| blob | b43a7f3e2b353cfb150df8ff25c37c1835c00c5d |
1 2021-11-04 David Malcolm <dmalcolm@redhat.com>
3 * program-state.cc (sm_state_map::dump): Use default_tree_printer
4 as format decoder.
6 2021-09-16 Maxim Blinov <maxim.blinov@embecosm.com>
8 PR bootstrap/102242
9 * engine.cc (INCLUDE_UNIQUE_PTR): Define.
11 2021-09-08 David Malcolm <dmalcolm@redhat.com>
13 PR analyzer/102225
14 * analyzer.h (compat_types_p): New decl.
15 * constraint-manager.cc
16 (constraint_manager::get_or_add_equiv_class): Guard against NULL
17 type when checking for pointer types.
18 * region-model-impl-calls.cc (region_model::impl_call_realloc):
19 Guard against NULL lhs type/region. Guard against the size value
20 not being of a compatible type for dynamic extents.
21 * region-model.cc (compat_types_p): Make non-static.
23 2021-08-30 David Malcolm <dmalcolm@redhat.com>
25 PR analyzer/99260
26 * analyzer.h (class custom_edge_info): New class, adapted from
27 exploded_edge::custom_info_t. Make member functions const.
28 Make update_model return bool, converting edge param from
29 reference to a pointer, and adding a ctxt param.
30 (class path_context): New class.
31 * call-info.cc: New file.
32 * call-info.h: New file.
33 * engine.cc: Include "analyzer/call-info.h" and <memory>.
34 (impl_region_model_context::impl_region_model_context): Update for
35 new m_path_ctxt field.
36 (impl_region_model_context::bifurcate): New.
37 (impl_region_model_context::terminate_path): New.
38 (impl_region_model_context::get_malloc_map): New.
39 (impl_sm_context::impl_sm_context): Update for new m_path_ctxt
40 field.
41 (impl_sm_context::get_fndecl_for_call): Likewise.
42 (impl_sm_context::set_next_state): Likewise.
43 (impl_sm_context::warn): Likewise.
44 (impl_sm_context::is_zero_assignment): Likewise.
45 (impl_sm_context::get_path_context): New.
46 (impl_sm_context::m_path_ctxt): New.
47 (impl_region_model_context::on_condition): Update for new
48 path_ctxt param. Handle m_enode_for_diag being NULL.
49 (impl_region_model_context::on_phi): Update for new path_ctxt
50 param.
51 (exploded_node::on_stmt): Add path_ctxt param, updating ctor calls
52 to use it as necessary. Use it to bail out after sm-handling,
53 if needed.
54 (exploded_node::detect_leaks): Update for new path_ctxt param.
55 (dynamic_call_info_t::update_model): Update for conversion of
56 exploded_edge::custom_info_t to custom_edge_info.
57 (dynamic_call_info_t::add_events_to_path): Likewise.
58 (rewind_info_t::update_model): Likewise.
59 (rewind_info_t::add_events_to_path): Likewise.
60 (exploded_edge::exploded_edge): Likewise.
61 (exploded_graph::add_edge): Likewise.
62 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
63 Update for new path_ctxt param.
64 (class impl_path_context): New.
65 (exploded_graph::process_node): Update for new path_ctxt param.
66 Create an impl_path_context and pass it to exploded_node::on_stmt.
67 Use it to terminate iterating stmts if terminate_path is called
68 on it. After processing a run of stmts, query path_ctxt to
69 potentially terminate the analysis path, and/or to "bifurcate" the
70 analysis into multiple additional paths.
71 (feasibility_state::maybe_update_for_edge): Update for new
72 update_model ctxt param.
73 * exploded-graph.h
74 (impl_region_model_context::impl_region_model_context): Add
75 path_ctxt param.
76 (impl_region_model_context::bifurcate): New.
77 (impl_region_model_context::terminate_path): New
78 (impl_region_model_context::get_ext_state): New.
79 (impl_region_model_context::get_malloc_map): New.
80 (impl_region_model_context::m_path_ctxt): New field.
81 (exploded_node::on_stmt): Add path_ctxt param.
82 (class exploded_edge::custom_info_t): Move to analyzer.h, renaming
83 to custom_edge_info, and making the changes as noted in analyzer.h
84 above.
85 (exploded_edge::exploded_edge): Update for these changes to
86 exploded_edge::custom_info_t.
87 (exploded_edge::m_custom_info): Likewise.
88 (class dynamic_call_info_t): Likewise.
89 (class rewind_info_t): Likewise.
90 (exploded_graph::add_edge): Likewise.
91 * program-state.cc (program_state::on_edge): Update for new
92 path_ctxt param.
93 (program_state::push_call): Likewise.
94 (program_state::returning_call): Likewise.
95 (program_state::prune_for_point): Likewise.
96 * region-model-impl-calls.cc: Include "analyzer/call-info.h".
97 (call_details::get_fndecl_for_call): New.
98 (region_model::impl_call_realloc): Reimplement.
99 * region-model.cc (region_model::on_call_pre): Move call to
100 impl_call_realloc to...
101 (region_model::on_call_post): ...here. Consolidate creation
102 of call_details instance.
103 (noop_region_model_context::bifurcate): New.
104 (noop_region_model_context::terminate_path): New.
105 * region-model.h (call_details::get_call_stmt): New.
106 (call_details::get_fndecl_for_call): New.
107 (region_model::on_realloc_with_move): New.
108 (region_model_context::bifurcate): New.
109 (region_model_context::terminate_path): New.
110 (region_model_context::get_ext_state): New.
111 (region_model_context::get_malloc_map): New.
112 (noop_region_model_context::bifurcate): New.
113 (noop_region_model_context::terminate_path): New.
114 (noop_region_model_context::get_ext_state): New.
115 (noop_region_model_context::get_malloc_map): New.
116 * sm-malloc.cc: Include "analyzer/program-state.h".
117 (malloc_state_machine::on_realloc_call): Reimplement.
118 (malloc_state_machine::on_realloc_with_move): New.
119 (region_model::on_realloc_with_move): New.
120 * sm-signal.cc (class signal_delivery_edge_info_t): Update for
121 conversion from exploded_edge::custom_info_t to custom_edge_info.
122 * sm.h (sm_context::get_path_context): New.
123 * svalue.cc (svalue::maybe_get_constant): Call
124 unwrap_any_unmergeable.
126 2021-08-25 Ankur Saini <arsenic@sourceware.org>
128 PR analyzer/101980
129 * engine.cc (exploded_graph::maybe_create_dynamic_call): Don't create
130 calls if max recursion limit is reached.
132 2021-08-23 David Malcolm <dmalcolm@redhat.com>
134 * analyzer.h (struct rejected_constraint): Convert to...
135 (class rejected_constraint): ...this.
136 (class bounded_ranges): New forward decl.
137 (class bounded_ranges_manager): New forward decl.
138 * constraint-manager.cc: Include "analyzer/analyzer-logging.h" and
139 "tree-pretty-print.h".
140 (can_plus_one_p): New.
141 (plus_one): New.
142 (can_minus_one_p): New.
143 (minus_one): New.
144 (bounded_range::bounded_range): New.
145 (dump_cst): New.
146 (bounded_range::dump_to_pp): New.
147 (bounded_range::dump): New.
148 (bounded_range::to_json): New.
149 (bounded_range::set_json_attr): New.
150 (bounded_range::contains_p): New.
151 (bounded_range::intersects_p): New.
152 (bounded_range::operator==): New.
153 (bounded_range::cmp): New.
154 (bounded_ranges::bounded_ranges): New.
155 (bounded_ranges::bounded_ranges): New.
156 (bounded_ranges::bounded_ranges): New.
157 (bounded_ranges::canonicalize): New.
158 (bounded_ranges::validate): New.
159 (bounded_ranges::operator==): New.
160 (bounded_ranges::dump_to_pp): New.
161 (bounded_ranges::dump): New.
162 (bounded_ranges::to_json): New.
163 (bounded_ranges::eval_condition): New.
164 (bounded_ranges::contain_p): New.
165 (bounded_ranges::cmp): New.
166 (bounded_ranges_manager::~bounded_ranges_manager): New.
167 (bounded_ranges_manager::get_or_create_empty): New.
168 (bounded_ranges_manager::get_or_create_point): New.
169 (bounded_ranges_manager::get_or_create_range): New.
170 (bounded_ranges_manager::get_or_create_union): New.
171 (bounded_ranges_manager::get_or_create_intersection): New.
172 (bounded_ranges_manager::get_or_create_inverse): New.
173 (bounded_ranges_manager::consolidate): New.
174 (bounded_ranges_manager::get_or_create_ranges_for_switch): New.
175 (bounded_ranges_manager::create_ranges_for_switch): New.
176 (bounded_ranges_manager::make_case_label_ranges): New.
177 (bounded_ranges_manager::log_stats): New.
178 (bounded_ranges_constraint::print): New.
179 (bounded_ranges_constraint::to_json): New.
180 (bounded_ranges_constraint::operator==): New.
181 (bounded_ranges_constraint::add_to_hash): New.
182 (constraint_manager::constraint_manager): Update for new field
183 m_bounded_ranges_constraints.
184 (constraint_manager::operator=): Likewise.
185 (constraint_manager::hash): Likewise.
186 (constraint_manager::operator==): Likewise.
187 (constraint_manager::print): Likewise.
188 (constraint_manager::dump_to_pp): Likewise.
189 (constraint_manager::to_json): Likewise.
190 (constraint_manager::add_unknown_constraint): Update the lhs_ec_id
191 if necessary in existing constraints when combining equivalence
192 classes. Add similar code for handling
193 m_bounded_ranges_constraints.
194 (constraint_manager::add_constraint_internal): Add comment.
195 (constraint_manager::add_bounded_ranges): New.
196 (constraint_manager::eval_condition): Use new field
197 m_bounded_ranges_constraints.
198 (constraint_manager::purge): Update bounded_ranges_constraint
199 instances.
200 (constraint_manager::canonicalize): Update for new field.
201 (merger_fact_visitor::on_ranges): New.
202 (constraint_manager::for_each_fact): Use new field
203 m_bounded_ranges_constraints.
204 (constraint_manager::validate): Fix off-by-one error needed due
205 to bug fixed above in add_unknown_constraint. Validate the EC IDs
206 in m_bounded_ranges_constraints.
207 (constraint_manager::get_range_manager): New.
208 (selftest::assert_dump_bounded_range_eq): New.
209 (ASSERT_DUMP_BOUNDED_RANGE_EQ): New.
210 (selftest::test_bounded_range): New.
211 (selftest::assert_dump_bounded_ranges_eq): New.
212 (ASSERT_DUMP_BOUNDED_RANGES_EQ): New.
213 (selftest::test_bounded_ranges): New.
214 (selftest::run_constraint_manager_tests): Call the new selftests.
215 * constraint-manager.h (struct bounded_range): New.
216 (struct bounded_ranges): New.
217 (template <> struct default_hash_traits<bounded_ranges::key_t>): New.
218 (class bounded_ranges_manager): New.
219 (fact_visitor::on_ranges): New pure virtual function.
220 (class bounded_ranges_constraint): New.
221 (constraint_manager::add_bounded_ranges): New decl.
222 (constraint_manager::get_range_manager): New decl.
223 (constraint_manager::m_bounded_ranges_constraints): New field.
224 * diagnostic-manager.cc (epath_finder::process_worklist_item):
225 Transfer ownership of rc to add_feasibility_problem.
226 * engine.cc (feasibility_problem::dump_to_pp): Use get_model.
227 * feasible-graph.cc (infeasible_node::dump_dot): Update for
228 conversion of m_rc to a pointer.
229 (feasible_graph::add_feasibility_problem): Pass RC by pointer and
230 take ownership.
231 * feasible-graph.h (infeasible_node::infeasible_node): Pass RC by
232 pointer and take ownership.
233 (infeasible_node::~infeasible_node): New.
234 (infeasible_node::m_rc): Convert to a pointer.
235 (feasible_graph::add_feasibility_problem): Pass RC by pointer and
236 take ownership.
237 * region-model-manager.cc: Include
238 "analyzer/constraint-manager.h".
239 (region_model_manager::region_model_manager): Initializer new
240 field m_range_mgr.
241 (region_model_manager::~region_model_manager): Delete it.
242 (region_model_manager::log_stats): Call log_stats on it.
243 * region-model.cc (region_model::add_constraint): Use new subclass
244 rejected_op_constraint.
245 (region_model::apply_constraints_for_gswitch): Reimplement using
246 bounded_ranges_manager.
247 (rejected_constraint::dump_to_pp): Convert to...
248 (rejected_op_constraint::dump_to_pp): ...this.
249 (rejected_ranges_constraint::dump_to_pp): New.
250 * region-model.h (struct purge_stats): Add field
251 m_num_bounded_ranges_constraints.
252 (region_model_manager::get_range_manager): New.
253 (region_model_manager::m_range_mgr): New.
254 (region_model::get_range_manager): New.
255 (struct rejected_constraint): Split into...
256 (class rejected_constraint):...this new abstract base class,
257 and...
258 (class rejected_op_constraint): ...this new concrete subclass.
259 (class rejected_ranges_constraint): New.
260 * supergraph.cc: Include "tree-cfg.h".
261 (supergraph::supergraph): Drop idx param from add_cfg_edge.
262 (supergraph::add_cfg_edge): Drop idx param.
263 (switch_cfg_superedge::switch_cfg_superedge): Move here from
264 header. Populate m_case_labels with all cases which go to DST.
265 (switch_cfg_superedge::dump_label_to_pp): Reimplement to use
266 m_case_labels.
267 (switch_cfg_superedge::get_case_label): Delete.
268 * supergraph.h (supergraphadd_cfg_edge): Drop "idx" param.
269 (switch_cfg_superedge::switch_cfg_superedge): Drop idx param and
270 move implementation to supergraph.cc.
271 (switch_cfg_superedge::get_case_label): Delete.
272 (switch_cfg_superedge::get_case_labels): New.
273 (switch_cfg_superedge::m_idx): Delete.
274 (switch_cfg_superedge::m_case_labels): New field.
276 2021-08-23 David Malcolm <dmalcolm@redhat.com>
278 PR analyzer/101875
279 * sm-file.cc (file_diagnostic::describe_state_change): Handle
280 change.m_expr being NULL.
282 2021-08-23 David Malcolm <dmalcolm@redhat.com>
284 PR analyzer/101837
285 * analyzer.cc (maybe_reconstruct_from_def_stmt): Bail if fn is
286 NULL, and assert that it's non-NULL before passing it to
287 build_call_array_loc.
289 2021-08-23 David Malcolm <dmalcolm@redhat.com>
291 PR analyzer/101962
292 * region-model.cc (region_model::eval_condition_without_cm):
293 Refactor comparison against zero, adding a check for
294 POINTER_PLUS_EXPR of non-NULL.
296 2021-08-23 David Malcolm <dmalcolm@redhat.com>
298 * store.cc (bit_range::intersects_p): New overload.
299 (bit_range::operator-): New.
300 (binding_cluster::maybe_get_compound_binding): Handle the partial
301 overlap case.
302 (selftest::test_bit_range_intersects_p): Add test coverage for
303 new overload of bit_range::intersects_p.
304 * store.h (bit_range::intersects_p): New overload.
305 (bit_range::operator-): New.
307 2021-08-23 Ankur Saini <arsenic@sourceware.org>
309 PR analyzer/102020
310 * diagnostic-manager.cc
311 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Fix typo.
313 2021-08-21 Ankur Saini <arsenic@sourceware.org>
315 PR analyzer/101980
316 * diagnostic-manager.cc
317 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Use
318 caller_model only when the supergraph_edge doesn't exixt.
319 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
320 Likewise.
321 * engine.cc (exploded_graph::create_dynamic_call): Rename to...
322 (exploded_graph::maybe_create_dynamic_call): ...this, return call
323 creation status.
324 (exploded_graph::process_node): Handle calls which were not dynamically
325 discovered.
326 * exploded-graph.h (exploded_graph::create_dynamic_call): Rename to...
327 (exploded_graph::maybe_create_dynamic_call): ...this.
328 * region-model.cc (region_model::update_for_gcall): New param, use it
329 to push call to frame.
330 (region_model::update_for_call_superedge): Pass callee function to
331 update_for_gcall.
332 * region-model.h (region_model::update_for_gcall): New param.
334 2021-08-18 Ankur Saini <arsenic@sourceware.org>
336 PR analyzer/97114
337 * region-model.cc (region_model::get_rvalue_1): Add case for
338 OBJ_TYPE_REF.
340 2021-08-18 Ankur Saini <arsenic@sourceware.org>
342 PR analyzer/100546
343 * analysis-plan.cc (analysis_plan::use_summary_p): Don't use call
344 summaries if there is no callgraph edge
345 * checker-path.cc (call_event::call_event): Handle calls events that
346 are not represented by a supergraph call edge
347 (return_event::return_event): Likewise.
348 (call_event::get_desc): Work with new call_event structure.
349 (return_event::get_desc): Likeise.
350 * checker-path.h (call_event::m_src_snode): New field.
351 (call_event::m_dest_snode): New field.
352 (return_event::m_src_snode): New field.
353 (return_event::m_dest_snode): New field.
354 * diagnostic-manager.cc
355 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>:
356 Refactor to work with edges without callgraph edge.
357 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
358 Likewise.
359 * engine.cc (dynamic_call_info_t::update_model): New function.
360 (dynamic_call_info_t::add_events_to_path): New function.
361 (exploded_graph::create_dynamic_call): New function.
362 (exploded_graph::process_node): Work with dynamically discovered calls.
363 * exploded-graph.h (class dynamic_call_info_t): New class.
364 (exploded_graph::create_dynamic_call): New decl.
365 * program-point.cc (program_point::push_to_call_stack): New function.
366 (program_point::pop_from_call_stack): New function.
367 * program-point.h (program_point::push_to_call_stack): New decl.
368 (program_point::pop_from_call_stack): New decl.
369 * program-state.cc (program_state::push_call): New function.
370 (program_state::returning_call): New function.
371 * program-state.h (program_state::push_call): New decl.
372 (program_state::returning_call): New decl.
373 * region-model.cc (region_model::update_for_gcall) New function.
374 (region_model::update_for_return_gcall): New function.
375 (egion_model::update_for_call_superedge): Get the underlying gcall and
376 update for gcall.
377 (region_model::update_for_return_superedge): Likewise.
378 * region-model.h (region_model::update_for_gcall): New decl.
379 (region_model::update_for_return_gcall): New decl.
380 * state-purge.cc (state_purge_per_ssa_name::process_point): Update to
381 work with calls without underlying cgraph edge.
382 * supergraph.cc (supergraph::supergraph) Split snodes at every callsite.
383 * supergraph.h (supernode::get_returning_call) New accessor.
385 2021-08-04 David Malcolm <dmalcolm@redhat.com>
387 PR analyzer/101570
388 * analyzer.cc (maybe_reconstruct_from_def_stmt): Add GIMPLE_ASM
389 case.
390 * analyzer.h (class asm_output_svalue): New forward decl.
391 (class reachable_regions): New forward decl.
392 * complexity.cc (complexity::from_vec_svalue): New.
393 * complexity.h (complexity::from_vec_svalue): New decl.
394 * engine.cc (feasibility_state::maybe_update_for_edge): Handle
395 asm stmts by calling on_asm_stmt.
396 * region-model-asm.cc: New file.
397 * region-model-manager.cc
398 (region_model_manager::maybe_fold_asm_output_svalue): New.
399 (region_model_manager::get_or_create_asm_output_svalue): New.
400 (region_model_manager::log_stats): Log m_asm_output_values_map.
401 * region-model.cc (region_model::on_stmt_pre): Handle GIMPLE_ASM.
402 * region-model.h (visitor::visit_asm_output_svalue): New.
403 (region_model_manager::get_or_create_asm_output_svalue): New decl.
404 (region_model_manager::maybe_fold_asm_output_svalue): New decl.
405 (region_model_manager::asm_output_values_map_t): New typedef.
406 (region_model_manager::m_asm_output_values_map): New field.
407 (region_model::on_asm_stmt): New.
408 * store.cc (binding_cluster::on_asm): New.
409 * store.h (binding_cluster::on_asm): New decl.
410 * svalue.cc (svalue::cmp_ptr): Handle SK_ASM_OUTPUT.
411 (asm_output_svalue::dump_to_pp): New.
412 (asm_output_svalue::dump_input): New.
413 (asm_output_svalue::input_idx_to_asm_idx): New.
414 (asm_output_svalue::accept): New.
415 * svalue.h (enum svalue_kind): Add SK_ASM_OUTPUT.
416 (svalue::dyn_cast_asm_output_svalue): New.
417 (class asm_output_svalue): New.
418 (is_a_helper <const asm_output_svalue *>::test): New.
419 (struct default_hash_traits<asm_output_svalue::key_t>): New.
421 2021-08-03 Jakub Jelinek <jakub@redhat.com>
423 PR analyzer/101721
424 * sm-malloc.cc (known_allocator_p): Only check DECL_FUNCTION_CODE on
425 BUILT_IN_NORMAL builtins.
427 2021-07-29 Ankur Saini <arsenic@sourceware.org>
429 * call-string.cc (call_string::element_t::operator==): New operator.
430 (call_String::element_t::operator!=): New operator.
431 (call_string::element_t::get_caller_function): New function.
432 (call_string::element_t::get_callee_function): New function.
433 (call_string::call_string): Refactor to Initialise m_elements.
434 (call_string::operator=): Refactor to work with m_elements.
435 (call_string::operator==): Likewise.
436 (call_string::to_json): Likewise.
437 (call_string::hash): Refactor to hash e.m_caller.
438 (call_string::push_call): Refactor to work with m_elements.
439 (call_string::push_call): New overload to push call via supernodes.
440 (call_string::pop): Refactor to work with m_elements.
441 (call_string::calc_recursion_depth): Likewise.
442 (call_string::cmp): Likewise.
443 (call_string::validate): Likewise.
444 (call_string::operator[]): Likewise.
445 * call-string.h (class supernode): New forward decl.
446 (struct call_string::element_t): New struct.
447 (call_string::call_string): Refactor to initialise m_elements.
448 (call_string::bool empty_p): Refactor to work with m_elements.
449 (call_string::get_callee_node): New decl.
450 (call_string::get_caller_node): New decl.
451 (m_elements): Replaces m_return_edges.
452 * program-point.cc (program_point::get_function_at_depth): Refactor to
453 work with new call-string format.
454 (program_point::validate): Likewise.
455 (program_point::on_edge): Likewise.
457 2021-07-28 David Malcolm <dmalcolm@redhat.com>
459 * region-model.cc (region_model::on_call_pre): Treat
460 IFN_UBSAN_BOUNDS, BUILT_IN_STACK_SAVE, and BUILT_IN_STACK_RESTORE
461 as no-ops, rather than handling them as unknown functions.
463 2021-07-28 David Malcolm <dmalcolm@redhat.com>
465 * region-model-impl-calls.cc (region_model::impl_call_alloca):
466 Drop redundant return value.
467 (region_model::impl_call_builtin_expect): Likewise.
468 (region_model::impl_call_calloc): Likewise.
469 (region_model::impl_call_malloc): Likewise.
470 (region_model::impl_call_memset): Likewise.
471 (region_model::impl_call_operator_new): Likewise.
472 (region_model::impl_call_operator_delete): Likewise.
473 (region_model::impl_call_strlen): Likewise.
474 * region-model.cc (region_model::on_call_pre): Fix return value of
475 known functions that don't have unknown side-effects.
476 * region-model.h (region_model::impl_call_alloca): Drop redundant
477 return value.
478 (region_model::impl_call_builtin_expect): Likewise.
479 (region_model::impl_call_calloc): Likewise.
480 (region_model::impl_call_malloc): Likewise.
481 (region_model::impl_call_memset): Likewise.
482 (region_model::impl_call_strlen): Likewise.
483 (region_model::impl_call_operator_new): Likewise.
484 (region_model::impl_call_operator_delete): Likewise.
486 2021-07-28 Siddhesh Poyarekar <siddhesh@gotplt.org>
488 * analyzer.cc (is_named_call_p, is_std_named_call_p): Make
489 first argument a const_tree.
490 * analyzer.h (is_named_call_p, -s_std_named_call_p): Likewise.
491 * sm-malloc.cc (known_allocator_p): New function.
492 (malloc_state_machine::on_stmt): Use it.
494 2021-07-28 Siddhesh Poyarekar <siddhesh@gotplt.org>
496 * sm-malloc.cc
497 (malloc_state_machine::get_or_create_deallocator): Recognize
498 __builtin_free.
500 2021-07-26 David Malcolm <dmalcolm@redhat.com>
502 * region-model.cc (region_model::on_call_pre): Always set conjured
503 LHS, not just for SSA names.
505 2021-07-23 David Malcolm <dmalcolm@redhat.com>
507 * diagnostic-manager.cc
508 (class auto_disable_complexity_checks): New.
509 (epath_finder::explore_feasible_paths): Use it to disable
510 complexity checks whilst processing the worklist.
