_count_negative_diagnostic): New.
8196 (class shift_count_overflow_diagnostic): New.
8197 (region_model::get_gassign_result): Complain about shift counts that
8198 are negative or are >= the operand's type's width.
8200 2020-11-10 Martin Liska <mliska@suse.cz>
8202 * constraint-manager.cc (constraint_manager::merge): Remove
8204 * constraint-manager.h: Likewise.
8205 * program-state.cc (sm_state_map::sm_state_map): Likewise.
8206 (program_state::program_state): Likewise.
8207 (test_sm_state_map): Likewise.
8208 * program-state.h: Likewise.
8209 * region-model-reachability.cc (reachable_regions::reachable_regions): Likewise.
8210 * region-model-reachability.h: Likewise.
8211 * region-model.cc (region_model::handle_unrecognized_call): Likewise.
8212 (region_model::get_reachable_svalues): Likewise.
8213 (region_model::can_merge_with_p): Likewise.
8215 2020-11-05 David Malcolm <dmalcolm@redhat.com>
8218 * svalue.cc (cmp_cst): Handle COMPLEX_CST.
8220 2020-10-29 David Malcolm <dmalcolm@redhat.com>
8222 * program-state.cc (sm_state_map::on_liveness_change): Sort the
8223 leaking svalues before calling on_state_leak.
8224 (program_state::detect_leaks): Likewise when calling
8226 * region-model-reachability.cc
8227 (reachable_regions::mark_escaped_clusters): Likewise when
8228 calling on_escaped_function.
8230 2020-10-29 David Malcolm <dmalcolm@redhat.com>
8233 * region-model-reachability.cc (reachable_regions::handle_sval):
8234 Operands of reachable reversible operations are reachable.
8236 2020-10-29 David Malcolm <dmalcolm@redhat.com>
8238 * analyzer.h (class state_machine): New forward decl.
8239 (class logger): Likewise.
8240 (class visitor): Likewise.
8241 * complexity.cc: New file, taken from svalue.cc.
8242 * complexity.h: New file, taken from region-model.h.
8243 * region-model.h: Include "analyzer/svalue.h" and
8244 "analyzer/region.h". Move struct complexity to complexity.h.
8245 Move svalue, its subclasses and supporting decls to svalue.h.
8246 Move region, its subclasses and supporting decls to region.h.
8247 * region.cc: Include "analyzer/region.h".
8248 (symbolic_region::symbolic_region): Move here from region-model.h.
8249 * region.h: New file, based on material from region-model.h.
8250 * svalue.cc: Include "analyzer/svalue.h".
8251 (complexity::complexity): Move to complexity.cc.
8252 (complexity::from_pair): Likewise.
8253 * svalue.h: New file, based on material from region-model.h.
8255 2020-10-29 David Malcolm <dmalcolm@redhat.com>
8257 * program-state.cc (sm_state_map::print): Guard the printing of
8258 the origin pointer with !flag_dump_noaddr.
8259 * region.cc (string_region::dump_to_pp): Likewise for
8262 2020-10-27 David Malcolm <dmalcolm@redhat.com>
8265 * region-model.cc (region_model::get_initial_value_for_global):
8266 Move check that !DECL_EXTERNAL from here to...
8267 * region.cc (decl_region::get_svalue_for_initializer): ...here,
8268 using it to reject zero initialization.
8270 2020-10-27 Markus Böck <markus.boeck02@gmail.com>
8273 * store.h (hash): Cast to intptr_t instead of long
8275 2020-10-27 David Malcolm <dmalcolm@redhat.com>
8277 * constraint-manager.cc (svalue_cmp_by_ptr): Delete.
8278 (equiv_class::canonicalize): Use svalue::cmp_ptr_ptr instead.
8279 (equiv_class_cmp): Eliminate pointer comparison.
8280 * diagnostic-manager.cc (dedupe_key::comparator): If they are at
8281 the same location, also compare epath ength and pending_diagnostic
8283 * engine.cc (readability_comparator): If two path_vars have the
8284 same readability, then impose an arbitrary ordering on them.
8285 (worklist::key_t::cmp): If two points have the same plan ordering,
8286 continue the comparison. Call sm_state_map::cmp rather than
8287 comparing hash values.
8288 * program-state.cc (sm_state_map::entry_t::cmp): New.
8289 (sm_state_map::cmp): New.
8290 * program-state.h (sm_state_map::entry_t::cmp): New decl.
8291 (sm_state_map::elements): New.
8292 (sm_state_map::cmp): New.
8294 2020-10-27 David Malcolm <dmalcolm@redhat.com>
8296 * engine.cc (setjmp_record::cmp): New.
8297 (supernode_cluster::dump_dot): Avoid embedding pointer in cluster
8299 (supernode_cluster::cmp_ptr_ptr): New.
8300 (function_call_string_cluster::dump_dot): Avoid embedding pointer
8301 in cluster name. Sort m_map when dumping child clusters.
8302 (function_call_string_cluster::cmp_ptr_ptr): New.
8303 (root_cluster::dump_dot): Sort m_map when dumping child clusters.
8304 * program-point.cc (function_point::cmp): New.
8305 (function_point::cmp_ptr): New.
8306 * program-point.h (function_point::cmp): New decl.
8307 (function_point::cmp_ptr): New decl.
8308 * program-state.cc (sm_state_map::print): Sort the values. Guard
8309 the printing of pointers with !flag_dump_noaddr.
8310 (program_state::prune_for_point): Sort the regions.
8311 (log_set_of_svalues): Sort the values. Guard the printing of
8312 pointers with !flag_dump_noaddr.
8313 * region-model-manager.cc (log_uniq_map): Sort the values.
8314 * region-model-reachability.cc (dump_set): New function template.
8315 (reachable_regions::dump_to_pp): Use it.
8316 * region-model.h (svalue::cmp_ptr): New decl.
8317 (svalue::cmp_ptr_ptr): New decl.
8318 (setjmp_record::cmp): New decl.
8319 (placeholder_svalue::get_name): New accessor.
8320 (widening_svalue::get_point): New accessor.
8321 (compound_svalue::get_map): New accessor.
8322 (conjured_svalue::get_stmt): New accessor.
8323 (conjured_svalue::get_id_region): New accessor.
8324 (region::cmp_ptrs): Rename to...
8325 (region::cmp_ptr_ptr): ...this.
8326 * region.cc (region::cmp_ptrs): Rename to...
8327 (region::cmp_ptr_ptr): ...this.
8329 (state_purge_per_ssa_name::state_purge_per_ssa_name): Sort
8330 m_points_needing_name when dumping.
8331 * store.cc (concrete_binding::cmp_ptr_ptr): New.
8332 (symbolic_binding::cmp_ptr_ptr): New.
8333 (binding_map::cmp): New.
8334 (get_sorted_parent_regions): Update for renaming of
8335 region::cmp_ptrs to region::cmp_ptr_ptr.
8336 (store::dump_to_pp): Likewise.
8337 (store::to_json): Likewise.
8338 (store::can_merge_p): Sort the base regions before considering
8340 * store.h (concrete_binding::cmp_ptr_ptr): New decl.
8341 (symbolic_binding::cmp_ptr_ptr): New decl.
8342 (binding_map::cmp): New decl.
8343 * supergraph.cc (supergraph::supergraph): Assign UIDs to the
8345 * svalue.cc (cmp_cst): New.
8346 (svalue::cmp_ptr): New.
8347 (svalue::cmp_ptr_ptr): New.
8349 2020-10-27 David Malcolm <dmalcolm@redhat.com>
8351 * engine.cc (exploded_graph::get_or_create_node): Fix off-by-one
8352 when imposing param_analyzer_max_enodes_per_program_point limit.
8354 2020-10-27 David Malcolm <dmalcolm@redhat.com>
8356 * region-model.cc (region_model::get_representative_path_var):
8357 Implement case RK_LABEL.
8358 * region-model.h (label_region::get_label): New accessor.
8360 2020-10-22 David Malcolm <dmalcolm@redhat.com>
8363 * engine.cc (exploded_graph::add_function_entry): Handle failure
8364 to create an enode, rather than asserting.
8366 2020-10-22 David Malcolm <dmalcolm@redhat.com>
8369 * engine.cc (exploded_graph::add_function_entry): Assert that we
8370 have a function body.
8371 (exploded_graph::on_escaped_function): Reject fndecls that don't
8372 have a function body.
8374 2020-10-14 David Malcolm <dmalcolm@redhat.com>
8377 * region-model.cc (region_model::get_initial_value_for_global):
8378 Fall back to returning an initial_svalue if
8379 decl_region::get_svalue_for_initializer fails.
8380 * region.cc (decl_region::get_svalue_for_initializer): Don't
8381 attempt to create a compound_svalue if the region has an unknown
8384 2020-10-14 David Malcolm <dmalcolm@redhat.com>
8387 * store.cc (binding_map::apply_ctor_to_region): Remove redundant
8390 2020-10-12 David Malcolm <dmalcolm@redhat.com>
8393 * engine.cc (impl_region_model_context::on_escaped_function): New
8395 (exploded_graph::add_function_entry): Use m_functions_with_enodes
8396 to implement idempotency.
8397 (add_any_callbacks): New.
8398 (exploded_graph::build_initial_worklist): Use the above to find
8399 callbacks that are reachable from global initializers.
8400 (exploded_graph::on_escaped_function): New.
8402 (impl_region_model_context::on_escaped_function): New decl.
8403 (exploded_graph::on_escaped_function): New decl.
8404 (exploded_graph::m_functions_with_enodes): New field.
8405 * region-model-reachability.cc
8406 (reachable_regions::reachable_regions): Replace "store" param with
8407 "model" param; use it to initialize m_model.
8408 (reachable_regions::add): When getting the svalue for the region,
8409 call get_store_value on the model rather than using an initial
8411 (reachable_regions::mark_escaped_clusters): Add ctxt param and
8412 use it to call on_escaped_function when a function_region escapes.
8413 * region-model-reachability.h
8414 (reachable_regions::reachable_regions): Replace "store" param with
8416 (reachable_regions::mark_escaped_clusters): Add ctxt param.
8417 (reachable_regions::m_model): New field.
8418 * region-model.cc (region_model::handle_unrecognized_call): Update
8419 for change in reachable_regions ctor.
8420 (region_model::handle_unrecognized_call): Pass ctxt to
8421 mark_escaped_clusters.
8422 (region_model::get_reachable_svalues): Update for change in
8423 reachable_regions ctor.
8424 (region_model::get_initial_value_for_global): Read-only variables
8425 keep their initial values.
8426 * region-model.h (region_model_context::on_escaped_function): New
8428 (noop_region_model_context::on_escaped_function): New.
8430 2020-10-12 David Malcolm <dmalcolm@redhat.com>
8432 * analyzer.opt (Wanalyzer-write-to-const): New.
8433 (Wanalyzer-write-to-string-literal): New.
8434 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
8435 Call check_for_writable_region.
8436 (region_model::impl_call_memset): Likewise.
8437 (region_model::impl_call_strcpy): Likewise.
8438 * region-model.cc (class write_to_const_diagnostic): New.
8439 (class write_to_string_literal_diagnostic): New.
8440 (region_model::check_for_writable_region): New.
8441 (region_model::set_value): Call check_for_writable_region.
8442 * region-model.h (region_model::check_for_writable_region): New
8445 2020-10-07 David Malcolm <dmalcolm@redhat.com>
8448 * sm-malloc.cc (method_p): New.
8449 (describe_argument_index): New.
8450 (inform_nonnull_attribute): Use describe_argument_index.
8451 (possible_null_arg::describe_final_event): Likewise.
8452 (null_arg::describe_final_event): Likewise.
8454 2020-09-29 David Malcolm <dmalcolm@redhat.com>
8457 * engine.cc (stmt_requires_new_enode_p): Split enodes before
8460 2020-09-29 David Malcolm <dmalcolm@redhat.com>
8462 * constraint-manager.cc
8463 (constraint_manager::add_constraint_internal): Whitespace fixes.
8464 Silence -Wsign-compare warning.
8465 * engine.cc (maybe_process_run_of_before_supernode_enodes):
8466 Silence -Wsign-compare warning.
8468 2020-09-28 David Malcolm <dmalcolm@redhat.com>
8470 * region-model.h (binop_svalue::dyn_cast_binop_svalue): Remove
8471 redundant "virtual". Add FINAL OVERRIDE.
8472 (widening_svalue::dyn_cast_widening_svalue): Add FINAL OVERRIDE.
8473 (compound_svalue::dyn_cast_compound_svalue): Likewise.
8474 (conjured_svalue::dyn_cast_conjured_svalue): Likewise.
8476 2020-09-28 David Malcolm <dmalcolm@redhat.com>
8478 * diagnostic-manager.cc (null_assignment_sm_context::m_visitor):
8479 Remove unused field.
8481 2020-09-28 David Malcolm <dmalcolm@redhat.com>
8484 * analyzer.cc (is_longjmp_call_p): Require the initial argument
8486 * engine.cc (exploded_node::on_longjmp): Likewise.
8488 2020-09-28 David Malcolm <dmalcolm@redhat.com>
8490 * program-state.cc (sm_state_map::print): Update check
8491 for m_global_state being the start state.
8493 2020-09-26 David Malcolm <dmalcolm@redhat.com>
8497 * region-model.cc (region_model::get_representative_path_var):
8498 When handling offset_region, wrap the MEM_REF's first argument in
8499 an ADDR_EXPR of pointer type, rather than simply using the tree
8500 for the parent region. Require the MEM_REF's second argument to
8501 be an integer constant.
8503 2020-09-24 David Malcolm <dmalcolm@redhat.com>
8505 * analyzer.h (struct rejected_constraint): New decl.
8506 * analyzer.opt (fanalyzer-feasibility): New option.
8507 * diagnostic-manager.cc (path_builder::path_builder): Add
8508 "problem" param and use it to initialize new field.
8509 (path_builder::get_feasibility_problem): New accessor.
8510 (path_builder::m_feasibility_problem): New field.
8511 (dedupe_winners::add): Remove inversion of logic in "if" clause,
8512 swapping if/else suites. In the !feasible_p suite, inspect
8513 flag_analyzer_feasibility and add code to handle when this
8514 is off, accepting the infeasible path, but recording the
8515 feasibility_problem.
8516 (diagnostic_manager::emit_saved_diagnostic): Pass the
8517 feasibility_problem to the path_builder.
8518 (diagnostic_manager::add_events_for_eedge): If we have
8519 a feasibility_problem at this edge, use it to add a custom event.
8520 * engine.cc (exploded_path::feasible_p): Pass a
8521 rejected_constraint ** to model.maybe_update_for_edge and transfer
8522 ownership of any created instance to any feasibility_problem.
8523 (feasibility_problem::dump_to_pp): New.
8524 * exploded-graph.h (feasibility_problem::feasibility_problem):
8525 Drop "model" param; add rejected_constraint * param.
8526 (feasibility_problem::~feasibility_problem): New.
8527 (feasibility_problem::dump_to_pp): New decl.
8528 (feasibility_problem::m_model): Drop field.
8529 (feasibility_problem::m_rc): New field.
8530 * program-point.cc (function_point::get_location): Handle
8531 PK_BEFORE_SUPERNODE and PK_AFTER_SUPERNODE.
8532 * program-state.cc (program_state::on_edge): Pass NULL to new
8533 param of region_model::maybe_update_for_edge.
8534 * region-model.cc (region_model::add_constraint): New overload
8535 adding a rejected_constraint ** param.
8536 (region_model::maybe_update_for_edge): Add rejected_constraint **
8537 param and pass it to the various apply_constraints_for_ calls.
8538 (region_model::apply_constraints_for_gcond): Add
8539 rejected_constraint ** param and pass it to add_constraint calls.
8540 (region_model::apply_constraints_for_gswitch): Likewise.
8541 (region_model::apply_constraints_for_exception): Likewise.
8542 (rejected_constraint::dump_to_pp): New.
8543 * region-model.h (region_model::maybe_update_for_edge):
8544 Add rejected_constraint ** param.
8545 (region_model::add_constraint): New overload adding a
8546 rejected_constraint ** param.
8547 (region_model::apply_constraints_for_gcond): Add
8548 rejected_constraint ** param.
8549 (region_model::apply_constraints_for_gswitch): Likewise.
8550 (region_model::apply_constraints_for_exception): Likewise.
8551 (struct rejected_constraint): New.
8553 2020-09-23 David Malcolm <dmalcolm@redhat.com>
8556 * engine.cc (impl_run_checkers): Update for change to ext_state
8558 * program-state.cc (selftest::test_sm_state_map): Pass an engine
8559 instance to ext_state ctor.
8560 (selftest::test_program_state_1): Likewise.
8561 (selftest::test_program_state_2): Likewise.
8562 (selftest::test_program_state_merging): Likewise.
8563 (selftest::test_program_state_merging_2): Likewise.
8564 * program-state.h (extrinsic_state::extrinsic_state): Remove NULL
8565 default value for "eng" param.
8567 2020-09-23 Tobias Burnus <tobias@codesourcery.com>
8569 * analyzer-logging.cc: Guard '#pragma ... ignored "-Wformat-diag"'
8570 by '#if __GNUC__ >= 10'
8571 * analyzer.h: Likewise.
8572 * call-string.cc: Likewise.
8574 2020-09-23 David Malcolm <dmalcolm@redhat.com>
8576 * engine.cc (exploded_node::on_stmt): Replace sequence of dyn_cast
8579 2020-09-22 David Malcolm <dmalcolm@redhat.com>
8581 * analysis-plan.cc: Include "json.h".
8582 * analyzer.opt (fdump-analyzer-json): New.
8583 * call-string.cc: Include "json.h".
8584 (call_string::to_json): New.
8585 * call-string.h (call_string::to_json): New decl.
8586 * checker-path.cc: Include "json.h".
8587 * constraint-manager.cc: Include "json.h".
8588 (equiv_class::to_json): New.
8589 (constraint::to_json): New.
8590 (constraint_manager::to_json): New.
8591 * constraint-manager.h (equiv_class::to_json): New decl.
8592 (constraint::to_json): New decl.
8593 (constraint_manager::to_json): New decl.
8594 * diagnostic-manager.cc: Include "json.h".
8595 (saved_diagnostic::to_json): New.
8596 (diagnostic_manager::to_json): New.
8597 * diagnostic-manager.h (saved_diagnostic::to_json): New decl.
8598 (diagnostic_manager::to_json): New decl.
8599 * engine.cc: Include "json.h", <zlib.h>.
8600 (exploded_node::status_to_str): New.
8601 (exploded_node::to_json): New.
8602 (exploded_edge::to_json): New.
8603 (exploded_graph::to_json): New.
8604 (dump_analyzer_json): New.
8605 (impl_run_checkers): Call it.
8606 * exploded-graph.h (exploded_node::status_to_str): New decl.
8607 (exploded_node::to_json): New.
8608 (exploded_edge::to_json): New.
8609 (exploded_graph::to_json): New.
8610 * pending-diagnostic.cc: Include "json.h".
8611 * program-point.cc: Include "json.h".
8612 (program_point::to_json): New.
8613 * program-point.h (program_point::to_json): New decl.
8614 * program-state.cc: Include "json.h".
8615 (extrinsic_state::to_json): New.
8616 (sm_state_map::to_json): New.
8617 (program_state::to_json): New.
8618 * program-state.h (extrinsic_state::to_json): New decl.
8619 (sm_state_map::to_json): New decl.
8620 (program_state::to_json): New decl.
8621 * region-model-impl-calls.cc: Include "json.h".
8622 * region-model-manager.cc: Include "json.h".
8623 * region-model-reachability.cc: Include "json.h".
8624 * region-model.cc: Include "json.h".
8625 * region-model.h (svalue::to_json): New decl.
8626 (region::to_json): New decl.
8627 * region.cc: Include "json.h".
8628 (region::to_json: New.
8629 * sm-file.cc: Include "json.h".
8630 * sm-malloc.cc: Include "json.h".
8631 * sm-pattern-test.cc: Include "json.h".
8632 * sm-sensitive.cc: Include "json.h".
8633 * sm-signal.cc: Include "json.h".
8634 (signal_delivery_edge_info_t::to_json): New.
8635 * sm-taint.cc: Include "json.h".
8636 * sm.cc: Include "diagnostic.h", "tree-diagnostic.h", and
8638 (state_machine::state::to_json): New.
8639 (state_machine::to_json): New.
8640 * sm.h (state_machine::state::to_json): New.
8641 (state_machine::to_json): New.
8642 * state-purge.cc: Include "json.h".
8643 * store.cc: Include "json.h".
8644 (binding_key::get_desc): New.
8645 (binding_map::to_json): New.
8646 (binding_cluster::to_json): New.
8647 (store::to_json): New.
8648 * store.h (binding_key::get_desc): New decl.
8649 (binding_map::to_json): New decl.
8650 (binding_cluster::to_json): New decl.
8651 (store::to_json): New decl.
8652 * supergraph.cc: Include "json.h".
8653 (supergraph::to_json): New.
8654 (supernode::to_json): New.
8655 (superedge::to_json): New.
8656 * supergraph.h (supergraph::to_json): New decl.
8657 (supernode::to_json): New decl.
8658 (superedge::to_json): New decl.
8659 * svalue.cc: Include "json.h".
8660 (svalue::to_json): New.
8662 2020-09-21 David Malcolm <dmalcolm@redhat.com>
8665 * region-model-impl-calls.cc (call_details::get_arg_type): New.
8666 * region-model.cc (region_model::on_call_pre): Check that the
8667 initial arg is a pointer before calling impl_call_memset and
8669 * region-model.h (call_details::get_arg_type): New decl.
8671 2020-09-21 David Malcolm <dmalcolm@redhat.com>
8674 * sm-malloc.cc (malloc_state_machine::get_default_state): Look at
8675 the base region when considering pointers. Treat pointers to
8676 decls as being non-heap.
8678 2020-09-18 David Malcolm <dmalcolm@redhat.com>
8680 * checker-path.cc (warning_event::get_desc): Handle global state
8683 2020-09-18 David Malcolm <dmalcolm@redhat.com>
8685 * sm-malloc.cc (malloc_state_machine::on_stmt): Handle strdup and
8686 strndup as being malloc-like allocators.
8688 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8690 * engine.cc (strongly_connected_components::strong_connect): Only
8691 consider intraprocedural edges when creating SCCs.
