2 * sparse/smatch_implied.c
4 * Copyright (C) 2008 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
11 * Imagine we have this code:
19 * if (foo == 1) // <-- point #3
20 * bar->baz; // <-- point #4
22 * Currently (Oct 2008) in smatch when we merge bar states
23 * null and nonnull, at point #2, the state becomes undefined.
24 * As a result we get an error at point #3.
26 * The idea behind "implied state pools" is to fix that.
28 * The implied pools get created in merge_slist(). Whatever
29 * is unique to one slist being merged gets put into a pool.
31 * If we set a state that removes it from all pools.
33 * When we come to an if statement where "foo" has some pools
34 * associated we take all the pools where "foo == 1" and keep
35 * all the states that are consistent across those pools.
37 * The point of doing this is to turn an undefined state into
38 * a defined state. This hopefully gets rid of some false positives.
39 * What it doesn't do is find new errors that were
42 * There are quite a few implementation details I haven't figured
43 * out. How do you create implied state pools inside a
44 * complex condition? How do you determine what is implied
45 * from a complex condition? The initial patch is extremely rudimentary...
49 #include "smatch_slist.h"
55 * What are the implications if (foo == num) ...
58 static struct state_list
*get_eq_neq_filtered(struct sm_state
*sm_state
,
61 struct state_list
*list
;
62 struct smatch_state
*s
;
63 struct state_list
*ret
= NULL
;
65 FOR_EACH_PTR(sm_state
->pools
, list
) {
66 s
= get_state_slist(list
, sm_state
->name
, sm_state
->owner
,
68 if (s
== &undefined
) {
72 if (s
->data
&& ((eq_neq
== EQUALS
&& *(int *)s
->data
== num
) ||
73 (eq_neq
== NOTEQUALS
&& *(int *)s
->data
!= num
))) {
75 ret
= clone_states_in_pool(list
, __get_cur_slist());
77 filter(&ret
, list
, __get_cur_slist());
79 } END_FOR_EACH_PTR(list
);
84 * This condition hook is very connected to smatch_extra.c.
87 void __implied_states_hook(struct expression
*expr
)
91 struct sm_state
*state
;
92 struct state_list
*implied_true
;
93 struct state_list
*implied_false
;
95 name
= get_variable_from_expr(expr
, &sym
);
98 state
= get_sm_state(name
, SMATCH_EXTRA
, sym
);
103 implied_true
= get_eq_neq_filtered(state
, NOTEQUALS
, 0);
104 implied_false
= get_eq_neq_filtered(state
, EQUALS
, 0);
106 printf("Setting the following implied states for the true path.\n");
107 __print_slist(implied_true
);
110 /* FIXME. We lose the ->pools by doing this. */
111 FOR_EACH_PTR(implied_true
, state
) {
112 set_true_false_states(state
->name
, state
->owner
, state
->sym
,
114 } END_FOR_EACH_PTR(state
);
117 printf("Setting the following implied states for the false path.\n");
118 __print_slist(implied_false
);
121 FOR_EACH_PTR(implied_false
, state
) {
122 set_true_false_states(state
->name
, state
->owner
, state
->sym
,
124 } END_FOR_EACH_PTR(state
);
129 void register_implications(int id
)
131 add_hook(&__implied_states_hook
, CONDITION_HOOK
);