511 * region-model-manager.cc
512 (region_model_manager::region_model_manager): Initialize
513 m_check_complexity.
514 (region_model_manager::reject_if_too_complex): Bail if
515 m_check_complexity is false.
516 * region-model.h
517 (region_model_manager::enable_complexity_check): New.
518 (region_model_manager::disable_complexity_check): New.
519 (region_model_manager::m_check_complexity): New.
521 2021-07-21 David Malcolm <dmalcolm@redhat.com>
523 PR analyzer/101547
524 * sm-file.cc (file_leak::emit): Handle m_arg being NULL.
525 (file_leak::describe_final_event): Handle ev.m_expr being NULL.
527 2021-07-21 David Malcolm <dmalcolm@redhat.com>
529 PR analyzer/101522
530 * store.cc (binding_cluster::purge_state_involving): Don't change
531 m_map whilst iterating through it.
533 2021-07-21 David Malcolm <dmalcolm@redhat.com>
535 * region-model.cc (region_model::handle_phi): Add "old_state"
536 param and use it.
537 (region_model::update_for_phis): Update so that all of the phi
538 stmts are effectively handled simultaneously, rather than in
539 order.
540 * region-model.h (region_model::handle_phi): Add "old_state"
541 param.
542 * state-purge.cc (self_referential_phi_p): Replace with...
543 (name_used_by_phis_p): ...this new function.
544 (state_purge_per_ssa_name::process_point): Update to use the
545 above, so that all phi stmts at a basic block are effectively
546 considered simultaneously, and only consider the phi arguments for
547 the pertinent in-edge.
548 * supergraph.cc (cfg_superedge::get_phi_arg_idx): New.
549 (cfg_superedge::get_phi_arg): Use the above.
550 * supergraph.h (cfg_superedge::get_phi_arg_idx): New decl.
552 2021-07-21 David Malcolm <dmalcolm@redhat.com>
554 * state-purge.cc (state_purge_annotator::add_node_annotations):
555 Rather than erroneously always using the NULL in-edge, determine
556 each relevant in-edge, and print the appropriate data for each
557 in-edge. Use print_needed to print the data as comma-separated
558 lists of SSA names.
559 (print_vec_of_names): Add "within_table" param and use it.
560 (state_purge_annotator::add_stmt_annotations): Factor out
561 collation and printing code into...
562 (state_purge_annotator::print_needed): ...this new function.
563 * state-purge.h (state_purge_annotator::print_needed): New decl.
565 2021-07-21 David Malcolm <dmalcolm@redhat.com>
567 * program-point.cc (function_point::print): Show src BB index at
568 BEFORE_SUPERNODE.
570 2021-07-21 David Malcolm <dmalcolm@redhat.com>
572 * svalue.cc (infix_p): New.
573 (binop_svalue::dump_to_pp): Use it to print MIN_EXPR and MAX_EXPR
574 in prefix form, rather than infix.
576 2021-07-19 David Malcolm <dmalcolm@redhat.com>
578 PR analyzer/101503
579 * constraint-manager.cc (constraint_manager::add_constraint): Use
580 can_have_associated_state_p rather than testing for unknown.
581 (constraint_manager::get_or_add_equiv_class): Likewise.
582 * program-state.cc (sm_state_map::set_state): Likewise.
583 (sm_state_map::impl_set_state): Add assertion.
584 * region-model-manager.cc
585 (region_model_manager::maybe_fold_unaryop): Handle poisoned
586 values.
587 (region_model_manager::maybe_fold_binop): Move handling of unknown
588 values...
589 (region_model_manager::get_or_create_binop): ...to here, and
590 generalize to use can_have_associated_state_p.
591 (region_model_manager::maybe_fold_sub_svalue): Use
592 can_have_associated_state_p rather than testing for unknown.
593 (region_model_manager::maybe_fold_repeated_svalue): Use unknown
594 when the size or repeated value is "unknown"/"poisoned".
595 * region-model.cc (region_model::purge_state_involving): Reject
596 attempts to purge unknown/poisoned svalues, as these svalues
597 should not have state associated with them.
598 * svalue.cc (sub_svalue::sub_svalue): Assert that we're building
599 on top of an svalue with can_have_associated_state_p.
600 (repeated_svalue::repeated_svalue): Likewise.
601 (bits_within_svalue::bits_within_svalue): Likewise.
602 * svalue.h (svalue::can_have_associated_state_p): New.
603 (unknown_svalue::can_have_associated_state_p): New.
604 (poisoned_svalue::can_have_associated_state_p): New.
605 (unaryop_svalue::unaryop_svalue): Assert that we're building on
606 top of an svalue with can_have_associated_state_p.
607 (binop_svalue::binop_svalue): Likewise.
608 (widening_svalue::widening_svalue): Likewise.
610 2021-07-16 David Malcolm <dmalcolm@redhat.com>
612 * analyzer.h (enum access_direction): New.
613 * engine.cc (exploded_node::on_longjmp): Update for new param of
614 get_store_value.
615 * program-state.cc (program_state::prune_for_point): Likewise.
616 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
617 Replace call to check_for_writable_region with call to
618 check_region_for_write.
619 (region_model::impl_call_memset): Likewise.
620 (region_model::impl_call_strcpy): Likewise.
621 * region-model-reachability.cc (reachable_regions::add): Update
622 for new param of get_store_value.
623 * region-model.cc (region_model::get_rvalue_1): Likewise, also for
624 get_rvalue_for_bits.
625 (region_model::get_store_value): Add ctxt param and use it to call
626 check_region_for_read.
627 (region_model::get_rvalue_for_bits): Add ctxt param and use it to
628 call get_store_value.
629 (region_model::check_region_access): New.
630 (region_model::check_region_for_write): New.
631 (region_model::check_region_for_read): New.
632 (region_model::set_value): Update comment. Replace call to
633 check_for_writable_region with call to check_region_for_write.
634 * region-model.h (region_model::get_rvalue_for_bits): Add ctxt
635 param.
636 (region_model::get_store_value): Add ctxt param.
637 (region_model::check_region_access): New decl.
638 (region_model::check_region_for_write): New decl.
639 (region_model::check_region_for_read): New decl.
640 * region.cc (region_model::copy_region): Update call to
641 get_store_value.
642 * svalue.cc (initial_svalue::implicitly_live_p): Likewise.
644 2021-07-16 David Malcolm <dmalcolm@redhat.com>
646 * engine.cc (exploded_node::on_stmt_pre): Handle
647 __analyzer_dump_state.
648 * program-state.cc (extrinsic_state::get_sm_idx_by_name): New.
649 (program_state::impl_call_analyzer_dump_state): New.
650 * program-state.h (extrinsic_state::get_sm_idx_by_name): New decl.
651 (program_state::impl_call_analyzer_dump_state): New decl.
652 * region-model-impl-calls.cc
653 (call_details::get_arg_string_literal): New.
654 * region-model.h (call_details::get_arg_string_literal): New decl.
656 2021-07-16 David Malcolm <dmalcolm@redhat.com>
658 * program-state.cc (program_state::detect_leaks): Simplify using
659 svalue::maybe_get_region.
660 * region-model-impl-calls.cc (region_model::impl_call_fgets): Likewise.
661 (region_model::impl_call_fread): Likewise.
662 (region_model::impl_call_free): Likewise.
663 (region_model::impl_call_operator_delete): Likewise.
664 * region-model.cc (selftest::test_stack_frames): Likewise.
665 (selftest::test_state_merging): Likewise.
666 * svalue.cc (svalue::maybe_get_region): New.
667 * svalue.h (svalue::maybe_get_region): New decl.
669 2021-07-15 David Malcolm <dmalcolm@redhat.com>
671 * svalue.h (is_a_helper <placeholder_svalue *>::test): Make
672 param and template param const.
673 (is_a_helper <widening_svalue *>::test): Likewise.
674 (is_a_helper <compound_svalue *>::test): Likewise.
675 (is_a_helper <conjured_svalue *>::test): Likewise.
677 2021-07-15 David Malcolm <dmalcolm@redhat.com>
679 PR analyzer/95006
680 PR analyzer/94713
681 PR analyzer/94714
682 * analyzer.cc (maybe_reconstruct_from_def_stmt): Split out
683 GIMPLE_ASSIGN case into...
684 (get_diagnostic_tree_for_gassign_1): New.
685 (get_diagnostic_tree_for_gassign): New.
686 * analyzer.h (get_diagnostic_tree_for_gassign): New decl.
687 * analyzer.opt (Wanalyzer-write-to-string-literal): New.
688 * constraint-manager.cc (class svalue_purger): New.
689 (constraint_manager::purge_state_involving): New.
690 * constraint-manager.h
691 (constraint_manager::purge_state_involving): New.
692 * diagnostic-manager.cc (saved_diagnostic::supercedes_p): New.
693 (dedupe_winners::handle_interactions): New.
694 (diagnostic_manager::emit_saved_diagnostics): Call it.
695 * diagnostic-manager.h (saved_diagnostic::supercedes_p): New decl.
696 * engine.cc (impl_region_model_context::warn): Convert return type
697 to bool. Return false if the diagnostic isn't saved.
698 (impl_region_model_context::purge_state_involving): New.
699 (impl_sm_context::get_state): Use NULL ctxt when querying old
700 rvalue.
701 (impl_sm_context::set_next_state): Use new sval when querying old
702 state.
703 (class dump_path_diagnostic): Move to region-model.cc
704 (exploded_node::on_stmt): Move to on_stmt_pre and on_stmt_post.
705 Remove call to purge_state_involving.
706 (exploded_node::on_stmt_pre): New, based on the above. Move most
707 of it to region_model::on_stmt_pre.
708 (exploded_node::on_stmt_post): Likewise, moving to
709 region_model::on_stmt_post.
710 (class stale_jmp_buf): Fix parent class to use curiously recurring
711 template pattern.
712 (feasibility_state::maybe_update_for_edge): Call on_call_pre and
713 on_call_post on gcalls.
714 * exploded-graph.h (impl_region_model_context::warn): Return bool.
715 (impl_region_model_context::purge_state_involving): New decl.
716 (exploded_node::on_stmt_pre): New decl.
717 (exploded_node::on_stmt_post): New decl.
718 * pending-diagnostic.h (pending_diagnostic::use_of_uninit_p): New.
719 (pending_diagnostic::supercedes_p): New.
720 * program-state.cc (sm_state_map::get_state): Inherit state for
721 conjured_svalue as well as initial_svalue.
722 (sm_state_map::purge_state_involving): Also support SK_CONJURED.
723 * region-model-impl-calls.cc (call_details::get_uncertainty):
724 Handle m_ctxt being NULL.
725 (call_details::get_or_create_conjured_svalue): New.
726 (region_model::impl_call_fgets): New.
727 (region_model::impl_call_fread): New.
728 * region-model-manager.cc
729 (region_model_manager::get_or_create_initial_value): Return an
730 uninitialized poisoned value for regions that can't have initial
731 values.
732 * region-model-reachability.cc
733 (reachable_regions::mark_escaped_clusters): Handle ctxt being
734 NULL.
735 * region-model.cc (region_to_value_map::purge_state_involving): New.
736 (poisoned_value_diagnostic::use_of_uninit_p): New.
737 (poisoned_value_diagnostic::emit): Handle POISON_KIND_UNINIT.
738 (poisoned_value_diagnostic::describe_final_event): Likewise.
739 (region_model::check_for_poison): New.
740 (region_model::on_assignment): Call it.
741 (class dump_path_diagnostic): Move here from engine.cc.
742 (region_model::on_stmt_pre): New, based on exploded_node::on_stmt.
743 (region_model::on_call_pre): Move the setting of the LHS to a
744 conjured svalue to before the checks for specific functions.
745 Handle "fgets", "fgets_unlocked", and "fread".
746 (region_model::purge_state_involving): New.
747 (region_model::handle_unrecognized_call): Handle ctxt being NULL.
748 (region_model::get_rvalue): Call check_for_poison.
749 (selftest::test_stack_frames): Use NULL for context when getting
750 uninitialized rvalue.
751 (selftest::test_alloca): Likewise.
752 * region-model.h (region_to_value_map::purge_state_involving): New
753 decl.
754 (call_details::get_or_create_conjured_svalue): New decl.
755 (region_model::on_stmt_pre): New decl.
756 (region_model::purge_state_involving): New decl.
757 (region_model::impl_call_fgets): New decl.
758 (region_model::impl_call_fread): New decl.
759 (region_model::check_for_poison): New decl.
760 (region_model_context::warn): Return bool.
761 (region_model_context::purge_state_involving): New.
762 (noop_region_model_context::warn): Return bool.
763 (noop_region_model_context::purge_state_involving): New.
764 (test_region_model_context:: warn): Return bool.
765 * region.cc (region::get_memory_space): New.
766 (region::can_have_initial_svalue_p): New.
767 (region::involves_p): New.
768 * region.h (enum memory_space): New.
769 (region::get_memory_space): New decl.
770 (region::can_have_initial_svalue_p): New decl.
771 (region::involves_p): New decl.
772 * sm-malloc.cc (use_after_free::supercedes_p): New.
773 * store.cc (binding_cluster::purge_state_involving): New.
774 (store::purge_state_involving): New.
775 * store.h (class symbolic_binding): New forward decl.
776 (binding_key::dyn_cast_symbolic_binding): New.
777 (symbolic_binding::dyn_cast_symbolic_binding): New.
778 (binding_cluster::purge_state_involving): New.
779 (store::purge_state_involving): New.
780 * svalue.cc (svalue::can_merge_p): Reject attempts to merge
781 poisoned svalues with other svalues, so that we identify
782 paths in which a variable is conditionally uninitialized.
783 (involvement_visitor::visit_conjured_svalue): New.
784 (svalue::involves_p): Also handle SK_CONJURED.
785 (poison_kind_to_str): Handle POISON_KIND_UNINIT.
786 (poisoned_svalue::maybe_fold_bits_within): New.
787 * svalue.h (enum poison_kind): Add POISON_KIND_UNINIT.
788 (poisoned_svalue::maybe_fold_bits_within): New decl.
790 2021-07-15 David Malcolm <dmalcolm@redhat.com>
792 * analyzer.opt (fdump-analyzer-exploded-paths): New.
793 * diagnostic-manager.cc
794 (diagnostic_manager::emit_saved_diagnostic): Implement it.
795 * engine.cc (exploded_path::dump_to_pp): Add ext_state param and
796 use it to dump states if non-NULL.
797 (exploded_path::dump): Likewise.
798 (exploded_path::dump_to_file): New.
799 * exploded-graph.h (exploded_path::dump_to_pp): Add ext_state
800 param.
801 (exploded_path::dump): Likewise.
802 (exploded_path::dump): Likewise.
803 (exploded_path::dump_to_file): New.
805 2021-07-15 David Malcolm <dmalcolm@redhat.com>
807 * analyzer.cc (fixup_tree_for_diagnostic_1): Use DECL_DEBUG_EXPR
808 if it's available.
809 * engine.cc (readability): Likewise.
811 2021-07-15 David Malcolm <dmalcolm@redhat.com>
813 * state-purge.cc (self_referential_phi_p): New.
814 (state_purge_per_ssa_name::process_point): Don't purge an SSA name
815 at its def-stmt if the def-stmt is self-referential.
817 2021-07-07 David Malcolm <dmalcolm@redhat.com>
819 * diagnostic-manager.cc (null_assignment_sm_context::get_state):
820 New overload.
821 (null_assignment_sm_context::set_next_state): New overload.
822 (null_assignment_sm_context::get_diagnostic_tree): New.
823 * engine.cc (impl_sm_context::get_state): New overload.
824 (impl_sm_context::set_next_state): New overload.
825 (impl_sm_context::get_diagnostic_tree): New overload.
826 (impl_region_model_context::on_condition): Convert params from
827 tree to const svalue *.
828 * exploded-graph.h (impl_region_model_context::on_condition):
829 Likewise.
830 * region-model.cc (region_model::on_call_pre): Move handling of
831 internal calls to before checking for get_fndecl_for_call.
832 (region_model::add_constraints_from_binop): New.
833 (region_model::add_constraint): Split out into a new overload
834 working on const svalue * rather than tree. Call
835 add_constraints_from_binop. Drop call to
836 add_any_constraints_from_ssa_def_stmt.
837 (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
838 (region_model::add_any_constraints_from_gassign): Delete.
839 (region_model::add_any_constraints_from_gcall): Delete.
840 * region-model.h
841 (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
842 (region_model::add_any_constraints_from_gassign): Delete.
843 (region_model::add_any_constraints_from_gcall): Delete.
844 (region_model::add_constraint): Add overload decl.
845 (region_model::add_constraints_from_binop): New decl.
846 (region_model_context::on_condition): Convert params from tree to
847 const svalue *.
848 (noop_region_model_context::on_condition): Likewise.
849 * sm-file.cc (fileptr_state_machine::condition): Likewise.
850 * sm-malloc.cc (malloc_state_machine::on_condition): Likewise.
851 * sm-pattern-test.cc: Include tristate.h, selftest.h,
852 analyzer/call-string.h, analyzer/program-point.h,
853 analyzer/store.h, and analyzer/region-model.h.
854 (pattern_test_state_machine::on_condition): Convert params from tree to
855 const svalue *.
856 * sm-sensitive.cc (sensitive_state_machine::on_condition): Delete.
857 * sm-signal.cc (signal_state_machine::on_condition): Delete.
858 * sm-taint.cc (taint_state_machine::on_condition): Convert params
859 from tree to const svalue *.
860 * sm.cc: Include tristate.h, selftest.h, analyzer/call-string.h,
861 analyzer/program-point.h, analyzer/store.h, and
862 analyzer/region-model.h.
863 (any_pointer_p): Add overload taking const svalue *sval.
864 * sm.h (any_pointer_p): Add overload taking const svalue *sval.
865 (state_machine::on_condition): Convert params from tree to
866 const svalue *. Provide no-op default implementation.
867 (sm_context::get_state): Add overload taking const svalue *sval.
868 (sm_context::set_next_state): Likewise.
869 (sm_context::on_transition): Likewise.
870 (sm_context::get_diagnostic_tree): Likewise.
871 * svalue.cc (svalue::all_zeroes_p): New.
872 (constant_svalue::all_zeroes_p): New.
873 (repeated_svalue::all_zeroes_p): Convert to vfunc.
874 * svalue.h (svalue::all_zeroes_p): New decl.
875 (constant_svalue::all_zeroes_p): New decl.
876 (repeated_svalue::all_zeroes_p): Convert decl to vfunc.
878 2021-06-30 David Malcolm <dmalcolm@redhat.com>
880 PR analyzer/95006
881 * analyzer.h (class repeated_svalue): New forward decl.
882 (class bits_within_svalue): New forward decl.
883 (class sized_region): New forward decl.
884 (get_field_at_bit_offset): New forward decl.
885 * engine.cc (exploded_graph::get_or_create_node): Validate the
886 merged state.
887 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
888 Validate the states at each stage.
889 * program-state.cc (program_state::validate): Validate
890 m_region_model.
891 * region-model-impl-calls.cc (region_model::impl_call_memset):
892 Replace special-case logic for handling constant sizes with
893 a call to fill_region of a sized_region with the given fill value.
894 * region-model-manager.cc (maybe_undo_optimize_bit_field_compare):
895 Drop DK_direct.
896 (region_model_manager::maybe_fold_sub_svalue): Fold element-based
897 subregions of an initial value into initial values of an element.
898 Fold subvalues of repeated svalues.
899 (region_model_manager::maybe_fold_repeated_svalue): New.
900 (region_model_manager::get_or_create_repeated_svalue): New.
901 (get_bit_range_for_field): New.
902 (get_byte_range_for_field): New.
903 (get_field_at_byte_range): New.
904 (region_model_manager::maybe_fold_bits_within_svalue): New.
905 (region_model_manager::get_or_create_bits_within): New.
906 (region_model_manager::get_sized_region): New.
907 (region_model_manager::log_stats): Update for addition of
908 m_repeated_values_map, m_bits_within_values_map, and
909 m_sized_regions.
910 * region-model.cc (region_model::validate): New.
911 (region_model::on_assignment): Drop enum binding_kind.
912 (region_model::get_initial_value_for_global): Likewise.
913 (region_model::get_rvalue_for_bits): Replace body with call to
914 get_or_create_bits_within.
915 (region_model::get_capacity): Handle RK_SIZED.
916 (region_model::set_value): Drop enum binding_kind.
917 (region_model::fill_region): New.
918 (region_model::get_representative_path_var_1): Handle RK_SIZED.
919 * region-model.h (visitor::visit_repeated_svalue): New.
920 (visitor::visit_bits_within_svalue): New.
921 (region_model_manager::get_or_create_repeated_svalue): New decl.
922 (region_model_manager::get_or_create_bits_within): New decl.
923 (region_model_manager::get_sized_region): New decl.
924 (region_model_manager::maybe_fold_repeated_svalue): New decl.
925 (region_model_manager::maybe_fold_bits_within_svalue): New decl.
926 (region_model_manager::repeated_values_map_t): New typedef.
927 (region_model_manager::m_repeated_values_map): New field.
928 (region_model_manager::bits_within_values_map_t): New typedef.
929 (region_model_manager::m_bits_within_values_map): New field.
930 (region_model_manager::m_sized_regions): New field.
931 (region_model::fill_region): New decl.
932 * region.cc (region::get_base_region): Handle RK_SIZED.
933 (region::base_region_p): Likewise.
934 (region::get_byte_size_sval): New.
935 (get_field_at_bit_offset): Make non-static.
936 (region::calc_offset): Move implementation of cases to
937 get_relative_concrete_offset vfunc implementations. Handle
938 RK_SIZED.
939 (region::get_relative_concrete_offset): New.
940 (decl_region::get_svalue_for_initializer): Drop enum binding_kind.
941 (field_region::get_relative_concrete_offset): New, from
942 region::calc_offset.
943 (element_region::get_relative_concrete_offset): Likewise.
944 (offset_region::get_relative_concrete_offset): Likewise.
945 (sized_region::accept): New.
946 (sized_region::dump_to_pp): New.
947 (sized_region::get_byte_size): New.
948 (sized_region::get_bit_size): New.
949 * region.h (enum region_kind): Add RK_SIZED.
950 (region::dyn_cast_sized_region): New.
951 (region::get_byte_size): Make virtual.
952 (region::get_bit_size): Likewise.
953 (region::get_byte_size_sval): New decl.
954 (region::get_relative_concrete_offset): New decl.
955 (field_region::get_relative_concrete_offset): New decl.
956 (element_region::get_relative_concrete_offset): Likewise.
957 (offset_region::get_relative_concrete_offset): Likewise.
958 (class sized_region): New.
959 * store.cc (binding_kind_to_string): Delete.
960 (binding_key::make): Drop enum binding_kind.
961 (binding_key::dump_to_pp): Delete.
962 (binding_key::cmp_ptrs): Drop enum binding_kind.
963 (bit_range::contains_p): New.
964 (byte_range::dump): New.
965 (byte_range::contains_p): New.
966 (byte_range::cmp): New.
967 (concrete_binding::dump_to_pp): Drop enum binding_kind.
968 (concrete_binding::cmp_ptr_ptr): Likewise.
969 (symbolic_binding::dump_to_pp): Likewise.
970 (symbolic_binding::cmp_ptr_ptr): Likewise.
971 (binding_map::apply_ctor_val_to_range): Likewise.
972 (binding_map::apply_ctor_pair_to_child_region): Likewise.
973 (binding_map::get_overlapping_bindings): New.
974 (binding_map::remove_overlapping_bindings): New.
975 (binding_cluster::validate): New.
976 (binding_cluster::bind): Drop enum binding_kind.
977 (binding_cluster::bind_compound_sval): Likewise.
978 (binding_cluster::purge_region): Likewise.
979 (binding_cluster::zero_fill_region): Reimplement in terms of...
980 (binding_cluster::fill_region): New.
981 (binding_cluster::mark_region_as_unknown): Drop enum binding_kind.
982 (binding_cluster::get_binding): Likewise.
983 (binding_cluster::get_binding_recursive): Likewise.
984 (binding_cluster::get_any_binding): Likewise.
985 (binding_cluster::maybe_get_compound_binding): Reimplement.
986 (binding_cluster::get_overlapping_bindings): Delete.
987 (binding_cluster::remove_overlapping_bindings): Reimplement in
988 terms of binding_map::remove_overlapping_bindings.
989 (binding_cluster::can_merge_p): Update for removal of
990 enum binding_kind.
991 (binding_cluster::on_unknown_fncall): Drop enum binding_kind.
992 (binding_cluster::maybe_get_simple_value): Likewise.
993 (store_manager::get_concrete_binding): Likewise.
994 (store_manager::get_symbolic_binding): Likewise.
995 (store::validate): New.
996 (store::set_value): Drop enum binding_kind.
997 (store::zero_fill_region): Reimplement in terms of...
998 (store::fill_region): New.
999 (selftest::test_binding_key_overlap): Drop enum binding_kind.
1000 * store.h (enum binding_kind): Delete.
1001 (binding_kind_to_string): Delete decl.
1002 (binding_key::make): Drop enum binding_kind.