8692 (worklist::key_t::cmp): Add comment. Treat call_string
8693 differences as more important than differences of program_point
8696 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8698 * engine.cc (supernode_cluster::dump_dot): Show the SCC id
8699 in the per-supernode clusters in FILENAME.eg.dot output.
8700 (exploded_graph_annotator::add_node_annotations):
8701 Show the SCC of the supernode in FILENAME.supernode.eg.dot output.
8702 * exploded-graph.h (worklist::scc_id): New.
8703 (exploded_graph::get_scc_id): New.
8705 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8707 * engine.cc (exploded_node::dump_dot): Show STATUS_BULK_MERGED.
8708 (exploded_graph::process_worklist): Call
8709 maybe_process_run_of_before_supernode_enodes.
8710 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
8712 (exploded_graph_annotator::print_enode): Show STATUS_BULK_MERGED.
8713 * exploded-graph.h (enum exploded_node::status): Add
8716 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8719 (exploded_graph::process_node) <case PK_BEFORE_SUPERNODE>:
8720 Simplify by using program_point::get_next.
8721 * program-point.cc (program_point::get_next): New.
8722 * program-point.h (program_point::get_next): New decl.
8724 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8726 * engine.cc (exploded_graph::get_or_create_node): Show the
8727 program point when issuing -Wanalyzer-too-complex due to hitting
8728 the per-program-point limit.
8730 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8732 * region-model.cc (region_model::on_call_pre): Treat getchar as
8733 having no side-effects.
8735 2020-09-15 David Malcolm <dmalcolm@redhat.com>
8738 * constraint-manager.cc (merger_fact_visitor::on_fact): Replace
8739 assertion that add_constraint succeeded with an assertion that
8740 if it fails, -fanalyzer-transitivity is off.
8742 2020-09-14 David Malcolm <dmalcolm@redhat.com>
8744 * analyzer.opt (-param=analyzer-max-constraints=): New param.
8745 * constraint-manager.cc
8746 (constraint_manager::add_constraint_internal): Silently reject
8747 attempts to add constraints when the above limit is reached.
8749 2020-09-14 David Malcolm <dmalcolm@redhat.com>
8752 * constraint-manager.cc
8753 (constraint_manager::get_or_add_equiv_class): Don't accumulate
8754 transitive closure of all constraints on constants.
8756 2020-09-14 David Malcolm <dmalcolm@redhat.com>
8759 * analyzer.cc (is_setjmp_call_p): Require the initial arg to be a
8761 * region-model.cc (region_model::deref_rvalue): Assert that the
8762 svalue is of pointer type.
8764 2020-09-11 David Malcolm <dmalcolm@redhat.com>
8767 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
8769 (region_model::impl_call_strcpy): New.
8770 * region-model.cc (region_model::on_call_pre): Flag unhandled
8771 builtins that are non-pure as having unknown side-effects.
8772 Implement BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_STRCPY,
8773 BUILT_IN_STRCPY_CHK, BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED,
8774 BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_FPUTC,
8775 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
8776 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
8777 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR,
8778 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED,
8779 BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF.
8780 * region-model.h (region_model::impl_call_memcpy): New decl.
8781 (region_model::impl_call_strcpy): New decl.
8783 2020-09-09 David Malcolm <dmalcolm@redhat.com>
8786 * analyzer.opt (Wanalyzer-mismatching-deallocation): New warning.
8787 * region-model-impl-calls.cc
8788 (region_model::impl_call_operator_new): New.
8789 (region_model::impl_call_operator_delete): New.
8790 * region-model.cc (region_model::on_call_pre): Detect operator new
8791 and operator delete.
8792 (region_model::on_call_post): Likewise.
8793 (region_model::maybe_update_for_edge): Detect EH edges and call...
8794 (region_model::apply_constraints_for_exception): New function.
8795 * region-model.h (region_model::impl_call_operator_new): New decl.
8796 (region_model::impl_call_operator_delete): New decl.
8797 (region_model::apply_constraints_for_exception): New decl.
8798 * sm-malloc.cc (enum resource_state): New.
8799 (struct allocation_state): New state subclass.
8800 (enum wording): New.
8802 (malloc_state_machine::custom_data_t): New typedef.
8803 (malloc_state_machine::add_state): New decl.
8804 (malloc_state_machine::m_unchecked)
8805 (malloc_state_machine::m_nonnull)
8806 (malloc_state_machine::m_freed): Delete these states in favor
8808 (malloc_state_machine::m_malloc)
8809 (malloc_state_machine::m_scalar_new)
8810 (malloc_state_machine::m_vector_new): ...this new api instances,
8811 which own their own versions of these states.
8812 (malloc_state_machine::on_allocator_call): New decl.
8813 (malloc_state_machine::on_deallocator_call): New decl.
8814 (api::api): New ctor.
8815 (dyn_cast_allocation_state): New.
8816 (as_a_allocation_state): New.
8821 (malloc_diagnostic::describe_state_change): Use unchecked_p and
8823 (class mismatching_deallocation): New.
8824 (double_free::double_free): Add funcname param for initializing
8826 (double_free::emit): Use m_funcname in warning message rather
8827 than hardcoding "free".
8828 (double_free::describe_state_change): Likewise. Use freed_p.
8829 (double_free::describe_call_with_state): Use freed_p.
8830 (double_free::describe_final_event): Use m_funcname in message
8831 rather than hardcoding "free".
8832 (double_free::m_funcname): New field.
8833 (possible_null::describe_state_change): Use unchecked_p.
8834 (possible_null::describe_return_of_state): Likewise.
8835 (use_after_free::use_after_free): Add param for initializing m_api.
8836 (use_after_free::emit): Use m_api->m_dealloc_funcname in message
8837 rather than hardcoding "free".
8838 (use_after_free::describe_state_change): Use freed_p. Change the
8839 wording of the message based on the API.
8840 (use_after_free::describe_final_event): Use
8841 m_api->m_dealloc_funcname in message rather than hardcoding
8842 "free". Change the wording of the message based on the API.
8843 (use_after_free::m_api): New field.
8844 (malloc_leak::describe_state_change): Use unchecked_p. Update
8845 for renaming of m_malloc_event to m_alloc_event.
8846 (malloc_leak::describe_final_event): Update for renaming of
8847 m_malloc_event to m_alloc_event.
8848 (malloc_leak::m_malloc_event): Rename...
8849 (malloc_leak::m_alloc_event): ...to this.
8850 (free_of_non_heap::free_of_non_heap): Add param for initializing
8852 (free_of_non_heap::emit): Use m_funcname in message rather than
8854 (free_of_non_heap::describe_final_event): Likewise.
8855 (free_of_non_heap::m_funcname): New field.
8856 (allocation_state::dump_to_pp): New.
8857 (allocation_state::get_nonnull): New.
8858 (malloc_state_machine::malloc_state_machine): Update for changes
8859 to state fields and new api fields.
8860 (malloc_state_machine::add_state): New.
8861 (malloc_state_machine::on_stmt): Move malloc/calloc handling to
8862 on_allocator_call and call it, passing in the API pointer.
8863 Likewise for free, moving it to on_deallocator_call. Handle calls
8864 to operator new and delete in an analogous way. Use unchecked_p
8865 when testing for possibly-null-arg and possibly-null-deref, and
8866 transition to the non-null for the correct API. Remove redundant
8867 node param from call to on_zero_assignment. Use freed_p for
8868 use-after-free check, and pass in API.
8869 (malloc_state_machine::on_allocator_call): New, based on code in
8871 (malloc_state_machine::on_deallocator_call): Likewise.
8872 (malloc_state_machine::on_phi): Mark node param with
8873 ATTRIBUTE_UNUSED; don't pass it to on_zero_assignment.
8874 (malloc_state_machine::on_condition): Mark node param with
8875 ATTRIBUTE_UNUSED. Replace on_transition calls with get_state and
8876 set_next_state pairs, transitioning to the non-null state for the
8878 (malloc_state_machine::can_purge_p): Port to new state approach.
8879 (malloc_state_machine::on_zero_assignment): Replace on_transition
8880 calls with get_state and set_next_state pairs. Drop redundant
8882 * sm.h (state_machine::add_custom_state): New.
8884 2020-09-09 David Malcolm <dmalcolm@redhat.com>
8886 * diagnostic-manager.cc
8887 (null_assignment_sm_context::warn_for_state): Replace with...
8888 (null_assignment_sm_context::warn): ...this.
8889 * engine.cc (impl_sm_context::warn_for_state): Replace with...
8890 (impl_sm_context::warn): ...this.
8891 * sm-file.cc (fileptr_state_machine::on_stmt): Replace
8892 warn_for_state and on_transition calls with a get_state
8893 test guarding warn and set_next_state calls.
8894 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
8895 * sm-pattern-test.cc (pattern_test_state_machine::on_condition):
8896 Replace warn_for_state call with warn call.
8898 (sensitive_state_machine::warn_for_any_exposure): Replace
8899 warn_for_state call with a get_state test guarding a warn call.
8900 * sm-signal.cc (signal_state_machine::on_stmt): Likewise.
8901 * sm-taint.cc (taint_state_machine::on_stmt): Replace
8902 warn_for_state and on_transition calls with a get_state
8903 test guarding warn and set_next_state calls.
8904 * sm.h (sm_context::warn_for_state): Replace with...
8905 (sm_context::warn): ...this.
8907 2020-09-09 David Malcolm <dmalcolm@redhat.com>
8909 * diagnostic-manager.cc
8910 (null_assignment_sm_context::null_assignment_sm_context): Add old_state
8911 and ext_state params, initializing m_old_state and m_ext_state.
8912 (null_assignment_sm_context::on_transition): Split into...
8913 (null_assignment_sm_context::get_state): ...this new vfunc
8914 implementation and...
8915 (null_assignment_sm_context::set_next_state): ...this new vfunc
8917 (null_assignment_sm_context::m_old_state): New field.
8918 (null_assignment_sm_context::m_ext_state): New field.
8919 (diagnostic_manager::add_events_for_eedge): Pass in old state and
8920 ext_state when creating sm_ctxt.
8921 * engine.cc (impl_sm_context::on_transition): Split into...
8922 (impl_sm_context::get_state): ...this new vfunc
8923 implementation and...
8924 (impl_sm_context::set_next_state): ...this new vfunc
8926 * sm.h (sm_context::get_state): New pure virtual function.
8927 (sm_context::set_next_state): Likewise.
8928 (sm_context::on_transition): Convert from a pure virtual function
8929 to a regular function implemented in terms of get_state and
8932 2020-09-09 David Malcolm <dmalcolm@redhat.com>
8934 * checker-path.cc (state_change_event::get_desc): Update
8935 state_machine::get_state_name calls to state::get_name.
8936 (warning_event::get_desc): Likewise.
8937 * diagnostic-manager.cc
8938 (null_assignment_sm_context::on_transition): Update comparison
8939 against 0 with comparison with m_sm.get_start_state.
8940 (diagnostic_manager::prune_for_sm_diagnostic): Update
8941 state_machine::get_state_name calls to state::get_name.
8942 * engine.cc (impl_sm_context::on_transition): Likewise.
8943 (exploded_node::get_dot_fillcolor): Use get_id when summing
8945 * program-state.cc (sm_state_map::sm_state_map): Don't hardcode
8946 0 as the start state when initializing m_global_state.
8947 (sm_state_map::print): Use dump_to_pp rather than get_state_name
8948 when dumping states.
8949 (sm_state_map::is_empty_p): Don't hardcode 0 as the start state
8950 when examining m_global_state.
8951 (sm_state_map::hash): Use get_id when hashing states.
8952 (selftest::test_sm_state_map): Use state objects rather than
8953 arbitrary hardcoded integers.
8954 (selftest::test_program_state_merging): Likewise.
8955 (selftest::test_program_state_merging_2): Likewise.
8956 * sm-file.cc (fileptr_state_machine::m_start): Move to base class.
8957 (file_diagnostic::describe_state_change): Use get_start_state.
8958 (fileptr_state_machine::fileptr_state_machine): Drop m_start
8960 * sm-malloc.cc (malloc_state_machine::m_start): Move to base
8962 (malloc_diagnostic::describe_state_change): Use get_start_state.
8963 (possible_null::describe_state_change): Likewise.
8964 (malloc_state_machine::malloc_state_machine): Drop m_start
8966 * sm-pattern-test.cc (pattern_test_state_machine::m_start): Move
8968 (pattern_test_state_machine::pattern_test_state_machine): Drop
8969 m_start initialization.
8970 * sm-sensitive.cc (sensitive_state_machine::m_start): Move to base
8972 (sensitive_state_machine::sensitive_state_machine): Drop m_start
8974 * sm-signal.cc (signal_state_machine::m_start): Move to base
8976 (signal_state_machine::signal_state_machine): Drop m_start
8978 * sm-taint.cc (taint_state_machine::m_start): Move to base class.
8979 (taint_state_machine::taint_state_machine): Drop m_start
8981 * sm.cc (state_machine::state::dump_to_pp): New.
8982 (state_machine::state_machine): Move here from sm.h. Initialize
8983 m_next_state_id and m_start.
8984 (state_machine::add_state): Reimplement in terms of state objects.
8985 (state_machine::get_state_name): Delete.
8986 (state_machine::get_state_by_name): Reimplement in terms of state
8987 objects. Make const.
8988 (state_machine::validate): Delete.
8989 (state_machine::dump_to_pp): Reimplement in terms of state
8991 * sm.h (state_machine::state): New class.
8992 (state_machine::state_t): Convert typedef from "unsigned" to
8993 "const state_machine::state *".
8994 (state_machine::state_machine): Move to sm.cc.
8995 (state_machine::get_default_state): Use m_start rather than
8997 (state_machine::get_state_name): Delete.
8998 (state_machine::get_state_by_name): Make const.
8999 (state_machine::get_start_state): New accessor.
9000 (state_machine::alloc_state_id): New.
9001 (state_machine::m_state_names): Drop in favor of...
9002 (state_machine::m_states): New field
9003 (state_machine::m_start): New field
9004 (start_start_p): Delete.
9006 2020-09-08 David Malcolm <dmalcolm@redhat.com>
9009 * store.cc (binding_map::apply_ctor_val_to_range): Add
9010 error-handling for the cases where we have symbolic offsets.
9012 2020-09-08 David Malcolm <dmalcolm@redhat.com>
9015 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
9016 where min_index == max_index.
9017 (binding_map::apply_ctor_val_to_range): Replace assertion that we
9018 don't have a CONSTRUCTOR value with error-handling.
9020 2020-09-08 David Malcolm <dmalcolm@redhat.com>
9023 * region-model.cc (region_model::on_call_pre): Fix guard on switch
9024 on built-ins to only consider BUILT_IN_NORMAL, rather than other
9027 2020-09-01 David Malcolm <dmalcolm@redhat.com>
9030 * region-model.cc (region_model::deref_rvalue): Add the constraint
9031 that PTR_SVAL is non-NULL.
9033 2020-08-31 David Malcolm <dmalcolm@redhat.com>
9036 * region-model.cc (region_model::on_call_pre): Handle
9037 BUILT_IN_MEMSET_CHK.
9039 2020-08-31 David Malcolm <dmalcolm@redhat.com>
9041 * region-model.cc (region_model::on_call_pre): Gather handling of
9042 builtins and of internal fns into switch statements. Handle
9043 "alloca" and BUILT_IN_ALLOCA_WITH_ALIGN.
9045 2020-08-31 David Malcolm <dmalcolm@redhat.com>
9048 * region.cc (decl_region::get_svalue_for_constructor): Support
9049 apply_ctor_to_region failing.
9050 * store.cc (binding_map::apply_ctor_to_region): Add failure
9052 (binding_map::apply_ctor_val_to_range): Likewise.
9053 (binding_map::apply_ctor_pair_to_child_region): Likewise. Replace
9054 assertion that child_base_offset is not symbolic with error
9056 * store.h (binding_map::apply_ctor_to_region): Convert return type
9058 (binding_map::apply_ctor_val_to_range): Likewise.
9059 (binding_map::apply_ctor_pair_to_child_region): Likewise.
9061 2020-08-31 David Malcolm <dmalcolm@redhat.com>
9064 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
9065 by calling a new binding_map::apply_ctor_val_to_range subroutine.
9066 Split out the existing non-CONSTRUCTOR-handling code to a new
9067 apply_ctor_pair_to_child_region subroutine.
9068 (binding_map::apply_ctor_val_to_range): New.
9069 (binding_map::apply_ctor_pair_to_child_region): New, split out
9070 from binding_map::apply_ctor_to_region as noted above.
9071 * store.h (binding_map::apply_ctor_val_to_range): New decl.
9072 (binding_map::apply_ctor_pair_to_child_region): New decl.
9074 2020-08-31 David Malcolm <dmalcolm@redhat.com>
9077 * region-model-manager.cc
9078 (region_model_manager::maybe_fold_unaryop): Handle VIEW_CONVERT_EXPR.
9079 (region_model_manager::get_or_create_cast): Move logic for
9080 real->integer casting to...
9081 (get_code_for_cast): ...this new function, and add logic for
9082 real->non-integer casts.
9083 (region_model_manager::maybe_fold_sub_svalue): Handle
9086 (region_model::add_any_constraints_from_gassign): Likewise.
9087 * svalue.cc (svalue::maybe_undo_cast): Likewise.
9088 (unaryop_svalue::dump_to_pp): Likewise.
9090 2020-08-26 David Malcolm <dmalcolm@redhat.com>
9093 * region-model-manager.cc
9094 (region_model_manager::get_or_create_widening_svalue): Assert that
9095 neither of the inputs are themselves widenings.
9096 * store.cc (store::eval_alias_1): The initial value of a pointer
9097 can't point to a region that was allocated on the heap after the
9098 beginning of the path. A widened pointer value can't alias anything
9099 that the initial pointer value can't alias.
9100 * svalue.cc (svalue::can_merge_p): Merge BINOP (X, OP, CST) with X
9101 to a widening svalue. Merge
9102 BINOP(WIDENING(BASE, BINOP(BASE, X)), X) and BINOP(BASE, X) to
9103 to the LHS of the first BINOP.
9105 2020-08-26 David Malcolm <dmalcolm@redhat.com>
9108 * region-model.h (class compound_svalue): Document that all keys
9110 (compound_svalue::compound_svalue): Move definition to svalue.cc.
9111 * store.cc (binding_map::apply_ctor_to_region): Handle
9112 initializers for trailing arrays with incomplete size.
9113 * svalue.cc (compound_svalue::compound_svalue): Move definition
9114 here from region-model.h. Add assertion that all keys are
9117 2020-08-22 David Malcolm <dmalcolm@redhat.com>
9120 * region-model-manager.cc
9121 (region_model_manager::maybe_fold_binop): Fold bitwise "& 0" to 0.
9123 2020-08-22 David Malcolm <dmalcolm@redhat.com>
9125 * store.cc (store::eval_alias): Make const. Split out 2nd half
9126 into store::eval_alias_1 and call it twice for symmetry, avoiding
9128 (store::eval_alias_1): New function, split out from the above.
9129 * store.h (store::eval_alias): Make const.
9130 (store::eval_alias_1): New decl.
9132 2020-08-22 David Malcolm <dmalcolm@redhat.com>
9134 * region-model.cc (region_model::push_frame): Bind the default
9135 SSA name for each parm if it exists, falling back to the parm
9136 itself otherwise, rather than doing both.
9138 2020-08-20 David Malcolm <dmalcolm@redhat.com>
9141 * region-model-manager.cc
9142 (region_model_manager::get_field_region): Assert that field is a
9144 * region.cc (region::get_subregions_for_binding): In
9145 union-handling, filter the TYPE_FIELDS traversal to just FIELD_DECLs.
9147 2020-08-20 David Malcolm <dmalcolm@redhat.com>
9150 * region-model.cc (region_model::get_gassign_result): For
9151 comparisons, only use eval_condition when the lhs has boolean
9152 type, and use get_or_create_constant_svalue on the boolean
9153 constants directly rather than via get_rvalue.
9155 2020-08-19 David Malcolm <dmalcolm@redhat.com>
9158 * region-model.cc (region_model::deref_rvalue): Rather than
9159 attempting to handle all svalue kinds in the switch, only cover
9160 the special cases, and move symbolic-region handling to after
9161 the switch, thus implicitly handling the missing case SK_COMPOUND.
9163 2020-08-19 David Malcolm <dmalcolm@redhat.com>
9166 * region-model-manager.cc
9167 (region_model_manager::maybe_fold_binop): Check that we have an
9168 integral type before calling build_int_cst.
9170 2020-08-19 David Malcolm <dmalcolm@redhat.com>
9173 * region-model-manager.cc
9174 (region_model_manager::get_or_create_cast): Use FIX_TRUNC_EXPR for
9175 casting from REAL_TYPE to INTEGER_TYPE.
9177 2020-08-19 David Malcolm <dmalcolm@redhat.com>
9180 * region-model.cc (region_model::called_from_main_p): New.
9181 (region_model::get_store_value): Move handling for globals into...
9182 (region_model::get_initial_value_for_global): ...this new
9183 function, and add logic for extracting values from decl
9185 * region-model.h (decl_region::get_svalue_for_constructor): New
9187 (decl_region::get_svalue_for_initializer): New decl.
9188 (region_model::called_from_main_p): New decl.
9189 (region_model::get_initial_value_for_global): New.
9190 * region.cc (decl_region::maybe_get_constant_value): Move logic
9191 for getting an svalue from a CONSTRUCTOR node to...
9192 (decl_region::get_svalue_for_constructor): ...this new function.
9193 (decl_region::get_svalue_for_initializer): New.
9194 * store.cc (get_svalue_for_ctor_val): Rewrite in terms of
9195 region_model::get_rvalue.
9196 * store.h (binding_cluster::get_map): New accessor.
9198 2020-08-19 David Malcolm <dmalcolm@redhat.com>
9201 * region.cc (get_field_at_bit_offset): Gracefully handle negative
9202 values for bit_offset.
9204 2020-08-18 David Malcolm <dmalcolm@redhat.com>
9206 * region-model.cc (region_model::get_rvalue_1): Fix name of local.
9208 2020-08-18 David Malcolm <dmalcolm@redhat.com>
9211 * region-model.cc (region_model::get_rvalue_1): Handle
9212 unrecognized tree codes by returning "UNKNOWN.