1003 (binding_key::dump_to_pp): Make pure virtual.
1004 (binding_key::get_kind): Delete.
1005 (binding_key::mark_deleted): Delete.
1006 (binding_key::mark_empty): Delete.
1007 (binding_key::is_deleted): Delete.
1008 (binding_key::is_empty): Delete.
1009 (binding_key::binding_key): Delete.
1010 (binding_key::impl_hash): Delete.
1011 (binding_key::impl_eq): Delete.
1012 (binding_key::m_kind): Delete.
1013 (bit_range::get_last_bit_offset): New.
1014 (bit_range::contains_p): New.
1015 (byte_range::contains_p): New.
1016 (byte_range::operator==): New.
1017 (byte_range::get_start_byte_offset): New.
1018 (byte_range::get_next_byte_offset): New.
1019 (byte_range::get_last_byte_offset): New.
1020 (byte_range::as_bit_range): New.
1021 (byte_range::cmp): New.
1022 (concrete_binding::concrete_binding): Drop enum binding_kind.
1023 (concrete_binding::hash): Likewise.
1024 (concrete_binding::operator==): Likewise.
1025 (concrete_binding::mark_deleted): New.
1026 (concrete_binding::mark_empty): New.
1027 (concrete_binding::is_deleted): New.
1028 (concrete_binding::is_empty): New.
1029 (default_hash_traits<ana::concrete_binding>::empty_zero_p): Make false.
1030 (symbolic_binding::symbolic_binding): Drop enum binding_kind.
1031 (symbolic_binding::hash): Likewise.
1032 (symbolic_binding::operator==): Likewise.
1033 (symbolic_binding::mark_deleted): New.
1034 (symbolic_binding::mark_empty): New.
1035 (symbolic_binding::is_deleted): New.
1036 (symbolic_binding::is_empty): New.
1037 (binding_map::remove_overlapping_bindings): New decl.
1038 (binding_map::get_overlapping_bindings): New decl.
1039 (binding_cluster::validate): New decl.
1040 (binding_cluster::bind): Drop enum binding_kind.
1041 (binding_cluster::fill_region): New decl.
1042 (binding_cluster::get_binding): Drop enum binding_kind.
1043 (binding_cluster::get_binding_recursive): Likewise.
1044 (binding_cluster::get_overlapping_bindings): Delete.
1045 (store::validate): New decl.
1046 (store::set_value): Drop enum binding_kind.
1047 (store::fill_region): New decl.
1048 (store_manager::get_concrete_binding): Drop enum binding_kind.
1049 (store_manager::get_symbolic_binding): Likewise.
1050 * svalue.cc (svalue::cmp_ptr): Handle SK_REPEATED and
1051 SK_BITS_WITHIN.
1052 (svalue::extract_bit_range): New.
1053 (svalue::maybe_fold_bits_within): New.
1054 (constant_svalue::maybe_fold_bits_within): New.
1055 (unknown_svalue::maybe_fold_bits_within): New.
1056 (unaryop_svalue::maybe_fold_bits_within): New.
1057 (repeated_svalue::repeated_svalue): New.
1058 (repeated_svalue::dump_to_pp): New.
1059 (repeated_svalue::accept): New.
1060 (repeated_svalue::all_zeroes_p): New.
1061 (repeated_svalue::maybe_fold_bits_within): New.
1062 (bits_within_svalue::bits_within_svalue): New.
1063 (bits_within_svalue::dump_to_pp): New.
1064 (bits_within_svalue::maybe_fold_bits_within): New.
1065 (bits_within_svalue::accept): New.
1066 (bits_within_svalue::implicitly_live_p): New.
1067 (compound_svalue::maybe_fold_bits_within): New.
1068 * svalue.h (enum svalue_kind): Add SK_REPEATED and SK_BITS_WITHIN.
1069 (svalue::dyn_cast_repeated_svalue): New.
1070 (svalue::dyn_cast_bits_within_svalue): New.
1071 (svalue::extract_bit_range): New decl.
1072 (svalue::maybe_fold_bits_within): New vfunc decl.
1073 (region_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
1074 (region_svalue::key_t::is_empty): Likewise.
1075 (default_hash_traits<region_svalue::key_t>::empty_zero_p): Make false.
1076 (constant_svalue::maybe_fold_bits_within): New.
1077 (unknown_svalue::maybe_fold_bits_within): New.
1078 (poisoned_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
1079 (poisoned_svalue::key_t::is_empty): Likewise.
1080 (default_hash_traits<poisoned_svalue::key_t>::empty_zero_p): Make
1081 false.
1082 (setjmp_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
1083 (setjmp_svalue::key_t::is_empty): Likewise.
1084 (default_hash_traits<setjmp_svalue::key_t>::empty_zero_p): Make
1085 false.
1086 (unaryop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
1087 (unaryop_svalue::key_t::is_empty): Likewise.
1088 (unaryop_svalue::maybe_fold_bits_within): New.
1089 (default_hash_traits<unaryop_svalue::key_t>::empty_zero_p): Make
1090 false.
1091 (binop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
1092 (binop_svalue::key_t::is_empty): Likewise.
1093 (default_hash_traits<binop_svalue::key_t>::empty_zero_p): Make
1094 false.
1095 (sub_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
1096 (sub_svalue::key_t::is_empty): Likewise.
1097 (default_hash_traits<sub_svalue::key_t>::empty_zero_p): Make
1098 false.
1099 (class repeated_svalue): New.
1100 (is_a_helper <const repeated_svalue *>::test): New.
1101 (struct default_hash_traits<repeated_svalue::key_t>): New.
1102 (class bits_within_svalue): New.
1103 (is_a_helper <const bits_within_svalue *>::test): New.
1104 (struct default_hash_traits<bits_within_svalue::key_t>): New.
1105 (widening_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
1106 (widening_svalue::key_t::is_empty): Likewise.
1107 (default_hash_traits<widening_svalue::key_t>::empty_zero_p): Make
1108 false.
1109 (compound_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
1110 (compound_svalue::key_t::is_empty): Likewise.
1111 (compound_svalue::maybe_fold_bits_within): New.
1112 (default_hash_traits<compound_svalue::key_t>::empty_zero_p): Make
1113 false.
1115 2021-06-28 David Malcolm <dmalcolm@redhat.com>
1117 * analyzer.h (byte_offset_t): New typedef.
1118 * store.cc (bit_range::dump_to_pp): Dump as a byte range if
1119 possible.
1120 (bit_range::as_byte_range): New.
1121 (byte_range::dump_to_pp): New.
1122 * store.h (class byte_range): New forward decl.
1123 (struct bit_range): Add comment.
1124 (bit_range::as_byte_range): New decl.
1125 (struct byte_range): New.
1127 2021-06-22 David Malcolm <dmalcolm@redhat.com>
1129 PR analyzer/101143
1130 * region-model.cc (compat_types_p): New function.
1131 (region_model::create_region_for_heap_alloc): Convert assertion to
1132 an error check.
1133 (region_model::create_region_for_alloca): Likewise.
1135 2021-06-18 David Malcolm <dmalcolm@redhat.com>
1137 * store.cc (binding_cluster::get_any_binding): Make symbolic reads
1138 from a cluster with concrete bindings return unknown.
1140 2021-06-18 David Malcolm <dmalcolm@redhat.com>
1142 * region-model-manager.cc
1143 (region_model_manager::get_or_create_int_cst): New.
1144 (region_model_manager::maybe_undo_optimize_bit_field_compare): Use
1145 it to simplify away a local tree.
1146 * region-model.cc (region_model::on_setjmp): Likewise.
1147 (region_model::on_longjmp): Likewise.
1148 * region-model.h (region_model_manager::get_or_create_int_cst):
1149 New decl.
1150 * store.cc (binding_cluster::zero_fill_region): Use it to simplify
1151 away a local tree.
1153 2021-06-18 David Malcolm <dmalcolm@redhat.com>
1155 * checker-path.cc (class custom_event): Make abstract to allow for
1156 custom vfuncs, splitting existing implementation into...
1157 (class precanned_custom_event): New subclass.
1158 (custom_event::get_desc): Move to...
1159 (precanned_custom_event::get_desc): ...subclass.
1160 * checker-path.h (class custom_event): Make abstract to allow for
1161 custom vfuncs, splitting existing implementation into...
1162 (class precanned_custom_event): New subclass.
1163 * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
1164 Use precanned_custom_event.
1165 * engine.cc
1166 (stale_jmp_buf::maybe_add_custom_events_for_superedge): Likewise.
1167 * sm-signal.cc (signal_delivery_edge_info_t::add_events_to_path):
1168 Likewise.
1170 2021-06-15 David Malcolm <dmalcolm@redhat.com>
1172 PR analyzer/99212
1173 PR analyzer/101082
1174 * engine.cc: Include "target.h".
1175 (impl_run_checkers): Log BITS_BIG_ENDIAN, BYTES_BIG_ENDIAN, and
1176 WORDS_BIG_ENDIAN.
1177 * region-model-manager.cc
1178 (region_model_manager::maybe_fold_binop): Move support for masking
1179 via ARG0 & CST into...
1180 (region_model_manager::maybe_undo_optimize_bit_field_compare):
1181 ...this new function. Flatten by converting from nested
1182 conditionals to a series of early return statements to reject
1183 failures. Reject if type is not unsigned_char_type_node.
1184 Handle BYTES_BIG_ENDIAN when determining which bits are bound
1185 in the binding_map.
1186 * region-model.h
1187 (region_model_manager::maybe_undo_optimize_bit_field_compare):
1188 New decl.
1189 * store.cc (bit_range::dump): New function.
1190 * store.h (bit_range::dump): New decl.
1192 2021-06-15 David Malcolm <dmalcolm@redhat.com>
1194 * engine.cc (exploded_node::on_stmt): Handle __analyzer_dump_capacity.
1195 (exploded_node::on_stmt): Drop m_sm_changes from on_stmt_flags.
1196 (state_change_requires_new_enode_p): New function...
1197 (exploded_graph::process_node): Call it, rather than querying
1198 flags.m_sm_changes, so that dynamic-extent differences can also
1199 trigger the splitting of nodes.
1200 * exploded-graph.h (struct on_stmt_flags): Drop field m_sm_changes.
1201 * program-state.cc (program_state::detect_leaks): Purge dead
1202 heap-allocated regions from dynamic extents.
1203 (selftest::test_program_state_1): Fix type of "size_in_bytes".
1204 (selftest::test_program_state_merging): Likewise.
1205 * region-model-impl-calls.cc
1206 (region_model::impl_call_analyzer_dump_capacity): New.
1207 (region_model::impl_call_free): Remove dynamic extents from the
1208 freed region.
1209 * region-model-reachability.h
1210 (reachable_regions::begin_mutable_base_regs): New.
1211 (reachable_regions::end_mutable_base_regs): New.
1212 * region-model.cc: Include "tree-object-size.h".
1213 (region_model::region_model): Support new field m_dynamic_extents.
1214 (region_model::operator=): Likewise.
1215 (region_model::operator==): Likewise.
1216 (region_model::dump_to_pp): Dump sizes of dynamic regions.
1217 (region_model::handle_unrecognized_call): Purge dynamic extents
1218 from any regions that have escaped mutably:.
1219 (region_model::get_capacity): New function.
1220 (region_model::add_constraint): Unset dynamic extents when a
1221 heap-allocated region's address is NULL.
1222 (region_model::unbind_region_and_descendents): Purge dynamic
1223 extents of unbound regions.
1224 (region_model::can_merge_with_p): Call
1225 m_dynamic_extents.can_merge_with_p.
1226 (region_model::create_region_for_heap_alloc): Assert that
1227 size_in_bytes's type is compatible with size_type_node. Update
1228 for renaming of record_dynamic_extents to set_dynamic_extents.
1229 (region_model::create_region_for_alloca): Likewise.
1230 (region_model::record_dynamic_extents): Rename to...
1231 (region_model::set_dynamic_extents): ...this. Assert that
1232 size_in_bytes's type is compatible with size_type_node. Add it
1233 to the m_dynamic_extents map.
1234 (region_model::get_dynamic_extents): New.
1235 (region_model::unset_dynamic_extents): New.
1236 (selftest::test_state_merging): Fix type of "size".
1237 (selftest::test_malloc_constraints): Likewise.
1238 (selftest::test_malloc): Verify dynamic extents.
1239 (selftest::test_alloca): Likewise.
1240 * region-model.h (region_to_value_map::is_empty): New.
1241 (region_model::dynamic_extents_t): New typedef.
1242 (region_model::impl_call_analyzer_dump_capacity): New decl.
1243 (region_model::get_dynamic_extents): New function.
1244 (region_model::get_dynamic_extents): New decl.
1245 (region_model::set_dynamic_extents): New decl.
1246 (region_model::unset_dynamic_extents): New decl.
1247 (region_model::get_capacity): New decl.
1248 (region_model::record_dynamic_extents): Rename to set_dynamic_extents.
1249 (region_model::m_dynamic_extents): New field.
1251 2021-06-15 David Malcolm <dmalcolm@redhat.com>
1253 * region-model.cc (region_to_value_map::operator=): New.
1254 (region_to_value_map::operator==): New.
1255 (region_to_value_map::dump_to_pp): New.
1256 (region_to_value_map::dump): New.
1257 (region_to_value_map::can_merge_with_p): New.
1258 * region-model.h (class region_to_value_map): New class.
1260 2021-06-13 Trevor Saunders <tbsaunde@tbsaunde.org>
1262 * call-string.cc (call_string::call_string): Use range based for
1263 to iterate over vec<>.
1264 (call_string::to_json): Likewise.
1265 (call_string::hash): Likewise.
1266 (call_string::calc_recursion_depth): Likewise.
1267 * checker-path.cc (checker_path::fixup_locations): Likewise.
1268 * constraint-manager.cc (equiv_class::equiv_class): Likewise.
1269 (equiv_class::to_json): Likewise.
1270 (equiv_class::hash): Likewise.
1271 (constraint_manager::to_json): Likewise.
1272 * engine.cc (impl_region_model_context::on_svalue_leak):
1273 Likewise.
1274 (on_liveness_change): Likewise.
1275 (impl_region_model_context::on_unknown_change): Likewise.
1276 * program-state.cc (sm_state_map::set_state): Likewise.
1277 * region-model.cc (test_canonicalization_4): Likewise.
1279 2021-06-11 David Malcolm <dmalcolm@redhat.com>
1281 * engine.cc (worklist::key_t::cmp): Move sort by call_string to
1282 before SCC.
1284 2021-06-09 David Malcolm <dmalcolm@redhat.com>
1286 * region-model.cc (region_model::get_lvalue_1): Make const.
1287 (region_model::get_lvalue): Likewise.
1288 (region_model::get_rvalue_1): Likewise.
1289 (region_model::get_rvalue): Likewise.
1290 (region_model::deref_rvalue): Likewise.
1291 (region_model::get_rvalue_for_bits): Likewise.
1292 * region-model.h (region_model::get_lvalue): Likewise.
1293 (region_model::get_rvalue): Likewise.
1294 (region_model::deref_rvalue): Likewise.
1295 (region_model::get_rvalue_for_bits): Likewise.
1296 (region_model::get_lvalue_1): Likewise.
1297 (region_model::get_rvalue_1): Likewise.
1299 2021-06-08 David Malcolm <dmalcolm@redhat.com>
1301 PR analyzer/99212
1302 * region-model-manager.cc
1303 (region_model_manager::maybe_fold_binop): Add support for folding
1304 BIT_AND_EXPR of compound_svalue and a mask constant.
1305 * region-model.cc (region_model::get_rvalue_1): Implement
1306 BIT_FIELD_REF in terms of...
1307 (region_model::get_rvalue_for_bits): New function.
1308 * region-model.h (region_model::get_rvalue_for_bits): New decl.
1309 * store.cc (bit_range::from_mask): New function.
1310 (selftest::test_bit_range_intersects_p): New selftest.
1311 (selftest::assert_bit_range_from_mask_eq): New.
1312 (ASSERT_BIT_RANGE_FROM_MASK_EQ): New macro.
1313 (selftest::assert_no_bit_range_from_mask_eq): New.
1314 (ASSERT_NO_BIT_RANGE_FROM_MASK): New macro.
1315 (selftest::test_bit_range_from_mask): New selftest.
1316 (selftest::analyzer_store_cc_tests): Call the new selftests.
1317 * store.h (bit_range::intersects_p): New.
1318 (bit_range::from_mask): New decl.
1319 (concrete_binding::get_bit_range): New accessor.
1320 (store_manager::get_concrete_binding): New overload taking
1321 const bit_range &.
1323 2021-06-08 David Malcolm <dmalcolm@redhat.com>
1325 * analyzer.h (int_size_in_bits): New decl.
1326 * region.cc (int_size_in_bits): New function.
1327 (region::get_bit_size): Reimplement in terms of the above.
1329 2021-06-08 David Malcolm <dmalcolm@redhat.com>
1331 * store.cc (concrete_binding::dump_to_pp): Move bulk of
1332 implementation to...
1333 (bit_range::dump_to_pp): ...this new function.
1334 (bit_range::cmp): New.
1335 (concrete_binding::overlaps_p): Update for use of bit_range.
1336 (concrete_binding::cmp_ptr_ptr): Likewise.
1337 * store.h (struct bit_range): New.
1338 (class concrete_binding): Replace fields m_start_bit_offset and
1339 m_size_in_bits with new field m_bit_range.
1341 2021-06-08 David Malcolm <dmalcolm@redhat.com>
1343 * svalue.h (conjured_svalue::iterator_t): Delete.
1345 2021-06-03 David Malcolm <dmalcolm@redhat.com>
1347 * store.h (store::get_direct_binding): Remove unused decl.
1348 (store::get_default_binding): Likewise.
1350 2021-06-03 David Malcolm <dmalcolm@redhat.com>
1352 * svalue.cc (poisoned_svalue::dump_to_pp): Dump type.
1353 (compound_svalue::dump_to_pp): Dump any type.
1355 2021-05-18 David Malcolm <dmalcolm@redhat.com>
1357 PR analyzer/100615
1358 * sm-malloc.cc: Include "analyzer/function-set.h".
1359 (malloc_state_machine::on_stmt): Call unaffected_by_call_p and
1360 bail on the functions it recognizes.
1361 (malloc_state_machine::unaffected_by_call_p): New.
1363 2021-05-10 Martin Liska <mliska@suse.cz>
1365 * sm-file.cc (is_file_using_fn_p): Use startswith
1366 function instead of strncmp.
1368 2021-05-10 Martin Liska <mliska@suse.cz>
1370 * program-state.cc (program_state::operator=): Remove
1371 __cplusplus >= 201103.
1372 (program_state::program_state): Likewise.
1373 * program-state.h: Likewise.
1374 * region-model.h (class region_model): Remove dead code.
1376 2021-04-24 David Malcolm <dmalcolm@redhat.com>
1378 PR analyzer/100244
1379 * sm-malloc.cc (free_of_non_heap::describe_state_change):
1380 Bulletproof against change.m_expr being NULL.
1382 2021-04-13 David Malcolm <dmalcolm@redhat.com>
1384 PR analyzer/98599
1385 * supergraph.cc (saved_uids::make_uid_unique): New.
1386 (saved_uids::restore_uids): New.
1387 (supergraph::supergraph): Replace assignments to stmt->uid with
1388 calls to m_stmt_uids.make_uid_unique.
1389 (supergraph::~supergraph): New.
1390 * supergraph.h (class saved_uids): New.
1391 (supergraph::~supergraph): New decl.
1392 (supergraph::m_stmt_uids): New field.
1394 2021-04-10 David Malcolm <dmalcolm@redhat.com>
1396 PR analyzer/100011
1397 * region-model.cc (region_model::on_assignment): Avoid NULL
1398 dereference if ctxt is NULL when assigning from a STRING_CST.
1400 2021-04-08 David Malcolm <dmalcolm@redhat.com>
1402 PR analyzer/99042
1403 PR analyzer/99774
1404 * engine.cc
1405 (impl_region_model_context::impl_region_model_context): Add
1406 uncertainty param and use it to initialize m_uncertainty.
1407 (impl_region_model_context::get_uncertainty): New.
1408 (impl_sm_context::get_fndecl_for_call): Add NULL for new
1409 uncertainty param when constructing impl_region_model_context.
1410 (impl_sm_context::get_state): Likewise.
1411 (impl_sm_context::set_next_state): Likewise.
1412 (impl_sm_context::warn): Likewise.
1413 (exploded_node::on_stmt): Add uncertainty param
1414 and use it when constructing impl_region_model_context.
1415 (exploded_node::on_edge): Add uncertainty param and pass
1416 to on_edge call.
1417 (exploded_node::detect_leaks): Create uncertainty_t and pass to
1418 impl_region_model_context.
1419 (exploded_graph::get_or_create_node): Create uncertainty_t and
1420 pass to prune_for_point.
1421 (maybe_process_run_of_before_supernode_enodes): Create
1422 uncertainty_t and pass to impl_region_model_context.
1423 (exploded_graph::process_node): Create uncertainty_t instances and
1424 pass around as needed.
1425 * exploded-graph.h
1426 (impl_region_model_context::impl_region_model_context): Add
1427 uncertainty param.
1428 (impl_region_model_context::get_uncertainty): New decl.
1429 (impl_region_model_context::m_uncertainty): New field.
1430 (exploded_node::on_stmt): Add uncertainty param.
1431 (exploded_node::on_edge): Likewise.
1432 * program-state.cc (sm_state_map::on_liveness_change): Get
1433 uncertainty from context and use it to unset sm-state from
1434 svalues as appropriate.
1435 (program_state::on_edge): Add uncertainty param and use it when
1436 constructing impl_region_model_context. Fix indentation.
1437 (program_state::prune_for_point): Add uncertainty param and use it
1438 when constructing impl_region_model_context.
1439 (program_state::detect_leaks): Get any uncertainty from ctxt and
1440 use it to get maybe-live svalues for dest_state, rather than
1441 definitely-live ones; use this when determining which svalues
1442 have leaked.
1443 (selftest::test_program_state_merging): Create uncertainty_t and
1444 pass to impl_region_model_context.
1445 * program-state.h (program_state::on_edge): Add uncertainty param.
1446 (program_state::prune_for_point): Likewise.
1447 * region-model-impl-calls.cc (call_details::get_uncertainty): New.
1448 (region_model::impl_call_memcpy): Pass uncertainty to
1449 mark_region_as_unknown call.
1450 (region_model::impl_call_memset): Likewise.
1451 (region_model::impl_call_strcpy): Likewise.
1452 * region-model-reachability.cc (reachable_regions::handle_sval):
1453 Also add sval to m_mutable_svals.
1454 * region-model.cc (region_model::on_assignment): Pass any
1455 uncertainty from ctxt to the store::set_value call.
1456 (region_model::handle_unrecognized_call): Get any uncertainty from
1457 ctxt and use it to record mutable svalues at the unknown call.
1458 (region_model::get_reachable_svalues): Add uncertainty param and
1459 use it to mark any maybe-bound svalues as being reachable.
1460 (region_model::set_value): Pass any uncertainty from ctxt to the
1461 store::set_value call.
1462 (region_model::mark_region_as_unknown): Add uncertainty param and
1463 pass it on to the store::mark_region_as_unknown call.
1464 (region_model::update_for_call_summary): Add uncertainty param and
1465 pass it on to the region_model::mark_region_as_unknown call.
1466 * region-model.h (call_details::get_uncertainty): New decl.
1467 (region_model::get_reachable_svalues): Add uncertainty param.
1468 (region_model::mark_region_as_unknown): Add uncertainty param.
1469 (region_model_context::get_uncertainty): New vfunc.
1470 (noop_region_model_context::get_uncertainty): New vfunc
1471 implementation.
1472 * store.cc (dump_svalue_set): New.
1473 (uncertainty_t::dump_to_pp): New.
1474 (uncertainty_t::dump): New.
1475 (binding_cluster::clobber_region): Pass NULL for uncertainty to
1476 remove_overlapping_bindings.
1477 (binding_cluster::mark_region_as_unknown): Add uncertainty param
1478 and pass it to remove_overlapping_bindings.
1479 (binding_cluster::remove_overlapping_bindings): Add uncertainty param.
1480 Use it to record any svalues that were in clobbered bindings.
1481 (store::set_value): Add uncertainty param. Pass it to
1482 binding_cluster::mark_region_as_unknown when handling symbolic
1483 regions.
1484 (store::mark_region_as_unknown): Add uncertainty param and pass it
1485 to binding_cluster::mark_region_as_unknown.
1486 (store::remove_overlapping_bindings): Add uncertainty param and
1487 pass it to binding_cluster::remove_overlapping_bindings.
1488 * store.h (binding_cluster::mark_region_as_unknown): Add
1489 uncertainty param.
1490 (binding_cluster::remove_overlapping_bindings): Likewise.
1491 (store::set_value): Likewise.
1492 (store::mark_region_as_unknown): Likewise.
1494 2021-04-05 David Malcolm <dmalcolm@redhat.com>
1496 PR analyzer/99906
1497 * analyzer.cc (maybe_reconstruct_from_def_stmt): Fix NULL
1498 dereference on calls with zero arguments.