9214 2020-08-18 David Malcolm <dmalcolm@redhat.com>
9217 * region-model.cc (region_model::get_gassign_result): Handle various
9218 VEC_* tree codes by returning UNKNOWN.
9219 (region_model::on_assignment): Handle unrecognized tree codes by
9220 setting lhs to an unknown value, rather than issuing a "sorry" and
9223 2020-08-17 David Malcolm <dmalcolm@redhat.com>
9226 * region-model-manager.cc (get_region_for_unexpected_tree_code):
9227 Handle ctxt being NULL.
9229 2020-08-17 David Malcolm <dmalcolm@redhat.com>
9232 * region.cc (region::get_subregions_for_binding): Check for "type"
9235 2020-08-17 David Malcolm <dmalcolm@redhat.com>
9238 * store.cc (get_svalue_for_ctor_val): New.
9239 (binding_map::apply_ctor_to_region): Call it.
9241 2020-08-14 David Malcolm <dmalcolm@redhat.com>
9245 * region-model.cc (region_model::get_store_value): Call
9246 maybe_get_constant_value on decl_regions first.
9247 * region-model.h (decl_region::maybe_get_constant_value): New decl.
9248 * region.cc (decl_region::get_stack_depth): Likewise.
9249 (decl_region::maybe_get_constant_value): New.
9250 * store.cc (get_subregion_within_ctor): New.
9251 (binding_map::apply_ctor_to_region): New.
9252 * store.h (binding_map::apply_ctor_to_region): New decl.
9254 2020-08-14 David Malcolm <dmalcolm@redhat.com>
9257 * store.cc (store::mark_as_escaped): Reject attempts to
9258 get a cluster for an unknown pointer.
9260 2020-08-13 David Malcolm <dmalcolm@redhat.com>
9276 * analyzer-logging.cc: Ignore "-Wformat-diag".
9277 (logger::enter_scope): Use inc_indent in both overloads.
9278 (logger::exit_scope): Use dec_indent.
9279 * analyzer-logging.h (logger::inc_indent): New.
9280 (logger::dec_indent): New.
9281 * analyzer-selftests.cc (run_analyzer_selftests): Call
9282 analyzer_store_cc_tests.
9283 * analyzer-selftests.h (analyzer_store_cc_tests): New decl.
9284 * analyzer.cc (get_stmt_location): New function.
9285 * analyzer.h (class initial_svalue): New forward decl.
9286 (class unaryop_svalue): New forward decl.
9287 (class binop_svalue): New forward decl.
9288 (class sub_svalue): New forward decl.
9289 (class unmergeable_svalue): New forward decl.
9290 (class placeholder_svalue): New forward decl.
9291 (class widening_svalue): New forward decl.
9292 (class compound_svalue): New forward decl.
9293 (class conjured_svalue): New forward decl.
9294 (svalue_set): New typedef.
9295 (class map_region): Delete.
9296 (class array_region): Delete.
9297 (class frame_region): New forward decl.
9298 (class function_region): New forward decl.
9299 (class label_region): New forward decl.
9300 (class decl_region): New forward decl.
9301 (class element_region): New forward decl.
9302 (class offset_region): New forward decl.
9303 (class cast_region): New forward decl.
9304 (class field_region): New forward decl.
9305 (class string_region): New forward decl.
9306 (class region_model_manager): New forward decl.
9307 (class store_manager): New forward decl.
9308 (class store): New forward decl.
9309 (class call_details): New forward decl.
9310 (struct svalue_id_merger_mapping): Delete.
9311 (struct canonicalization): Delete.
9312 (class function_point): New forward decl.
9313 (class engine): New forward decl.
9314 (dump_tree): New function decl.
9315 (print_quoted_type): New function decl.
9316 (readability_comparator): New function decl.
9317 (tree_cmp): New function decl.
9318 (class path_var): Move here from region-model.h
9319 (bit_offset_t, bit_size_t, byte_size_t): New typedefs.
9320 (class region_offset): New class.
9321 (get_stmt_location): New decl.
9322 (struct member_function_hash_traits): New struct.
9323 (class consolidation_map): New class.
9324 Ignore "-Wformat-diag".
9325 * analyzer.opt (-param=analyzer-max-svalue-depth=): New param.
9326 (-param=analyzer-max-enodes-for-full-dump=): New param.
9327 * call-string.cc: Ignore -Wformat-diag.
9328 * checker-path.cc: Move includes of "analyzer/call-string.h" and
9329 "analyzer/program-point.h" to before "analyzer/region-model.h",
9330 and also include "analyzer/store.h" before it.
9331 (state_change_event::state_change_event): Replace "tree var" param
9332 with "const svalue *sval". Convert "origin" param from tree to
9334 (state_change_event::get_desc): Call get_representative_tree to
9335 convert the var and origin from const svalue * to tree. Use
9336 svalue::get_desc rather than %qE when describing state changes.
9337 (checker_path::add_final_event): Use get_stmt_location.
9338 * checker-path.h (state_change_event::state_change_event): Port
9339 from tree to const svalue *.
9340 (state_change_event::get_lvalue): Delete.
9341 (state_change_event::get_dest_function): New.
9342 (state_change_event::m_var): Replace with...
9343 (state_change_event::m_sval): ...this.
9344 (state_change_event::m_origin): Convert from tree to
9346 * constraint-manager.cc: Include "analyzer/call-string.h",
9347 "analyzer/program-point.h", and "analyzer/store.h" before
9348 "analyzer/region-model.h".
9349 (struct bound, struct range): Move to constraint-manager.h.
9350 (compare_constants): New function.
9351 (range::dump): Rename to...
9352 (range::dump_to_pp): ...this. Support NULL constants.
9353 (range::dump): Reintroduce for dumping to stderr.
9354 (range::constrained_to_single_element): Return result, rather than
9356 (range::eval_condition): New.
9357 (range::below_lower_bound): New.
9358 (range::above_upper_bound): New.
9359 (equiv_class::equiv_class): Port from svalue_id to const svalue *.
9360 (equiv_class::print): Likewise.
9361 (equiv_class::hash): Likewise.
9362 (equiv_class::operator==): Port from svalue_id to const svalue *.
9363 (equiv_class::add): Port from svalue_id to const svalue *. Drop
9365 (equiv_class::del): Port from svalue_id to const svalue *.
9366 (equiv_class::get_representative): Likewise.
9367 (equiv_class::remap_svalue_ids): Delete.
9368 (svalue_id_cmp_by_id): Rename to...
9369 (svalue_cmp_by_ptr): ...this, porting from svalue_id to
9371 (equiv_class::canonicalize): Update qsort comparator.
9372 (constraint::implied_by): New.
9373 (constraint_manager::constraint_manager): Copy m_mgr in copy ctor.
9374 (constraint_manager::dump_to_pp): Add "multiline" param
9375 (constraint_manager::dump): Pass "true" for "multiline".
9376 (constraint_manager::add_constraint): Port from svalue_id to
9377 const svalue *. Split out second part into...
9378 (constraint_manager::add_unknown_constraint): ...this new
9379 function. Remove self-constraints when merging equivalence
9381 (constraint_manager::add_constraint_internal): Remove constraints
9382 that would be implied by the new constraint. Port from svalue_id
9384 (constraint_manager::get_equiv_class_by_sid): Rename to...
9385 (constraint_manager::get_equiv_class_by_svalue): ...this, porting
9386 from svalue_id to const svalue *.
9387 (constraint_manager::get_or_add_equiv_class): Port from svalue_id
9389 (constraint_manager::eval_condition): Make const. Call
9390 compare_constants and return early if it provides a known result.
9391 (constraint_manager::get_ec_bounds): New.
9392 (constraint_manager::eval_condition): New overloads. Make
9393 existing one const, and use compare_constants.
9394 (constraint_manager::purge): Convert "p" param to a template
9395 rather that an abstract base class. Port from svalue_id to
9397 (class dead_svalue_purger): New class.
9398 (constraint_manager::remap_svalue_ids): Delete.
9399 (constraint_manager::on_liveness_change): New.
9400 (equiv_class_cmp): Port from svalue_id to const svalue *.
9401 (constraint_manager::canonicalize): Likewise. Combine with
9402 purging of redundant equivalence classes and constraints.
9403 (class cleaned_constraint_manager): Delete.
9404 (class merger_fact_visitor): Make "m_cm_b" const. Add "m_merger"
9406 (merger_fact_visitor::fact): Port from svalue_id to const svalue *.
9407 Add special case for widening.
9408 (constraint_manager::merge): Port from svalue_id to const svalue *.
9409 (constraint_manager::clean_merger_input): Delete.
9410 (constraint_manager::for_each_fact): Port from svalue_id to
9412 (constraint_manager::validate): Likewise.
9413 (selftest::test_constraint_conditions): Provide a
9414 region_model_manager when creating region_model instances.
9415 Add test for self-equality not creating equivalence classes.
9416 (selftest::test_transitivity): Provide a region_model_manager when
9417 creating region_model instances. Verify that EC-merging happens
9418 when constraints are implied.
9419 (selftest::test_constant_comparisons): Provide a
9420 region_model_manager when creating region_model instances.
9421 (selftest::test_constraint_impl): Likewise. Remove over-specified
9423 (selftest::test_equality): Provide a region_model_manager when
9424 creating region_model instances.
9425 (selftest::test_many_constants): Likewise. Provide a
9426 program_point when testing merging.
9427 (selftest::run_constraint_manager_tests): Move call to
9428 test_constant_comparisons to outside the transitivity guard.
9429 * constraint-manager.h (struct bound): Move here from
9430 constraint-manager.cc.
9431 (struct range): Likewise.
9432 (struct::eval_condition): New decl.
9433 (struct::below_lower_bound): New decl.
9434 (struct::above_upper_bound): New decl.
9435 (equiv_class::add): Port from svalue_id to const svalue *.
9436 (equiv_class::del): Likewise.
9437 (equiv_class::get_representative): Likewise.
9438 (equiv_class::remap_svalue_ids): Drop.
9439 (equiv_class::m_cst_sid): Convert to..
9440 (equiv_class::m_cst_sval): ...this.
9441 (equiv_class::m_vars): Port from svalue_id to const svalue *.
9442 (constraint::bool implied_by): New decl.
9443 (fact_visitor::on_fact): Port from svalue_id to const svalue *.
9444 (constraint_manager::constraint_manager): Add mgr param.
9445 (constraint_manager::clone): Delete.
9446 (constraint_manager::maybe_get_constant): Delete.
9447 (constraint_manager::get_sid_for_constant): Delete.
9448 (constraint_manager::get_num_svalues): Delete.
9449 (constraint_manager::dump_to_pp): Add "multiline" param.
9450 (constraint_manager::get_equiv_class): Port from svalue_id to
9452 (constraint_manager::add_constraint): Likewise.
9453 (constraint_manager::get_equiv_class_by_sid): Rename to...
9454 (constraint_manager::get_equiv_class_by_svalue): ...this, porting
9455 from svalue_id to const svalue *.
9456 (constraint_manager::add_unknown_constraint): New decl.
9457 (constraint_manager::get_or_add_equiv_class): Port from svalue_id
9459 (constraint_manager::eval_condition): Likewise. Add overloads.
9460 (constraint_manager::get_ec_bounds): New decl.
9461 (constraint_manager::purge): Convert to template.
9462 (constraint_manager::remap_svalue_ids): Delete.
9463 (constraint_manager::on_liveness_change): New decl.
9464 (constraint_manager::canonicalize): Drop param.
9465 (constraint_manager::clean_merger_input): Delete.
9466 (constraint_manager::m_mgr): New field.
9467 * diagnostic-manager.cc: Move includes of
9468 "analyzer/call-string.h" and "analyzer/program-point.h" to before
9469 "analyzer/region-model.h", and also include "analyzer/store.h"
9471 (saved_diagnostic::saved_diagnostic): Add "sval" param.
9472 (diagnostic_manager::diagnostic_manager): Add engine param.
9473 (diagnostic_manager::add_diagnostic): Add "sval" param, passing it
9474 to saved_diagnostic ctor. Update overload to pass NULL for it.
9475 (dedupe_winners::dedupe_winners): Add engine param.
9476 (dedupe_winners::add): Add "eg" param. Pass m_engine to
9478 (dedupe_winner::m_engine): New field.
9479 (diagnostic_manager::emit_saved_diagnostics): Pass engine to
9480 dedupe_winners. Pass &eg when adding candidates. Pass svalue
9481 rather than tree to prune_path. Use get_stmt_location to get
9482 primary location of diagnostic.
9483 (diagnostic_manager::emit_saved_diagnostic): Likewise.
9484 (get_any_origin): Drop.
9485 (state_change_event_creator::on_global_state_change): Pass NULL
9486 const svalue * rather than NULL_TREE trees to state_change_event
9488 (state_change_event_creator::on_state_change): Port from tree and
9489 svalue_id to const svalue *.
9490 (for_each_state_change): Port from svalue_id to const svalue *.
9491 (struct null_assignment_sm_context): New.
9492 (diagnostic_manager::add_events_for_eedge): Add state change
9493 events for assignment to NULL.
9494 (diagnostic_manager::prune_path): Update param from tree to
9496 (diagnostic_manager::prune_for_sm_diagnostic): Port from tracking
9497 by tree to by const svalue *.
9498 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add sval
9500 (saved_diagnostic::m_sval): New field.
9501 (diagnostic_manager::diagnostic_manager): Add engine param.
9502 (diagnostic_manager::get_engine): New.
9503 (diagnostic_manager::add_diagnostic): Add "sval" param.
9504 (diagnostic_manager::prune_path): Likewise.
9505 (diagnostic_manager::prune_for_sm_diagnostic): New overload.
9506 (diagnostic_manager::m_eng): New field.
9507 * engine.cc: Move includes of "analyzer/call-string.h" and
9508 "analyzer/program-point.h" to before "analyzer/region-model.h",
9509 and also include "analyzer/store.h" before it.
9510 (impl_region_model_context::impl_region_model_context): Update for
9511 removal of m_change field.
9512 (impl_region_model_context::remap_svalue_ids): Delete.
9513 (impl_region_model_context::on_svalue_leak): New.
9514 (impl_region_model_context::on_svalue_purge): Delete.
9515 (impl_region_model_context::on_liveness_change): New.
9516 (impl_region_model_context::on_unknown_change): Update param
9517 from svalue_id to const svalue *. Add is_mutable param.
9518 (setjmp_svalue::compare_fields): Delete.
9519 (setjmp_svalue::accept): New.
9520 (setjmp_svalue::add_to_hash): Delete.
9521 (setjmp_svalue::dump_to_pp): New.
9522 (setjmp_svalue::print_details): Delete.
9523 (impl_sm_context::impl_sm_context): Drop "change" param.
9524 (impl_sm_context::get_fndecl_for_call): Drop "m_change".
9525 (impl_sm_context::on_transition): Drop ATTRIBUTE_UNUSED from
9526 "stmt" param. Drop m_change. Port from svalue_id to
9528 (impl_sm_context::warn_for_state): Drop m_change. Port from
9529 svalue_id to const svalue *.
9530 (impl_sm_context::get_readable_tree): Rename to...
9531 (impl_sm_context::get_diagnostic_tree): ...this. Port from
9532 svalue_id to const svalue *.
9533 (impl_sm_context::is_zero_assignment): New.
9534 (impl_sm_context::m_change): Delete field.
9535 (leak_stmt_finder::find_stmt): Handle m_var being NULL.
9536 (readability): Increase penalty for MEM_REF. For SSA_NAMEs,
9537 slightly favor the underlying var over the SSA name. Heavily
9538 penalize temporaries. Handle RESULT_DECL.
9539 (readability_comparator): Make non-static. Consider stack depths.
9540 (impl_region_model_context::on_state_leak): Convert from svalue_id
9541 to const svalue *, updating for region_model changes. Use
9543 (impl_region_model_context::on_inherited_svalue): Delete.
9544 (impl_region_model_context::on_cast): Delete.
9545 (impl_region_model_context::on_condition): Drop m_change.
9546 (impl_region_model_context::on_phi): Likewise.
9547 (impl_region_model_context::on_unexpected_tree_code): Handle t
9549 (point_and_state::validate): Update stack checking for
9550 region_model changes.
9551 (eg_traits::dump_args_t::show_enode_details_p): New.
9552 (exploded_node::exploded_node): Initialize m_num_processed_stmts.
9553 (exploded_node::get_processed_stmt): New function.
9554 (exploded_node::get_dot_fillcolor): Add more colors.
9555 (exploded_node::dump_dot): Guard the printing of the point and
9556 state with show_enode_details_p. Print the processed stmts for
9557 this enode after the initial state.
9558 (exploded_node::dump_to_pp): Pass true for new multiline param
9559 of program_state::dump_to_pp.
9560 (exploded_node::on_stmt): Drop "change" param. Log the stmt.
9561 Set input_location. Implement __analyzer_describe. Update
9562 implementation of __analyzer_dump and __analyzer_eval.
9563 Remove purging of sm-state for unknown fncalls from here.
9564 (exploded_node::on_edge): Drop "change" param.
9565 (exploded_node::on_longjmp): Port from region_id/svalue_id to
9566 const region */const svalue *. Call program_state::detect_leaks.
9568 (exploded_node::detect_leaks): Update for changes to region_model.
9569 Call program_state::detect_leaks.
9570 (exploded_edge::exploded_edge): Drop ext_state and change params.
9571 (exploded_edge::dump_dot): "args" is no longer used. Drop dumping
9573 (exploded_graph::exploded_graph): Pass engine to
9574 m_diagnostic_manager ctor. Use program_point::origin.
9575 (exploded_graph::add_function_entry): Drop ctxt. Use
9576 program_state::push_frame. Drop state_change.
9577 (exploded_graph::get_or_create_node): Drop "change" param. Add
9578 "enode_for_diag" param. Update dumping calls for API changes.
9579 Pass point to can_merge_with_p. Show enode indices
9580 within -Wanalyzer-too-complex diagnostic for hitting the per-point
9582 (exploded_graph::add_edge): Drop "change" param. Log which nodes
9583 are being connected. Update for changes to exploded_edge ctor.
9584 (exploded_graph::get_per_program_point_data): New.
9585 (exploded_graph::process_worklist): Pass point to
9586 can_merge_with_p. Drop state_change. Update dumping call for API
9588 (exploded_graph::process_node): Drop state_change. Split the
9589 node in-place if an sm-state-change occurs. Update
9590 m_num_processed_stmts. Update dumping calls for API change.
9591 (exploded_graph::log_stats): Call engine::log_stats.
9592 (exploded_graph::dump_states_for_supernode): Update dumping
9594 (exploded_path::feasible_p): Add "eng" and "eg" params.
9595 Rename "i" to "end_idx". Pass the manager to the region_model
9596 ctor. Update for every processed stmt in the enode, not just the
9597 first. Keep track of which snodes have been visited, and call
9598 loop_replay_fixup when revisiting one.
9599 (enode_label::get_text): Update dump call for new param.
9600 (exploded_graph::dump_exploded_nodes): Likewise.
9601 (exploded_graph::get_node_by_index): New.
9602 (impl_run_checkers): Create engine instance and pass its address
9603 to extrinsic_state ctor.
9605 (impl_region_model_context::impl_region_model_context): Drop
9607 (impl_region_model_context::void remap_svalue_ids): Delete.
9608 (impl_region_model_context::on_svalue_purge): Delete.
9609 (impl_region_model_context::on_svalue_leak): New.
9610 (impl_region_model_context::on_liveness_change): New.
9611 (impl_region_model_context::on_state_leak): Update signature.
9612 (impl_region_model_context::on_inherited_svalue): Delete.
9613 (impl_region_model_context::on_cast): Delete.
9614 (impl_region_model_context::on_unknown_change): Update signature.
9615 (impl_region_model_context::m_change): Delete.
9616 (eg_traits::dump_args_t::show_enode_details_p): New.
9617 (exploded_node::on_stmt): Drop "change" param.
9618 (exploded_node::on_edge): Likewise.
9619 (exploded_node::get_processed_stmt): New decl.
9620 (exploded_node::m_num_processed_stmts): New field.
9621 (exploded_edge::exploded_edge): Drop ext_state and change params.
9622 (exploded_edge::m_change): Delete.
9623 (exploded_graph::get_engine): New accessor.
9624 (exploded_graph::get_or_create_node): Drop "change" param. Add
9625 "enode_for_diag" param.
9626 (exploded_graph::add_edge): Drop "change" param.
9627 (exploded_graph::get_per_program_point_data): New decl.
9628 (exploded_graph::get_node_by_index): New decl.
9629 (exploded_path::feasible_p): Add "eng" and "eg" params.
9630 * program-point.cc: Include "analyzer/store.h" before including
9631 "analyzer/region-model.h".
9632 (function_point::function_point): Move here from
9634 (function_point::get_function): Likewise.
9635 (function_point::from_function_entry): Likewise.
9636 (function_point::before_supernode): Likewise.
9637 (function_point::next_stmt): New function.
9638 * program-point.h (function_point::function_point): Move
9639 implementation from here to program-point.cc.
9640 (function_point::get_function): Likewise.
9641 (function_point::from_function_entry): Likewise.
9642 (function_point::before_supernode): Likewise.
9643 (function_point::next_stmt): New decl.
9644 (program_point::operator!=): New.
9645 (program_point::origin): New.
9646 (program_point::next_stmt): New.
9647 (program_point::m_function_point): Make non-const.
9648 * program-state.cc: Move includes of "analyzer/call-string.h" and
9649 "analyzer/program-point.h" to before "analyzer/region-model.h",
9650 and also include "analyzer/store.h" before it.
9651 (extrinsic_state::get_model_manager): New.
9652 (sm_state_map::sm_state_map): Pass in sm and sm_idx to ctor,
9653 rather than pass the around.
9654 (sm_state_map::clone_with_remapping): Delete.
9655 (sm_state_map::print): Remove "sm" param in favor of "m_sm". Add
9656 "simple" and "multiline" params and support multiline vs single
9658 (sm_state_map::dump): Remove "sm" param in favor of "m_sm". Add
9660 (sm_state_map::hash): Port from svalue_id to const svalue *.
9661 (sm_state_map::operator==): Likewise.
9662 (sm_state_map::get_state): Likewise. Call canonicalize_svalue on
9663 input. Handle inheritance of sm-state. Call get_default_state.
9664 (sm_state_map::get_origin): Port from svalue_id to const svalue *.