1499 * sm-malloc.cc (malloc_state_machine::on_stmt): When handling
1500 __attribute__((nonnull)), only call get_diagnostic_tree if the
1501 result will be used.
1503 2021-04-05 David Malcolm <dmalcolm@redhat.com>
1505 PR analyzer/99886
1506 * diagnostic-manager.cc
1507 (diagnostic_manager::prune_interproc_events): Use signed integers
1508 when subtracting one from path->num_events ().
1509 (diagnostic_manager::consolidate_conditions): Likewise. Convert
1510 next_idx to a signed int.
1512 2021-04-01 David Malcolm <dmalcolm@redhat.com>
1514 * diagnostic-manager.cc (diagnostic_manager::add_diagnostic): Make
1515 enode param non-constant, and call add_diagnostic on it. Add
1516 enode index to log message.
1517 (diagnostic_manager::add_diagnostic): Make enode param
1518 non-constant.
1519 * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
1520 Likewise for both decls.
1521 * engine.cc
1522 (impl_region_model_context::impl_region_model_context): Likewise
1523 for enode_for_diag.
1524 (impl_sm_context::impl_sm_context): Likewise.
1525 (impl_sm_context::m_enode_for_diag): Likewise.
1526 (exploded_node::dump_dot): Don't pass the diagnostic manager
1527 to dump_saved_diagnostics.
1528 (exploded_node::dump_saved_diagnostics): Drop param. Iterate
1529 directly through all saved diagnostics for the enode, rather
1530 than all saved diagnostics in the diagnostic_manager and
1531 filtering.
1532 (exploded_node::on_stmt): Make non-const.
1533 (exploded_node::on_edge): Likewise.
1534 (exploded_node::on_longjmp): Likewise.
1535 (exploded_node::detect_leaks): Likewise.
1536 (exploded_graph::get_or_create_node): Make enode_for_diag param
1537 non-const.
1538 (exploded_graph_annotator::print_enode): Iterate
1539 directly through all saved diagnostics for the enode, rather
1540 than all saved diagnostics in the diagnostic_manager and
1541 filtering.
1542 * exploded-graph.h
1543 (impl_region_model_context::impl_region_model_context): Make
1544 enode_for_diag param non-constant.
1545 (impl_region_model_context::m_enode_for_diag): Likewise.
1546 (exploded_node::dump_saved_diagnostics): Drop param.
1547 (exploded_node::on_stmt): Make non-const.
1548 (exploded_node::on_edge): Likewise.
1549 (exploded_node::on_longjmp): Likewise.
1550 (exploded_node::detect_leaks): Likewise.
1551 (exploded_node::add_diagnostic): New.
1552 (exploded_node::get_num_diagnostics): New.
1553 (exploded_node::get_saved_diagnostic): New.
1554 (exploded_node::m_saved_diagnostics): New.
1555 (exploded_graph::get_or_create_node): Make enode_for_diag param
1556 non-constant.
1557 * feasible-graph.cc (feasible_node::dump_dot): Drop
1558 diagnostic_manager from call to dump_saved_diagnostics.
1559 * program-state.cc (program_state::on_edge): Convert enode param
1560 to non-const pointer.
1561 (program_state::prune_for_point): Likewise for enode_for_diag
1562 param.
1563 * program-state.h (program_state::on_edge): Convert enode param
1564 to non-const pointer.
1565 (program_state::prune_for_point): Likewise for enode_for_diag
1566 param.
1568 2021-03-31 David Malcolm <dmalcolm@redhat.com>
1570 PR analyzer/99771
1571 * analyzer.cc (maybe_reconstruct_from_def_stmt): New.
1572 (fixup_tree_for_diagnostic_1): New.
1573 (fixup_tree_for_diagnostic): New.
1574 * analyzer.h (fixup_tree_for_diagnostic): New decl.
1575 * checker-path.cc (call_event::get_desc): Call
1576 fixup_tree_for_diagnostic and use it for the call_with_state call.
1577 (warning_event::get_desc): Likewise for the final_event and
1578 make_label_text calls.
1579 * engine.cc (impl_region_model_context::on_state_leak): Likewise
1580 for the on_leak and add_diagnostic calls.
1581 * region-model.cc (region_model::get_representative_tree):
1582 Likewise for the result.
1584 2021-03-30 David Malcolm <dmalcolm@redhat.com>
1586 * region.h (region::dump_to_pp): Remove old decl.
1588 2021-03-30 David Malcolm <dmalcolm@redhat.com>
1590 * sm-file.cc (fileptr_state_machine::on_stmt): Only call
1591 get_diagnostic_tree if the result will be used.
1592 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
1593 (malloc_state_machine::on_deallocator_call): Likewise.
1594 (malloc_state_machine::on_realloc_call): Likewise.
1595 (malloc_state_machine::on_realloc_call): Likewise.
1596 * sm-sensitive.cc
1597 (sensitive_state_machine::warn_for_any_exposure): Likewise.
1598 * sm-taint.cc (taint_state_machine::on_stmt): Likewise.
1600 2021-03-25 David Malcolm <dmalcolm@redhat.com>
1602 PR analyzer/93695
1603 PR analyzer/99044
1604 PR analyzer/99716
1605 * engine.cc (exploded_node::on_stmt): Clear sm-state involving
1606 an SSA name at the def-stmt of that SSA name.
1607 * program-state.cc (sm_state_map::purge_state_involving): New.
1608 * program-state.h (sm_state_map::purge_state_involving): New decl.
1609 * region-model.cc (selftest::test_involves_p): New.
1610 (selftest::analyzer_region_model_cc_tests): Call it.
1611 * svalue.cc (class involvement_visitor): New class
1612 (svalue::involves_p): New.
1613 * svalue.h (svalue::involves_p): New decl.
1615 2021-03-19 David Malcolm <dmalcolm@redhat.com>
1617 PR analyzer/99614
1618 * diagnostic-manager.cc (class epath_finder): Add
1619 DISABLE_COPY_AND_ASSIGN.
1621 2021-03-15 Martin Liska <mliska@suse.cz>
1623 * sm-file.cc (get_file_using_fns): Add missing comma in initializer.
1625 2021-03-11 David Malcolm <dmalcolm@redhat.com>
1627 PR analyzer/96374
1628 * analyzer.opt (-param=analyzer-max-infeasible-edges=): New param.
1629 (fdump-analyzer-feasibility): New flag.
1630 * diagnostic-manager.cc: Include "analyzer/trimmed-graph.h" and
1631 "analyzer/feasible-graph.h".
1632 (epath_finder::epath_finder): Convert m_sep to a pointer and
1633 only create it if !flag_analyzer_feasibility.
1634 (epath_finder::~epath_finder): New.
1635 (epath_finder::m_sep): Convert to a pointer.
1636 (epath_finder::get_best_epath): Add param "diag_idx" and use it
1637 when logging. Rather than finding the shortest path and then
1638 checking feasibility, instead use explore_feasible_paths unless
1639 !flag_analyzer_feasibility, in which case simply use the shortest
1640 path, and note if it is infeasible. Update for m_sep becoming a
1641 pointer.
1642 (class feasible_worklist): New.
1643 (epath_finder::explore_feasible_paths): New.
1644 (epath_finder::process_worklist_item): New.
1645 (class dump_eg_with_shortest_path): New.
1646 (epath_finder::dump_trimmed_graph): New.
1647 (epath_finder::dump_feasible_graph): New.
1648 (saved_diagnostic::saved_diagnostic): Add "idx" param, using it
1649 on new field m_idx.
1650 (saved_diagnostic::to_json): Dump m_idx.
1651 (saved_diagnostic::calc_best_epath): Pass m_idx to get_best_epath.
1652 Remove assertion that m_problem was set when m_best_epath is NULL.
1653 (diagnostic_manager::add_diagnostic): Pass an index when created
1654 saved_diagnostic instances.
1655 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add
1656 "idx" param.
1657 (saved_diagnostic::get_index): New accessor.
1658 (saved_diagnostic::m_idx): New field.
1659 * engine.cc (exploded_node::dump_dot): Call args.dump_extra_info.
1660 Move code to...
1661 (exploded_node::dump_processed_stmts): ...this new function and...
1662 (exploded_node::dump_saved_diagnostics): ...this new function.
1663 Add index of each diagnostic.
1664 (exploded_edge::dump_dot): Move bulk of code to...
1665 (exploded_edge::dump_dot_label): ...this new function.
1666 * exploded-graph.h (eg_traits::dump_args_t::dump_extra_info): New
1667 vfunc.
1668 (exploded_node::dump_processed_stmts): New decl.
1669 (exploded_node::dump_saved_diagnostics): New decl.
1670 (exploded_edge::dump_dot_label): New decl.
1671 * feasible-graph.cc: New file.
1672 * feasible-graph.h: New file.
1673 * trimmed-graph.cc: New file.
1674 * trimmed-graph.h: New file.
1676 2021-03-11 David Malcolm <dmalcolm@redhat.com>
1678 * diagnostic-manager.cc (epath_finder::epath_finder):
1679 Update shortest_paths init for new param.
1681 2021-03-10 David Malcolm <dmalcolm@redhat.com>
1683 PR analyzer/96374
1684 * engine.cc (exploded_path::feasible_p): Move "snodes_visited" and
1685 "model" locals into a new class feasibility_state. Move heart
1686 of per-edge processing into
1687 feasibility_state::maybe_update_for_edge.
1688 (feasibility_state::feasibility_state): New.
1689 (feasibility_state::maybe_update_for_edge): New, based on loop
1690 body in exploded_path::feasible_p.
1691 * exploded-graph.h (class feasibility_state): New.
1693 2021-03-10 David Malcolm <dmalcolm@redhat.com>
1695 * supergraph.h
1696 (callgraph_superedge::dyn_cast_callgraph_superedge): New.
1697 (call_superedge::dyn_cast_callgraph_superedge): Delete.
1698 (return_superedge::dyn_cast_callgraph_superedge): Delete.
1700 2021-03-02 Martin Liska <mliska@suse.cz>
1702 * diagnostic-manager.cc (diagnostic_manager::emit_saved_diagnostics):
1703 Do not pass engine.
1705 2021-02-26 David Malcolm <dmalcolm@redhat.com>
1707 * engine.cc (exploded_path::exploded_path): New copy-ctor.
1708 * exploded-graph.h (exploded_path::operator=): Drop decl.
1710 2021-02-26 David Malcolm <dmalcolm@redhat.com>
1712 PR analyzer/96374
1713 * diagnostic-manager.cc (class epath_finder): New.
1714 (epath_finder::get_best_epath): New.
1715 (saved_diagnostic::saved_diagnostic): Update for replacement of
1716 m_state and m_epath_length with m_best_epath.
1717 (saved_diagnostic::~saved_diagnostic): Delete m_best_epath.
1718 (saved_diagnostic::to_json): Update "path_length" to be optional.
1719 (saved_diagnostic::calc_best_epath): New, based on
1720 dedupe_winners::add and parts of dedupe_key::dedupe_key.
1721 (saved_diagnostic::get_epath_length): New.
1722 (saved_diagnostic::add_duplicate): New.
1723 (dedupe_key::dedupe_key): Drop epath param. Move invocation of
1724 stmt_finder to saved_diagnostic::calc_best_epath.
1725 (class dedupe_candidate): Delete.
1726 (class dedupe_hash_map_traits): Update to use saved_diagnotic *
1727 rather than dedupe_candidate * as the value_type/compare_type.
1728 (dedupe_winners::~dedupe_winners): Don't delete the values.
1729 (dedupe_winners::add): Convert param from shortest_exploded_paths to
1730 epath_finder. Drop "eg" param. Drop dedupe_candidate, moving
1731 path generation and feasiblity checking to
1732 epath_finder::get_best_epath. Update winner-selection for move
1733 of epaths from dedupe_candidate to saved_diagnostic.
1734 (dedupe_winners::emit_best): Update for removal of class
1735 dedupe_candidate.
1736 (dedupe_winners::map_t): Update to use saved_diagnotic * rather
1737 than dedupe_candidate * as the value_type/compare_type.
1738 (diagnostic_manager::emit_saved_diagnostics): Move
1739 shortest_exploded_paths instance into epath_finder and pass that
1740 around instead.
1741 (diagnostic_manager::emit_saved_diagnostic): Drop epath, stmt
1742 and num_dupes params, instead getting these from the
1743 saved_diagnostic. Use correct location in inform_n call.
1744 * diagnostic-manager.h (class epath_finder): New forward decl.
1745 (saved_diagnostic::status): Drop enum.
1746 (saved_diagnostic::set_feasible): Drop.
1747 (saved_diagnostic::set_infeasible): Drop.
1748 (saved_diagnostic::get_status): Drop.
1749 (saved_diagnostic::calc_best_epath): New decl.
1750 (saved_diagnostic::get_best_epath): New decl.
1751 (saved_diagnostic::get_epath_length): New decl.
1752 (saved_diagnostic::set_epath_length): Drop.
1753 (saved_diagnostic::get_epath_length): Drop inline implementation.
1754 (saved_diagnostic::add_duplicate): New.
1755 (saved_diagnostic::get_num_dupes): New.
1756 (saved_diagnostic::m_d): Document ownership.
1757 (saved_diagnostic::m_trailing_eedge): Make const.
1758 (saved_diagnostic::m_status): Drop field.
1759 (saved_diagnostic::m_epath_length): Drop field.
1760 (saved_diagnostic::m_best_epath): New field.
1761 (saved_diagnostic::m_problem): Document ownership.
1762 (saved_diagnostic::m_duplicates): New field.
1763 (diagnostic_manager::emit_saved_diagnostic): Drop params epath,
1764 stmt, and num_dupes.
1765 * engine.cc (exploded_graph_annotator::print_saved_diagnostic):
1766 Update for changes to saved_diagnostic class.
1767 * exploded-graph.h (exploded_path::feasible_p): Drop unused
1768 overloaded decl.
1770 2021-02-25 David Malcolm <dmalcolm@redhat.com>
1772 PR analyzer/99193
1773 * region-model-impl-calls.cc (region_model::impl_call_realloc): New.
1774 * region-model.cc (region_model::on_call_pre): Call it.
1775 * region-model.h (region_model::impl_call_realloc): New decl.
1776 * sm-malloc.cc (enum wording): Add WORDING_REALLOCATED.
1777 (malloc_state_machine::m_realloc): New field.
1778 (use_after_free::describe_state_change): Add case for
1779 WORDING_REALLOCATED.
1780 (use_after_free::describe_final_event): Likewise.
1781 (malloc_state_machine::malloc_state_machine): Initialize
1782 m_realloc.
1783 (malloc_state_machine::on_stmt): Handle realloc by calling...
1784 (malloc_state_machine::on_realloc_call): New.
1786 2021-02-22 David Malcolm <dmalcolm@redhat.com>
1788 PR analyzer/99196
1789 * engine.cc (exploded_node::on_stmt): Provide terminate_path
1790 flag as a way for on_call_pre to terminate the current analysis
1791 path.
1792 * region-model-impl-calls.cc (call_details::num_args): New.
1793 (region_model::impl_call_error): New.
1794 * region-model.cc (region_model::on_call_pre): Add param
1795 "out_terminate_path". Handle "error" and "error_at_line".
1796 * region-model.h (call_details::num_args): New decl.
1797 (region_model::on_call_pre): Add param "out_terminate_path".
1798 (region_model::impl_call_error): New decl.
1800 2021-02-17 David Malcolm <dmalcolm@redhat.com>
1802 PR analyzer/98969
1803 * constraint-manager.cc (dead_svalue_purger::should_purge_p):
1804 Update for change to svalue::live_p.
1805 * program-state.cc (sm_state_map::on_liveness_change): Likewise.
1806 (program_state::detect_leaks): Likewise.
1807 * region-model-reachability.cc (reachable_regions::init_cluster):
1808 When dealing with a symbolic region, if the underlying pointer is
1809 implicitly live, add the region to the reachable regions.
1810 * region-model.cc (region_model::compare_initial_and_pointer):
1811 Move logic for detecting initial values of params to
1812 initial_svalue::initial_value_of_param_p.
1813 * svalue.cc (svalue::live_p): Convert "live_svalues" from a
1814 reference to a pointer; support it being NULL.
1815 (svalue::implicitly_live_p): Convert first param from a
1816 refererence to a pointer.
1817 (region_svalue::implicitly_live_p): Likewise.
1818 (constant_svalue::implicitly_live_p): Likewise.
1819 (initial_svalue::implicitly_live_p): Likewise. Treat the initial
1820 values of params for the top level frame as still live.
1821 (initial_svalue::initial_value_of_param_p): New function, taken
1822 from a test in region_model::compare_initial_and_pointer.
1823 (unaryop_svalue::implicitly_live_p): Convert first param from a
1824 refererence to a pointer.
1825 (binop_svalue::implicitly_live_p): Likewise.
1826 (sub_svalue::implicitly_live_p): Likewise.
1827 (unmergeable_svalue::implicitly_live_p): Likewise.
1828 * svalue.h (svalue::live_p): Likewise.
1829 (svalue::implicitly_live_p): Likewise.
1830 (region_svalue::implicitly_live_p): Likewise.
1831 (constant_svalue::implicitly_live_p): Likewise.
1832 (initial_svalue::implicitly_live_p): Likewise.
1833 (initial_svalue::initial_value_of_param_p): New decl.
1834 (unaryop_svalue::implicitly_live_p): Convert first param from a
1835 refererence to a pointer.
1836 (binop_svalue::implicitly_live_p): Likewise.
1837 (sub_svalue::implicitly_live_p): Likewise.
1838 (unmergeable_svalue::implicitly_live_p): Likewise.
1840 2021-02-12 David Malcolm <dmalcolm@redhat.com>
1842 PR analyzer/98969
1843 * engine.cc (readability): Add names for the various arbitrary
1844 values. Handle NOP_EXPR and INTEGER_CST.
1845 (readability_comparator): Combine the readability tests for
1846 tree and stack depth, rather than performing them sequentially.
1847 (impl_region_model_context::on_state_leak): Strip off top-level
1848 casts.
1849 * region-model.cc (region_model::get_representative_path_var): Add
1850 type-checking, moving the bulk of the implementation to...
1851 (region_model::get_representative_path_var_1): ...here. Respect
1852 types in casts by recursing and re-adding the cast, rather than
1853 merely stripping them off. Use the correct type when handling
1854 region_svalue.
1855 (region_model::get_representative_tree): Strip off any top-level
1856 cast.
1857 (region_model::get_representative_path_var): Add type-checking,
1858 moving the bulk of the implementation to...
1859 (region_model::get_representative_path_var_1): ...here.
1860 * region-model.h (region_model::get_representative_path_var_1):
1861 New decl
1862 (region_model::get_representative_path_var_1): New decl.
1863 * store.cc (append_pathvar_with_type): New.
1864 (binding_cluster::get_representative_path_vars): Cast path_vars
1865 to the correct type when adding them to *OUT_PVS.
1867 2021-02-09 David Malcolm <dmalcolm@redhat.com>
1869 PR analyzer/98575
1870 * sm-file.cc (is_file_using_fn_p): Support "_IO_"-prefixed
1871 variants.
1873 2021-02-09 David Malcolm <dmalcolm@redhat.com>
1875 PR analyzer/98575
1876 * store.cc (store::set_value): Treat a pointer written to *UNKNOWN
1877 as having escaped.
1879 2021-02-02 David Malcolm <dmalcolm@redhat.com>
1881 PR analyzer/93355
1882 PR analyzer/96374
1883 * engine.cc (toplevel_function_p): Simplify so that
1884 we only reject functions with a "__analyzer_" prefix.
1885 (add_any_callbacks): Delete.
1886 (exploded_graph::build_initial_worklist): Update for
1887 dropped param of toplevel_function_p.
1888 (exploded_graph::build_initial_worklist): Don't bother
1889 looking for callbacks that are reachable from global
1890 initializers.
1892 2021-02-01 David Malcolm <dmalcolm@redhat.com>
1894 PR analyzer/98918
1895 * region-model-manager.cc
1896 (region_model_manager::get_or_create_initial_value):
1897 Fold the initial value of *UNKNOWN_PTR to an UNKNOWN value.
1898 (region_model_manager::get_field_region): Fold the value
1899 of UNKNOWN_PTR->FIELD to *UNKNOWN_PTR_OF_&FIELD_TYPE.
1901 2021-01-29 David Malcolm <dmalcolm@redhat.com>
1903 * checker-path.cc (event_kind_to_string): Handle
1904 EK_START_CONSOLIDATED_CFG_EDGES and
1905 EK_END_CONSOLIDATED_CFG_EDGES.
1906 (start_consolidated_cfg_edges_event::get_desc): New.
1907 (checker_path::cfg_edge_pair_at_p): New.
1908 * checker-path.h (enum event_kind): Add
1909 EK_START_CONSOLIDATED_CFG_EDGES and
1910 EK_END_CONSOLIDATED_CFG_EDGES.
1911 (class start_consolidated_cfg_edges_event): New class.
1912 (class end_consolidated_cfg_edges_event): New class.
1913 (checker_path::delete_events): New.
1914 (checker_path::replace_event): New.
1915 (checker_path::cfg_edge_pair_at_p): New decl.
1916 * diagnostic-manager.cc (diagnostic_manager::prune_path): Call
1917 consolidate_conditions.
1918 (same_line_as_p): New.
1919 (diagnostic_manager::consolidate_conditions): New.
1920 * diagnostic-manager.h
1921 (diagnostic_manager::consolidate_conditions): New decl.
1923 2021-01-18 David Malcolm <dmalcolm@redhat.com>
1925 * analyzer.h (is_std_named_call_p): New decl.
1926 * diagnostic-manager.cc (path_builder::get_sm): New.
1927 (state_change_event_creator::state_change_event_creator): Add "pb"
1928 param.
1929 (state_change_event_creator::on_global_state_change): Don't consider
1930 state changes affecting other state_machines.
1931 (state_change_event_creator::on_state_change): Likewise.
1932 (state_change_event_creator::m_pb): New field.
1933 (diagnostic_manager::add_events_for_eedge): Pass pb to visitor
1934 ctor.
1935 * region-model-impl-calls.cc
1936 (region_model::impl_deallocation_call): New.
1937 * region-model.cc: Include "attribs.h".
1938 (region_model::on_call_post): Handle fndecls referenced by
1939 __attribute__((deallocated_by(FOO))).
1940 * region-model.h (region_model::impl_deallocation_call): New decl.
1941 * sm-malloc.cc: Include "stringpool.h" and "attribs.h". Add
1942 leading comment.
1943 (class api): Delete.
1944 (enum resource_state): Update comment for change from api to
1945 deallocator and deallocator_set.
1946 (allocation_state::allocation_state): Drop api param. Add
1947 "deallocators" and "deallocator".
1948 (allocation_state::m_api): Drop field in favor of...
1949 (allocation_state::m_deallocators): New field.
1950 (allocation_state::m_deallocator): New field.
1951 (enum wording): Add WORDING_DEALLOCATED.
1952 (struct deallocator): New.
1953 (struct standard_deallocator): New.
1954 (struct custom_deallocator): New.
1955 (struct deallocator_set): New.
1956 (struct custom_deallocator_set): New.
1957 (struct standard_deallocator_set): New.
1958 (struct deallocator_set_map_traits): New.
1959 (malloc_state_machine::m_malloc): Drop field
1960 (malloc_state_machine::m_scalar_new): Likewise.
1961 (malloc_state_machine::m_vector_new): Likewise.
1962 (malloc_state_machine::m_free): New field
1963 (malloc_state_machine::m_scalar_delete): Likewise.
1964 (malloc_state_machine::m_vector_delete): Likewise.
1965 (malloc_state_machine::deallocator_map_t): New typedef.
1966 (malloc_state_machine::m_deallocator_map): New field.
1967 (malloc_state_machine::deallocator_set_cache_t): New typedef.
1968 (malloc_state_machine::m_custom_deallocator_set_cache): New field.
1969 (malloc_state_machine::custom_deallocator_set_map_t): New typedef.
1970 (malloc_state_machine::m_custom_deallocator_set_map): New field.
1971 (malloc_state_machine::m_dynamic_sets): New field.
1972 (malloc_state_machine::m_dynamic_deallocators): New field.
1973 (api::api): Delete.
1974 (deallocator::deallocator): New ctor.
1975 (deallocator::hash): New.
1976 (deallocator::dump_to_pp): New.
1977 (deallocator::cmp): New.
1978 (deallocator::cmp_ptr_ptr): New.
1979 (standard_deallocator::standard_deallocator): New ctor.
1980 (deallocator_set::deallocator_set): New ctor.
1981 (deallocator_set::dump): New.
1982 (custom_deallocator_set::custom_deallocator_set): New ctor.
1983 (custom_deallocator_set::contains_p): New.
1984 (custom_deallocator_set::maybe_get_single): New.
1985 (custom_deallocator_set::dump_to_pp): New.
1986 (standard_deallocator_set::standard_deallocator_set): New ctor.
1987 (standard_deallocator_set::contains_p): New.
1988 (standard_deallocator_set::maybe_get_single): New.