9665 (sm_state_map::set_state): Likewise. Pass in ext_state. Reject
9666 attempts to set state on UNKNOWN.
9667 (sm_state_map::impl_set_state): Port from svalue_id to
9668 const svalue *. Pass in ext_state. Call canonicalize_svalue on
9670 (sm_state_map::purge_for_unknown_fncall): Delete.
9671 (sm_state_map::on_svalue_leak): New.
9672 (sm_state_map::remap_svalue_ids): Delete.
9673 (sm_state_map::on_liveness_change): New.
9674 (sm_state_map::on_unknown_change): Reimplement.
9675 (sm_state_map::on_svalue_purge): Delete.
9676 (sm_state_map::on_inherited_svalue): Delete.
9677 (sm_state_map::on_cast): Delete.
9678 (sm_state_map::validate): Delete.
9679 (sm_state_map::canonicalize_svalue): New.
9680 (program_state::program_state): Update to pass manager to
9681 region_model's ctor. Constify num_states and pass state machine
9682 and index to sm_state_map ctor.
9683 (program_state::print): Update for changes to dump API.
9684 (program_state::dump_to_pp): Ignore the summarize param. Add
9686 (program_state::dump_to_file): Add "multiline" param.
9687 (program_state::dump): Pass "true" for new "multiline" param.
9688 (program_state::push_frame): New.
9689 (program_state::on_edge): Drop "change" param. Call
9690 program_state::detect_leaks.
9691 (program_state::prune_for_point): Add enode_for_diag param.
9692 Reimplement based on store class. Call detect_leaks
9693 (program_state::remap_svalue_ids): Delete.
9694 (program_state::get_representative_tree): Port from svalue_id to
9696 (program_state::can_merge_with_p): Add "point" param. Add early
9697 reject for sm-differences. Drop id remapping.
9698 (program_state::validate): Drop region model and sm_state_map
9700 (state_change::sm_change::dump): Delete.
9701 (state_change::sm_change::remap_svalue_ids): Delete.
9702 (state_change::sm_change::on_svalue_purge): Delete.
9703 (log_set_of_svalues): New.
9704 (state_change::sm_change::validate): Delete.
9705 (state_change::state_change): Delete.
9706 (state_change::add_sm_change): Delete.
9707 (state_change::affects_p): Delete.
9708 (state_change::dump): Delete.
9709 (state_change::remap_svalue_ids): Delete.
9710 (state_change::on_svalue_purge): Delete.
9711 (state_change::validate): Delete.
9712 (selftest::assert_dump_eq): Delete.
9713 (ASSERT_DUMP_EQ): Delete.
9714 (selftest::test_sm_state_map): Update for changes to region_model
9715 and sm_state_map, porting from svalue_id to const svalue *.
9716 (selftest::test_program_state_dumping): Likewise. Drop test of
9717 dumping, renaming to...
9718 (selftest::test_program_state_1): ...this.
9719 (selftest::test_program_state_dumping_2): Likewise, renaming to...
9720 (selftest::test_program_state_2): ...this.
9721 (selftest::test_program_state_merging): Update for changes to
9723 (selftest::test_program_state_merging_2): Likewise.
9724 (selftest::analyzer_program_state_cc_tests): Update for renamed
9726 * program-state.h (extrinsic_state::extrinsic_state): Add logger
9728 (extrinsic_state::get_logger): New accessor.
9729 (extrinsic_state::get_engine): New accessor.
9730 (extrinsic_state::get_model_manager): New accessor.
9731 (extrinsic_state::m_logger): New field.
9732 (extrinsic_state::m_engine): New field.
9733 (struct default_hash_traits<svalue_id>): Delete.
9734 (pod_hash_traits<svalue_id>::hash): Delete.
9735 (pod_hash_traits<svalue_id>::equal): Delete.
9736 (pod_hash_traits<svalue_id>::mark_deleted): Delete.
9737 (pod_hash_traits<svalue_id>::mark_empty): Delete.
9738 (pod_hash_traits<svalue_id>::is_deleted): Delete.
9739 (pod_hash_traits<svalue_id>::is_empty): Delete.
9740 (sm_state_map::entry_t::entry_t): Port from svalue_id to
9742 (sm_state_map::entry_t::m_origin): Likewise.
9743 (sm_state_map::map_t): Likewise.
9744 (sm_state_map::sm_state_map): Add state_machine and index params.
9745 (sm_state_map::clone_with_remapping): Delete.
9746 (sm_state_map::print): Drop sm param; add simple and multiline
9748 (sm_state_map::dump): Drop sm param; add simple param.
9749 (sm_state_map::get_state): Port from svalue_id to const svalue *.
9750 Add ext_state param.
9751 (sm_state_map::get_origin): Likewise.
9752 (sm_state_map::set_state): Likewise.
9753 (sm_state_map::impl_set_state): Likewise.
9754 (sm_state_map::purge_for_unknown_fncall): Delete.
9755 (sm_state_map::remap_svalue_ids): Delete.
9756 (sm_state_map::on_svalue_purge): Delete.
9757 (sm_state_map::on_svalue_leak): New.
9758 (sm_state_map::on_liveness_change): New.
9759 (sm_state_map::on_inherited_svalue): Delete.
9760 (sm_state_map::on_cast): Delete.
9761 (sm_state_map::validate): Delete.
9762 (sm_state_map::on_unknown_change): Port from svalue_id to
9763 const svalue *. Add is_mutable and ext_state params.
9764 (sm_state_map::canonicalize_svalue): New.
9765 (sm_state_map::m_sm): New field.
9766 (sm_state_map::m_sm_idx): New field.
9767 (program_state::operator=): Delete.
9768 (program_state::dump_to_pp): Drop "summarize" param, adding
9769 "simple" and "multiline".
9770 (program_state::dump_to_file): Likewise.
9771 (program_state::dump): Rename "summarize" to "simple".
9772 (program_state::push_frame): New.
9773 (program_state::get_current_function): New.
9774 (program_state::on_edge): Drop "change" param.
9775 (program_state::prune_for_point): Likewise. Add enode_for_diag
9777 (program_state::remap_svalue_ids): Delete.
9778 (program_state::get_representative_tree): Port from svalue_id to
9780 (program_state::can_purge_p): Likewise. Pass ext_state to get_state.
9781 (program_state::can_merge_with_p): Add point param.
9782 (program_state::detect_leaks): New.
9783 (state_change_visitor::on_state_change): Port from tree and
9784 svalue_id to a pair of const svalue *.
9785 (class state_change): Delete.
9786 * region.cc: New file.
9787 * region-model-impl-calls.cc: New file.
9788 * region-model-manager.cc: New file.
9789 * region-model-reachability.cc: New file.
9790 * region-model-reachability.h: New file.
9791 * region-model.cc: Include "analyzer/call-string.h",
9792 "analyzer/program-point.h", and "analyzer/store.h" before
9793 "analyzer/region-model.h". Include
9794 "analyzer/region-model-reachability.h".
9795 (dump_tree): Make non-static.
9796 (dump_quoted_tree): Make non-static.
9797 (print_quoted_type): Make non-static.
9798 (path_var::dump): Delete.
9799 (dump_separator): Delete.
9800 (class impl_constraint_manager): Delete.
9801 (svalue_id::print): Delete.
9802 (svalue_id::dump_node_name_to_pp): Delete.
9803 (svalue_id::validate): Delete.
9804 (region_id::print): Delete.
9805 (region_id::dump_node_name_to_pp): Delete.
9806 (region_id::validate): Delete.
9807 (region_id_set::region_id_set): Delete.
9808 (svalue_id_set::svalue_id_set): Delete.
9809 (svalue::operator==): Delete.
9810 (svalue::hash): Delete.
9811 (svalue::print): Delete.
9812 (svalue::dump_dot_to_pp): Delete.
9813 (svalue::remap_region_ids): Delete.
9814 (svalue::walk_for_canonicalization): Delete.
9815 (svalue::get_child_sid): Delete.
9816 (svalue::maybe_get_constant): Delete.
9817 (region_svalue::compare_fields): Delete.
9818 (region_svalue::add_to_hash): Delete.
9819 (region_svalue::print_details): Delete.
9820 (region_svalue::dump_dot_to_pp): Delete.
9821 (region_svalue::remap_region_ids): Delete.
9822 (region_svalue::merge_values): Delete.
9823 (region_svalue::walk_for_canonicalization): Delete.
9824 (region_svalue::eval_condition): Delete.
9825 (constant_svalue::compare_fields): Delete.
9826 (constant_svalue::add_to_hash): Delete.
9827 (constant_svalue::merge_values): Delete.
9828 (constant_svalue::eval_condition): Move to svalue.cc.
9829 (constant_svalue::print_details): Delete.
9830 (constant_svalue::get_child_sid): Delete.
9831 (unknown_svalue::compare_fields): Delete.
9832 (unknown_svalue::add_to_hash): Delete.
9833 (unknown_svalue::print_details): Delete.
9834 (poison_kind_to_str): Move to svalue.cc.
9835 (poisoned_svalue::compare_fields): Delete.
9836 (poisoned_svalue::add_to_hash): Delete.
9837 (poisoned_svalue::print_details): Delete.
9838 (region_kind_to_str): Move to region.cc and reimplement.
9839 (region::operator==): Delete.
9840 (region::get_parent_region): Delete.
9841 (region::set_value): Delete.
9842 (region::become_active_view): Delete.
9843 (region::deactivate_any_active_view): Delete.
9844 (region::deactivate_view): Delete.
9845 (region::get_value): Delete.
9846 (region::get_inherited_child_sid): Delete.
9847 (region_model::copy_region): Delete.
9848 (region_model::copy_struct_region): Delete.
9849 (region_model::copy_union_region): Delete.
9850 (region_model::copy_array_region): Delete.
9851 (region::hash): Delete.
9852 (region::print): Delete.
9853 (region::dump_dot_to_pp): Delete.
9854 (region::dump_to_pp): Delete.
9855 (region::dump_child_label): Delete.
9856 (region::validate): Delete.
9857 (region::remap_svalue_ids): Delete.
9858 (region::remap_region_ids): Delete.
9859 (region::add_view): Delete.
9860 (region::get_view): Delete.
9861 (region::region): Move to region.cc.
9862 (region::add_to_hash): Delete.
9863 (region::print_fields): Delete.
9864 (region::non_null_p): Delete.
9865 (primitive_region::clone): Delete.
9866 (primitive_region::walk_for_canonicalization): Delete.
9867 (map_region::map_region): Delete.
9868 (map_region::compare_fields): Delete.
9869 (map_region::print_fields): Delete.
9870 (map_region::validate): Delete.
9871 (map_region::dump_dot_to_pp): Delete.
9872 (map_region::dump_child_label): Delete.
9873 (map_region::get_or_create): Delete.
9874 (map_region::get): Delete.
9875 (map_region::add_to_hash): Delete.
9876 (map_region::remap_region_ids): Delete.
9877 (map_region::unbind): Delete.
9878 (map_region::get_tree_for_child_region): Delete.
9879 (map_region::get_tree_for_child_region): Delete.
9880 (tree_cmp): Move to region.cc.
9881 (map_region::can_merge_p): Delete.
9882 (map_region::walk_for_canonicalization): Delete.
9883 (map_region::get_value_by_name): Delete.
9884 (struct_or_union_region::valid_key_p): Delete.
9885 (struct_or_union_region::compare_fields): Delete.
9886 (struct_region::clone): Delete.
9887 (struct_region::compare_fields): Delete.
9888 (union_region::clone): Delete.
9889 (union_region::compare_fields): Delete.
9890 (frame_region::compare_fields): Delete.
9891 (frame_region::clone): Delete.
9892 (frame_region::valid_key_p): Delete.
9893 (frame_region::print_fields): Delete.
9894 (frame_region::add_to_hash): Delete.
9895 (globals_region::compare_fields): Delete.
9896 (globals_region::clone): Delete.
9897 (globals_region::valid_key_p): Delete.
9898 (code_region::compare_fields): Delete.
9899 (code_region::clone): Delete.
9900 (code_region::valid_key_p): Delete.
9901 (array_region::array_region): Delete.
9902 (array_region::get_element): Delete.
9903 (array_region::clone): Delete.
9904 (array_region::compare_fields): Delete.
9905 (array_region::print_fields): Delete.
9906 (array_region::validate): Delete.
9907 (array_region::dump_dot_to_pp): Delete.
9908 (array_region::dump_child_label): Delete.
9909 (array_region::get_or_create): Delete.
9910 (array_region::get): Delete.
9911 (array_region::add_to_hash): Delete.
9912 (array_region::remap_region_ids): Delete.
9913 (array_region::get_key_for_child_region): Delete.
9914 (array_region::key_cmp): Delete.
9915 (array_region::walk_for_canonicalization): Delete.
9916 (array_region::key_from_constant): Delete.
9917 (array_region::constant_from_key): Delete.
9918 (function_region::compare_fields): Delete.
9919 (function_region::clone): Delete.
9920 (function_region::valid_key_p): Delete.
9921 (stack_region::stack_region): Delete.
9922 (stack_region::compare_fields): Delete.
9923 (stack_region::clone): Delete.
9924 (stack_region::print_fields): Delete.
9925 (stack_region::dump_child_label): Delete.
9926 (stack_region::validate): Delete.
9927 (stack_region::push_frame): Delete.
9928 (stack_region::get_current_frame_id): Delete.
9929 (stack_region::pop_frame): Delete.
9930 (stack_region::add_to_hash): Delete.
9931 (stack_region::remap_region_ids): Delete.
9932 (stack_region::can_merge_p): Delete.
9933 (stack_region::walk_for_canonicalization): Delete.
9934 (stack_region::get_value_by_name): Delete.
9935 (heap_region::heap_region): Delete.
9936 (heap_region::compare_fields): Delete.
9937 (heap_region::clone): Delete.
9938 (heap_region::walk_for_canonicalization): Delete.
9939 (root_region::root_region): Delete.
9940 (root_region::compare_fields): Delete.
9941 (root_region::clone): Delete.
9942 (root_region::print_fields): Delete.
9943 (root_region::validate): Delete.
9944 (root_region::dump_child_label): Delete.
9945 (root_region::push_frame): Delete.
9946 (root_region::get_current_frame_id): Delete.
9947 (root_region::pop_frame): Delete.
9948 (root_region::ensure_stack_region): Delete.
9949 (root_region::get_stack_region): Delete.
9950 (root_region::ensure_globals_region): Delete.
9951 (root_region::get_code_region): Delete.
9952 (root_region::ensure_code_region): Delete.
9953 (root_region::get_globals_region): Delete.
9954 (root_region::ensure_heap_region): Delete.
9955 (root_region::get_heap_region): Delete.
9956 (root_region::remap_region_ids): Delete.
9957 (root_region::can_merge_p): Delete.
9958 (root_region::add_to_hash): Delete.
9959 (root_region::walk_for_canonicalization): Delete.
9960 (root_region::get_value_by_name): Delete.
9961 (symbolic_region::symbolic_region): Delete.
9962 (symbolic_region::compare_fields): Delete.
9963 (symbolic_region::clone): Delete.
9964 (symbolic_region::walk_for_canonicalization): Delete.
9965 (symbolic_region::print_fields): Delete.
9966 (region_model::region_model): Add region_model_manager * param.
9967 Reimplement in terms of store, dropping impl_constraint_manager
9969 (region_model::operator=): Reimplement in terms of store
9970 (region_model::operator==): Likewise.
9971 (region_model::hash): Likewise.
9972 (region_model::print): Delete.
9973 (region_model::print_svalue): Delete.
9974 (region_model::dump_dot_to_pp): Delete.
9975 (region_model::dump_dot_to_file): Delete.
9976 (region_model::dump_dot): Delete.
9977 (region_model::dump_to_pp): Replace "summarize" param with
9978 "simple" and "multiline". Port to store-based implementation.
9979 (region_model::dump): Replace "summarize" param with "simple" and
9981 (dump_vec_of_tree): Delete.
9982 (region_model::dump_summary_of_rep_path_vars): Delete.
9983 (region_model::validate): Delete.
9984 (svalue_id_cmp_by_constant_svalue_model): Delete.
9985 (svalue_id_cmp_by_constant_svalue): Delete.
9986 (region_model::canonicalize): Drop "ctxt" param. Reimplement in
9987 terms of store and constraints.
9988 (region_model::canonicalized_p): Remove NULL arg to canonicalize.
9989 (region_model::loop_replay_fixup): New.
9990 (poisoned_value_diagnostic::emit): Tweak wording of warnings.
9991 (region_model::check_for_poison): Delete.
9992 (region_model::get_gassign_result): New.
9993 (region_model::on_assignment): Port to store-based implementation.
9994 (region_model::on_call_pre): Delete calls to check_for_poison.
9995 Move implementations to region-model-impl-calls.c and port to
9996 store-based implementation.
9997 (region_model::on_call_post): Likewise.
9998 (class reachable_regions): Move to region-model-reachability.h/cc
9999 and port to store-based implementation.
10000 (region_model::handle_unrecognized_call): Port to store-based
10002 (region_model::get_reachable_svalues): New.
10003 (region_model::on_setjmp): Port to store-based implementation.
10004 (region_model::on_longjmp): Likewise.
10005 (region_model::handle_phi): Drop is_back_edge param and the logic
10007 (region_model::get_lvalue_1): Port from region_id to const region *.
10008 (region_model::make_region_for_unexpected_tree_code): Delete.
10009 (assert_compat_types): If the check fails, use internal_error to
10011 (region_model::get_lvalue): Port from region_id to const region *.
10012 (region_model::get_rvalue_1): Port from svalue_id to const svalue *.
10013 (region_model::get_rvalue): Likewise.
10014 (region_model::get_or_create_ptr_svalue): Delete.
10015 (region_model::get_or_create_constant_svalue): Delete.
10016 (region_model::get_svalue_for_fndecl): Delete.
10017 (region_model::get_region_for_fndecl): Delete.
10018 (region_model::get_svalue_for_label): Delete.
10019 (region_model::get_region_for_label): Delete.
10020 (build_cast): Delete.
10021 (region_model::maybe_cast_1): Delete.
10022 (region_model::maybe_cast): Delete.
10023 (region_model::get_field_region): Delete.
10024 (region_model::get_store_value): New.
10025 (region_model::region_exists_p): New.
10026 (region_model::deref_rvalue): Port from svalue_id to const svalue *.
10027 (region_model::set_value): Likewise.
10028 (region_model::clobber_region): New.
10029 (region_model::purge_region): New.
10030 (region_model::zero_fill_region): New.
10031 (region_model::mark_region_as_unknown): New.
10032 (region_model::eval_condition): Port from svalue_id to
10034 (region_model::eval_condition_without_cm): Likewise.
10035 (region_model::compare_initial_and_pointer): New.
10036 (region_model::add_constraint): Port from svalue_id to
10038 (region_model::maybe_get_constant): Delete.
10039 (region_model::get_representative_path_var): New.
10040 (region_model::add_new_malloc_region): Delete.
10041 (region_model::get_representative_tree): Port to const svalue *.
10042 (region_model::get_representative_path_var): Port to
10044 (region_model::get_path_vars_for_svalue): Delete.
10045 (region_model::set_to_new_unknown_value): Delete.
10046 (region_model::update_for_phis): Don't pass is_back_edge to handle_phi.
10047 (region_model::update_for_call_superedge): Port from svalue_id to
10049 (region_model::update_for_return_superedge): Port to store-based
10051 (region_model::update_for_call_summary): Replace
10052 set_to_new_unknown_value with mark_region_as_unknown.
10053 (region_model::get_root_region): Delete.
10054 (region_model::get_stack_region_id): Delete.
10055 (region_model::push_frame): Delete.
10056 (region_model::get_current_frame_id): Delete.
10057 (region_model::get_current_function): Delete.
10058 (region_model::pop_frame): Delete.
10059 (region_model::on_top_level_param): New.
10060 (region_model::get_stack_depth): Delete.
10061 (region_model::get_function_at_depth): Delete.
10062 (region_model::get_globals_region_id): Delete.
10063 (region_model::add_svalue): Delete.
10064 (region_model::replace_svalue): Delete.
10065 (region_model::add_region): Delete.
10066 (region_model::get_svalue): Delete.
10067 (region_model::get_region): Delete.
10068 (make_region_for_type): Delete.
10069 (region_model::add_region_for_type): Delete.
10070 (region_model::on_top_level_param): New.
10071 (class restrict_to_used_svalues): Delete.
10072 (region_model::purge_unused_svalues): Delete.
10073 (region_model::push_frame): New.
10074 (region_model::remap_svalue_ids): Delete.
10075 (region_model::remap_region_ids): Delete.
10076 (region_model::purge_regions): Delete.
10077 (region_model::get_descendents): Delete.
10078 (region_model::delete_region_and_descendents): Delete.
10079 (region_model::poison_any_pointers_to_bad_regions): Delete.
10080 (region_model::can_merge_with_p): Delete.
10081 (region_model::get_current_function): New.
10082 (region_model::get_value_by_name): Delete.
10083 (region_model::convert_byte_offset_to_array_index): Delete.
10084 (region_model::pop_frame): New.
10085 (region_model::get_or_create_mem_ref): Delete.
10086 (region_model::get_stack_depth): New.
10087 (region_model::get_frame_at_index): New.
10088 (region_model::unbind_region_and_descendents): New.
10089 (struct bad_pointer_finder): New.
10090 (region_model::get_or_create_pointer_plus_expr): Delete.
10091 (region_model::poison_any_pointers_to_descendents): New.
10092 (region_model::get_or_create_view): Delete.
10093 (region_model::can_merge_with_p): New.
10094 (region_model::get_fndecl_for_call): Port from svalue_id to
10096 (struct append_ssa_names_cb_data): New.
10097 (get_ssa_name_regions_for_current_frame): New.
10098 (region_model::append_ssa_names_cb): New.
10099 (model_merger::dump_to_pp): Add "simple" param. Drop dumping of
10101 (model_merger::dump): Add "simple" param to both overloads.
10102 (model_merger::can_merge_values_p): Delete.
10103 (model_merger::record_regions): Delete.
10104 (model_merger::record_svalues): Delete.
10105 (svalue_id_merger_mapping::svalue_id_merger_mapping): Delete.
10106 (svalue_id_merger_mapping::dump_to_pp): Delete.
10107 (svalue_id_merger_mapping::dump): Delete.
10108 (region_model::create_region_for_heap_alloc): New.