1989 (standard_deallocator_set::dump_to_pp): New.
1990 (start_p): New.
1991 (class mismatching_deallocation): Update for conversion from api
1992 to deallocator_set and deallocator.
1993 (double_free::emit): Use %qs.
1994 (class use_after_free): Update for conversion from api to
1995 deallocator_set and deallocator.
1996 (malloc_leak::describe_state_change): Only emit "allocated here" on
1997 a start->nonnull transition, rather than on other transitions to
1998 nonnull.
1999 (allocation_state::dump_to_pp): Update for conversion from api to
2000 deallocator_set.
2001 (allocation_state::get_nonnull): Likewise.
2002 (malloc_state_machine::malloc_state_machine): Likewise.
2003 (malloc_state_machine::~malloc_state_machine): New.
2004 (malloc_state_machine::add_state): Update for conversion from api
2005 to deallocator_set.
2006 (malloc_state_machine::get_or_create_custom_deallocator_set): New.
2007 (malloc_state_machine::maybe_create_custom_deallocator_set): New.
2008 (malloc_state_machine::get_or_create_deallocator): New.
2009 (malloc_state_machine::on_stmt): Update for conversion from api
2010 to deallocator_set. Handle "__attribute__((malloc(FOO)))", and
2011 the special attribute set on FOO.
2012 (malloc_state_machine::on_allocator_call): Update for conversion
2013 from api to deallocator_set. Add "returns_nonnull" param and use
2014 it to affect which state to transition to.
2015 (malloc_state_machine::on_deallocator_call): Update for conversion
2016 from api to deallocator_set.
2018 2021-01-14 David Malcolm <dmalcolm@redhat.com>
2020 * engine.cc (strongly_connected_components::to_json): New.
2021 (worklist::to_json): New.
2022 (exploded_graph::to_json): JSON-ify the worklist.
2023 * exploded-graph.h (strongly_connected_components::to_json): New
2024 decl.
2025 (worklist::to_json): New decl.
2026 * store.cc (store::to_json): Fix comment.
2027 * supergraph.cc (supernode::to_json): Fix reference to
2028 "returning_call" in comment. Add optional "fun" to JSON.
2029 (edge_kind_to_string): New.
2030 (superedge::to_json): Add "kind" to JSON.
2032 2021-01-14 David Malcolm <dmalcolm@redhat.com>
2034 PR analyzer/98679
2035 * analyzer.h (region_offset::operator==): Make const.
2036 * pending-diagnostic.h (pending_diagnostic::equal_p): Likewise.
2037 * store.h (binding_cluster::for_each_value): Likewise.
2038 (binding_cluster::for_each_binding): Likewise.
2040 2021-01-12 David Malcolm <dmalcolm@redhat.com>
2042 PR analyzer/98628
2043 * store.cc (binding_cluster::make_unknown_relative_to): Don't mark
2044 dereferenced unknown pointers as having escaped.
2046 2021-01-07 David Malcolm <dmalcolm@redhat.com>
2048 PR analyzer/98580
2049 * region.cc (decl_region::get_svalue_for_initializer): Gracefully
2050 handle when LTO writes out DECL_INITIAL as error_mark_node.
2052 2021-01-07 David Malcolm <dmalcolm@redhat.com>
2054 PR analyzer/97074
2055 * store.cc (binding_cluster::can_merge_p): Add "out_store" param
2056 and pass to calls to binding_cluster::make_unknown_relative_to.
2057 (binding_cluster::make_unknown_relative_to): Add "out_store"
2058 param. Use it to mark base regions that are pointed to by
2059 pointers that become unknown as having escaped.
2060 (store::can_merge_p): Pass out_store to
2061 binding_cluster::can_merge_p.
2062 * store.h (binding_cluster::can_merge_p): Add "out_store" param.
2063 (binding_cluster::make_unknown_relative_to): Likewise.
2064 * svalue.cc (region_svalue::implicitly_live_p): New vfunc.
2065 * svalue.h (region_svalue::implicitly_live_p): New vfunc decl.
2067 2021-01-07 David Malcolm <dmalcolm@redhat.com>
2069 PR analyzer/98564
2070 * engine.cc (exploded_path::feasible_p): Add missing call to
2071 bitmap_clear.
2073 2021-01-06 David Malcolm <dmalcolm@redhat.com>
2075 PR analyzer/97072
2076 * region-model-reachability.cc (reachable_regions::init_cluster):
2077 Convert symbolic region handling to a switch statement. Add cases
2078 to handle SK_UNKNOWN and SK_CONJURED.
2080 2021-01-05 David Malcolm <dmalcolm@redhat.com>
2082 PR analyzer/98293
2083 * store.cc (binding_map::apply_ctor_to_region): When "index" is
2084 NULL, iterate through the fields for RECORD_TYPEs, rather than
2085 creating an INTEGER_CST index.
2087 2020-11-30 David Malcolm <dmalcolm@redhat.com>
2089 * analyzer-pass.cc: Include "analyzer/analyzer.h" for the
2090 declaration of sorry_no_analyzer; include "tree.h" and
2091 "function.h" as these are needed by it.
2093 2020-11-30 David Malcolm <dmalcolm@redhat.com>
2095 * analyzer-pass.cc (pass_analyzer::execute): Move sorry call to...
2096 (sorry_no_analyzer): New.
2097 * analyzer.h (class state_machine): New forward decl.
2098 (class logger): New forward decl.
2099 (class plugin_analyzer_init_iface): New.
2100 (sorry_no_analyzer): New decl.
2101 * checker-path.cc (checker_path::fixup_locations): New.
2102 * checker-path.h (checker_event::set_location): New.
2103 (checker_path::fixup_locations): New decl.
2104 * diagnostic-manager.cc
2105 (diagnostic_manager::emit_saved_diagnostic): Call
2106 checker_path::fixup_locations, and call fixup_location
2107 on the primary location.
2108 * engine.cc: Include "plugin.h".
2109 (class plugin_analyzer_init_impl): New.
2110 (impl_run_checkers): Invoke PLUGIN_ANALYZER_INIT callbacks.
2111 * pending-diagnostic.h (pending_diagnostic::fixup_location): New
2112 vfunc.
2114 2020-11-18 David Malcolm <dmalcolm@redhat.com>
2116 PR analyzer/97893
2117 * sm-malloc.cc (null_deref::emit): Use CWE-476 rather than
2118 CWE-690, as this isn't due to an unchecked return value.
2119 (null_arg::emit): Likewise.
2121 2020-11-12 David Malcolm <dmalcolm@redhat.com>
2123 * checker-path.h (checker_event::get_id_ptr): New.
2124 * diagnostic-manager.cc (path_builder::path_builder): Add "sd"
2125 param and use it to initialize new field "m_sd".
2126 (path_builder::get_pending_diagnostic): New.
2127 (path_builder::m_sd): New field.
2128 (diagnostic_manager::emit_saved_diagnostic): Pass sd to
2129 path_builder ctor.
2130 (diagnostic_manager::add_events_for_superedge): Call new
2131 maybe_add_custom_events_for_superedge vfunc.
2132 * engine.cc (stale_jmp_buf::stale_jmp_buf): Add "setjmp_point"
2133 param and use it to initialize new field "m_setjmp_point".
2134 Initialize new field "m_stack_pop_event".
2135 (stale_jmp_buf::maybe_add_custom_events_for_superedge): New vfunc
2136 implementation.
2137 (stale_jmp_buf::describe_final_event): New vfunc implementation.
2138 (stale_jmp_buf::m_setjmp_point): New field.
2139 (stale_jmp_buf::m_stack_pop_event): New field.
2140 (exploded_node::on_longjmp): Pass setjmp_point to stale_jmp_buf
2141 ctor.
2142 * pending-diagnostic.h
2143 (pending_diagnostic::maybe_add_custom_events_for_superedge): New
2144 vfunc.
2146 2020-11-12 David Malcolm <dmalcolm@redhat.com>
2148 PR tree-optimization/97424
2149 * analyzer.opt (Wanalyzer-shift-count-negative): New.
2150 (Wanalyzer-shift-count-overflow): New.
2151 * region-model.cc (class shift_count_negative_diagnostic): New.
2152 (class shift_count_overflow_diagnostic): New.
2153 (region_model::get_gassign_result): Complain about shift counts that
2154 are negative or are >= the operand's type's width.
2156 2020-11-10 Martin Liska <mliska@suse.cz>
2158 * constraint-manager.cc (constraint_manager::merge): Remove
2159 unused code.
2160 * constraint-manager.h: Likewise.
2161 * program-state.cc (sm_state_map::sm_state_map): Likewise.
2162 (program_state::program_state): Likewise.
2163 (test_sm_state_map): Likewise.
2164 * program-state.h: Likewise.
2165 * region-model-reachability.cc (reachable_regions::reachable_regions): Likewise.
2166 * region-model-reachability.h: Likewise.
2167 * region-model.cc (region_model::handle_unrecognized_call): Likewise.
2168 (region_model::get_reachable_svalues): Likewise.
2169 (region_model::can_merge_with_p): Likewise.
2171 2020-11-05 David Malcolm <dmalcolm@redhat.com>
2173 PR analyzer/97668
2174 * svalue.cc (cmp_cst): Handle COMPLEX_CST.
2176 2020-10-29 David Malcolm <dmalcolm@redhat.com>
2178 * program-state.cc (sm_state_map::on_liveness_change): Sort the
2179 leaking svalues before calling on_state_leak.
2180 (program_state::detect_leaks): Likewise when calling
2181 on_svalue_leak.
2182 * region-model-reachability.cc
2183 (reachable_regions::mark_escaped_clusters): Likewise when
2184 calling on_escaped_function.
2186 2020-10-29 David Malcolm <dmalcolm@redhat.com>
2188 PR analyzer/97608
2189 * region-model-reachability.cc (reachable_regions::handle_sval):
2190 Operands of reachable reversible operations are reachable.
2192 2020-10-29 David Malcolm <dmalcolm@redhat.com>
2194 * analyzer.h (class state_machine): New forward decl.
2195 (class logger): Likewise.
2196 (class visitor): Likewise.
2197 * complexity.cc: New file, taken from svalue.cc.
2198 * complexity.h: New file, taken from region-model.h.
2199 * region-model.h: Include "analyzer/svalue.h" and
2200 "analyzer/region.h". Move struct complexity to complexity.h.
2201 Move svalue, its subclasses and supporting decls to svalue.h.
2202 Move region, its subclasses and supporting decls to region.h.
2203 * region.cc: Include "analyzer/region.h".
2204 (symbolic_region::symbolic_region): Move here from region-model.h.
2205 * region.h: New file, based on material from region-model.h.
2206 * svalue.cc: Include "analyzer/svalue.h".
2207 (complexity::complexity): Move to complexity.cc.
2208 (complexity::from_pair): Likewise.
2209 * svalue.h: New file, based on material from region-model.h.
2211 2020-10-29 David Malcolm <dmalcolm@redhat.com>
2213 * program-state.cc (sm_state_map::print): Guard the printing of
2214 the origin pointer with !flag_dump_noaddr.
2215 * region.cc (string_region::dump_to_pp): Likewise for
2216 m_string_cst.
2218 2020-10-27 David Malcolm <dmalcolm@redhat.com>
2220 PR analyzer/97568
2221 * region-model.cc (region_model::get_initial_value_for_global):
2222 Move check that !DECL_EXTERNAL from here to...
2223 * region.cc (decl_region::get_svalue_for_initializer): ...here,
2224 using it to reject zero initialization.
2226 2020-10-27 Markus Böck <markus.boeck02@gmail.com>
2228 PR analyzer/96608
2229 * store.h (hash): Cast to intptr_t instead of long
2231 2020-10-27 David Malcolm <dmalcolm@redhat.com>
2233 * constraint-manager.cc (svalue_cmp_by_ptr): Delete.
2234 (equiv_class::canonicalize): Use svalue::cmp_ptr_ptr instead.
2235 (equiv_class_cmp): Eliminate pointer comparison.
2236 * diagnostic-manager.cc (dedupe_key::comparator): If they are at
2237 the same location, also compare epath ength and pending_diagnostic
2238 kind.
2239 * engine.cc (readability_comparator): If two path_vars have the
2240 same readability, then impose an arbitrary ordering on them.
2241 (worklist::key_t::cmp): If two points have the same plan ordering,
2242 continue the comparison. Call sm_state_map::cmp rather than
2243 comparing hash values.
2244 * program-state.cc (sm_state_map::entry_t::cmp): New.
2245 (sm_state_map::cmp): New.
2246 * program-state.h (sm_state_map::entry_t::cmp): New decl.
2247 (sm_state_map::elements): New.
2248 (sm_state_map::cmp): New.
2250 2020-10-27 David Malcolm <dmalcolm@redhat.com>
2252 * engine.cc (setjmp_record::cmp): New.
2253 (supernode_cluster::dump_dot): Avoid embedding pointer in cluster
2254 name.
2255 (supernode_cluster::cmp_ptr_ptr): New.
2256 (function_call_string_cluster::dump_dot): Avoid embedding pointer
2257 in cluster name. Sort m_map when dumping child clusters.
2258 (function_call_string_cluster::cmp_ptr_ptr): New.
2259 (root_cluster::dump_dot): Sort m_map when dumping child clusters.
2260 * program-point.cc (function_point::cmp): New.
2261 (function_point::cmp_ptr): New.
2262 * program-point.h (function_point::cmp): New decl.
2263 (function_point::cmp_ptr): New decl.
2264 * program-state.cc (sm_state_map::print): Sort the values. Guard
2265 the printing of pointers with !flag_dump_noaddr.
2266 (program_state::prune_for_point): Sort the regions.
2267 (log_set_of_svalues): Sort the values. Guard the printing of
2268 pointers with !flag_dump_noaddr.
2269 * region-model-manager.cc (log_uniq_map): Sort the values.
2270 * region-model-reachability.cc (dump_set): New function template.
2271 (reachable_regions::dump_to_pp): Use it.
2272 * region-model.h (svalue::cmp_ptr): New decl.
2273 (svalue::cmp_ptr_ptr): New decl.
2274 (setjmp_record::cmp): New decl.
2275 (placeholder_svalue::get_name): New accessor.
2276 (widening_svalue::get_point): New accessor.
2277 (compound_svalue::get_map): New accessor.
2278 (conjured_svalue::get_stmt): New accessor.
2279 (conjured_svalue::get_id_region): New accessor.
2280 (region::cmp_ptrs): Rename to...
2281 (region::cmp_ptr_ptr): ...this.
2282 * region.cc (region::cmp_ptrs): Rename to...
2283 (region::cmp_ptr_ptr): ...this.
2284 * state-purge.cc
2285 (state_purge_per_ssa_name::state_purge_per_ssa_name): Sort
2286 m_points_needing_name when dumping.
2287 * store.cc (concrete_binding::cmp_ptr_ptr): New.
2288 (symbolic_binding::cmp_ptr_ptr): New.
2289 (binding_map::cmp): New.
2290 (get_sorted_parent_regions): Update for renaming of
2291 region::cmp_ptrs to region::cmp_ptr_ptr.
2292 (store::dump_to_pp): Likewise.
2293 (store::to_json): Likewise.
2294 (store::can_merge_p): Sort the base regions before considering
2295 them.
2296 * store.h (concrete_binding::cmp_ptr_ptr): New decl.
2297 (symbolic_binding::cmp_ptr_ptr): New decl.
2298 (binding_map::cmp): New decl.
2299 * supergraph.cc (supergraph::supergraph): Assign UIDs to the
2300 gimple stmts.
2301 * svalue.cc (cmp_cst): New.
2302 (svalue::cmp_ptr): New.
2303 (svalue::cmp_ptr_ptr): New.
2305 2020-10-27 David Malcolm <dmalcolm@redhat.com>
2307 * engine.cc (exploded_graph::get_or_create_node): Fix off-by-one
2308 when imposing param_analyzer_max_enodes_per_program_point limit.
2310 2020-10-27 David Malcolm <dmalcolm@redhat.com>
2312 * region-model.cc (region_model::get_representative_path_var):
2313 Implement case RK_LABEL.
2314 * region-model.h (label_region::get_label): New accessor.
2316 2020-10-22 David Malcolm <dmalcolm@redhat.com>
2318 PR analyzer/97514
2319 * engine.cc (exploded_graph::add_function_entry): Handle failure
2320 to create an enode, rather than asserting.
2322 2020-10-22 David Malcolm <dmalcolm@redhat.com>
2324 PR analyzer/97489
2325 * engine.cc (exploded_graph::add_function_entry): Assert that we
2326 have a function body.
2327 (exploded_graph::on_escaped_function): Reject fndecls that don't
2328 have a function body.
2330 2020-10-14 David Malcolm <dmalcolm@redhat.com>
2332 PR analyzer/93388
2333 * region-model.cc (region_model::get_initial_value_for_global):
2334 Fall back to returning an initial_svalue if
2335 decl_region::get_svalue_for_initializer fails.
2336 * region.cc (decl_region::get_svalue_for_initializer): Don't
2337 attempt to create a compound_svalue if the region has an unknown
2338 size.
2340 2020-10-14 David Malcolm <dmalcolm@redhat.com>
2342 PR analyzer/93723
2343 * store.cc (binding_map::apply_ctor_to_region): Remove redundant
2344 assertion.
2346 2020-10-12 David Malcolm <dmalcolm@redhat.com>
2348 PR analyzer/97258
2349 * engine.cc (impl_region_model_context::on_escaped_function): New
2350 vfunc.
2351 (exploded_graph::add_function_entry): Use m_functions_with_enodes
2352 to implement idempotency.
2353 (add_any_callbacks): New.
2354 (exploded_graph::build_initial_worklist): Use the above to find
2355 callbacks that are reachable from global initializers.
2356 (exploded_graph::on_escaped_function): New.
2357 * exploded-graph.h
2358 (impl_region_model_context::on_escaped_function): New decl.
2359 (exploded_graph::on_escaped_function): New decl.
2360 (exploded_graph::m_functions_with_enodes): New field.
2361 * region-model-reachability.cc
2362 (reachable_regions::reachable_regions): Replace "store" param with
2363 "model" param; use it to initialize m_model.
2364 (reachable_regions::add): When getting the svalue for the region,
2365 call get_store_value on the model rather than using an initial
2366 value.
2367 (reachable_regions::mark_escaped_clusters): Add ctxt param and
2368 use it to call on_escaped_function when a function_region escapes.
2369 * region-model-reachability.h
2370 (reachable_regions::reachable_regions): Replace "store" param with
2371 "model" param.
2372 (reachable_regions::mark_escaped_clusters): Add ctxt param.
2373 (reachable_regions::m_model): New field.
2374 * region-model.cc (region_model::handle_unrecognized_call): Update
2375 for change in reachable_regions ctor.
2376 (region_model::handle_unrecognized_call): Pass ctxt to
2377 mark_escaped_clusters.
2378 (region_model::get_reachable_svalues): Update for change in
2379 reachable_regions ctor.
2380 (region_model::get_initial_value_for_global): Read-only variables
2381 keep their initial values.
2382 * region-model.h (region_model_context::on_escaped_function): New
2383 vfunc.
2384 (noop_region_model_context::on_escaped_function): New.
2386 2020-10-12 David Malcolm <dmalcolm@redhat.com>
2388 * analyzer.opt (Wanalyzer-write-to-const): New.
2389 (Wanalyzer-write-to-string-literal): New.
2390 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
2391 Call check_for_writable_region.
2392 (region_model::impl_call_memset): Likewise.
2393 (region_model::impl_call_strcpy): Likewise.
2394 * region-model.cc (class write_to_const_diagnostic): New.
2395 (class write_to_string_literal_diagnostic): New.
2396 (region_model::check_for_writable_region): New.
2397 (region_model::set_value): Call check_for_writable_region.
2398 * region-model.h (region_model::check_for_writable_region): New
2399 decl.
2401 2020-10-07 David Malcolm <dmalcolm@redhat.com>
2403 PR analyzer/97116
2404 * sm-malloc.cc (method_p): New.
2405 (describe_argument_index): New.
2406 (inform_nonnull_attribute): Use describe_argument_index.
2407 (possible_null_arg::describe_final_event): Likewise.
2408 (null_arg::describe_final_event): Likewise.
2410 2020-09-29 David Malcolm <dmalcolm@redhat.com>
2412 PR analyzer/95188
2413 * engine.cc (stmt_requires_new_enode_p): Split enodes before
2414 "signal" calls.
2416 2020-09-29 David Malcolm <dmalcolm@redhat.com>
2418 * constraint-manager.cc
2419 (constraint_manager::add_constraint_internal): Whitespace fixes.
2420 Silence -Wsign-compare warning.
2421 * engine.cc (maybe_process_run_of_before_supernode_enodes):
2422 Silence -Wsign-compare warning.
2424 2020-09-28 David Malcolm <dmalcolm@redhat.com>
2426 * region-model.h (binop_svalue::dyn_cast_binop_svalue): Remove
2427 redundant "virtual". Add FINAL OVERRIDE.
2428 (widening_svalue::dyn_cast_widening_svalue): Add FINAL OVERRIDE.
2429 (compound_svalue::dyn_cast_compound_svalue): Likewise.
2430 (conjured_svalue::dyn_cast_conjured_svalue): Likewise.
2432 2020-09-28 David Malcolm <dmalcolm@redhat.com>
2434 * diagnostic-manager.cc (null_assignment_sm_context::m_visitor):
2435 Remove unused field.
2437 2020-09-28 David Malcolm <dmalcolm@redhat.com>
2439 PR analyzer/97233
2440 * analyzer.cc (is_longjmp_call_p): Require the initial argument
2441 to be a pointer.
2442 * engine.cc (exploded_node::on_longjmp): Likewise.
2444 2020-09-28 David Malcolm <dmalcolm@redhat.com>
2446 * program-state.cc (sm_state_map::print): Update check
2447 for m_global_state being the start state.
2449 2020-09-26 David Malcolm <dmalcolm@redhat.com>
2451 PR analyzer/96646
2452 PR analyzer/96841
2453 * region-model.cc (region_model::get_representative_path_var):
2454 When handling offset_region, wrap the MEM_REF's first argument in
2455 an ADDR_EXPR of pointer type, rather than simply using the tree
2456 for the parent region. Require the MEM_REF's second argument to
2457 be an integer constant.
2459 2020-09-24 David Malcolm <dmalcolm@redhat.com>
2461 * analyzer.h (struct rejected_constraint): New decl.
2462 * analyzer.opt (fanalyzer-feasibility): New option.
2463 * diagnostic-manager.cc (path_builder::path_builder): Add
2464 "problem" param and use it to initialize new field.
2465 (path_builder::get_feasibility_problem): New accessor.
2466 (path_builder::m_feasibility_problem): New field.
2467 (dedupe_winners::add): Remove inversion of logic in "if" clause,
2468 swapping if/else suites. In the !feasible_p suite, inspect
2469 flag_analyzer_feasibility and add code to handle when this
2470 is off, accepting the infeasible path, but recording the
2471 feasibility_problem.
2472 (diagnostic_manager::emit_saved_diagnostic): Pass the
2473 feasibility_problem to the path_builder.
2474 (diagnostic_manager::add_events_for_eedge): If we have
2475 a feasibility_problem at this edge, use it to add a custom event.
2476 * engine.cc (exploded_path::feasible_p): Pass a
2477 rejected_constraint ** to model.maybe_update_for_edge and transfer
2478 ownership of any created instance to any feasibility_problem.
2479 (feasibility_problem::dump_to_pp): New.
2480 * exploded-graph.h (feasibility_problem::feasibility_problem):
2481 Drop "model" param; add rejected_constraint * param.
2482 (feasibility_problem::~feasibility_problem): New.
2483 (feasibility_problem::dump_to_pp): New decl.
2484 (feasibility_problem::m_model): Drop field.
2485 (feasibility_problem::m_rc): New field.
2486 * program-point.cc (function_point::get_location): Handle
2487 PK_BEFORE_SUPERNODE and PK_AFTER_SUPERNODE.
2488 * program-state.cc (program_state::on_edge): Pass NULL to new
2489 param of region_model::maybe_update_for_edge.
2490 * region-model.cc (region_model::add_constraint): New overload
2491 adding a rejected_constraint ** param.
2492 (region_model::maybe_update_for_edge): Add rejected_constraint **
2493 param and pass it to the various apply_constraints_for_ calls.
2494 (region_model::apply_constraints_for_gcond): Add
2495 rejected_constraint ** param and pass it to add_constraint calls.
2496 (region_model::apply_constraints_for_gswitch): Likewise.
2497 (region_model::apply_constraints_for_exception): Likewise.
2498 (rejected_constraint::dump_to_pp): New.
2499 * region-model.h (region_model::maybe_update_for_edge):
2500 Add rejected_constraint ** param.
2501 (region_model::add_constraint): New overload adding a
2502 rejected_constraint ** param.
2503 (region_model::apply_constraints_for_gcond): Add
2504 rejected_constraint ** param.
2505 (region_model::apply_constraints_for_gswitch): Likewise.
2506 (region_model::apply_constraints_for_exception): Likewise.