10109 (region_model::create_region_for_alloca): New.
10110 (region_model::record_dynamic_extents): New.
10111 (canonicalization::canonicalization): Delete.
10112 (canonicalization::walk_rid): Delete.
10113 (canonicalization::walk_sid): Delete.
10114 (canonicalization::dump_to_pp): Delete.
10115 (canonicalization::dump): Delete.
10116 (inchash::add): Delete overloads for svalue_id and region_id.
10117 (engine::log_stats): New.
10118 (assert_condition): Add overload comparing svalues.
10119 (assert_dump_eq): Pass "true" for multiline.
10120 (selftest::test_dump): Update for rewrite of region_model.
10121 (selftest::test_dump_2): Rename to...
10122 (selftest::test_struct): ...this. Provide a region_model_manager
10123 when creating region_model instance. Remove dump test. Add
10124 checks for get_offset.
10125 (selftest::test_dump_3): Rename to...
10126 (selftest::test_array_1): ...this. Provide a region_model_manager
10127 when creating region_model instance. Remove dump test.
10128 (selftest::test_get_representative_tree): Port from svalue_id to
10129 new API. Add test coverage for various expressions.
10130 (selftest::test_unique_constants): Provide a region_model_manager
10131 for the region_model. Add test coverage for comparing const vs
10133 (selftest::test_svalue_equality): Delete.
10134 (selftest::test_region_equality): Delete.
10135 (selftest::test_unique_unknowns): New.
10136 (class purge_all_svalue_ids): Delete.
10137 (class purge_one_svalue_id): Delete.
10138 (selftest::test_purging_by_criteria): Delete.
10139 (selftest::test_initial_svalue_folding): New.
10140 (selftest::test_unaryop_svalue_folding): New.
10141 (selftest::test_binop_svalue_folding): New.
10142 (selftest::test_sub_svalue_folding): New.
10143 (selftest::test_purge_unused_svalues): Delete.
10144 (selftest::test_descendent_of_p): New.
10145 (selftest::test_assignment): Provide a region_model_manager for
10146 the region_model. Drop the dump test.
10147 (selftest::test_compound_assignment): Likewise.
10148 (selftest::test_stack_frames): Port to new implementation.
10149 (selftest::test_get_representative_path_var): Likewise.
10150 (selftest::test_canonicalization_1): Rename to...
10151 (selftest::test_equality_1): ...this. Port to new API, and add
10152 (selftest::test_canonicalization_2): Provide a
10153 region_model_manager when creating region_model instances.
10154 Remove redundant canicalization.
10155 (selftest::test_canonicalization_3): Provide a
10156 region_model_manager when creating region_model instances.
10157 Remove param from calls to region_model::canonicalize.
10158 (selftest::test_canonicalization_4): Likewise.
10159 (selftest::assert_region_models_merge): Constify
10160 out_merged_svalue. Port to new API.
10161 (selftest::test_state_merging): Provide a
10162 region_model_manager when creating region_model instances.
10163 Provide a program_point point when merging them. Replace
10164 set_to_new_unknown_value with usage of placeholder_svalues.
10165 Drop get_value_by_name. Port from svalue_id to const svalue *.
10166 Add test of heap allocation.
10167 (selftest::test_constraint_merging): Provide a
10168 region_model_manager when creating region_model instances.
10169 Provide a program_point point when merging them. Eliminate use
10170 of set_to_new_unknown_value.
10171 (selftest::test_widening_constraints): New.
10172 (selftest::test_iteration_1): New.
10173 (selftest::test_malloc_constraints): Port to store-based
10175 (selftest::test_var): New test.
10176 (selftest::test_array_2): New test.
10177 (selftest::test_mem_ref): New test.
10178 (selftest::test_POINTER_PLUS_EXPR_then_MEM_REF): New.
10179 (selftest::test_malloc): New.
10180 (selftest::test_alloca): New.
10181 (selftest::analyzer_region_model_cc_tests): Update for renamings.
10182 Call new functions.
10183 * region-model.h (class path_var): Move to analyzer.h.
10184 (class svalue_id): Delete.
10185 (class region_id): Delete.
10186 (class id_map): Delete.
10187 (svalue_id_map): Delete.
10188 (region_id_map): Delete.
10189 (id_map<T>::id_map): Delete.
10190 (id_map<T>::put): Delete.
10191 (id_map<T>::get_dst_for_src): Delete.
10192 (id_map<T>::get_src_for_dst): Delete.
10193 (id_map<T>::dump_to_pp): Delete.
10194 (id_map<T>::dump): Delete.
10195 (id_map<T>::update): Delete.
10196 (one_way_svalue_id_map): Delete.
10197 (one_way_region_id_map): Delete.
10198 (class region_id_set): Delete.
10199 (class svalue_id_set): Delete.
10200 (struct complexity): New.
10201 (class visitor): New.
10202 (enum svalue_kind): Add SK_SETJMP, SK_INITIAL, SK_UNARYOP,
10203 SK_BINOP, SK_SUB,SK_UNMERGEABLE, SK_PLACEHOLDER, SK_WIDENING,
10204 SK_COMPOUND, and SK_CONJURED.
10205 (svalue::operator==): Delete.
10206 (svalue::operator!=): Delete.
10207 (svalue::clone): Delete.
10208 (svalue::hash): Delete.
10209 (svalue::dump_dot_to_pp): Delete.
10210 (svalue::dump_to_pp): New.
10211 (svalue::dump): New.
10212 (svalue::get_desc): New.
10213 (svalue::dyn_cast_initial_svalue): New.
10214 (svalue::dyn_cast_unaryop_svalue): New.
10215 (svalue::dyn_cast_binop_svalue): New.
10216 (svalue::dyn_cast_sub_svalue): New.
10217 (svalue::dyn_cast_unmergeable_svalue): New.
10218 (svalue::dyn_cast_widening_svalue): New.
10219 (svalue::dyn_cast_compound_svalue): New.
10220 (svalue::dyn_cast_conjured_svalue): New.
10221 (svalue::maybe_undo_cast): New.
10222 (svalue::unwrap_any_unmergeable): New.
10223 (svalue::remap_region_ids): Delete
10224 (svalue::can_merge_p): New.
10225 (svalue::walk_for_canonicalization): Delete
10226 (svalue::get_complexity): New.
10227 (svalue::get_child_sid): Delete
10228 (svalue::accept): New.
10229 (svalue::live_p): New.
10230 (svalue::implicitly_live_p): New.
10231 (svalue::svalue): Add complexity param.
10232 (svalue::add_to_hash): Delete
10233 (svalue::print_details): Delete
10234 (svalue::m_complexity): New field.
10235 (region_svalue::key_t): New struct.
10236 (region_svalue::region_svalue): Port from region_id to
10237 const region_id *. Add complexity.
10238 (region_svalue::compare_fields): Delete.
10239 (region_svalue::clone): Delete.
10240 (region_svalue::dump_dot_to_pp): Delete.
10241 (region_svalue::get_pointee): Port from region_id to
10243 (region_svalue::remap_region_ids): Delete.
10244 (region_svalue::merge_values): Delete.
10245 (region_svalue::dump_to_pp): New.
10246 (region_svalue::accept): New.
10247 (region_svalue::walk_for_canonicalization): Delete.
10248 (region_svalue::eval_condition): Make params const.
10249 (region_svalue::add_to_hash): Delete.
10250 (region_svalue::print_details): Delete.
10251 (region_svalue::m_rid): Replace with...
10252 (region_svalue::m_reg): ...this.
10253 (is_a_helper <region_svalue *>::test): Convert to...
10254 (is_a_helper <const region_svalue *>::test): ...this.
10255 (template <> struct default_hash_traits<region_svalue::key_t>):
10257 (constant_svalue::constant_svalue): Add complexity.
10258 (constant_svalue::compare_fields): Delete.
10259 (constant_svalue::clone): Delete.
10260 (constant_svalue::add_to_hash): Delete.
10261 (constant_svalue::dump_to_pp): New.
10262 (constant_svalue::accept): New.
10263 (constant_svalue::implicitly_live_p): New.
10264 (constant_svalue::merge_values): Delete.
10265 (constant_svalue::eval_condition): Make params const.
10266 (constant_svalue::get_child_sid): Delete.
10267 (constant_svalue::print_details): Delete.
10268 (is_a_helper <constant_svalue *>::test): Convert to...
10269 (is_a_helper <const constant_svalue *>::test): ...this.
10270 (class unknown_svalue): Update leading comment.
10271 (unknown_svalue::unknown_svalue): Add complexity.
10272 (unknown_svalue::compare_fields): Delete.
10273 (unknown_svalue::add_to_hash): Delete.
10274 (unknown_svalue::dyn_cast_unknown_svalue): Delete.
10275 (unknown_svalue::print_details): Delete.
10276 (unknown_svalue::dump_to_pp): New.
10277 (unknown_svalue::accept): New.
10278 (poisoned_svalue::key_t): New struct.
10279 (poisoned_svalue::poisoned_svalue): Add complexity.
10280 (poisoned_svalue::compare_fields): Delete.
10281 (poisoned_svalue::clone): Delete.
10282 (poisoned_svalue::add_to_hash): Delete.
10283 (poisoned_svalue::dump_to_pp): New.
10284 (poisoned_svalue::accept): New.
10285 (poisoned_svalue::print_details): Delete.
10286 (is_a_helper <poisoned_svalue *>::test): Convert to...
10287 (is_a_helper <const poisoned_svalue *>::test): ...this.
10288 (template <> struct default_hash_traits<poisoned_svalue::key_t>):
10290 (setjmp_record::add_to_hash): New.
10291 (setjmp_svalue::key_t): New struct.
10292 (setjmp_svalue::compare_fields): Delete.
10293 (setjmp_svalue::clone): Delete.
10294 (setjmp_svalue::add_to_hash): Delete.
10295 (setjmp_svalue::setjmp_svalue): Add complexity.
10296 (setjmp_svalue::dump_to_pp): New.
10297 (setjmp_svalue::accept): New.
10298 (setjmp_svalue::void print_details): Delete.
10299 (is_a_helper <const setjmp_svalue *>::test): New.
10300 (template <> struct default_hash_traits<setjmp_svalue::key_t>): New.
10301 (class initial_svalue : public svalue): New.
10302 (is_a_helper <const initial_svalue *>::test): New.
10303 (class unaryop_svalue): New.
10304 (is_a_helper <const unaryop_svalue *>::test): New.
10305 (template <> struct default_hash_traits<unaryop_svalue::key_t>): New.
10306 (class binop_svalue): New.
10307 (is_a_helper <const binop_svalue *>::test): New.
10308 (template <> struct default_hash_traits<binop_svalue::key_t>): New.
10309 (class sub_svalue): New.
10310 (is_a_helper <const sub_svalue *>::test): New.
10311 (template <> struct default_hash_traits<sub_svalue::key_t>): New.
10312 (class unmergeable_svalue): New.
10313 (is_a_helper <const unmergeable_svalue *>::test): New.
10314 (class placeholder_svalue): New.
10315 (is_a_helper <placeholder_svalue *>::test): New.
10316 (class widening_svalue): New.
10317 (is_a_helper <widening_svalue *>::test): New.
10318 (template <> struct default_hash_traits<widening_svalue::key_t>): New.
10319 (class compound_svalue): New.
10320 (is_a_helper <compound_svalue *>::test): New.
10321 (template <> struct default_hash_traits<compound_svalue::key_t>): New.
10322 (class conjured_svalue): New.
10323 (is_a_helper <conjured_svalue *>::test): New.
10324 (template <> struct default_hash_traits<conjured_svalue::key_t>): New.
10325 (enum region_kind): Delete RK_PRIMITIVE, RK_STRUCT, RK_UNION, and
10326 RK_ARRAY. Add RK_LABEL, RK_DECL, RK_FIELD, RK_ELEMENT, RK_OFFSET,
10327 RK_CAST, RK_HEAP_ALLOCATED, RK_ALLOCA, RK_STRING, and RK_UNKNOWN.
10328 (region_kind_to_str): Delete.
10329 (region::~region): Move implementation to region.cc.
10330 (region::operator==): Delete.
10331 (region::operator!=): Delete.
10332 (region::clone): Delete.
10333 (region::get_id): New.
10334 (region::cmp_ids): New.
10335 (region::dyn_cast_map_region): Delete.
10336 (region::dyn_cast_array_region): Delete.
10337 (region::region_id get_parent): Delete.
10338 (region::get_parent_region): Convert to a simple accessor.
10339 (region::void set_value): Delete.
10340 (region::svalue_id get_value): Delete.
10341 (region::svalue_id get_value_direct): Delete.
10342 (region::svalue_id get_inherited_child_sid): Delete.
10343 (region::dyn_cast_frame_region): New.
10344 (region::dyn_cast_function_region): New.
10345 (region::dyn_cast_decl_region): New.
10346 (region::dyn_cast_field_region): New.
10347 (region::dyn_cast_element_region): New.
10348 (region::dyn_cast_offset_region): New.
10349 (region::dyn_cast_cast_region): New.
10350 (region::dyn_cast_string_region): New.
10351 (region::accept): New.
10352 (region::get_base_region): New.
10353 (region::base_region_p): New.
10354 (region::descendent_of_p): New.
10355 (region::maybe_get_frame_region): New.
10356 (region::maybe_get_decl): New.
10357 (region::hash): Delete.
10358 (region::rint): Delete.
10359 (region::dump_dot_to_pp): Delete.
10360 (region::get_desc): New.
10361 (region::dump_to_pp): Convert to vfunc, changing signature.
10362 (region::dump_child_label): Delete.
10363 (region::remap_svalue_ids): Delete.
10364 (region::remap_region_ids): Delete.
10365 (region::dump): New.
10366 (region::walk_for_canonicalization): Delete.
10367 (region::non_null_p): Drop region_model param.
10368 (region::add_view): Delete.
10369 (region::get_view): Delete.
10370 (region::get_active_view): Delete.
10371 (region::is_view_p): Delete.
10372 (region::cmp_ptrs): New.
10373 (region::validate): Delete.
10374 (region::get_offset): New.
10375 (region::get_byte_size): New.
10376 (region::get_bit_size): New.
10377 (region::get_subregions_for_binding): New.
10378 (region::region): Add complexity param. Convert parent from
10379 region_id to const region *. Drop svalue_id. Drop copy ctor.
10380 (region::symbolic_for_unknown_ptr_p): New.
10381 (region::add_to_hash): Delete.
10382 (region::print_fields): Delete.
10383 (region::get_complexity): New accessor.
10384 (region::become_active_view): Delete.
10385 (region::deactivate_any_active_view): Delete.
10386 (region::deactivate_view): Delete.
10387 (region::calc_offset): New.
10388 (region::m_parent_rid): Delete.
10389 (region::m_sval_id): Delete.
10390 (region::m_complexity): New.
10391 (region::m_id): New.
10392 (region::m_parent): New.
10393 (region::m_view_rids): Delete.
10394 (region::m_is_view): Delete.
10395 (region::m_active_view_rid): Delete.
10396 (region::m_cached_offset): New.
10397 (is_a_helper <region *>::test): Convert to...
10398 (is_a_helper <const region *>::test): ... this.
10399 (class primitive_region): Delete.
10400 (class space_region): New.
10401 (class map_region): Delete.
10402 (is_a_helper <map_region *>::test): Delete.
10403 (class frame_region): Reimplement.
10404 (template <> struct default_hash_traits<frame_region::key_t>):
10406 (class globals_region): Reimplement.
10407 (is_a_helper <globals_region *>::test): Convert to...
10408 (is_a_helper <const globals_region *>::test): ...this.
10409 (class struct_or_union_region): Delete.
10410 (is_a_helper <struct_or_union_region *>::test): Delete.
10411 (class code_region): Reimplement.
10412 (is_a_helper <const code_region *>::test): New.
10413 (class struct_region): Delete.
10414 (is_a_helper <struct_region *>::test): Delete.
10415 (class function_region): Reimplement.
10416 (is_a_helper <function_region *>::test): Convert to...
10417 (is_a_helper <const function_region *>::test): ...this.
10418 (class union_region): Delete.
10419 (is_a_helper <union_region *>::test): Delete.
10420 (class label_region): New.
10421 (is_a_helper <const label_region *>::test): New.
10422 (class scope_region): Delete.
10423 (class stack_region): Reimplement.
10424 (is_a_helper <stack_region *>::test): Convert to...
10425 (is_a_helper <const stack_region *>::test): ...this.
10426 (class heap_region): Reimplement.
10427 (is_a_helper <heap_region *>::test): Convert to...
10428 (is_a_helper <const heap_region *>::test): ...this.
10429 (class root_region): Reimplement.
10430 (is_a_helper <root_region *>::test): Convert to...
10431 (is_a_helper <const root_region *>::test): ...this.
10432 (class symbolic_region): Reimplement.
10433 (is_a_helper <const symbolic_region *>::test): New.
10434 (template <> struct default_hash_traits<symbolic_region::key_t>):
10436 (class decl_region): New.
10437 (is_a_helper <const decl_region *>::test): New.
10438 (class field_region): New.
10439 (template <> struct default_hash_traits<field_region::key_t>): New.
10440 (class array_region): Delete.
10441 (class element_region): New.
10442 (is_a_helper <array_region *>::test): Delete.
10443 (is_a_helper <const element_region *>::test): New.
10444 (template <> struct default_hash_traits<element_region::key_t>):
10446 (class offset_region): New.
10447 (is_a_helper <const offset_region *>::test): New.
10448 (template <> struct default_hash_traits<offset_region::key_t>):
10450 (class cast_region): New.
10451 (is_a_helper <const cast_region *>::test): New.
10452 (template <> struct default_hash_traits<cast_region::key_t>): New.
10453 (class heap_allocated_region): New.
10454 (class alloca_region): New.
10455 (class string_region): New.
10456 (is_a_helper <const string_region *>::test): New.
10457 (class unknown_region): New.
10458 (class region_model_manager): New.
10459 (struct append_ssa_names_cb_data): New.
10460 (class call_details): New.
10461 (region_model::region_model): Add region_model_manager param.
10462 (region_model::print_svalue): Delete.
10463 (region_model::dump_dot_to_pp): Delete.
10464 (region_model::dump_dot_to_file): Delete.
10465 (region_model::dump_dot): Delete.
10466 (region_model::dump_to_pp): Drop summarize param in favor of
10467 simple and multiline.
10468 (region_model::dump): Likewise.
10469 (region_model::summarize_to_pp): Delete.
10470 (region_model::summarize): Delete.
10471 (region_model::void canonicalize): Drop ctxt param.
10472 (region_model::void check_for_poison): Delete.
10473 (region_model::get_gassign_result): New.
10474 (region_model::impl_call_alloca): New.
10475 (region_model::impl_call_analyzer_describe): New.
10476 (region_model::impl_call_analyzer_eval): New.
10477 (region_model::impl_call_builtin_expect): New.
10478 (region_model::impl_call_calloc): New.
10479 (region_model::impl_call_free): New.
10480 (region_model::impl_call_malloc): New.
10481 (region_model::impl_call_memset): New.
10482 (region_model::impl_call_strlen): New.
10483 (region_model::get_reachable_svalues): New.
10484 (region_model::handle_phi): Drop is_back_edge param.
10485 (region_model::region_id get_root_rid): Delete.
10486 (region_model::root_region *get_root_region): Delete.
10487 (region_model::region_id get_stack_region_id): Delete.
10488 (region_model::push_frame): Convert from region_id and svalue_id
10489 to const region * and const svalue *.
10490 (region_model::get_current_frame_id): Replace with...
10491 (region_model::get_current_frame): ...this.
10492 (region_model::pop_frame): Convert from region_id to
10493 const region *. Drop purge and stats param. Add out_result.
10494 (region_model::function *get_function_at_depth): Delete.
10495 (region_model::get_globals_region_id): Delete.
10496 (region_model::add_svalue): Delete.
10497 (region_model::replace_svalue): Delete.
10498 (region_model::add_region): Delete.
10499 (region_model::add_region_for_type): Delete.
10500 (region_model::get_svalue): Delete.
10501 (region_model::get_region): Delete.
10502 (region_model::get_lvalue): Convert from region_id to
10504 (region_model::get_rvalue): Convert from svalue_id to
10506 (region_model::get_or_create_ptr_svalue): Delete.
10507 (region_model::get_or_create_constant_svalue): Delete.
10508 (region_model::get_svalue_for_fndecl): Delete.
10509 (region_model::get_svalue_for_label): Delete.
10510 (region_model::get_region_for_fndecl): Delete.
10511 (region_model::get_region_for_label): Delete.
10512 (region_model::get_frame_at_index (int index) const;): New.
10513 (region_model::maybe_cast): Delete.
10514 (region_model::maybe_cast_1): Delete.
10515 (region_model::get_field_region): Delete.
10516 (region_model::id deref_rvalue): Convert from region_id and
10517 svalue_id to const region * and const svalue *. Drop overload,
10518 passing in both a tree and an svalue.
10519 (region_model::set_value): Convert from region_id and svalue_id to
10520 const region * and const svalue *.
10521 (region_model::set_to_new_unknown_value): Delete.
10522 (region_model::clobber_region (const region *reg);): New.
10523 (region_model::purge_region (const region *reg);): New.
10524 (region_model::zero_fill_region (const region *reg);): New.
10525 (region_model::mark_region_as_unknown (const region *reg);): New.
10526 (region_model::copy_region): Convert from region_id to
10528 (region_model::eval_condition): Convert from svalue_id to
10530 (region_model::eval_condition_without_cm): Likewise.
10531 (region_model::compare_initial_and_pointer): New.
10532 (region_model:maybe_get_constant): Delete.
10533 (region_model::add_new_malloc_region): Delete.
10534 (region_model::get_representative_tree): Convert from svalue_id to
10536 (region_model::get_representative_path_var): Delete decl taking a
10537 region_id in favor of two decls, for svalue vs region, with an
10538 svalue_set to ensure termination.
10539 (region_model::get_path_vars_for_svalue): Delete.
10540 (region_model::create_region_for_heap_alloc): New.
10541 (region_model::create_region_for_alloca): New.
10542 (region_model::purge_unused_svalues): Delete.
10543 (region_model::remap_svalue_ids): Delete.
10544 (region_model::remap_region_ids): Delete.
10545 (region_model::purge_regions): Delete.
10546 (region_model::get_num_svalues): Delete.