2507 (struct rejected_constraint): New.
2509 2020-09-23 David Malcolm <dmalcolm@redhat.com>
2511 PR analyzer/97178
2512 * engine.cc (impl_run_checkers): Update for change to ext_state
2513 ctor.
2514 * program-state.cc (selftest::test_sm_state_map): Pass an engine
2515 instance to ext_state ctor.
2516 (selftest::test_program_state_1): Likewise.
2517 (selftest::test_program_state_2): Likewise.
2518 (selftest::test_program_state_merging): Likewise.
2519 (selftest::test_program_state_merging_2): Likewise.
2520 * program-state.h (extrinsic_state::extrinsic_state): Remove NULL
2521 default value for "eng" param.
2523 2020-09-23 Tobias Burnus <tobias@codesourcery.com>
2525 * analyzer-logging.cc: Guard '#pragma ... ignored "-Wformat-diag"'
2526 by '#if __GNUC__ >= 10'
2527 * analyzer.h: Likewise.
2528 * call-string.cc: Likewise.
2530 2020-09-23 David Malcolm <dmalcolm@redhat.com>
2532 * engine.cc (exploded_node::on_stmt): Replace sequence of dyn_cast
2533 with switch.
2535 2020-09-22 David Malcolm <dmalcolm@redhat.com>
2537 * analysis-plan.cc: Include "json.h".
2538 * analyzer.opt (fdump-analyzer-json): New.
2539 * call-string.cc: Include "json.h".
2540 (call_string::to_json): New.
2541 * call-string.h (call_string::to_json): New decl.
2542 * checker-path.cc: Include "json.h".
2543 * constraint-manager.cc: Include "json.h".
2544 (equiv_class::to_json): New.
2545 (constraint::to_json): New.
2546 (constraint_manager::to_json): New.
2547 * constraint-manager.h (equiv_class::to_json): New decl.
2548 (constraint::to_json): New decl.
2549 (constraint_manager::to_json): New decl.
2550 * diagnostic-manager.cc: Include "json.h".
2551 (saved_diagnostic::to_json): New.
2552 (diagnostic_manager::to_json): New.
2553 * diagnostic-manager.h (saved_diagnostic::to_json): New decl.
2554 (diagnostic_manager::to_json): New decl.
2555 * engine.cc: Include "json.h", <zlib.h>.
2556 (exploded_node::status_to_str): New.
2557 (exploded_node::to_json): New.
2558 (exploded_edge::to_json): New.
2559 (exploded_graph::to_json): New.
2560 (dump_analyzer_json): New.
2561 (impl_run_checkers): Call it.
2562 * exploded-graph.h (exploded_node::status_to_str): New decl.
2563 (exploded_node::to_json): New.
2564 (exploded_edge::to_json): New.
2565 (exploded_graph::to_json): New.
2566 * pending-diagnostic.cc: Include "json.h".
2567 * program-point.cc: Include "json.h".
2568 (program_point::to_json): New.
2569 * program-point.h (program_point::to_json): New decl.
2570 * program-state.cc: Include "json.h".
2571 (extrinsic_state::to_json): New.
2572 (sm_state_map::to_json): New.
2573 (program_state::to_json): New.
2574 * program-state.h (extrinsic_state::to_json): New decl.
2575 (sm_state_map::to_json): New decl.
2576 (program_state::to_json): New decl.
2577 * region-model-impl-calls.cc: Include "json.h".
2578 * region-model-manager.cc: Include "json.h".
2579 * region-model-reachability.cc: Include "json.h".
2580 * region-model.cc: Include "json.h".
2581 * region-model.h (svalue::to_json): New decl.
2582 (region::to_json): New decl.
2583 * region.cc: Include "json.h".
2584 (region::to_json: New.
2585 * sm-file.cc: Include "json.h".
2586 * sm-malloc.cc: Include "json.h".
2587 * sm-pattern-test.cc: Include "json.h".
2588 * sm-sensitive.cc: Include "json.h".
2589 * sm-signal.cc: Include "json.h".
2590 (signal_delivery_edge_info_t::to_json): New.
2591 * sm-taint.cc: Include "json.h".
2592 * sm.cc: Include "diagnostic.h", "tree-diagnostic.h", and
2593 "json.h".
2594 (state_machine::state::to_json): New.
2595 (state_machine::to_json): New.
2596 * sm.h (state_machine::state::to_json): New.
2597 (state_machine::to_json): New.
2598 * state-purge.cc: Include "json.h".
2599 * store.cc: Include "json.h".
2600 (binding_key::get_desc): New.
2601 (binding_map::to_json): New.
2602 (binding_cluster::to_json): New.
2603 (store::to_json): New.
2604 * store.h (binding_key::get_desc): New decl.
2605 (binding_map::to_json): New decl.
2606 (binding_cluster::to_json): New decl.
2607 (store::to_json): New decl.
2608 * supergraph.cc: Include "json.h".
2609 (supergraph::to_json): New.
2610 (supernode::to_json): New.
2611 (superedge::to_json): New.
2612 * supergraph.h (supergraph::to_json): New decl.
2613 (supernode::to_json): New decl.
2614 (superedge::to_json): New decl.
2615 * svalue.cc: Include "json.h".
2616 (svalue::to_json): New.
2618 2020-09-21 David Malcolm <dmalcolm@redhat.com>
2620 PR analyzer/97130
2621 * region-model-impl-calls.cc (call_details::get_arg_type): New.
2622 * region-model.cc (region_model::on_call_pre): Check that the
2623 initial arg is a pointer before calling impl_call_memset and
2624 impl_call_strlen.
2625 * region-model.h (call_details::get_arg_type): New decl.
2627 2020-09-21 David Malcolm <dmalcolm@redhat.com>
2629 PR analyzer/93355
2630 * sm-malloc.cc (malloc_state_machine::get_default_state): Look at
2631 the base region when considering pointers. Treat pointers to
2632 decls as being non-heap.
2634 2020-09-18 David Malcolm <dmalcolm@redhat.com>
2636 * checker-path.cc (warning_event::get_desc): Handle global state
2637 changes.
2639 2020-09-18 David Malcolm <dmalcolm@redhat.com>
2641 * sm-malloc.cc (malloc_state_machine::on_stmt): Handle strdup and
2642 strndup as being malloc-like allocators.
2644 2020-09-16 David Malcolm <dmalcolm@redhat.com>
2646 * engine.cc (strongly_connected_components::strong_connect): Only
2647 consider intraprocedural edges when creating SCCs.
2648 (worklist::key_t::cmp): Add comment. Treat call_string
2649 differences as more important than differences of program_point
2650 within a supernode.
2652 2020-09-16 David Malcolm <dmalcolm@redhat.com>
2654 * engine.cc (supernode_cluster::dump_dot): Show the SCC id
2655 in the per-supernode clusters in FILENAME.eg.dot output.
2656 (exploded_graph_annotator::add_node_annotations):
2657 Show the SCC of the supernode in FILENAME.supernode.eg.dot output.
2658 * exploded-graph.h (worklist::scc_id): New.
2659 (exploded_graph::get_scc_id): New.
2661 2020-09-16 David Malcolm <dmalcolm@redhat.com>
2663 * engine.cc (exploded_node::dump_dot): Show STATUS_BULK_MERGED.
2664 (exploded_graph::process_worklist): Call
2665 maybe_process_run_of_before_supernode_enodes.
2666 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
2667 New.
2668 (exploded_graph_annotator::print_enode): Show STATUS_BULK_MERGED.
2669 * exploded-graph.h (enum exploded_node::status): Add
2670 STATUS_BULK_MERGED.
2672 2020-09-16 David Malcolm <dmalcolm@redhat.com>
2674 * engine.cc
2675 (exploded_graph::process_node) <case PK_BEFORE_SUPERNODE>:
2676 Simplify by using program_point::get_next.
2677 * program-point.cc (program_point::get_next): New.
2678 * program-point.h (program_point::get_next): New decl.
2680 2020-09-16 David Malcolm <dmalcolm@redhat.com>
2682 * engine.cc (exploded_graph::get_or_create_node): Show the
2683 program point when issuing -Wanalyzer-too-complex due to hitting
2684 the per-program-point limit.
2686 2020-09-16 David Malcolm <dmalcolm@redhat.com>
2688 * region-model.cc (region_model::on_call_pre): Treat getchar as
2689 having no side-effects.
2691 2020-09-15 David Malcolm <dmalcolm@redhat.com>
2693 PR analyzer/96650
2694 * constraint-manager.cc (merger_fact_visitor::on_fact): Replace
2695 assertion that add_constraint succeeded with an assertion that
2696 if it fails, -fanalyzer-transitivity is off.
2698 2020-09-14 David Malcolm <dmalcolm@redhat.com>
2700 * analyzer.opt (-param=analyzer-max-constraints=): New param.
2701 * constraint-manager.cc
2702 (constraint_manager::add_constraint_internal): Silently reject
2703 attempts to add constraints when the above limit is reached.
2705 2020-09-14 David Malcolm <dmalcolm@redhat.com>
2707 PR analyzer/96653
2708 * constraint-manager.cc
2709 (constraint_manager::get_or_add_equiv_class): Don't accumulate
2710 transitive closure of all constraints on constants.
2712 2020-09-14 David Malcolm <dmalcolm@redhat.com>
2714 PR analyzer/97029
2715 * analyzer.cc (is_setjmp_call_p): Require the initial arg to be a
2716 pointer.
2717 * region-model.cc (region_model::deref_rvalue): Assert that the
2718 svalue is of pointer type.
2720 2020-09-11 David Malcolm <dmalcolm@redhat.com>
2722 PR analyzer/96798
2723 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
2724 New.
2725 (region_model::impl_call_strcpy): New.
2726 * region-model.cc (region_model::on_call_pre): Flag unhandled
2727 builtins that are non-pure as having unknown side-effects.
2728 Implement BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_STRCPY,
2729 BUILT_IN_STRCPY_CHK, BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED,
2730 BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_FPUTC,
2731 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
2732 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
2733 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR,
2734 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED,
2735 BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF.
2736 * region-model.h (region_model::impl_call_memcpy): New decl.
2737 (region_model::impl_call_strcpy): New decl.
2739 2020-09-09 David Malcolm <dmalcolm@redhat.com>
2741 PR analyzer/94355
2742 * analyzer.opt (Wanalyzer-mismatching-deallocation): New warning.
2743 * region-model-impl-calls.cc
2744 (region_model::impl_call_operator_new): New.
2745 (region_model::impl_call_operator_delete): New.
2746 * region-model.cc (region_model::on_call_pre): Detect operator new
2747 and operator delete.
2748 (region_model::on_call_post): Likewise.
2749 (region_model::maybe_update_for_edge): Detect EH edges and call...
2750 (region_model::apply_constraints_for_exception): New function.
2751 * region-model.h (region_model::impl_call_operator_new): New decl.
2752 (region_model::impl_call_operator_delete): New decl.
2753 (region_model::apply_constraints_for_exception): New decl.
2754 * sm-malloc.cc (enum resource_state): New.
2755 (struct allocation_state): New state subclass.
2756 (enum wording): New.
2757 (struct api): New.
2758 (malloc_state_machine::custom_data_t): New typedef.
2759 (malloc_state_machine::add_state): New decl.
2760 (malloc_state_machine::m_unchecked)
2761 (malloc_state_machine::m_nonnull)
2762 (malloc_state_machine::m_freed): Delete these states in favor
2763 of...
2764 (malloc_state_machine::m_malloc)
2765 (malloc_state_machine::m_scalar_new)
2766 (malloc_state_machine::m_vector_new): ...this new api instances,
2767 which own their own versions of these states.
2768 (malloc_state_machine::on_allocator_call): New decl.
2769 (malloc_state_machine::on_deallocator_call): New decl.
2770 (api::api): New ctor.
2771 (dyn_cast_allocation_state): New.
2772 (as_a_allocation_state): New.
2773 (get_rs): New.
2774 (unchecked_p): New.
2775 (nonnull_p): New.
2776 (freed_p): New.
2777 (malloc_diagnostic::describe_state_change): Use unchecked_p and
2778 nonnull_p.
2779 (class mismatching_deallocation): New.
2780 (double_free::double_free): Add funcname param for initializing
2781 m_funcname.
2782 (double_free::emit): Use m_funcname in warning message rather
2783 than hardcoding "free".
2784 (double_free::describe_state_change): Likewise. Use freed_p.
2785 (double_free::describe_call_with_state): Use freed_p.
2786 (double_free::describe_final_event): Use m_funcname in message
2787 rather than hardcoding "free".
2788 (double_free::m_funcname): New field.
2789 (possible_null::describe_state_change): Use unchecked_p.
2790 (possible_null::describe_return_of_state): Likewise.
2791 (use_after_free::use_after_free): Add param for initializing m_api.
2792 (use_after_free::emit): Use m_api->m_dealloc_funcname in message
2793 rather than hardcoding "free".
2794 (use_after_free::describe_state_change): Use freed_p. Change the
2795 wording of the message based on the API.
2796 (use_after_free::describe_final_event): Use
2797 m_api->m_dealloc_funcname in message rather than hardcoding
2798 "free". Change the wording of the message based on the API.
2799 (use_after_free::m_api): New field.
2800 (malloc_leak::describe_state_change): Use unchecked_p. Update
2801 for renaming of m_malloc_event to m_alloc_event.
2802 (malloc_leak::describe_final_event): Update for renaming of
2803 m_malloc_event to m_alloc_event.
2804 (malloc_leak::m_malloc_event): Rename...
2805 (malloc_leak::m_alloc_event): ...to this.
2806 (free_of_non_heap::free_of_non_heap): Add param for initializing
2807 m_funcname.
2808 (free_of_non_heap::emit): Use m_funcname in message rather than
2809 hardcoding "free".
2810 (free_of_non_heap::describe_final_event): Likewise.
2811 (free_of_non_heap::m_funcname): New field.
2812 (allocation_state::dump_to_pp): New.
2813 (allocation_state::get_nonnull): New.
2814 (malloc_state_machine::malloc_state_machine): Update for changes
2815 to state fields and new api fields.
2816 (malloc_state_machine::add_state): New.
2817 (malloc_state_machine::on_stmt): Move malloc/calloc handling to
2818 on_allocator_call and call it, passing in the API pointer.
2819 Likewise for free, moving it to on_deallocator_call. Handle calls
2820 to operator new and delete in an analogous way. Use unchecked_p
2821 when testing for possibly-null-arg and possibly-null-deref, and
2822 transition to the non-null for the correct API. Remove redundant
2823 node param from call to on_zero_assignment. Use freed_p for
2824 use-after-free check, and pass in API.
2825 (malloc_state_machine::on_allocator_call): New, based on code in
2826 on_stmt.
2827 (malloc_state_machine::on_deallocator_call): Likewise.
2828 (malloc_state_machine::on_phi): Mark node param with
2829 ATTRIBUTE_UNUSED; don't pass it to on_zero_assignment.
2830 (malloc_state_machine::on_condition): Mark node param with
2831 ATTRIBUTE_UNUSED. Replace on_transition calls with get_state and
2832 set_next_state pairs, transitioning to the non-null state for the
2833 appropriate API.
2834 (malloc_state_machine::can_purge_p): Port to new state approach.
2835 (malloc_state_machine::on_zero_assignment): Replace on_transition
2836 calls with get_state and set_next_state pairs. Drop redundant
2837 node param.
2838 * sm.h (state_machine::add_custom_state): New.
2840 2020-09-09 David Malcolm <dmalcolm@redhat.com>
2842 * diagnostic-manager.cc
2843 (null_assignment_sm_context::warn_for_state): Replace with...
2844 (null_assignment_sm_context::warn): ...this.
2845 * engine.cc (impl_sm_context::warn_for_state): Replace with...
2846 (impl_sm_context::warn): ...this.
2847 * sm-file.cc (fileptr_state_machine::on_stmt): Replace
2848 warn_for_state and on_transition calls with a get_state
2849 test guarding warn and set_next_state calls.
2850 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
2851 * sm-pattern-test.cc (pattern_test_state_machine::on_condition):
2852 Replace warn_for_state call with warn call.
2853 * sm-sensitive.cc
2854 (sensitive_state_machine::warn_for_any_exposure): Replace
2855 warn_for_state call with a get_state test guarding a warn call.
2856 * sm-signal.cc (signal_state_machine::on_stmt): Likewise.
2857 * sm-taint.cc (taint_state_machine::on_stmt): Replace
2858 warn_for_state and on_transition calls with a get_state
2859 test guarding warn and set_next_state calls.
2860 * sm.h (sm_context::warn_for_state): Replace with...
2861 (sm_context::warn): ...this.
2863 2020-09-09 David Malcolm <dmalcolm@redhat.com>
2865 * diagnostic-manager.cc
2866 (null_assignment_sm_context::null_assignment_sm_context): Add old_state
2867 and ext_state params, initializing m_old_state and m_ext_state.
2868 (null_assignment_sm_context::on_transition): Split into...
2869 (null_assignment_sm_context::get_state): ...this new vfunc
2870 implementation and...
2871 (null_assignment_sm_context::set_next_state): ...this new vfunc
2872 implementation.
2873 (null_assignment_sm_context::m_old_state): New field.
2874 (null_assignment_sm_context::m_ext_state): New field.
2875 (diagnostic_manager::add_events_for_eedge): Pass in old state and
2876 ext_state when creating sm_ctxt.
2877 * engine.cc (impl_sm_context::on_transition): Split into...
2878 (impl_sm_context::get_state): ...this new vfunc
2879 implementation and...
2880 (impl_sm_context::set_next_state): ...this new vfunc
2881 implementation.
2882 * sm.h (sm_context::get_state): New pure virtual function.
2883 (sm_context::set_next_state): Likewise.
2884 (sm_context::on_transition): Convert from a pure virtual function
2885 to a regular function implemented in terms of get_state and
2886 set_next_state.
2888 2020-09-09 David Malcolm <dmalcolm@redhat.com>
2890 * checker-path.cc (state_change_event::get_desc): Update
2891 state_machine::get_state_name calls to state::get_name.
2892 (warning_event::get_desc): Likewise.
2893 * diagnostic-manager.cc
2894 (null_assignment_sm_context::on_transition): Update comparison
2895 against 0 with comparison with m_sm.get_start_state.
2896 (diagnostic_manager::prune_for_sm_diagnostic): Update
2897 state_machine::get_state_name calls to state::get_name.
2898 * engine.cc (impl_sm_context::on_transition): Likewise.
2899 (exploded_node::get_dot_fillcolor): Use get_id when summing
2900 the sm states.
2901 * program-state.cc (sm_state_map::sm_state_map): Don't hardcode
2902 0 as the start state when initializing m_global_state.
2903 (sm_state_map::print): Use dump_to_pp rather than get_state_name
2904 when dumping states.
2905 (sm_state_map::is_empty_p): Don't hardcode 0 as the start state
2906 when examining m_global_state.
2907 (sm_state_map::hash): Use get_id when hashing states.
2908 (selftest::test_sm_state_map): Use state objects rather than
2909 arbitrary hardcoded integers.
2910 (selftest::test_program_state_merging): Likewise.
2911 (selftest::test_program_state_merging_2): Likewise.
2912 * sm-file.cc (fileptr_state_machine::m_start): Move to base class.
2913 (file_diagnostic::describe_state_change): Use get_start_state.
2914 (fileptr_state_machine::fileptr_state_machine): Drop m_start
2915 initialization.
2916 * sm-malloc.cc (malloc_state_machine::m_start): Move to base
2917 class.
2918 (malloc_diagnostic::describe_state_change): Use get_start_state.
2919 (possible_null::describe_state_change): Likewise.
2920 (malloc_state_machine::malloc_state_machine): Drop m_start
2921 initialization.
2922 * sm-pattern-test.cc (pattern_test_state_machine::m_start): Move
2923 to base class.
2924 (pattern_test_state_machine::pattern_test_state_machine): Drop
2925 m_start initialization.
2926 * sm-sensitive.cc (sensitive_state_machine::m_start): Move to base
2927 class.
2928 (sensitive_state_machine::sensitive_state_machine): Drop m_start
2929 initialization.
2930 * sm-signal.cc (signal_state_machine::m_start): Move to base
2931 class.
2932 (signal_state_machine::signal_state_machine): Drop m_start
2933 initialization.
2934 * sm-taint.cc (taint_state_machine::m_start): Move to base class.
2935 (taint_state_machine::taint_state_machine): Drop m_start
2936 initialization.
2937 * sm.cc (state_machine::state::dump_to_pp): New.
2938 (state_machine::state_machine): Move here from sm.h. Initialize
2939 m_next_state_id and m_start.
2940 (state_machine::add_state): Reimplement in terms of state objects.
2941 (state_machine::get_state_name): Delete.
2942 (state_machine::get_state_by_name): Reimplement in terms of state
2943 objects. Make const.
2944 (state_machine::validate): Delete.
2945 (state_machine::dump_to_pp): Reimplement in terms of state
2946 objects.
2947 * sm.h (state_machine::state): New class.
2948 (state_machine::state_t): Convert typedef from "unsigned" to
2949 "const state_machine::state *".
2950 (state_machine::state_machine): Move to sm.cc.
2951 (state_machine::get_default_state): Use m_start rather than
2952 hardcoding 0.
2953 (state_machine::get_state_name): Delete.
2954 (state_machine::get_state_by_name): Make const.
2955 (state_machine::get_start_state): New accessor.
2956 (state_machine::alloc_state_id): New.
2957 (state_machine::m_state_names): Drop in favor of...
2958 (state_machine::m_states): New field
2959 (state_machine::m_start): New field
2960 (start_start_p): Delete.
2962 2020-09-08 David Malcolm <dmalcolm@redhat.com>
2964 PR analyzer/96949
2965 * store.cc (binding_map::apply_ctor_val_to_range): Add
2966 error-handling for the cases where we have symbolic offsets.
2968 2020-09-08 David Malcolm <dmalcolm@redhat.com>
2970 PR analyzer/96950
2971 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
2972 where min_index == max_index.
2973 (binding_map::apply_ctor_val_to_range): Replace assertion that we
2974 don't have a CONSTRUCTOR value with error-handling.
2976 2020-09-08 David Malcolm <dmalcolm@redhat.com>
2978 PR analyzer/96962
2979 * region-model.cc (region_model::on_call_pre): Fix guard on switch
2980 on built-ins to only consider BUILT_IN_NORMAL, rather than other
2981 kinds of build-ins.
2983 2020-09-01 David Malcolm <dmalcolm@redhat.com>
2985 PR analyzer/96792
2986 * region-model.cc (region_model::deref_rvalue): Add the constraint
2987 that PTR_SVAL is non-NULL.
2989 2020-08-31 David Malcolm <dmalcolm@redhat.com>
2991 PR analyzer/96798
2992 * region-model.cc (region_model::on_call_pre): Handle
2993 BUILT_IN_MEMSET_CHK.
2995 2020-08-31 David Malcolm <dmalcolm@redhat.com>
2997 * region-model.cc (region_model::on_call_pre): Gather handling of
2998 builtins and of internal fns into switch statements. Handle
2999 "alloca" and BUILT_IN_ALLOCA_WITH_ALIGN.
3001 2020-08-31 David Malcolm <dmalcolm@redhat.com>
3003 PR analyzer/96860
3004 * region.cc (decl_region::get_svalue_for_constructor): Support
3005 apply_ctor_to_region failing.
3006 * store.cc (binding_map::apply_ctor_to_region): Add failure
3007 handling.
3008 (binding_map::apply_ctor_val_to_range): Likewise.
3009 (binding_map::apply_ctor_pair_to_child_region): Likewise. Replace
3010 assertion that child_base_offset is not symbolic with error
3011 handling.
3012 * store.h (binding_map::apply_ctor_to_region): Convert return type
3013 from void to bool.
3014 (binding_map::apply_ctor_val_to_range): Likewise.
3015 (binding_map::apply_ctor_pair_to_child_region): Likewise.
3017 2020-08-31 David Malcolm <dmalcolm@redhat.com>
3019 PR analyzer/96763
3020 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
3021 by calling a new binding_map::apply_ctor_val_to_range subroutine.
3022 Split out the existing non-CONSTRUCTOR-handling code to a new
3023 apply_ctor_pair_to_child_region subroutine.
3024 (binding_map::apply_ctor_val_to_range): New.
3025 (binding_map::apply_ctor_pair_to_child_region): New, split out
3026 from binding_map::apply_ctor_to_region as noted above.
3027 * store.h (binding_map::apply_ctor_val_to_range): New decl.
3028 (binding_map::apply_ctor_pair_to_child_region): New decl.
3030 2020-08-31 David Malcolm <dmalcolm@redhat.com>
3032 PR analyzer/96764
3033 * region-model-manager.cc
3034 (region_model_manager::maybe_fold_unaryop): Handle VIEW_CONVERT_EXPR.
3035 (region_model_manager::get_or_create_cast): Move logic for
3036 real->integer casting to...
3037 (get_code_for_cast): ...this new function, and add logic for
3038 real->non-integer casts.
3039 (region_model_manager::maybe_fold_sub_svalue): Handle
3040 VIEW_CONVERT_EXPR.
3041 * region-model.cc
3042 (region_model::add_any_constraints_from_gassign): Likewise.
3043 * svalue.cc (svalue::maybe_undo_cast): Likewise.
3044 (unaryop_svalue::dump_to_pp): Likewise.
3046 2020-08-26 David Malcolm <dmalcolm@redhat.com>
3048 PR analyzer/94858
3049 * region-model-manager.cc
3050 (region_model_manager::get_or_create_widening_svalue): Assert that
3051 neither of the inputs are themselves widenings.
3052 * store.cc (store::eval_alias_1): The initial value of a pointer
3053 can't point to a region that was allocated on the heap after the
3054 beginning of the path. A widened pointer value can't alias anything
3055 that the initial pointer value can't alias.
3056 * svalue.cc (svalue::can_merge_p): Merge BINOP (X, OP, CST) with X
3057 to a widening svalue. Merge
3058 BINOP(WIDENING(BASE, BINOP(BASE, X)), X) and BINOP(BASE, X) to
3059 to the LHS of the first BINOP.
3061 2020-08-26 David Malcolm <dmalcolm@redhat.com>
3063 PR analyzer/96777
3064 * region-model.h (class compound_svalue): Document that all keys
3065 must be concrete.
3066 (compound_svalue::compound_svalue): Move definition to svalue.cc.
3067 * store.cc (binding_map::apply_ctor_to_region): Handle
3068 initializers for trailing arrays with incomplete size.
3069 * svalue.cc (compound_svalue::compound_svalue): Move definition
3070 here from region-model.h. Add assertion that all keys are
3071 concrete.
3073 2020-08-22 David Malcolm <dmalcolm@redhat.com>
3075 PR analyzer/94851
3076 * region-model-manager.cc
3077 (region_model_manager::maybe_fold_binop): Fold bitwise "& 0" to 0.
3079 2020-08-22 David Malcolm <dmalcolm@redhat.com>
3081 * store.cc (store::eval_alias): Make const. Split out 2nd half
3082 into store::eval_alias_1 and call it twice for symmetry, avoiding
3083 test duplication.
3084 (store::eval_alias_1): New function, split out from the above.
3085 * store.h (store::eval_alias): Make const.
3086 (store::eval_alias_1): New decl.
3088 2020-08-22 David Malcolm <dmalcolm@redhat.com>
3090 * region-model.cc (region_model::push_frame): Bind the default
3091 SSA name for each parm if it exists, falling back to the parm
3092 itself otherwise, rather than doing both.
3094 2020-08-20 David Malcolm <dmalcolm@redhat.com>
3096 PR analyzer/96723
3097 * region-model-manager.cc
3098 (region_model_manager::get_field_region): Assert that field is a
3099 FIELD_DECL.
3100 * region.cc (region::get_subregions_for_binding): In
3101 union-handling, filter the TYPE_FIELDS traversal to just FIELD_DECLs.
3103 2020-08-20 David Malcolm <dmalcolm@redhat.com>
3105 PR analyzer/96713
3106 * region-model.cc (region_model::get_gassign_result): For
3107 comparisons, only use eval_condition when the lhs has boolean
3108 type, and use get_or_create_constant_svalue on the boolean
3109 constants directly rather than via get_rvalue.
3111 2020-08-19 David Malcolm <dmalcolm@redhat.com>
3113 PR analyzer/96643
3114 * region-model.cc (region_model::deref_rvalue): Rather than
3115 attempting to handle all svalue kinds in the switch, only cover
3116 the special cases, and move symbolic-region handling to after
3117 the switch, thus implicitly handling the missing case SK_COMPOUND.
3119 2020-08-19 David Malcolm <dmalcolm@redhat.com>
3121 PR analyzer/96705
3122 * region-model-manager.cc
3123 (region_model_manager::maybe_fold_binop): Check that we have an
3124 integral type before calling build_int_cst.
3126 2020-08-19 David Malcolm <dmalcolm@redhat.com>
3128 PR analyzer/96699
3129 * region-model-manager.cc
3130 (region_model_manager::get_or_create_cast): Use FIX_TRUNC_EXPR for
3131 casting from REAL_TYPE to INTEGER_TYPE.
3133 2020-08-19 David Malcolm <dmalcolm@redhat.com>
3135 PR analyzer/96651
3136 * region-model.cc (region_model::called_from_main_p): New.
3137 (region_model::get_store_value): Move handling for globals into...
3138 (region_model::get_initial_value_for_global): ...this new
3139 function, and add logic for extracting values from decl
3140 initializers.
3141 * region-model.h (decl_region::get_svalue_for_constructor): New
3142 decl.
3143 (decl_region::get_svalue_for_initializer): New decl.
3144 (region_model::called_from_main_p): New decl.
3145 (region_model::get_initial_value_for_global): New.
3146 * region.cc (decl_region::maybe_get_constant_value): Move logic
3147 for getting an svalue from a CONSTRUCTOR node to...
3148 (decl_region::get_svalue_for_constructor): ...this new function.
3149 (decl_region::get_svalue_for_initializer): New.
3150 * store.cc (get_svalue_for_ctor_val): Rewrite in terms of
3151 region_model::get_rvalue.
3152 * store.h (binding_cluster::get_map): New accessor.
3154 2020-08-19 David Malcolm <dmalcolm@redhat.com>
3156 PR analyzer/96648
3157 * region.cc (get_field_at_bit_offset): Gracefully handle negative
3158 values for bit_offset.
3160 2020-08-18 David Malcolm <dmalcolm@redhat.com>
3162 * region-model.cc (region_model::get_rvalue_1): Fix name of local.
3164 2020-08-18 David Malcolm <dmalcolm@redhat.com>
3166 PR analyzer/96641
3167 * region-model.cc (region_model::get_rvalue_1): Handle
3168 unrecognized tree codes by returning "UNKNOWN.
3170 2020-08-18 David Malcolm <dmalcolm@redhat.com>
3172 PR analyzer/96640
3173 * region-model.cc (region_model::get_gassign_result): Handle various
3174 VEC_* tree codes by returning UNKNOWN.
3175 (region_model::on_assignment): Handle unrecognized tree codes by
3176 setting lhs to an unknown value, rather than issuing a "sorry" and
3177 asserting.
3179 2020-08-17 David Malcolm <dmalcolm@redhat.com>
3181 PR analyzer/96644
3182 * region-model-manager.cc (get_region_for_unexpected_tree_code):
3183 Handle ctxt being NULL.
3185 2020-08-17 David Malcolm <dmalcolm@redhat.com>
3187 PR analyzer/96639
3188 * region.cc (region::get_subregions_for_binding): Check for "type"
3189 being NULL.
3191 2020-08-17 David Malcolm <dmalcolm@redhat.com>
3193 PR analyzer/96642
3194 * store.cc (get_svalue_for_ctor_val): New.
3195 (binding_map::apply_ctor_to_region): Call it.
3197 2020-08-14 David Malcolm <dmalcolm@redhat.com>
3199 PR testsuite/96609
3200 PR analyzer/96616
3201 * region-model.cc (region_model::get_store_value): Call
3202 maybe_get_constant_value on decl_regions first.
3203 * region-model.h (decl_region::maybe_get_constant_value): New decl.
3204 * region.cc (decl_region::get_stack_depth): Likewise.
3205 (decl_region::maybe_get_constant_value): New.
3206 * store.cc (get_subregion_within_ctor): New.
3207 (binding_map::apply_ctor_to_region): New.
3208 * store.h (binding_map::apply_ctor_to_region): New decl.
3210 2020-08-14 David Malcolm <dmalcolm@redhat.com>
3212 PR analyzer/96611
3213 * store.cc (store::mark_as_escaped): Reject attempts to
3214 get a cluster for an unknown pointer.
3216 2020-08-13 David Malcolm <dmalcolm@redhat.com>
3218 PR analyzer/93032
3219 PR analyzer/93938
3220 PR analyzer/94011
3221 PR analyzer/94099
3222 PR analyzer/94399
3223 PR analyzer/94458
3224 PR analyzer/94503
3225 PR analyzer/94640
3226 PR analyzer/94688
3227 PR analyzer/94689
3228 PR analyzer/94839
3229 PR analyzer/95026
3230 PR analyzer/95042
3231 PR analyzer/95240
3232 * analyzer-logging.cc: Ignore "-Wformat-diag".
3233 (logger::enter_scope): Use inc_indent in both overloads.
3234 (logger::exit_scope): Use dec_indent.
3235 * analyzer-logging.h (logger::inc_indent): New.
3236 (logger::dec_indent): New.
3237 * analyzer-selftests.cc (run_analyzer_selftests): Call
3238 analyzer_store_cc_tests.
3239 * analyzer-selftests.h (analyzer_store_cc_tests): New decl.
3240 * analyzer.cc (get_stmt_location): New function.
3241 * analyzer.h (class initial_svalue): New forward decl.
3242 (class unaryop_svalue): New forward decl.
3243 (class binop_svalue): New forward decl.
3244 (class sub_svalue): New forward decl.
3245 (class unmergeable_svalue): New forward decl.
3246 (class placeholder_svalue): New forward decl.
3247 (class widening_svalue): New forward decl.
3248 (class compound_svalue): New forward decl.
3249 (class conjured_svalue): New forward decl.
3250 (svalue_set): New typedef.
3251 (class map_region): Delete.
3252 (class array_region): Delete.
3253 (class frame_region): New forward decl.
3254 (class function_region): New forward decl.
3255 (class label_region): New forward decl.
3256 (class decl_region): New forward decl.
3257 (class element_region): New forward decl.
3258 (class offset_region): New forward decl.
3259 (class cast_region): New forward decl.
3260 (class field_region): New forward decl.
3261 (class string_region): New forward decl.
3262 (class region_model_manager): New forward decl.
3263 (class store_manager): New forward decl.
3264 (class store): New forward decl.
3265 (class call_details): New forward decl.
3266 (struct svalue_id_merger_mapping): Delete.
3267 (struct canonicalization): Delete.
3268 (class function_point): New forward decl.
3269 (class engine): New forward decl.
3270 (dump_tree): New function decl.
3271 (print_quoted_type): New function decl.
3272 (readability_comparator): New function decl.
3273 (tree_cmp): New function decl.
3274 (class path_var): Move here from region-model.h
3275 (bit_offset_t, bit_size_t, byte_size_t): New typedefs.
3276 (class region_offset): New class.
3277 (get_stmt_location): New decl.
3278 (struct member_function_hash_traits): New struct.
3279 (class consolidation_map): New class.
3280 Ignore "-Wformat-diag".
3281 * analyzer.opt (-param=analyzer-max-svalue-depth=): New param.
3282 (-param=analyzer-max-enodes-for-full-dump=): New param.
3283 * call-string.cc: Ignore -Wformat-diag.
3284 * checker-path.cc: Move includes of "analyzer/call-string.h" and
3285 "analyzer/program-point.h" to before "analyzer/region-model.h",
3286 and also include "analyzer/store.h" before it.
3287 (state_change_event::state_change_event): Replace "tree var" param
3288 with "const svalue *sval". Convert "origin" param from tree to
3289 "const svalue *".
3290 (state_change_event::get_desc): Call get_representative_tree to
3291 convert the var and origin from const svalue * to tree. Use
3292 svalue::get_desc rather than %qE when describing state changes.
3293 (checker_path::add_final_event): Use get_stmt_location.
3294 * checker-path.h (state_change_event::state_change_event): Port
3295 from tree to const svalue *.
3296 (state_change_event::get_lvalue): Delete.
3297 (state_change_event::get_dest_function): New.
3298 (state_change_event::m_var): Replace with...
3299 (state_change_event::m_sval): ...this.
3300 (state_change_event::m_origin): Convert from tree to
3301 const svalue *.
3302 * constraint-manager.cc: Include "analyzer/call-string.h",
3303 "analyzer/program-point.h", and "analyzer/store.h" before
3304 "analyzer/region-model.h".
3305 (struct bound, struct range): Move to constraint-manager.h.
3306 (compare_constants): New function.
3307 (range::dump): Rename to...
3308 (range::dump_to_pp): ...this. Support NULL constants.
3309 (range::dump): Reintroduce for dumping to stderr.
3310 (range::constrained_to_single_element): Return result, rather than
3311 writing to *OUT.
3312 (range::eval_condition): New.
3313 (range::below_lower_bound): New.
3314 (range::above_upper_bound): New.
3315 (equiv_class::equiv_class): Port from svalue_id to const svalue *.
3316 (equiv_class::print): Likewise.
3317 (equiv_class::hash): Likewise.
3318 (equiv_class::operator==): Port from svalue_id to const svalue *.
3319 (equiv_class::add): Port from svalue_id to const svalue *. Drop
3320 "cm" param.
3321 (equiv_class::del): Port from svalue_id to const svalue *.
3322 (equiv_class::get_representative): Likewise.
3323 (equiv_class::remap_svalue_ids): Delete.
3324 (svalue_id_cmp_by_id): Rename to...
3325 (svalue_cmp_by_ptr): ...this, porting from svalue_id to
3326 const svalue *.
3327 (equiv_class::canonicalize): Update qsort comparator.
3328 (constraint::implied_by): New.
3329 (constraint_manager::constraint_manager): Copy m_mgr in copy ctor.
3330 (constraint_manager::dump_to_pp): Add "multiline" param
3331 (constraint_manager::dump): Pass "true" for "multiline".
3332 (constraint_manager::add_constraint): Port from svalue_id to
3333 const svalue *. Split out second part into...
3334 (constraint_manager::add_unknown_constraint): ...this new
3335 function. Remove self-constraints when merging equivalence
3336 classes.
3337 (constraint_manager::add_constraint_internal): Remove constraints
3338 that would be implied by the new constraint. Port from svalue_id
3339 to const svalue *.
3340 (constraint_manager::get_equiv_class_by_sid): Rename to...
3341 (constraint_manager::get_equiv_class_by_svalue): ...this, porting
3342 from svalue_id to const svalue *.
3343 (constraint_manager::get_or_add_equiv_class): Port from svalue_id
3344 to const svalue *.
3345 (constraint_manager::eval_condition): Make const. Call
3346 compare_constants and return early if it provides a known result.
3347 (constraint_manager::get_ec_bounds): New.
3348 (constraint_manager::eval_condition): New overloads. Make
3349 existing one const, and use compare_constants.
3350 (constraint_manager::purge): Convert "p" param to a template
3351 rather that an abstract base class. Port from svalue_id to
3352 const svalue *.
3353 (class dead_svalue_purger): New class.
3354 (constraint_manager::remap_svalue_ids): Delete.
3355 (constraint_manager::on_liveness_change): New.
3356 (equiv_class_cmp): Port from svalue_id to const svalue *.
3357 (constraint_manager::canonicalize): Likewise. Combine with
3358 purging of redundant equivalence classes and constraints.
3359 (class cleaned_constraint_manager): Delete.
3360 (class merger_fact_visitor): Make "m_cm_b" const. Add "m_merger"
3361 field.
3362 (merger_fact_visitor::fact): Port from svalue_id to const svalue *.
3363 Add special case for widening.
3364 (constraint_manager::merge): Port from svalue_id to const svalue *.
3365 (constraint_manager::clean_merger_input): Delete.
3366 (constraint_manager::for_each_fact): Port from svalue_id to
3367 const svalue *.
3368 (constraint_manager::validate): Likewise.
3369 (selftest::test_constraint_conditions): Provide a
3370 region_model_manager when creating region_model instances.
3371 Add test for self-equality not creating equivalence classes.
3372 (selftest::test_transitivity): Provide a region_model_manager when
3373 creating region_model instances. Verify that EC-merging happens
3374 when constraints are implied.
3375 (selftest::test_constant_comparisons): Provide a
3376 region_model_manager when creating region_model instances.
3377 (selftest::test_constraint_impl): Likewise. Remove over-specified
3378 assertions.
3379 (selftest::test_equality): Provide a region_model_manager when
3380 creating region_model instances.
3381 (selftest::test_many_constants): Likewise. Provide a
3382 program_point when testing merging.
3383 (selftest::run_constraint_manager_tests): Move call to
3384 test_constant_comparisons to outside the transitivity guard.
3385 * constraint-manager.h (struct bound): Move here from
3386 constraint-manager.cc.
3387 (struct range): Likewise.
3388 (struct::eval_condition): New decl.
3389 (struct::below_lower_bound): New decl.
3390 (struct::above_upper_bound): New decl.
3391 (equiv_class::add): Port from svalue_id to const svalue *.
3392 (equiv_class::del): Likewise.
3393 (equiv_class::get_representative): Likewise.
3394 (equiv_class::remap_svalue_ids): Drop.
3395 (equiv_class::m_cst_sid): Convert to..
3396 (equiv_class::m_cst_sval): ...this.
3397 (equiv_class::m_vars): Port from svalue_id to const svalue *.
3398 (constraint::bool implied_by): New decl.
3399 (fact_visitor::on_fact): Port from svalue_id to const svalue *.
3400 (constraint_manager::constraint_manager): Add mgr param.
3401 (constraint_manager::clone): Delete.
3402 (constraint_manager::maybe_get_constant): Delete.
3403 (constraint_manager::get_sid_for_constant): Delete.
3404 (constraint_manager::get_num_svalues): Delete.
3405 (constraint_manager::dump_to_pp): Add "multiline" param.
3406 (constraint_manager::get_equiv_class): Port from svalue_id to
3407 const svalue *.
3408 (constraint_manager::add_constraint): Likewise.
3409 (constraint_manager::get_equiv_class_by_sid): Rename to...
3410 (constraint_manager::get_equiv_class_by_svalue): ...this, porting
3411 from svalue_id to const svalue *.
3412 (constraint_manager::add_unknown_constraint): New decl.
3413 (constraint_manager::get_or_add_equiv_class): Port from svalue_id
3414 to const svalue *.
3415 (constraint_manager::eval_condition): Likewise. Add overloads.
3416 (constraint_manager::get_ec_bounds): New decl.
3417 (constraint_manager::purge): Convert to template.
3418 (constraint_manager::remap_svalue_ids): Delete.
3419 (constraint_manager::on_liveness_change): New decl.
3420 (constraint_manager::canonicalize): Drop param.
3421 (constraint_manager::clean_merger_input): Delete.
3422 (constraint_manager::m_mgr): New field.
3423 * diagnostic-manager.cc: Move includes of
3424 "analyzer/call-string.h" and "analyzer/program-point.h" to before
3425 "analyzer/region-model.h", and also include "analyzer/store.h"
3426 before it.
3427 (saved_diagnostic::saved_diagnostic): Add "sval" param.
3428 (diagnostic_manager::diagnostic_manager): Add engine param.
3429 (diagnostic_manager::add_diagnostic): Add "sval" param, passing it
3430 to saved_diagnostic ctor. Update overload to pass NULL for it.
3431 (dedupe_winners::dedupe_winners): Add engine param.
3432 (dedupe_winners::add): Add "eg" param. Pass m_engine to
3433 feasible_p.
3434 (dedupe_winner::m_engine): New field.
3435 (diagnostic_manager::emit_saved_diagnostics): Pass engine to
3436 dedupe_winners. Pass &eg when adding candidates. Pass svalue
3437 rather than tree to prune_path. Use get_stmt_location to get
3438 primary location of diagnostic.
3439 (diagnostic_manager::emit_saved_diagnostic): Likewise.
3440 (get_any_origin): Drop.
3441 (state_change_event_creator::on_global_state_change): Pass NULL
3442 const svalue * rather than NULL_TREE trees to state_change_event
3443 ctor.
3444 (state_change_event_creator::on_state_change): Port from tree and
3445 svalue_id to const svalue *.
3446 (for_each_state_change): Port from svalue_id to const svalue *.
3447 (struct null_assignment_sm_context): New.
3448 (diagnostic_manager::add_events_for_eedge): Add state change
3449 events for assignment to NULL.
3450 (diagnostic_manager::prune_path): Update param from tree to
3451 const svalue *.
3452 (diagnostic_manager::prune_for_sm_diagnostic): Port from tracking
3453 by tree to by const svalue *.
3454 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add sval
3455 param.
3456 (saved_diagnostic::m_sval): New field.
3457 (diagnostic_manager::diagnostic_manager): Add engine param.
3458 (diagnostic_manager::get_engine): New.
3459 (diagnostic_manager::add_diagnostic): Add "sval" param.
3460 (diagnostic_manager::prune_path): Likewise.
3461 (diagnostic_manager::prune_for_sm_diagnostic): New overload.
3462 (diagnostic_manager::m_eng): New field.
3463 * engine.cc: Move includes of "analyzer/call-string.h" and
3464 "analyzer/program-point.h" to before "analyzer/region-model.h",
3465 and also include "analyzer/store.h" before it.
3466 (impl_region_model_context::impl_region_model_context): Update for
3467 removal of m_change field.
3468 (impl_region_model_context::remap_svalue_ids): Delete.
3469 (impl_region_model_context::on_svalue_leak): New.
3470 (impl_region_model_context::on_svalue_purge): Delete.
3471 (impl_region_model_context::on_liveness_change): New.
3472 (impl_region_model_context::on_unknown_change): Update param
3473 from svalue_id to const svalue *. Add is_mutable param.
3474 (setjmp_svalue::compare_fields): Delete.
3475 (setjmp_svalue::accept): New.
3476 (setjmp_svalue::add_to_hash): Delete.
3477 (setjmp_svalue::dump_to_pp): New.
3478 (setjmp_svalue::print_details): Delete.
3479 (impl_sm_context::impl_sm_context): Drop "change" param.
3480 (impl_sm_context::get_fndecl_for_call): Drop "m_change".
3481 (impl_sm_context::on_transition): Drop ATTRIBUTE_UNUSED from
3482 "stmt" param. Drop m_change. Port from svalue_id to
3483 const svalue *.
3484 (impl_sm_context::warn_for_state): Drop m_change. Port from
3485 svalue_id to const svalue *.
3486 (impl_sm_context::get_readable_tree): Rename to...
3487 (impl_sm_context::get_diagnostic_tree): ...this. Port from
3488 svalue_id to const svalue *.
3489 (impl_sm_context::is_zero_assignment): New.
3490 (impl_sm_context::m_change): Delete field.
3491 (leak_stmt_finder::find_stmt): Handle m_var being NULL.
3492 (readability): Increase penalty for MEM_REF. For SSA_NAMEs,
3493 slightly favor the underlying var over the SSA name. Heavily
3494 penalize temporaries. Handle RESULT_DECL.
3495 (readability_comparator): Make non-static. Consider stack depths.
3496 (impl_region_model_context::on_state_leak): Convert from svalue_id
3497 to const svalue *, updating for region_model changes. Use
3498 id_equal.
3499 (impl_region_model_context::on_inherited_svalue): Delete.
3500 (impl_region_model_context::on_cast): Delete.
3501 (impl_region_model_context::on_condition): Drop m_change.
3502 (impl_region_model_context::on_phi): Likewise.
3503 (impl_region_model_context::on_unexpected_tree_code): Handle t
3504 being NULL.
3505 (point_and_state::validate): Update stack checking for
3506 region_model changes.
3507 (eg_traits::dump_args_t::show_enode_details_p): New.
3508 (exploded_node::exploded_node): Initialize m_num_processed_stmts.
3509 (exploded_node::get_processed_stmt): New function.
3510 (exploded_node::get_dot_fillcolor): Add more colors.
3511 (exploded_node::dump_dot): Guard the printing of the point and
3512 state with show_enode_details_p. Print the processed stmts for
3513 this enode after the initial state.
3514 (exploded_node::dump_to_pp): Pass true for new multiline param
3515 of program_state::dump_to_pp.
3516 (exploded_node::on_stmt): Drop "change" param. Log the stmt.
3517 Set input_location. Implement __analyzer_describe. Update
3518 implementation of __analyzer_dump and __analyzer_eval.
3519 Remove purging of sm-state for unknown fncalls from here.
3520 (exploded_node::on_edge): Drop "change" param.
3521 (exploded_node::on_longjmp): Port from region_id/svalue_id to
3522 const region */const svalue *. Call program_state::detect_leaks.
3523 Drop state_change.
3524 (exploded_node::detect_leaks): Update for changes to region_model.
3525 Call program_state::detect_leaks.
3526 (exploded_edge::exploded_edge): Drop ext_state and change params.
3527 (exploded_edge::dump_dot): "args" is no longer used. Drop dumping
3528 of m_change.
3529 (exploded_graph::exploded_graph): Pass engine to
3530 m_diagnostic_manager ctor. Use program_point::origin.
3531 (exploded_graph::add_function_entry): Drop ctxt. Use
3532 program_state::push_frame. Drop state_change.
3533 (exploded_graph::get_or_create_node): Drop "change" param. Add
3534 "enode_for_diag" param. Update dumping calls for API changes.
3535 Pass point to can_merge_with_p. Show enode indices
3536 within -Wanalyzer-too-complex diagnostic for hitting the per-point
3537 limit.
3538 (exploded_graph::add_edge): Drop "change" param. Log which nodes
3539 are being connected. Update for changes to exploded_edge ctor.
3540 (exploded_graph::get_per_program_point_data): New.