10547 (region_model::get_num_regions): Delete.
10548 (region_model::get_descendents): Delete.
10549 (region_model::get_store): New.
10550 (region_model::delete_region_and_descendents): Delete.
10551 (region_model::get_manager): New.
10552 (region_model::unbind_region_and_descendents): New.
10553 (region_model::can_merge_with_p): Add point param. Drop
10554 svalue_id_merger_mapping.
10555 (region_model::get_value_by_name): Delete.
10556 (region_model::convert_byte_offset_to_array_index): Delete.
10557 (region_model::get_or_create_mem_ref): Delete.
10558 (region_model::get_or_create_pointer_plus_expr): Delete.
10559 (region_model::get_or_create_view): Delete.
10560 (region_model::get_lvalue_1): Convert from region_id to
10562 (region_model::get_rvalue_1): Convert from svalue_id to
10564 (region_model::get_ssa_name_regions_for_current_frame): New.
10565 (region_model::append_ssa_names_cb): New.
10566 (region_model::get_store_value): New.
10567 (region_model::copy_struct_region): Delete.
10568 (region_model::copy_union_region): Delete.
10569 (region_model::copy_array_region): Delete.
10570 (region_model::region_exists_p): New.
10571 (region_model::make_region_for_unexpected_tree_code): Delete.
10572 (region_model::loop_replay_fixup): New.
10573 (region_model::poison_any_pointers_to_bad_regions): Delete.
10574 (region_model::poison_any_pointers_to_descendents): New.
10575 (region_model::dump_summary_of_rep_path_vars): Delete.
10576 (region_model::on_top_level_param): New.
10577 (region_model::record_dynamic_extents): New.
10578 (region_model::m_mgr;): New.
10579 (region_model::m_store;): New.
10580 (region_model::m_svalues;): Delete.
10581 (region_model::m_regions;): Delete.
10582 (region_model::m_root_rid;): Delete.
10583 (region_model::m_current_frame;): New.
10584 (region_model_context::remap_svalue_ids): Delete.
10585 (region_model_context::can_purge_p): Delete.
10586 (region_model_context::on_svalue_leak): New.
10587 (region_model_context::on_svalue_purge): Delete.
10588 (region_model_context::on_liveness_change): New.
10589 (region_model_context::on_inherited_svalue): Delete.
10590 (region_model_context::on_cast): Delete.
10591 (region_model_context::on_unknown_change): Convert from svalue_id to
10592 const svalue * and add is_mutable.
10593 (class noop_region_model_context): Update for region_model_context
10595 (model_merger::model_merger): Add program_point. Drop
10596 svalue_id_merger_mapping.
10597 (model_merger::dump_to_pp): Add "simple" param.
10598 (model_merger::dump): Likewise.
10599 (model_merger::get_region_a): Delete.
10600 (model_merger::get_region_b): Delete.
10601 (model_merger::can_merge_values_p): Delete.
10602 (model_merger::record_regions): Delete.
10603 (model_merger::record_svalues): Delete.
10604 (model_merger::m_point): New field.
10605 (model_merger::m_map_regions_from_a_to_m): Delete.
10606 (model_merger::m_map_regions_from_b_to_m): Delete.
10607 (model_merger::m_sid_mapping): Delete.
10608 (struct svalue_id_merger_mapping): Delete.
10609 (class engine): New.
10610 (struct canonicalization): Delete.
10611 (inchash::add): Delete decls for hashing svalue_id and region_id.
10612 (test_region_model_context::on_unexpected_tree_code): Require t to
10614 (selftest::assert_condition): Add overload comparing a pair of
10616 * sm-file.cc: Include "tristate.h", "selftest.h",
10617 "analyzer/call-string.h", "analyzer/program-point.h",
10618 "analyzer/store.h", and "analyzer/region-model.h".
10619 (fileptr_state_machine::get_default_state): New.
10620 (fileptr_state_machine::on_stmt): Remove calls to
10621 get_readable_tree in favor of get_diagnostic_tree.
10622 * sm-malloc.cc: Include "tristate.h", "selftest.h",
10623 "analyzer/call-string.h", "analyzer/program-point.h",
10624 "analyzer/store.h", and "analyzer/region-model.h".
10625 (malloc_state_machine::get_default_state): New.
10626 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New.
10627 (malloc_diagnostic::describe_state_change): Handle change.m_expr
10629 (null_arg::emit): Avoid printing "NULL '0'".
10630 (null_arg::describe_final_event): Avoid printing "(0) NULL".
10631 (malloc_leak::emit): Handle m_arg being NULL.
10632 (malloc_leak::describe_final_event): Handle ev.m_expr being NULL.
10633 (malloc_state_machine::on_stmt): Don't call get_readable_tree.
10634 Call get_diagnostic_tree when creating pending diagnostics.
10635 Update for is_zero_assignment becoming a member function of
10637 Don't transition to m_non_heap for ADDR_EXPR(MEM_REF()).
10638 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New
10639 vfunc implementation.
10640 * sm-sensitive.cc (sensitive_state_machine::warn_for_any_exposure): Call
10641 get_diagnostic_tree and pass the result to warn_for_state.
10642 * sm-signal.cc: Move includes of "analyzer/call-string.h" and
10643 "analyzer/program-point.h" to before "analyzer/region-model.h",
10644 and also include "analyzer/store.h" before it.
10645 (signal_unsafe_call::describe_state_change): Use
10646 get_dest_function to get handler.
10647 (update_model_for_signal_handler): Pass manager to region_model
10649 (register_signal_handler::impl_transition): Update for changes to
10650 get_or_create_node and add_edge.
10651 * sm-taint.cc (taint_state_machine::on_stmt): Remove calls to
10652 get_readable_tree, replacing them when calling warn_for_state with
10653 calls to get_diagnostic_tree.
10654 * sm.cc (is_zero_assignment): Delete.
10655 (any_pointer_p): Move to within namespace ana.
10656 * sm.h (is_zero_assignment): Remove decl.
10657 (any_pointer_p): Move decl to within namespace ana.
10658 (state_machine::get_default_state): New vfunc.
10659 (state_machine::reset_when_passed_to_unknown_fn_p): New vfunc.
10660 (sm_context::get_readable_tree): Rename to...
10661 (sm_context::get_diagnostic_tree): ...this.
10662 (sm_context::is_zero_assignment): New vfunc.
10663 * store.cc: New file.
10664 * store.h: New file.
10665 * svalue.cc: New file.
10667 2020-05-22 Mark Wielaard <mark@klomp.org>
10669 * sm-signal.cc(signal_unsafe_call::emit): Possibly add
10670 gcc_rich_location note for replacement.
10671 (signal_unsafe_call::get_replacement_fn): New private function.
10672 (get_async_signal_unsafe_fns): Add "exit".
10674 2020-04-28 David Malcolm <dmalcolm@redhat.com>
10677 * engine.cc (impl_region_model_context::on_unexpected_tree_code):
10679 * region-model.cc (region_model::add_region_for_type): Handle
10682 (test_region_model_context::on_unexpected_tree_code): Handle NULL
10685 2020-04-28 David Malcolm <dmalcolm@redhat.com>
10691 * analyzer.opt (Wanalyzer-use-of-uninitialized-value): Delete.
10692 * program-state.cc (selftest::test_program_state_dumping): Update
10693 expected dump result for removal of "uninit".
10694 * region-model.cc (poison_kind_to_str): Delete POISON_KIND_UNINIT
10696 (root_region::ensure_stack_region): Initialize stack with null
10697 svalue_id rather than with a typeless POISON_KIND_UNINIT value.
10698 (root_region::ensure_heap_region): Likewise for the heap.
10699 (region_model::dump_summary_of_rep_path_vars): Remove
10700 summarization of uninit values.
10701 (region_model::validate): Remove check that the stack has a
10702 POISON_KIND_UNINIT value.
10703 (poisoned_value_diagnostic::emit): Remove POISON_KIND_UNINIT
10705 (poisoned_value_diagnostic::describe_final_event): Likewise.
10706 (selftest::test_dump): Update expected dump result for removal of
10708 (selftest::test_svalue_equality): Remove "uninit" and "freed".
10709 * region-model.h (enum poison_kind): Remove POISON_KIND_UNINIT.
10711 2020-04-01 David Malcolm <dmalcolm@redhat.com>
10714 * checker-path.cc: Include "bitmap.h".
10715 * constraint-manager.cc: Likewise.
10716 * diagnostic-manager.cc: Likewise.
10717 * engine.cc: Likewise.
10718 (exploded_node::detect_leaks): Pass null region_id to pop_frame.
10719 * program-point.cc: Include "bitmap.h".
10720 * program-state.cc: Likewise.
10721 * region-model.cc (id_set<region_id>::id_set): Convert to...
10722 (region_id_set::region_id_set): ...this.
10723 (svalue_id_set::svalue_id_set): New ctor.
10724 (region_model::copy_region): New function.
10725 (region_model::copy_struct_region): New function.
10726 (region_model::copy_union_region): New function.
10727 (region_model::copy_array_region): New function.
10728 (stack_region::pop_frame): Drop return value. Add
10729 "result_dst_rid" param; if it is non-null, use copy_region to copy
10730 the result to it. Rather than capture and pass a single "known
10731 used" return value to be used by purge_unused_values, instead
10732 gather and pass a set of known used return values.
10733 (root_region::pop_frame): Drop return value. Add "result_dst_rid"
10735 (region_model::on_assignment): Use copy_region.
10736 (region_model::on_return): Likewise for the result.
10737 (region_model::on_longjmp): Pass null for pop_frame's
10739 (region_model::update_for_return_superedge): Pass the region for the
10740 return value of the call, if any, to pop_frame, rather than setting
10741 the lvalue for the lhs of the result.
10742 (region_model::pop_frame): Drop return value. Add
10743 "result_dst_rid" param.
10744 (region_model::purge_unused_svalues): Convert third param from an
10745 svalue_id * to an svalue_id_set *, updating the initial populating
10746 of the "used" bitmap accordingly. Don't remap it when done.
10747 (struct selftest::coord_test): New selftest fixture, extracted from...
10748 (selftest::test_dump_2): ...here.
10749 (selftest::test_compound_assignment): New selftest.
10750 (selftest::test_stack_frames): Pass null to new param of pop_frame.
10751 (selftest::analyzer_region_model_cc_tests): Call the new selftest.
10752 * region-model.h (class id_set): Delete template.
10753 (class region_id_set): Reimplement, using old id_set implementation.
10754 (class svalue_id_set): Likewise. Convert from auto_sbitmap to
10756 (region::get_active_view): New accessor.
10757 (stack_region::pop_frame): Drop return value. Add
10758 "result_dst_rid" param.
10759 (root_region::pop_frame): Likewise.
10760 (region_model::pop_frame): Likewise.
10761 (region_model::copy_region): New decl.
10762 (region_model::purge_unused_svalues): Convert third param from an
10763 svalue_id * to an svalue_id_set *.
10764 (region_model::copy_struct_region): New decl.
10765 (region_model::copy_union_region): New decl.
10766 (region_model::copy_array_region): New decl.
10768 2020-03-27 David Malcolm <dmalcolm@redhat.com>
10770 * program-state.cc (selftest::test_program_state_dumping): Update
10771 expected dump to include symbolic_region's possibly_null field.
10772 * region-model.cc (symbolic_region::print_fields): New vfunc
10774 (region_model::add_constraint): Clear m_possibly_null from
10775 symbolic_regions now known to be non-NULL.
10776 (selftest::test_malloc_constraints): New selftest.
10777 (selftest::analyzer_region_model_cc_tests): Call it.
10778 * region-model.h (region::dyn_cast_symbolic_region): Add non-const
10780 (symbolic_region::dyn_cast_symbolic_region): Implement it.
10781 (symbolic_region::print_fields): New vfunc override decl.
10783 2020-03-27 David Malcolm <dmalcolm@redhat.com>
10785 * analyzer.h (class feasibility_problem): New forward decl.
10786 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
10787 Initialize new fields m_status, m_epath_length, and m_problem.
10788 (saved_diagnostic::~saved_diagnostic): Delete m_problem.
10789 (dedupe_candidate::dedupe_candidate): Convert "sd" param from a
10790 const ref to a mutable ptr.
10791 (dedupe_winners::add): Convert "sd" param from a const ref to a
10792 mutable ptr. Record the length of the exploded_path. Record the
10793 feasibility/infeasibility of sd into sd, capturing a
10794 feasibility_problem when feasible_p fails, and storing it in sd.
10795 (diagnostic_manager::emit_saved_diagnostics): Update for pass by
10796 ptr rather than by const ref.
10797 * diagnostic-manager.h (class saved_diagnostic): Add new enum
10798 status. Add fields m_status, m_epath_length and m_problem.
10799 (saved_diagnostic::set_feasible): New member function.
10800 (saved_diagnostic::set_infeasible): New member function.
10801 (saved_diagnostic::get_feasibility_problem): New accessor.
10802 (saved_diagnostic::get_status): New accessor.
10803 (saved_diagnostic::set_epath_length): New member function.
10804 (saved_diagnostic::get_epath_length): New accessor.
10805 * engine.cc: Include "gimple-pretty-print.h".
10806 (exploded_path::feasible_p): Add OUT param and, if non-NULL, write
10807 a new feasibility_problem to it on failure.
10808 (viz_callgraph_node::dump_dot): Convert begin_tr calls to
10809 begin_trtd. Convert end_tr calls to end_tdtr.
10810 (class exploded_graph_annotator): New subclass of dot_annotator.
10811 (impl_run_checkers): Add a second -fdump-analyzer-supergraph dump
10812 after the analysis runs, using exploded_graph_annotator. dumping
10813 to DUMP_BASE_NAME.supergraph-eg.dot.
10814 * exploded-graph.h (exploded_node::get_dot_fillcolor): Make
10816 (exploded_path::feasible_p): Add OUT param.
10817 (class feasibility_problem): New class.
10818 * state-purge.cc (state_purge_annotator::add_node_annotations):
10819 Return a bool, add a "within_table" param.
10820 (print_vec_of_names): Convert begin_tr calls to begin_trtd.
10821 Convert end_tr calls to end_tdtr.
10822 (state_purge_annotator::add_stmt_annotations): Add "within_row"
10824 * state-purge.h ((state_purge_annotator::add_node_annotations):
10825 Return a bool, add a "within_table" param.
10826 (state_purge_annotator::add_stmt_annotations): Add "within_row"
10828 * supergraph.cc (supernode::dump_dot): Call add_node_annotations
10829 twice: as before, passing false for "within_table", then again
10830 with true when within the TABLE element. Convert some begin_tr
10831 calls to begin_trtd, and some end_tr calls to end_tdtr.
10832 Repeat each add_stmt_annotations call, distinguishing between
10833 calls that add TRs and those that add TDs to an existing TR.
10834 Add a call to add_after_node_annotations.
10835 * supergraph.h (dot_annotator::add_node_annotations): Add a
10836 "within_table" param.
10837 (dot_annotator::add_stmt_annotations): Add a "within_row" param.
10838 (dot_annotator::add_after_node_annotations): New vfunc.
10840 2020-03-27 David Malcolm <dmalcolm@redhat.com>
10842 * diagnostic-manager.cc (dedupe_winners::add): Show the
10843 exploded_node index in the log messages.
10844 (diagnostic_manager::emit_saved_diagnostics): Log a summary of
10845 m_saved_diagnostics at entry.
10847 2020-03-27 David Malcolm <dmalcolm@redhat.com>
10849 * supergraph.cc (superedge::dump): Add space before description;
10850 move newline to non-pretty_printer overload.
10852 2020-03-18 David Malcolm <dmalcolm@redhat.com>
10854 * region-model.cc: Include "stor-layout.h".
10855 (region_model::dump_to_pp): Rather than calling
10856 dump_summary_of_map on each of the current frame and the globals,
10857 instead get a vec of representative path_vars for all regions,
10858 and then dump a summary of all of them.
10859 (region_model::dump_summary_of_map): Delete, rewriting into...
10860 (region_model::dump_summary_of_rep_path_vars): ...this new
10861 function, working on a vec of path_vars.
10862 (region_model::set_value): New overload.
10863 (region_model::get_representative_path_var): Rename
10864 "parent_region" local to "parent_reg" and consolidate with other
10865 local. Guard test for grandparent being stack on parent_reg being
10866 non-NULL. Move handling for parent being an array_region to
10867 within guard for parent_reg being non-NULL.
10868 (selftest::make_test_compound_type): New function.
10869 (selftest::test_dump_2): New selftest.
10870 (selftest::test_dump_3): New selftest.
10871 (selftest::test_stack_frames): Update expected output from
10872 simplified dump to show "a" and "b" from parent frame and "y" in
10874 (selftest::analyzer_region_model_cc_tests): Call test_dump_2 and
10876 * region-model.h (region_model::set_value): New overload decl.
10877 (region_model::dump_summary_of_map): Delete.
10878 (region_model::dump_summary_of_rep_path_vars): New.
10880 2020-03-18 David Malcolm <dmalcolm@redhat.com>
10882 * region-model.h (class noop_region_model_context): New subclass
10883 of region_model_context.
10884 (class tentative_region_model_context): Inherit from
10885 noop_region_model_context rather than from region_model_context;
10886 drop redundant vfunc implementations.
10887 (class test_region_model_context): Likewise.
10889 2020-03-18 David Malcolm <dmalcolm@redhat.com>
10891 * engine.cc (exploded_node::exploded_node): Move implementation
10892 here from header; accept point_and_state by const reference rather
10894 * exploded-graph.h (exploded_node::exploded_node): Pass
10895 point_and_state by const reference rather than by value. Move
10898 2020-03-18 Jakub Jelinek <jakub@redhat.com>
10900 * sm-malloc.cc (malloc_state_machine::on_stmt): Fix up duplicated word
10901 issue in a comment.
10902 * region-model.cc (region_model::make_region_for_unexpected_tree_code,
10903 region_model::delete_region_and_descendents): Likewise.
10904 * engine.cc (class exploded_cluster): Likewise.
10905 * diagnostic-manager.cc (class path_builder): Likewise.
10907 2020-03-13 David Malcolm <dmalcolm@redhat.com>
10911 * diagnostic-manager.cc (for_each_state_change): Bulletproof
10912 against errors in get_rvalue by passing a
10913 tentative_region_model_context and rejecting if there's an error.
10914 * region-model.cc (region_model::get_lvalue_1): When handling
10915 ARRAY_REF, handle results of error-handling. Handle NOP_EXPR.
10917 2020-03-06 David Malcolm <dmalcolm@redhat.com>
10919 * analyzer.h (class array_region): New forward decl.
10920 * program-state.cc (selftest::test_program_state_dumping_2): New.
10921 (selftest::analyzer_program_state_cc_tests): Call it.
10922 * region-model.cc (array_region::constant_from_key): New.
10923 (region_model::get_representative_tree): Handle region_svalue by
10924 generating an ADDR_EXPR.
10925 (region_model::get_representative_path_var): In view handling,
10926 remove erroneous TREE_TYPE when determining the type of the tree.
10927 Handle array regions and STRING_CST.
10928 (selftest::assert_dump_tree_eq): New.
10929 (ASSERT_DUMP_TREE_EQ): New macro.
10930 (selftest::test_get_representative_tree): New selftest.
10931 (selftest::analyzer_region_model_cc_tests): Call it.
10932 * region-model.h (region::dyn_cast_array_region): New vfunc.
10933 (array_region::dyn_cast_array_region): New vfunc implementation.
10934 (array_region::constant_from_key): New decl.
10936 2020-03-06 David Malcolm <dmalcolm@redhat.com>
10938 * analyzer.h (dump_quoted_tree): New decl.
10939 * engine.cc (exploded_node::dump_dot): Pass region model to
10940 sm_state_map::print.
10941 * program-state.cc: Include diagnostic-core.h.
10942 (sm_state_map::print): Add "model" param and use it to print
10943 representative trees. Only print origin information if non-null.
10944 (sm_state_map::dump): Pass NULL for model to print call.
10945 (program_state::print): Pass region model to sm_state_map::print.
10946 (program_state::dump_to_pp): Use spaces rather than newlines when
10947 summarizing. Pass region_model to sm_state_map::print.
10948 (ana::selftest::assert_dump_eq): New function.
10949 (ASSERT_DUMP_EQ): New macro.
10950 (ana::selftest::test_program_state_dumping): New function.
10951 (ana::selftest::analyzer_program_state_cc_tests): Call it.
10952 * program-state.h (program_state::print): Add model param.
10953 * region-model.cc (dump_quoted_tree): New function.
10954 (map_region::print_fields): Use dump_quoted_tree rather than
10955 %qE to avoid lang-dependent output.
10956 (map_region::dump_child_label): Likewise.
10957 (region_model::dump_summary_of_map): For SK_REGION, when
10958 get_representative_path_var fails, print the region id rather than
10959 erroneously printing NULL.
10960 * sm.cc (state_machine::get_state_by_name): New function.
10961 * sm.h (state_machine::get_state_by_name): New decl.
10963 2020-03-04 David Malcolm <dmalcolm@redhat.com>
10965 * region-model.cc (region::validate): Convert model param from ptr
10966 to reference. Update comment to reflect that it's now a vfunc.
10967 (map_region::validate): New vfunc implementation.
10968 (array_region::validate): New vfunc implementation.
10969 (stack_region::validate): New vfunc implementation.
10970 (root_region::validate): New vfunc implementation.
10971 (region_model::validate): Pass a reference rather than a pointer
10972 to the region::validate vfunc.
10973 * region-model.h (region::validate): Make virtual. Convert model
10974 param from ptr to reference.
10975 (map_region::validate): New vfunc decl.
10976 (array_region::validate): New vfunc decl.
10977 (stack_region::validate): New vfunc decl.
10978 (root_region::validate): New vfunc decl.
10980 2020-03-04 David Malcolm <dmalcolm@redhat.com>
10983 * region-model.cc (region_model::on_call_pre): Handle
10984 BUILT_IN_EXPECT and its variants.
10985 (region_model::add_any_constraints_from_ssa_def_stmt): Split out
10986 gassign handling into add_any_constraints_from_gassign; add gcall
10988 (region_model::add_any_constraints_from_gassign): New function,
10989 based on the above. Add handling for NOP_EXPR.
10990 (region_model::add_any_constraints_from_gcall): New function.
10991 (region_model::get_representative_path_var): Handle views.
10993 (region_model::add_any_constraints_from_ssa_def_stmt): New decl.
10994 (region_model::add_any_constraints_from_gassign): New decl.
10996 2020-03-04 David Malcolm <dmalcolm@redhat.com>
10999 * checker-path.h (state_change_event::get_lvalue): Add ctxt param
11000 and pass it to region_model::get_value call.
11001 * diagnostic-manager.cc (get_any_origin): Pass a
11002 tentative_region_model_context to the calls to get_lvalue and reject
11003 the comparison if errors occur.
11004 (can_be_expr_of_interest_p): New function.
11005 (diagnostic_manager::prune_for_sm_diagnostic): Replace checks for
11006 CONSTANT_CLASS_P with calls to update_for_unsuitable_sm_exprs.
11007 Pass a tentative_region_model_context to the calls to
11008 state_change_event::get_lvalue and reject the comparison if errors
11010 (diagnostic_manager::update_for_unsuitable_sm_exprs): New.
11011 * diagnostic-manager.h
11012 (diagnostic_manager::update_for_unsuitable_sm_exprs): New decl.
11013 * region-model.h (class tentative_region_model_context): New class.
11015 2020-03-04 David Malcolm <dmalcolm@redhat.com>
11017 * engine.cc (worklist::worklist): Remove unused field m_eg.
11018 (class viz_callgraph_edge): Remove unused field m_call_sedge.
11019 (class viz_callgraph): Remove unused field m_sg.
11020 * exploded-graph.h (worklist::::m_eg): Remove unused field.
11022 2020-03-02 David Malcolm <dmalcolm@redhat.com>
11024 * analyzer.opt (fanalyzer-show-duplicate-count): New option.
11025 * diagnostic-manager.cc
11026 (diagnostic_manager::emit_saved_diagnostic): Use the above to
11027 guard the printing of the duplicate count.
11029 2020-03-02 David Malcolm <dmalcolm@redhat.com>
11032 * analyzer.cc (is_std_function_p): New function.
11033 (is_std_named_call_p): New functions.
11034 * analyzer.h (is_std_named_call_p): New decl.
11035 * sm-malloc.cc (malloc_state_machine::on_stmt): Check for "std::"
11036 variants when checking for malloc, calloc and free.
11038 2020-02-26 David Malcolm <dmalcolm@redhat.com>
11041 * diagnostic-manager.cc
11042 (diagnostic_manager::prune_for_sm_diagnostic): Assert that var is
11043 either NULL or not a constant. When updating var, bulletproof
11044 against constant values.
11046 2020-02-26 David Malcolm <dmalcolm@redhat.com>
11049 * region-model.cc (region_model::get_fndecl_for_call): Gracefully
11050 fail for fn_decls that don't have a cgraph_node.
11052 2020-02-26 David Malcolm <dmalcolm@redhat.com>
11054 * bar-chart.cc: New file.
11055 * bar-chart.h: New file.
11056 * engine.cc: Include "analyzer/bar-chart.h".
11057 (stats::log): Only log the m_num_nodes kinds that are non-zero.
11058 (stats::dump): Likewise when dumping.
11059 (stats::get_total_enodes): New.
11060 (exploded_graph::get_or_create_node): Increment the per-point-data
11061 m_excess_enodes when hitting the per-program-point limit on
11063 (exploded_graph::print_bar_charts): New.
11064 (exploded_graph::log_stats): Log the number of unprocessed enodes
11065 in the worklist. Call print_bar_charts.
11066 (exploded_graph::dump_stats): Print the number of unprocessed
11067 enodes in the worklist.
11068 * exploded-graph.h (stats::get_total_enodes): New decl.
11069 (struct per_program_point_data): Add field m_excess_enodes.
11070 (exploded_graph::print_bar_charts): New decl.
11071 * supergraph.cc (superedge::dump): New.
11072 (superedge::dump): New.
11073 * supergraph.h (supernode::get_function): New.
11074 (superedge::dump): New decl.
11075 (superedge::dump): New decl.
11077 2020-02-24 David Malcolm <dmalcolm@redhat.com>
11079 * engine.cc (exploded_graph::get_or_create_node): Dump the
11080 program_state to the pp, rather than to stderr.
11082 2020-02-24 David Malcolm <dmalcolm@redhat.com>
11085 * sm.cc (make_checkers): Require the "taint" checker to be
11086 explicitly enabled.
11088 2020-02-24 David Malcolm <dmalcolm@redhat.com>
11092 (impl_region_model_context::impl_region_model_context): Add logger
11094 * engine.cc (exploded_graph::add_function_entry): Create an
11095 impl_region_model_context and pass it to the push_frame call.
11096 Bail if the resulting state is invalid.
11097 (exploded_graph::build_initial_worklist): Likewise.
11098 (exploded_graph::build_initial_worklist): Handle the case where
11099 add_function_entry fails.
11101 (impl_region_model_context::impl_region_model_context): Add logger
11103 * region-model.cc (map_region::get_or_create): Add ctxt param and
11104 pass it to add_region_for_type.
11105 (map_region::can_merge_p): Pass NULL as a ctxt to call to
11107 (array_region::get_element): Pass ctxt to call to get_or_create.
11108 (array_region::get_or_create): Add ctxt param and pass it to
11109 add_region_for_type.
11110 (root_region::push_frame): Pass ctxt to get_or_create calls.
11111 (region_model::get_lvalue_1): Likewise.
11112 (region_model::make_region_for_unexpected_tree_code): Assert that
11114 (region_model::get_rvalue_1): Pass ctxt to get_svalue_for_fndecl
11115 and get_svalue_for_label calls.
11116 (region_model::get_svalue_for_fndecl): Add ctxt param and pass it
11117 to get_region_for_fndecl.
11118 (region_model::get_region_for_fndecl): Add ctxt param and pass it
11120 (region_model::get_svalue_for_label): Add ctxt param and pass it
11121 to get_region_for_label.
11122 (region_model::get_region_for_label): Add ctxt param and pass it
11123 to get_region_for_fndecl and get_or_create.
11124 (region_model::get_field_region): Add ctxt param and pass it to
11125 get_or_create_view and get_or_create.
11126 (make_region_for_type): Replace gcc_unreachable with return NULL.
11127 (region_model::add_region_for_type): Add ctxt param. Handle a
11128 return of NULL from make_region_for_type by calling
11129 make_region_for_unexpected_tree_code.
11130 (region_model::get_or_create_mem_ref): Pass ctxt to calls to
11131 get_or_create_view.
11132 (region_model::get_or_create_view): Add ctxt param and pass it to
11133 add_region_for_type.
11134 (selftest::test_state_merging): Pass ctxt to get_or_create_view.
11135 * region-model.h (region_model::get_or_create): Add ctxt param.
11136 (region_model::add_region_for_type): Likewise.
11137 (region_model::get_svalue_for_fndecl): Likewise.
11138 (region_model::get_svalue_for_label): Likewise.
11139 (region_model::get_region_for_fndecl): Likewise.
11140 (region_model::get_region_for_label): Likewise.
11141 (region_model::get_field_region): Likewise.
11142 (region_model::get_or_create_view): Likewise.
11144 2020-02-24 David Malcolm <dmalcolm@redhat.com>
11146 * checker-path.cc (superedge_event::should_filter_p): Update
11147 filter for empty descriptions to cover verbosity level 3 as well
11149 * diagnostic-manager.cc: Include "analyzer/reachability.h".
11150 (class path_builder): New class.
11151 (diagnostic_manager::emit_saved_diagnostic): Create a path_builder
11152 and pass it to build_emission_path, rather passing eg; similarly
11153 for add_events_for_eedge and ext_state.
11154 (diagnostic_manager::build_emission_path): Replace "eg" param
11155 with a path_builder, pass it to add_events_for_eedge.
11156 (diagnostic_manager::add_events_for_eedge): Replace ext_state
11157 param with path_builder; pass it to add_events_for_superedge.
11158 (diagnostic_manager::significant_edge_p): New.
11159 (diagnostic_manager::add_events_for_superedge): Add path_builder
11160 param. Reject insignificant edges at verbosity levels below 3.
11161 (diagnostic_manager::prune_for_sm_diagnostic): Update highest
11162 verbosity level to 4.
11163 * diagnostic-manager.h (class path_builder): New forward decl.
11164 (diagnostic_manager::build_emission_path): Replace "eg" param
11165 with a path_builder.
11166 (diagnostic_manager::add_events_for_eedge): Replace ext_state
11167 param with path_builder.
11168 (diagnostic_manager::significant_edge_p): New.
11169 (diagnostic_manager::add_events_for_superedge): Add path_builder
11171 * reachability.h: New file.
11173 2020-02-18 David Malcolm <dmalcolm@redhat.com>
11176 * analyzer.opt (fdump-analyzer-callgraph): Rewrite description.
11178 2020-02-18 David Malcolm <dmalcolm@redhat.com>
11181 * region-model.cc (region_model::maybe_cast_1): Replace assertion
11182 that build_cast returns non-NULL with a conditional, falling
11183 through to the logic which returns a new unknown value of the
11184 desired type if it fails.
11186 2020-02-18 David Malcolm <dmalcolm@redhat.com>
11189 * engine.cc (impl_region_model_context::on_unknown_tree_code):
11191 (impl_region_model_context::on_unexpected_tree_code): ...this and
11192 convert first argument from path_var to tree.
11193 (exploded_node::on_stmt): Pass ctxt to purge_for_unknown_fncall.
11194 * exploded-graph.h (region_model_context::on_unknown_tree_code):
11196 (region_model_context::on_unexpected_tree_code): ...this and
11197 convert first argument from path_var to tree.
11198 * program-state.cc (sm_state_map::purge_for_unknown_fncall): Add
11199 ctxt param and pass on to calls to get_rvalue.
11200 * program-state.h (sm_state_map::purge_for_unknown_fncall): Add
11202 * region-model.cc (region_model::handle_unrecognized_call): Pass
11203 ctxt on to call to get_rvalue.
11204 (region_model::get_lvalue_1): Move body of default case to
11205 region_model::make_region_for_unexpected_tree_code and call it.
11206 Within COMPONENT_REF case, reject attempts to handle types other
11207 than RECORD_TYPE and UNION_TYPE.
11208 (region_model::make_region_for_unexpected_tree_code): New
11209 function, based on default case of region_model::get_lvalue_1.
11211 (region_model::make_region_for_unexpected_tree_code): New decl.
11212 (region_model::on_unknown_tree_code): Rename to...
11213 (region_model::on_unexpected_tree_code): ...this and convert first
11214 argument from path_var to tree.
11215 (class test_region_model_context): Update vfunc implementation for
11218 2020-02-18 David Malcolm <dmalcolm@redhat.com>
11222 (region_model::convert_byte_offset_to_array_index): Use
11223 int_size_in_bytes before calling size_in_bytes, to gracefully fail
11224 on incomplete types.
11226 2020-02-17 David Malcolm <dmalcolm@redhat.com>
11229 * region-model.cc (region_model::get_fndecl_for_call): Handle the
11230 case where the code_region's get_tree_for_child_region returns
11233 2020-02-17 David Malcolm <dmalcolm@redhat.com>
11236 * engine.cc (impl_region_model_context::on_unknown_tree_code):
11238 (exploded_graph::get_or_create_node): Reject invalid states.
11240 (impl_region_model_context::on_unknown_tree_code): New decl.
11241 (point_and_state::point_and_state): Assert that the state is
11243 * program-state.cc (program_state::program_state): Initialize
11245 (program_state::operator=): Copy m_valid.
11246 (program_state::program_state): Likewise for move constructor.
11247 (program_state::print): Print m_valid.
11248 (program_state::dump_to_pp): Likewise.
11249 * program-state.h (program_state::m_valid): New field.
11250 * region-model.cc (region_model::get_lvalue_1): Implement the
11251 default case by returning a new symbolic region and calling
11252 the context's on_unknown_tree_code, rather than issuing an
11253 internal_error. Implement VIEW_CONVERT_EXPR.
11254 * region-model.h (region_model_context::on_unknown_tree_code): New
11256 (test_region_model_context::on_unknown_tree_code): New.
11258 2020-02-17 David Malcolm <dmalcolm@redhat.com>
11260 * sm-malloc.cc (malloc_diagnostic::describe_state_change): For
11261 transition to the "null" state, only say "assuming" when
11262 transitioning from the "unchecked" state.
11264 2020-02-17 David Malcolm <dmalcolm@redhat.com>
11266 * diagnostic-manager.h (diagnostic_manager::get_saved_diagnostic):
11267 Add const overload.
11268 * engine.cc (exploded_node::dump_dot): Dump saved_diagnostics.
11269 * exploded-graph.h (exploded_graph::get_diagnostic_manager): Add
11272 2020-02-11 David Malcolm <dmalcolm@redhat.com>
11275 * analysis-plan.cc (analysis_plan::use_summary_p): Look through
11276 the ultimate_alias_target when getting the called function.
11277 * engine.cc (exploded_node::on_stmt): Rename second "ctxt" to
11278 "sm_ctxt". Use the region_model's get_fndecl_for_call rather than
11279 gimple_call_fndecl.
11280 * region-model.cc (region_model::get_fndecl_for_call): Use
11281 ultimate_alias_target on fndecl.
11282 * supergraph.cc (get_ultimate_function_for_cgraph_edge): New
11284 (supergraph_call_edge): Use it when rejecting edges without
11286 (supergraph::supergraph): Use it to get the function for the
11287 cgraph_edge when building interprocedural superedges.
11288 (callgraph_superedge::get_callee_function): Use it.
11289 * supergraph.h (supergraph::get_num_snodes): Make param const.
11290 (supergraph::function_to_num_snodes_t): Make first type param
11293 2020-02-11 David Malcolm <dmalcolm@redhat.com>
11296 * engine.cc (exploded_edge::exploded_edge): Add ext_state param
11297 and pass it to change.validate.
11298 (exploded_graph::get_or_create_node): Move purging of change
11299 svalues to also cover the case of reusing an existing enode.
11300 (exploded_graph::add_edge): Pass m_ext_state to exploded_edge's
11302 * exploded-graph.h (exploded_edge::exploded_edge): Add ext_state
11304 * program-state.cc (state_change::sm_change::validate): Likewise.
11305 Assert that m_sm_idx is sane. Use ext_state to validate
11306 m_old_state and m_new_state.
11307 (state_change::validate): Add ext_state param and pass it to
11308 the sm_change validate calls.
11309 * program-state.h (state_change::sm_change::validate): Add
11311 (state_change::validate): Likewise.
11313 2020-02-11 David Malcolm <dmalcolm@redhat.com>
11316 * engine.cc (exploded_graph::dump_exploded_nodes): Handle missing
11317 case of STATUS_WORKLIST in implementation of
11318 "__analyzer_dump_exploded_nodes".
11320 2020-02-11 David Malcolm <dmalcolm@redhat.com>
11323 * constraint-manager.cc (constraint_manager::add_constraint): When
11324 merging equivalence classes and updating m_constant, also update
11326 (constraint_manager::validate): If m_constant is non-NULL assert
11327 that m_cst_sid is non-null and is valid.
11329 2020-02-11 David Malcolm <dmalcolm@redhat.com>
11332 * analyzer.opt (fdump-analyzer): Reword description.
11333 (fdump-analyzer-stderr): Likewise.
11335 2020-02-11 David Malcolm <dmalcolm@redhat.com>
11337 * region-model.cc (print_quoted_type): New function.
11338 (svalue::print): Use it to replace %qT.
11339 (region::dump_to_pp): Likewise.
11340 (region::dump_child_label): Likewise.
11341 (region::print_fields): Likewise.
11343 2020-02-10 David Malcolm <dmalcolm@redhat.com>
11346 * analyzer.opt (-param=analyzer-max-recursion-depth=): Fix "tha"
11348 (Wanalyzer-use-of-uninitialized-value): Fix "initialized" ->
11349 "uninitialized" typo.
11351 2020-02-10 David Malcolm <dmalcolm@redhat.com>
11354 * region-model.cc (region_model::get_lvalue_1):
11355 Handle BIT_FIELD_REF.
11356 (make_region_for_type): Handle VECTOR_TYPE.
11358 2020-02-10 David Malcolm <dmalcolm@redhat.com>
11361 * diagnostic-manager.cc
11362 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof against
11363 VAR being constant.
11364 * region-model.cc (region_model::get_lvalue_1): Provide a better
11365 error message when encountering an unhandled tree code.
11367 2020-02-10 David Malcolm <dmalcolm@redhat.com>
11370 * region-model.cc (region_model::get_lvalue_1): Implement
11373 2020-02-06 David Malcolm <dmalcolm@redhat.com>
11375 * region-model.cc (region_model::maybe_cast_1): Attempt to provide
11376 a region_svalue if either type is a pointer, rather than if both
11377 types are pointers.
11379 2020-02-05 David Malcolm <dmalcolm@redhat.com>
11381 * engine.cc (exploded_node::dump_dot): Show merger enodes.
11382 (worklist::add_node): Assert that the node's m_status is
11384 (exploded_graph::process_worklist): Likewise for nodes from the
11385 worklist. Set status of merged nodes to STATUS_MERGER.
11386 (exploded_graph::process_node): Set status of node to
11388 (exploded_graph::dump_exploded_nodes): Rework handling of
11389 "__analyzer_dump_exploded_nodes", splitting enodes by status into
11390 "processed" and "merger", showing the count of just the processed
11391 enodes at the call, rather than the count of all enodes.
11392 * exploded-graph.h (exploded_node::status): New enum.
11393 (exploded_node::exploded_node): Initialize m_status to
11395 (exploded_node::get_status): New getter.
11396 (exploded_node::set_status): New setter.
11398 2020-02-04 David Malcolm <dmalcolm@redhat.com>
11401 * engine.cc (pod_hash_traits<function_call_string>::mark_empty):
11402 Eliminate reinterpret_cast.
11403 (pod_hash_traits<function_call_string>::is_empty): Likewise.
11405 2020-02-03 David Malcolm <dmalcolm@redhat.com>
11407 * constraint-manager.cc (range::constrained_to_single_element):
11408 Replace fold_build2 with fold_binary. Remove unnecessary newline.
11409 (constraint_manager::get_or_add_equiv_class): Replace fold_build2
11410 with fold_binary in two places, and remove out-of-date comment.
11411 (constraint_manager::eval_condition): Replace fold_build2 with
11413 * region-model.cc (constant_svalue::eval_condition): Likewise.
11414 (region_model::on_assignment): Likewise.
11416 2020-02-03 David Malcolm <dmalcolm@redhat.com>
11419 * diagnostic-manager.cc
11420 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof
11421 against bad choices due to bad paths.
11422 * engine.cc (impl_region_model_context::on_phi): New.
11423 * exploded-graph.h (impl_region_model_context::on_phi): New decl.
11424 * region-model.cc (region_model::on_longjmp): Likewise.
11425 (region_model::handle_phi): Add phi param. Call the ctxt's on_phi
11427 (region_model::update_for_phis): Pass phi to handle_phi.
11428 * region-model.h (region_model::handle_phi): Add phi param.
11429 (region_model_context::on_phi): New vfunc.
11430 (test_region_model_context::on_phi): New.
11431 * sm-malloc.cc (malloc_state_machine::on_phi): New.
11432 (malloc_state_machine::on_zero_assignment): New.
11433 * sm.h (state_machine::on_phi): New vfunc.
11435 2020-02-03 David Malcolm <dmalcolm@redhat.com>
11437 * engine.cc (supernode_cluster::dump_dot): Show BB index as
11439 * supergraph.cc (supernode::dump_dot): Likewise.
11441 2020-02-03 David Malcolm <dmalcolm@redhat.com>
11444 * region-model.cc (region_model::on_call_pre): Update for new
11445 param of symbolic_region ctor.
11446 (region_model::deref_rvalue): Likewise.
11447 (region_model::add_new_malloc_region): Likewise.
11448 (make_region_for_type): Likewise, preserving type.
11449 * region-model.h (symbolic_region::symbolic_region): Add "type"
11450 param and pass it to base class ctor.
11452 2020-02-03 David Malcolm <dmalcolm@redhat.com>
11455 * constraint-manager.cc
11456 (constraint_manager::get_or_add_equiv_class): Ensure types are
11457 compatible before comparing constants.
11459 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11462 * region-model.cc (make_region_for_type): Use VOID_TYPE_P rather
11463 than checking against void_type_node.
11465 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11468 * region-model.cc (ASSERT_COMPAT_TYPES): Convert to...
11469 (assert_compat_types): ...this, and bail when either type is NULL,
11470 or when VOID_TYPE_P (dst_type).
11471 (region_model::get_lvalue): Update for above conversion.
11472 (region_model::get_rvalue): Likewise.
11474 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11477 * region-model.cc (region_model::update_for_return_superedge):
11478 Move check for null result so that it also guards setting the
11481 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11484 * region-model.cc (stack_region::can_merge_p): Split into a two
11485 pass approach, creating all stack regions first, then populating
11487 (selftest::test_state_merging): Add test coverage for (a) the case
11488 of self-merging a model in which a local in an older stack frame
11489 points to a local in a more recent stack frame (which previously
11490 would ICE), and (b) the case of self-merging a model in which a
11491 local points to a global (which previously worked OK).
11493 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11495 * analyzer.cc (is_named_call_p): Replace tests for fndecl being
11496 extern at file scope and having a non-NULL DECL_NAME with a call
11497 to maybe_special_function_p.
11498 * function-set.cc (function_set::contains_decl_p): Add call to
11499 maybe_special_function_p.
11501 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11504 * constraint-manager.cc
11505 (constraint_manager::get_or_add_equiv_class): Only compare constants
11506 if their types are compatible.
11507 * region-model.cc (constant_svalue::eval_condition): Replace check
11508 for identical types with call to types_compatible_p.
11510 2020-01-30 David Malcolm <dmalcolm@redhat.com>
11512 * program-state.cc (extrinsic_state::dump_to_pp): New.
11513 (extrinsic_state::dump_to_file): New.
11514 (extrinsic_state::dump): New.
11515 * program-state.h (extrinsic_state::dump_to_pp): New decl.
11516 (extrinsic_state::dump_to_file): New decl.
11517 (extrinsic_state::dump): New decl.
11518 * sm.cc: Include "pretty-print.h".
11519 (state_machine::dump_to_pp): New.
11520 * sm.h (state_machine::dump_to_pp): New decl.
11522 2020-01-30 David Malcolm <dmalcolm@redhat.com>
11524 * diagnostic-manager.cc (for_each_state_change): Use
11525 extrinsic_state::get_num_checkers rather than accessing m_checkers
11527 * program-state.cc (program_state::program_state): Likewise.
11528 * program-state.h (extrinsic_state::m_checkers): Make private.
11530 2020-01-30 David Malcolm <dmalcolm@redhat.com>
11533 * region-model.cc (region_model::eval_condition): In both
11534 overloads, bail out immediately on floating-point types.
11535 (region_model::eval_condition_without_cm): Likewise.
11536 (region_model::add_constraint): Likewise.
11538 2020-01-30 David Malcolm <dmalcolm@redhat.com>
11541 * program-state.cc (sm_state_map::set_state): For the overload
11542 taking an svalue_id, bail out if the set_state on the ec does
11543 nothing. Convert the latter's return type from void to bool,
11544 returning true if anything changed.
11545 (sm_state_map::impl_set_state): Convert the return type from void
11546 to bool, returning true if the state changed.
11547 * program-state.h (sm_state_map::set_state): Convert return type
11549 (sm_state_map::impl_set_state): Likewise.
11550 * region-model.cc (constant_svalue::eval_condition): Only call
11551 fold_build2 if the types are the same.
11553 2020-01-29 Jakub Jelinek <jakub@redhat.com>
11555 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Remove.
11556 * constraint-manager.cc: Include diagnostic-core.h before graphviz.h.
11557 (range::dump, equiv_class::print): Don't use PUSH_IGNORE_WFORMAT or
11558 POP_IGNORE_WFORMAT.
11559 * state-purge.cc: Include diagnostic-core.h before
11560 gimple-pretty-print.h.
11561 (state_purge_annotator::add_node_annotations, print_vec_of_names):
11562 Don't use PUSH_IGNORE_WFORMAT or POP_IGNORE_WFORMAT.
11563 * region-model.cc: Move diagnostic-core.h include before graphviz.h.
11564 (path_var::dump, svalue::print, constant_svalue::print_details,
11565 region::dump_to_pp, region::dump_child_label, region::print_fields,
11566 map_region::print_fields, map_region::dump_dot_to_pp,
11567 map_region::dump_child_label, array_region::print_fields,
11568 array_region::dump_dot_to_pp): Don't use PUSH_IGNORE_WFORMAT or
11569 POP_IGNORE_WFORMAT.
11571 2020-01-28 David Malcolm <dmalcolm@redhat.com>
11574 * engine.cc (rewind_info_t::update_model): Get the longjmp call
11575 stmt via get_longjmp_call () rather than assuming it is the last
11576 stmt in the longjmp's supernode.
11577 (rewind_info_t::add_events_to_path): Get the location_t for the
11578 rewind_from_longjmp_event via get_longjmp_call () rather than from
11579 the supernode's get_end_location ().
11581 2020-01-28 David Malcolm <dmalcolm@redhat.com>
11583 * region-model.cc (poisoned_value_diagnostic::emit): Update for
11584 renaming of warning_at overload to warning_meta.
11585 * sm-file.cc (file_leak::emit): Likewise.
11586 * sm-malloc.cc (double_free::emit): Likewise.
11587 (possible_null_deref::emit): Likewise.
11588 (possible_null_arg::emit): Likewise.
11589 (null_deref::emit): Likewise.
11590 (null_arg::emit): Likewise.
11591 (use_after_free::emit): Likewise.
11592 (malloc_leak::emit): Likewise.
11593 (free_of_non_heap::emit): Likewise.
11594 * sm-sensitive.cc (exposure_through_output_file::emit): Likewise.
11595 * sm-signal.cc (signal_unsafe_call::emit): Likewise.
11596 * sm-taint.cc (tainted_array_index::emit): Likewise.
11598 2020-01-27 David Malcolm <dmalcolm@redhat.com>
11601 * region-model.cc (tree_cmp): For the REAL_CST case, impose an
11602 arbitrary order on NaNs relative to other NaNs and to non-NaNs;
11603 const-correctness tweak.
11604 (ana::selftests::build_real_cst_from_string): New function.
11605 (ana::selftests::append_interesting_constants): New function.
11606 (ana::selftests::test_tree_cmp_on_constants): New test.
11607 (ana::selftests::test_canonicalization_4): New test.
11608 (ana::selftests::analyzer_region_model_cc_tests): Call the new
11611 2020-01-27 David Malcolm <dmalcolm@redhat.com>
11614 * engine.cc (run_checkers): Save and restore input_location.
11616 2020-01-27 David Malcolm <dmalcolm@redhat.com>
11618 * call-string.cc (call_string::cmp_1): Delete, moving body to...
11619 (call_string::cmp): ...here.
11620 * call-string.h (call_string::cmp_1): Delete decl.
11621 * engine.cc (worklist::key_t::cmp_1): Delete, moving body to...
11622 (worklist::key_t::cmp): ...here. Implement hash comparisons
11623 via comparison rather than subtraction to avoid overflow issues.
11624 * exploded-graph.h (worklist::key_t::cmp_1): Delete decl.
11625 * region-model.cc (tree_cmp): Eliminate buggy checking for
11628 2020-01-27 David Malcolm <dmalcolm@redhat.com>
11630 * analyzer.cc (is_named_call_p): Check that fndecl is "extern"
11631 and at file scope. Potentially disregard prefix _ or __ in
11632 fndecl's name. Bail if the identifier is NULL.
11633 (is_setjmp_call_p): Expect a gcall rather than plain gimple.
11634 Remove special-case check for leading prefix, and also check for
11636 (is_longjmp_call_p): Also check for siglongjmp.
11637 (get_user_facing_name): New function.
11638 * analyzer.h (is_setjmp_call_p): Expect a gcall rather than plain
11640 (get_user_facing_name): New decl.
11641 * checker-path.cc (setjmp_event::get_desc): Use
11642 get_user_facing_name to avoid hardcoding the function name.
11643 (rewind_event::rewind_event): Add rewind_info param, using it to
11644 initialize new m_rewind_info field, and strengthen the assertion.
11645 (rewind_from_longjmp_event::get_desc): Use get_user_facing_name to
11646 avoid hardcoding the function name.
11647 (rewind_to_setjmp_event::get_desc): Likewise.
11648 * checker-path.h (setjmp_event::setjmp_event): Add setjmp_call
11649 param and use it to initialize...
11650 (setjmp_event::m_setjmp_call): New field.
11651 (rewind_event::rewind_event): Add rewind_info param.
11652 (rewind_event::m_rewind_info): New protected field.
11653 (rewind_from_longjmp_event::rewind_from_longjmp_event): Add
11655 (class rewind_to_setjmp_event): Move rewind_info field to parent
11657 * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
11658 Update setjmp-handling for is_setjmp_call_p requiring a gcall;
11659 pass the call to the new setjmp_event.
11660 * engine.cc (exploded_node::on_stmt): Update for is_setjmp_call_p
11662 (stale_jmp_buf::emit): Use get_user_facing_name to avoid
11663 hardcoding the function names.
11664 (exploded_node::on_longjmp): Pass the longjmp_call when
11665 constructing rewind_info.
11666 (rewind_info_t::add_events_to_path): Pass the rewind_info_t to the
11667 rewind_from_longjmp_event's ctor.
11668 * exploded-graph.h (rewind_info_t::rewind_info_t): Add
11669 longjmp_call param.
11670 (rewind_info_t::get_longjmp_call): New.
11671 (rewind_info_t::m_longjmp_call): New.
11672 * region-model.cc (region_model::on_setjmp): Update comment to
11673 indicate this is also for sigsetjmp.
11674 * region-model.h (struct setjmp_record): Likewise.
11675 (class setjmp_svalue): Likewise.
11677 2020-01-27 David Malcolm <dmalcolm@redhat.com>
11680 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Guard these
11681 macros with GCC_VERSION >= 4006, making them no-op otherwise.
11682 * engine.cc (exploded_edge::exploded_edge): Specify template for
11683 base class initializer.
11684 (exploded_graph::add_edge): Specify template when chaining up to
11685 base class add_edge implementation.
11686 (viz_callgraph_node::dump_dot): Drop redundant "typename".
11687 (viz_callgraph_edge::viz_callgraph_edge): Specify template for
11688 base class initializer.
11689 * program-state.cc (sm_state_map::clone_with_remapping): Drop
11690 redundant "typename".
11691 (sm_state_map::print): Likewise.
11692 (sm_state_map::hash): Likewise.
11693 (sm_state_map::operator==): Likewise.
11694 (sm_state_map::remap_svalue_ids): Likewise.
11695 (sm_state_map::on_svalue_purge): Likewise.
11696 (sm_state_map::validate): Likewise.
11697 * program-state.h (sm_state_map::iterator_t): Likewise.
11698 * supergraph.h (superedge::superedge): Specify template for base
11701 2020-01-23 David Malcolm <dmalcolm@redhat.com>
11704 * supergraph.cc (callgraph_superedge::get_arg_for_parm): Fail
11705 gracefully is the number of parameters at the callee exceeds the
11706 number of arguments at the call stmt.
11707 (callgraph_superedge::get_parm_for_arg): Likewise.
11709 2020-01-22 David Malcolm <dmalcolm@redhat.com>
11712 * program-state.cc (sm_state_map::on_svalue_purge): If the
11713 entry survives, but the origin is being purged, then reset the
11716 2020-01-22 David Malcolm <dmalcolm@redhat.com>
11718 * sm-signal.cc: Fix nesting of CHECKING_P and namespace ana.
11720 2020-01-22 David Malcolm <dmalcolm@redhat.com>
11723 * engine.cc (setjmp_svalue::compare_fields): Update for
11724 replacement of m_enode with m_setjmp_record.
11725 (setjmp_svalue::add_to_hash): Likewise.
11726 (setjmp_svalue::get_index): Rename...
11727 (setjmp_svalue::get_enode_index): ...to this.
11728 (setjmp_svalue::print_details): Update for replacement of m_enode
11729 with m_setjmp_record.
11730 (exploded_node::on_longjmp): Likewise.
11731 * exploded-graph.h (rewind_info_t::m_enode_origin): Replace...
11732 (rewind_info_t::m_setjmp_record): ...with this.
11733 (rewind_info_t::rewind_info_t): Update for replacement of m_enode
11734 with m_setjmp_record.
11735 (rewind_info_t::get_setjmp_point): Likewise.
11736 (rewind_info_t::get_setjmp_call): Likewise.
11737 * region-model.cc (region_model::dump_summary_of_map): Likewise.
11738 (region_model::on_setjmp): Likewise.
11739 * region-model.h (struct setjmp_record): New struct.
11740 (setjmp_svalue::m_enode): Replace...
11741 (setjmp_svalue::m_setjmp_record): ...with this.
11742 (setjmp_svalue::setjmp_svalue): Update for replacement of m_enode
11743 with m_setjmp_record.
11744 (setjmp_svalue::clone): Likewise.
11745 (setjmp_svalue::get_index): Rename...
11746 (setjmp_svalue::get_enode_index): ...to this.
11747 (setjmp_svalue::get_exploded_node): Replace...
11748 (setjmp_svalue::get_setjmp_record): ...with this.
11750 2020-01-22 David Malcolm <dmalcolm@redhat.com>
11753 * analyzer.cc (is_setjmp_call_p): Check for "setjmp" as well as
11756 2020-01-22 David Malcolm <dmalcolm@redhat.com>
11759 * analysis-plan.h: Wrap everything namespace "ana".
11760 * analyzer-logging.cc: Likewise.
11761 * analyzer-logging.h: Likewise.
11762 * analyzer-pass.cc (pass_analyzer::execute): Update for "ana"
11764 * analyzer-selftests.cc: Wrap everything namespace "ana".
11765 * analyzer-selftests.h: Likewise.
11766 * analyzer.h: Likewise for forward decls of types.
11767 * call-string.h: Likewise.
11768 * checker-path.cc: Likewise.
11769 * checker-path.h: Likewise.
11770 * constraint-manager.cc: Likewise.
11771 * constraint-manager.h: Likewise.
11772 * diagnostic-manager.cc: Likewise.
11773 * diagnostic-manager.h: Likewise.
11774 * engine.cc: Likewise.
11775 * engine.h: Likewise.
11776 * exploded-graph.h: Likewise.
11777 * function-set.cc: Likewise.
11778 * function-set.h: Likewise.
11779 * pending-diagnostic.cc: Likewise.
11780 * pending-diagnostic.h: Likewise.
11781 * program-point.cc: Likewise.
11782 * program-point.h: Likewise.
11783 * program-state.cc: Likewise.
11784 * program-state.h: Likewise.
11785 * region-model.cc: Likewise.
11786 * region-model.h: Likewise.
11787 * sm-file.cc: Likewise.
11788 * sm-malloc.cc: Likewise.
11789 * sm-pattern-test.cc: Likewise.
11790 * sm-sensitive.cc: Likewise.
11791 * sm-signal.cc: Likewise.
11792 * sm-taint.cc: Likewise.
11795 * state-purge.h: Likewise.
11796 * supergraph.cc: Likewise.
11797 * supergraph.h: Likewise.
11799 2020-01-21 David Malcolm <dmalcolm@redhat.com>
11802 * region-model.cc (int_cmp): Rename to...
11803 (array_region::key_cmp): ...this, using key_t rather than int.
11804 Rewrite in terms of comparisons rather than subtraction to
11805 ensure qsort is anti-symmetric when handling extreme values.
11806 (array_region::walk_for_canonicalization): Update for above
11808 * region-model.h (array_region::key_cmp): New decl.
11810 2020-01-17 David Malcolm <dmalcolm@redhat.com>
11813 * region-model.cc (region_model::eval_condition_without_cm): Avoid
11814 gcc_unreachable for unexpected operations for the case where
11815 we're comparing an svalue against itself.
11817 2020-01-17 David Malcolm <dmalcolm@redhat.com>
11821 (region_model::convert_byte_offset_to_array_index): Convert to
11822 ssizetype before dividing by byte_size. Use fold_binary rather
11823 than fold_build2 to avoid needlessly constructing a tree for the
11826 2020-01-15 David Malcolm <dmalcolm@redhat.com>
11828 * engine.cc (class impl_region_model_context): Fix comment.
11830 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11833 * region-model.cc (make_region_for_type): Use
11834 FUNC_OR_METHOD_TYPE_P rather than comparing against FUNCTION_TYPE.
11835 * region-model.h (function_region::function_region): Likewise.
11837 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11839 * program-state.cc (sm_state_map::clone_with_remapping): Copy
11841 (selftest::test_program_state_merging_2): New selftest.
11842 (selftest::analyzer_program_state_cc_tests): Call it.
11844 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11846 * checker-path.h (checker_path::get_checker_event): New function.
11847 (checker_path): Add DISABLE_COPY_AND_ASSIGN; make fields private.
11848 * diagnostic-manager.cc
11849 (diagnostic_manager::prune_for_sm_diagnostic): Replace direct
11850 access to checker_path::m_events with accessor functions. Fix
11852 (diagnostic_manager::prune_interproc_events): Replace direct
11853 access to checker_path::m_events with accessor functions.
11854 (diagnostic_manager::finish_pruning): Likewise.
11856 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11858 * checker-path.h (checker_event::clone): Delete vfunc decl.
11859 (debug_event::clone): Delete vfunc impl.
11860 (custom_event::clone): Delete vfunc impl.
11861 (statement_event::clone): Delete vfunc impl.
11862 (function_entry_event::clone): Delete vfunc impl.
11863 (state_change_event::clone): Delete vfunc impl.
11864 (start_cfg_edge_event::clone): Delete vfunc impl.
11865 (end_cfg_edge_event::clone): Delete vfunc impl.
11866 (call_event::clone): Delete vfunc impl.
11867 (return_event::clone): Delete vfunc impl.
11868 (setjmp_event::clone): Delete vfunc impl.
11869 (rewind_from_longjmp_event::clone): Delete vfunc impl.
11870 (rewind_to_setjmp_event::clone): Delete vfunc impl.
11871 (warning_event::clone): Delete vfunc impl.
11873 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11875 * supergraph.cc (supernode::dump_dot): Ensure that the TABLE
11876 element has at least one TR.
11878 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11881 * engine.cc (leak_stmt_finder::find_stmt): Use get_pure_location
11882 when comparing against UNKNOWN_LOCATION.
11883 (stmt_requires_new_enode_p): Likewise.
11884 (exploded_graph::dump_exploded_nodes): Likewise.
11885 * supergraph.cc (supernode::get_start_location): Likewise.
11886 (supernode::get_end_location): Likewise.
11888 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11891 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
11892 selftest::analyzer_sm_file_cc_tests.
11893 * analyzer-selftests.h (selftest::analyzer_sm_file_cc_tests): New
11895 * sm-file.cc: Include "analyzer/function-set.h" and
11896 "analyzer/analyzer-selftests.h".
11897 (get_file_using_fns): New function.
11898 (is_file_using_fn_p): New function.
11899 (fileptr_state_machine::on_stmt): Return true for known functions.
11900 (selftest::analyzer_sm_file_cc_tests): New function.
11902 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11904 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
11905 selftest::analyzer_sm_signal_cc_tests.
11906 * analyzer-selftests.h (selftest::analyzer_sm_signal_cc_tests):
11908 * sm-signal.cc: Include "analyzer/function-set.h" and
11909 "analyzer/analyzer-selftests.h".
11910 (get_async_signal_unsafe_fns): New function.
11911 (signal_unsafe_p): Reimplement in terms of the above.
11912 (selftest::analyzer_sm_signal_cc_tests): New function.
11914 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11916 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
11917 selftest::analyzer_function_set_cc_tests.
11918 * analyzer-selftests.h (selftest::analyzer_function_set_cc_tests):
11920 * function-set.cc: New file.
11921 * function-set.h: New file.
11923 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11925 * analyzer.h (fndecl_has_gimple_body_p): New decl.
11926 * engine.cc (impl_region_model_context::on_unknown_change): New
11928 (fndecl_has_gimple_body_p): Make non-static.
11929 (exploded_node::on_stmt): Treat __analyzer_dump_exploded_nodes as
11930 known. Track whether we have a call with unknown side-effects and
11931 pass it to on_call_post.
11932 * exploded-graph.h (impl_region_model_context::on_unknown_change):
11934 * program-state.cc (sm_state_map::on_unknown_change): New function.
11935 * program-state.h (sm_state_map::on_unknown_change): New decl.
11936 * region-model.cc: Include "bitmap.h".
11937 (region_model::on_call_pre): Return a bool, capturing whether the
11938 call has unknown side effects.
11939 (region_model::on_call_post): Add arg "bool unknown_side_effects"
11940 and if true, call handle_unrecognized_call.
11941 (class reachable_regions): New class.
11942 (region_model::handle_unrecognized_call): New function.
11943 * region-model.h (region_model::on_call_pre): Return a bool.
11944 (region_model::on_call_post): Add arg "bool unknown_side_effects".
11945 (region_model::handle_unrecognized_call): New decl.
11946 (region_model_context::on_unknown_change): New vfunc.
11947 (test_region_model_context::on_unknown_change): New function.
11949 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11951 * diagnostic-manager.cc (saved_diagnostic::operator==): Move here
11952 from header. Replace pointer equality test on m_var with call to
11953 pending_diagnostic::same_tree_p.
11954 * diagnostic-manager.h (saved_diagnostic::operator==): Move to
11955 diagnostic-manager.cc.
11956 * pending-diagnostic.cc (pending_diagnostic::same_tree_p): New.
11957 * pending-diagnostic.h (pending_diagnostic::same_tree_p): New.
11958 * sm-file.cc (file_diagnostic::subclass_equal_p): Replace pointer
11959 equality on m_arg with call to pending_diagnostic::same_tree_p.
11960 * sm-malloc.cc (malloc_diagnostic::subclass_equal_p): Likewise.
11961 (possible_null_arg::subclass_equal_p): Likewise.
11962 (null_arg::subclass_equal_p): Likewise.
11963 (free_of_non_heap::subclass_equal_p): Likewise.
11964 * sm-pattern-test.cc (pattern_match::operator==): Likewise.
11965 * sm-sensitive.cc (exposure_through_output_file::operator==):
11967 * sm-taint.cc (tainted_array_index::operator==): Likewise.
11969 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11971 * diagnostic-manager.cc (dedupe_winners::add): Add logging
11972 of deduplication decisions made.
11974 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11976 * ChangeLog: New file.
11977 * analyzer-selftests.cc: New file.
11978 * analyzer-selftests.h: New file.
11979 * analyzer.opt: New file.
11980 * analysis-plan.cc: New file.
11981 * analysis-plan.h: New file.
11982 * analyzer-logging.cc: New file.
11983 * analyzer-logging.h: New file.
11984 * analyzer-pass.cc: New file.
11985 * analyzer.cc: New file.
11986 * analyzer.h: New file.
11987 * call-string.cc: New file.
11988 * call-string.h: New file.
11989 * checker-path.cc: New file.
11990 * checker-path.h: New file.
11991 * constraint-manager.cc: New file.
11992 * constraint-manager.h: New file.
11993 * diagnostic-manager.cc: New file.
11994 * diagnostic-manager.h: New file.
11995 * engine.cc: New file.
11996 * engine.h: New file.
11997 * exploded-graph.h: New file.
11998 * pending-diagnostic.cc: New file.
11999 * pending-diagnostic.h: New file.
12000 * program-point.cc: New file.
12001 * program-point.h: New file.
12002 * program-state.cc: New file.
12003 * program-state.h: New file.
12004 * region-model.cc: New file.
12005 * region-model.h: New file.
12006 * sm-file.cc: New file.
12007 * sm-malloc.cc: New file.
12008 * sm-malloc.dot: New file.
12009 * sm-pattern-test.cc: New file.
12010 * sm-sensitive.cc: New file.
12011 * sm-signal.cc: New file.
12012 * sm-taint.cc: New file.
12015 * state-purge.cc: New file.
12016 * state-purge.h: New file.
12017 * supergraph.cc: New file.
12018 * supergraph.h: New file.
12020 2019-12-13 David Malcolm <dmalcolm@redhat.com>
12025 Copyright (C) 2019-2024 Free Software Foundation, Inc.
12027 Copying and distribution of this file, with or without modification,
12028 are permitted in any medium without royalty provided the copyright
12029 notice and this notice are preserved.