3541 (exploded_graph::process_worklist): Pass point to
3542 can_merge_with_p. Drop state_change. Update dumping call for API
3543 change.
3544 (exploded_graph::process_node): Drop state_change. Split the
3545 node in-place if an sm-state-change occurs. Update
3546 m_num_processed_stmts. Update dumping calls for API change.
3547 (exploded_graph::log_stats): Call engine::log_stats.
3548 (exploded_graph::dump_states_for_supernode): Update dumping
3549 call.
3550 (exploded_path::feasible_p): Add "eng" and "eg" params.
3551 Rename "i" to "end_idx". Pass the manager to the region_model
3552 ctor. Update for every processed stmt in the enode, not just the
3553 first. Keep track of which snodes have been visited, and call
3554 loop_replay_fixup when revisiting one.
3555 (enode_label::get_text): Update dump call for new param.
3556 (exploded_graph::dump_exploded_nodes): Likewise.
3557 (exploded_graph::get_node_by_index): New.
3558 (impl_run_checkers): Create engine instance and pass its address
3559 to extrinsic_state ctor.
3560 * exploded-graph.h
3561 (impl_region_model_context::impl_region_model_context): Drop
3562 "change" params.
3563 (impl_region_model_context::void remap_svalue_ids): Delete.
3564 (impl_region_model_context::on_svalue_purge): Delete.
3565 (impl_region_model_context::on_svalue_leak): New.
3566 (impl_region_model_context::on_liveness_change): New.
3567 (impl_region_model_context::on_state_leak): Update signature.
3568 (impl_region_model_context::on_inherited_svalue): Delete.
3569 (impl_region_model_context::on_cast): Delete.
3570 (impl_region_model_context::on_unknown_change): Update signature.
3571 (impl_region_model_context::m_change): Delete.
3572 (eg_traits::dump_args_t::show_enode_details_p): New.
3573 (exploded_node::on_stmt): Drop "change" param.
3574 (exploded_node::on_edge): Likewise.
3575 (exploded_node::get_processed_stmt): New decl.
3576 (exploded_node::m_num_processed_stmts): New field.
3577 (exploded_edge::exploded_edge): Drop ext_state and change params.
3578 (exploded_edge::m_change): Delete.
3579 (exploded_graph::get_engine): New accessor.
3580 (exploded_graph::get_or_create_node): Drop "change" param. Add
3581 "enode_for_diag" param.
3582 (exploded_graph::add_edge): Drop "change" param.
3583 (exploded_graph::get_per_program_point_data): New decl.
3584 (exploded_graph::get_node_by_index): New decl.
3585 (exploded_path::feasible_p): Add "eng" and "eg" params.
3586 * program-point.cc: Include "analyzer/store.h" before including
3587 "analyzer/region-model.h".
3588 (function_point::function_point): Move here from
3589 program-point.h.
3590 (function_point::get_function): Likewise.
3591 (function_point::from_function_entry): Likewise.
3592 (function_point::before_supernode): Likewise.
3593 (function_point::next_stmt): New function.
3594 * program-point.h (function_point::function_point): Move
3595 implementation from here to program-point.cc.
3596 (function_point::get_function): Likewise.
3597 (function_point::from_function_entry): Likewise.
3598 (function_point::before_supernode): Likewise.
3599 (function_point::next_stmt): New decl.
3600 (program_point::operator!=): New.
3601 (program_point::origin): New.
3602 (program_point::next_stmt): New.
3603 (program_point::m_function_point): Make non-const.
3604 * program-state.cc: Move includes of "analyzer/call-string.h" and
3605 "analyzer/program-point.h" to before "analyzer/region-model.h",
3606 and also include "analyzer/store.h" before it.
3607 (extrinsic_state::get_model_manager): New.
3608 (sm_state_map::sm_state_map): Pass in sm and sm_idx to ctor,
3609 rather than pass the around.
3610 (sm_state_map::clone_with_remapping): Delete.
3611 (sm_state_map::print): Remove "sm" param in favor of "m_sm". Add
3612 "simple" and "multiline" params and support multiline vs single
3613 line dumping.
3614 (sm_state_map::dump): Remove "sm" param in favor of "m_sm". Add
3615 "simple" param.
3616 (sm_state_map::hash): Port from svalue_id to const svalue *.
3617 (sm_state_map::operator==): Likewise.
3618 (sm_state_map::get_state): Likewise. Call canonicalize_svalue on
3619 input. Handle inheritance of sm-state. Call get_default_state.
3620 (sm_state_map::get_origin): Port from svalue_id to const svalue *.
3621 (sm_state_map::set_state): Likewise. Pass in ext_state. Reject
3622 attempts to set state on UNKNOWN.
3623 (sm_state_map::impl_set_state): Port from svalue_id to
3624 const svalue *. Pass in ext_state. Call canonicalize_svalue on
3625 input.
3626 (sm_state_map::purge_for_unknown_fncall): Delete.
3627 (sm_state_map::on_svalue_leak): New.
3628 (sm_state_map::remap_svalue_ids): Delete.
3629 (sm_state_map::on_liveness_change): New.
3630 (sm_state_map::on_unknown_change): Reimplement.
3631 (sm_state_map::on_svalue_purge): Delete.
3632 (sm_state_map::on_inherited_svalue): Delete.
3633 (sm_state_map::on_cast): Delete.
3634 (sm_state_map::validate): Delete.
3635 (sm_state_map::canonicalize_svalue): New.
3636 (program_state::program_state): Update to pass manager to
3637 region_model's ctor. Constify num_states and pass state machine
3638 and index to sm_state_map ctor.
3639 (program_state::print): Update for changes to dump API.
3640 (program_state::dump_to_pp): Ignore the summarize param. Add
3641 "multiline" param.
3642 (program_state::dump_to_file): Add "multiline" param.
3643 (program_state::dump): Pass "true" for new "multiline" param.
3644 (program_state::push_frame): New.
3645 (program_state::on_edge): Drop "change" param. Call
3646 program_state::detect_leaks.
3647 (program_state::prune_for_point): Add enode_for_diag param.
3648 Reimplement based on store class. Call detect_leaks
3649 (program_state::remap_svalue_ids): Delete.
3650 (program_state::get_representative_tree): Port from svalue_id to
3651 const svalue *.
3652 (program_state::can_merge_with_p): Add "point" param. Add early
3653 reject for sm-differences. Drop id remapping.
3654 (program_state::validate): Drop region model and sm_state_map
3655 validation.
3656 (state_change::sm_change::dump): Delete.
3657 (state_change::sm_change::remap_svalue_ids): Delete.
3658 (state_change::sm_change::on_svalue_purge): Delete.
3659 (log_set_of_svalues): New.
3660 (state_change::sm_change::validate): Delete.
3661 (state_change::state_change): Delete.
3662 (state_change::add_sm_change): Delete.
3663 (state_change::affects_p): Delete.
3664 (state_change::dump): Delete.
3665 (state_change::remap_svalue_ids): Delete.
3666 (state_change::on_svalue_purge): Delete.
3667 (state_change::validate): Delete.
3668 (selftest::assert_dump_eq): Delete.
3669 (ASSERT_DUMP_EQ): Delete.
3670 (selftest::test_sm_state_map): Update for changes to region_model
3671 and sm_state_map, porting from svalue_id to const svalue *.
3672 (selftest::test_program_state_dumping): Likewise. Drop test of
3673 dumping, renaming to...
3674 (selftest::test_program_state_1): ...this.
3675 (selftest::test_program_state_dumping_2): Likewise, renaming to...
3676 (selftest::test_program_state_2): ...this.
3677 (selftest::test_program_state_merging): Update for changes to
3678 region_model.
3679 (selftest::test_program_state_merging_2): Likewise.
3680 (selftest::analyzer_program_state_cc_tests): Update for renamed
3681 tests.
3682 * program-state.h (extrinsic_state::extrinsic_state): Add logger
3683 and engine params.
3684 (extrinsic_state::get_logger): New accessor.
3685 (extrinsic_state::get_engine): New accessor.
3686 (extrinsic_state::get_model_manager): New accessor.
3687 (extrinsic_state::m_logger): New field.
3688 (extrinsic_state::m_engine): New field.
3689 (struct default_hash_traits<svalue_id>): Delete.
3690 (pod_hash_traits<svalue_id>::hash): Delete.
3691 (pod_hash_traits<svalue_id>::equal): Delete.
3692 (pod_hash_traits<svalue_id>::mark_deleted): Delete.
3693 (pod_hash_traits<svalue_id>::mark_empty): Delete.
3694 (pod_hash_traits<svalue_id>::is_deleted): Delete.
3695 (pod_hash_traits<svalue_id>::is_empty): Delete.
3696 (sm_state_map::entry_t::entry_t): Port from svalue_id to
3697 const svalue *.
3698 (sm_state_map::entry_t::m_origin): Likewise.
3699 (sm_state_map::map_t): Likewise.
3700 (sm_state_map::sm_state_map): Add state_machine and index params.
3701 (sm_state_map::clone_with_remapping): Delete.
3702 (sm_state_map::print): Drop sm param; add simple and multiline
3703 params.
3704 (sm_state_map::dump): Drop sm param; add simple param.
3705 (sm_state_map::get_state): Port from svalue_id to const svalue *.
3706 Add ext_state param.
3707 (sm_state_map::get_origin): Likewise.
3708 (sm_state_map::set_state): Likewise.
3709 (sm_state_map::impl_set_state): Likewise.
3710 (sm_state_map::purge_for_unknown_fncall): Delete.
3711 (sm_state_map::remap_svalue_ids): Delete.
3712 (sm_state_map::on_svalue_purge): Delete.
3713 (sm_state_map::on_svalue_leak): New.
3714 (sm_state_map::on_liveness_change): New.
3715 (sm_state_map::on_inherited_svalue): Delete.
3716 (sm_state_map::on_cast): Delete.
3717 (sm_state_map::validate): Delete.
3718 (sm_state_map::on_unknown_change): Port from svalue_id to
3719 const svalue *. Add is_mutable and ext_state params.
3720 (sm_state_map::canonicalize_svalue): New.
3721 (sm_state_map::m_sm): New field.
3722 (sm_state_map::m_sm_idx): New field.
3723 (program_state::operator=): Delete.
3724 (program_state::dump_to_pp): Drop "summarize" param, adding
3725 "simple" and "multiline".
3726 (program_state::dump_to_file): Likewise.
3727 (program_state::dump): Rename "summarize" to "simple".
3728 (program_state::push_frame): New.
3729 (program_state::get_current_function): New.
3730 (program_state::on_edge): Drop "change" param.
3731 (program_state::prune_for_point): Likewise. Add enode_for_diag
3732 param.
3733 (program_state::remap_svalue_ids): Delete.
3734 (program_state::get_representative_tree): Port from svalue_id to
3735 const svalue *.
3736 (program_state::can_purge_p): Likewise. Pass ext_state to get_state.
3737 (program_state::can_merge_with_p): Add point param.
3738 (program_state::detect_leaks): New.
3739 (state_change_visitor::on_state_change): Port from tree and
3740 svalue_id to a pair of const svalue *.
3741 (class state_change): Delete.
3742 * region.cc: New file.
3743 * region-model-impl-calls.cc: New file.
3744 * region-model-manager.cc: New file.
3745 * region-model-reachability.cc: New file.
3746 * region-model-reachability.h: New file.
3747 * region-model.cc: Include "analyzer/call-string.h",
3748 "analyzer/program-point.h", and "analyzer/store.h" before
3749 "analyzer/region-model.h". Include
3750 "analyzer/region-model-reachability.h".
3751 (dump_tree): Make non-static.
3752 (dump_quoted_tree): Make non-static.
3753 (print_quoted_type): Make non-static.
3754 (path_var::dump): Delete.
3755 (dump_separator): Delete.
3756 (class impl_constraint_manager): Delete.
3757 (svalue_id::print): Delete.
3758 (svalue_id::dump_node_name_to_pp): Delete.
3759 (svalue_id::validate): Delete.
3760 (region_id::print): Delete.
3761 (region_id::dump_node_name_to_pp): Delete.
3762 (region_id::validate): Delete.
3763 (region_id_set::region_id_set): Delete.
3764 (svalue_id_set::svalue_id_set): Delete.
3765 (svalue::operator==): Delete.
3766 (svalue::hash): Delete.
3767 (svalue::print): Delete.
3768 (svalue::dump_dot_to_pp): Delete.
3769 (svalue::remap_region_ids): Delete.
3770 (svalue::walk_for_canonicalization): Delete.
3771 (svalue::get_child_sid): Delete.
3772 (svalue::maybe_get_constant): Delete.
3773 (region_svalue::compare_fields): Delete.
3774 (region_svalue::add_to_hash): Delete.
3775 (region_svalue::print_details): Delete.
3776 (region_svalue::dump_dot_to_pp): Delete.
3777 (region_svalue::remap_region_ids): Delete.
3778 (region_svalue::merge_values): Delete.
3779 (region_svalue::walk_for_canonicalization): Delete.
3780 (region_svalue::eval_condition): Delete.
3781 (constant_svalue::compare_fields): Delete.
3782 (constant_svalue::add_to_hash): Delete.
3783 (constant_svalue::merge_values): Delete.
3784 (constant_svalue::eval_condition): Move to svalue.cc.
3785 (constant_svalue::print_details): Delete.
3786 (constant_svalue::get_child_sid): Delete.
3787 (unknown_svalue::compare_fields): Delete.
3788 (unknown_svalue::add_to_hash): Delete.
3789 (unknown_svalue::print_details): Delete.
3790 (poison_kind_to_str): Move to svalue.cc.
3791 (poisoned_svalue::compare_fields): Delete.
3792 (poisoned_svalue::add_to_hash): Delete.
3793 (poisoned_svalue::print_details): Delete.
3794 (region_kind_to_str): Move to region.cc and reimplement.
3795 (region::operator==): Delete.
3796 (region::get_parent_region): Delete.
3797 (region::set_value): Delete.
3798 (region::become_active_view): Delete.
3799 (region::deactivate_any_active_view): Delete.
3800 (region::deactivate_view): Delete.
3801 (region::get_value): Delete.
3802 (region::get_inherited_child_sid): Delete.
3803 (region_model::copy_region): Delete.
3804 (region_model::copy_struct_region): Delete.
3805 (region_model::copy_union_region): Delete.
3806 (region_model::copy_array_region): Delete.
3807 (region::hash): Delete.
3808 (region::print): Delete.
3809 (region::dump_dot_to_pp): Delete.
3810 (region::dump_to_pp): Delete.
3811 (region::dump_child_label): Delete.
3812 (region::validate): Delete.
3813 (region::remap_svalue_ids): Delete.
3814 (region::remap_region_ids): Delete.
3815 (region::add_view): Delete.
3816 (region::get_view): Delete.
3817 (region::region): Move to region.cc.
3818 (region::add_to_hash): Delete.
3819 (region::print_fields): Delete.
3820 (region::non_null_p): Delete.
3821 (primitive_region::clone): Delete.
3822 (primitive_region::walk_for_canonicalization): Delete.
3823 (map_region::map_region): Delete.
3824 (map_region::compare_fields): Delete.
3825 (map_region::print_fields): Delete.
3826 (map_region::validate): Delete.
3827 (map_region::dump_dot_to_pp): Delete.
3828 (map_region::dump_child_label): Delete.
3829 (map_region::get_or_create): Delete.
3830 (map_region::get): Delete.
3831 (map_region::add_to_hash): Delete.
3832 (map_region::remap_region_ids): Delete.
3833 (map_region::unbind): Delete.
3834 (map_region::get_tree_for_child_region): Delete.
3835 (map_region::get_tree_for_child_region): Delete.
3836 (tree_cmp): Move to region.cc.
3837 (map_region::can_merge_p): Delete.
3838 (map_region::walk_for_canonicalization): Delete.
3839 (map_region::get_value_by_name): Delete.
3840 (struct_or_union_region::valid_key_p): Delete.
3841 (struct_or_union_region::compare_fields): Delete.
3842 (struct_region::clone): Delete.
3843 (struct_region::compare_fields): Delete.
3844 (union_region::clone): Delete.
3845 (union_region::compare_fields): Delete.
3846 (frame_region::compare_fields): Delete.
3847 (frame_region::clone): Delete.
3848 (frame_region::valid_key_p): Delete.
3849 (frame_region::print_fields): Delete.
3850 (frame_region::add_to_hash): Delete.
3851 (globals_region::compare_fields): Delete.
3852 (globals_region::clone): Delete.
3853 (globals_region::valid_key_p): Delete.
3854 (code_region::compare_fields): Delete.
3855 (code_region::clone): Delete.
3856 (code_region::valid_key_p): Delete.
3857 (array_region::array_region): Delete.
3858 (array_region::get_element): Delete.
3859 (array_region::clone): Delete.
3860 (array_region::compare_fields): Delete.
3861 (array_region::print_fields): Delete.
3862 (array_region::validate): Delete.
3863 (array_region::dump_dot_to_pp): Delete.
3864 (array_region::dump_child_label): Delete.
3865 (array_region::get_or_create): Delete.
3866 (array_region::get): Delete.
3867 (array_region::add_to_hash): Delete.
3868 (array_region::remap_region_ids): Delete.
3869 (array_region::get_key_for_child_region): Delete.
3870 (array_region::key_cmp): Delete.
3871 (array_region::walk_for_canonicalization): Delete.
3872 (array_region::key_from_constant): Delete.
3873 (array_region::constant_from_key): Delete.
3874 (function_region::compare_fields): Delete.
3875 (function_region::clone): Delete.
3876 (function_region::valid_key_p): Delete.
3877 (stack_region::stack_region): Delete.
3878 (stack_region::compare_fields): Delete.
3879 (stack_region::clone): Delete.
3880 (stack_region::print_fields): Delete.
3881 (stack_region::dump_child_label): Delete.
3882 (stack_region::validate): Delete.
3883 (stack_region::push_frame): Delete.
3884 (stack_region::get_current_frame_id): Delete.
3885 (stack_region::pop_frame): Delete.
3886 (stack_region::add_to_hash): Delete.
3887 (stack_region::remap_region_ids): Delete.
3888 (stack_region::can_merge_p): Delete.
3889 (stack_region::walk_for_canonicalization): Delete.
3890 (stack_region::get_value_by_name): Delete.
3891 (heap_region::heap_region): Delete.
3892 (heap_region::compare_fields): Delete.
3893 (heap_region::clone): Delete.
3894 (heap_region::walk_for_canonicalization): Delete.
3895 (root_region::root_region): Delete.
3896 (root_region::compare_fields): Delete.
3897 (root_region::clone): Delete.
3898 (root_region::print_fields): Delete.
3899 (root_region::validate): Delete.
3900 (root_region::dump_child_label): Delete.
3901 (root_region::push_frame): Delete.
3902 (root_region::get_current_frame_id): Delete.
3903 (root_region::pop_frame): Delete.
3904 (root_region::ensure_stack_region): Delete.
3905 (root_region::get_stack_region): Delete.
3906 (root_region::ensure_globals_region): Delete.
3907 (root_region::get_code_region): Delete.
3908 (root_region::ensure_code_region): Delete.
3909 (root_region::get_globals_region): Delete.
3910 (root_region::ensure_heap_region): Delete.
3911 (root_region::get_heap_region): Delete.
3912 (root_region::remap_region_ids): Delete.
3913 (root_region::can_merge_p): Delete.
3914 (root_region::add_to_hash): Delete.
3915 (root_region::walk_for_canonicalization): Delete.
3916 (root_region::get_value_by_name): Delete.
3917 (symbolic_region::symbolic_region): Delete.
3918 (symbolic_region::compare_fields): Delete.
3919 (symbolic_region::clone): Delete.
3920 (symbolic_region::walk_for_canonicalization): Delete.
3921 (symbolic_region::print_fields): Delete.
3922 (region_model::region_model): Add region_model_manager * param.
3923 Reimplement in terms of store, dropping impl_constraint_manager
3924 subclass.
3925 (region_model::operator=): Reimplement in terms of store
3926 (region_model::operator==): Likewise.
3927 (region_model::hash): Likewise.
3928 (region_model::print): Delete.
3929 (region_model::print_svalue): Delete.
3930 (region_model::dump_dot_to_pp): Delete.
3931 (region_model::dump_dot_to_file): Delete.
3932 (region_model::dump_dot): Delete.
3933 (region_model::dump_to_pp): Replace "summarize" param with
3934 "simple" and "multiline". Port to store-based implementation.
3935 (region_model::dump): Replace "summarize" param with "simple" and
3936 "multiline".
3937 (dump_vec_of_tree): Delete.
3938 (region_model::dump_summary_of_rep_path_vars): Delete.
3939 (region_model::validate): Delete.
3940 (svalue_id_cmp_by_constant_svalue_model): Delete.
3941 (svalue_id_cmp_by_constant_svalue): Delete.
3942 (region_model::canonicalize): Drop "ctxt" param. Reimplement in
3943 terms of store and constraints.
3944 (region_model::canonicalized_p): Remove NULL arg to canonicalize.
3945 (region_model::loop_replay_fixup): New.
3946 (poisoned_value_diagnostic::emit): Tweak wording of warnings.
3947 (region_model::check_for_poison): Delete.
3948 (region_model::get_gassign_result): New.
3949 (region_model::on_assignment): Port to store-based implementation.
3950 (region_model::on_call_pre): Delete calls to check_for_poison.
3951 Move implementations to region-model-impl-calls.c and port to
3952 store-based implementation.
3953 (region_model::on_call_post): Likewise.
3954 (class reachable_regions): Move to region-model-reachability.h/cc
3955 and port to store-based implementation.
3956 (region_model::handle_unrecognized_call): Port to store-based
3957 implementation.
3958 (region_model::get_reachable_svalues): New.
3959 (region_model::on_setjmp): Port to store-based implementation.
3960 (region_model::on_longjmp): Likewise.
3961 (region_model::handle_phi): Drop is_back_edge param and the logic
3962 using it.
3963 (region_model::get_lvalue_1): Port from region_id to const region *.
3964 (region_model::make_region_for_unexpected_tree_code): Delete.
3965 (assert_compat_types): If the check fails, use internal_error to
3966 show the types.
3967 (region_model::get_lvalue): Port from region_id to const region *.
3968 (region_model::get_rvalue_1): Port from svalue_id to const svalue *.
3969 (region_model::get_rvalue): Likewise.
3970 (region_model::get_or_create_ptr_svalue): Delete.
3971 (region_model::get_or_create_constant_svalue): Delete.
3972 (region_model::get_svalue_for_fndecl): Delete.
3973 (region_model::get_region_for_fndecl): Delete.
3974 (region_model::get_svalue_for_label): Delete.
3975 (region_model::get_region_for_label): Delete.
3976 (build_cast): Delete.
3977 (region_model::maybe_cast_1): Delete.
3978 (region_model::maybe_cast): Delete.
3979 (region_model::get_field_region): Delete.
3980 (region_model::get_store_value): New.
3981 (region_model::region_exists_p): New.
3982 (region_model::deref_rvalue): Port from svalue_id to const svalue *.
3983 (region_model::set_value): Likewise.
3984 (region_model::clobber_region): New.
3985 (region_model::purge_region): New.
3986 (region_model::zero_fill_region): New.
3987 (region_model::mark_region_as_unknown): New.
3988 (region_model::eval_condition): Port from svalue_id to
3989 const svalue *.
3990 (region_model::eval_condition_without_cm): Likewise.
3991 (region_model::compare_initial_and_pointer): New.
3992 (region_model::add_constraint): Port from svalue_id to
3993 const svalue *.
3994 (region_model::maybe_get_constant): Delete.
3995 (region_model::get_representative_path_var): New.
3996 (region_model::add_new_malloc_region): Delete.
3997 (region_model::get_representative_tree): Port to const svalue *.
3998 (region_model::get_representative_path_var): Port to
3999 const region *.
4000 (region_model::get_path_vars_for_svalue): Delete.
4001 (region_model::set_to_new_unknown_value): Delete.
4002 (region_model::update_for_phis): Don't pass is_back_edge to handle_phi.
4003 (region_model::update_for_call_superedge): Port from svalue_id to
4004 const svalue *.
4005 (region_model::update_for_return_superedge): Port to store-based
4006 implementation.
4007 (region_model::update_for_call_summary): Replace
4008 set_to_new_unknown_value with mark_region_as_unknown.
4009 (region_model::get_root_region): Delete.
4010 (region_model::get_stack_region_id): Delete.
4011 (region_model::push_frame): Delete.
4012 (region_model::get_current_frame_id): Delete.
4013 (region_model::get_current_function): Delete.
4014 (region_model::pop_frame): Delete.
4015 (region_model::on_top_level_param): New.
4016 (region_model::get_stack_depth): Delete.
4017 (region_model::get_function_at_depth): Delete.
4018 (region_model::get_globals_region_id): Delete.
4019 (region_model::add_svalue): Delete.
4020 (region_model::replace_svalue): Delete.
4021 (region_model::add_region): Delete.
4022 (region_model::get_svalue): Delete.
4023 (region_model::get_region): Delete.
4024 (make_region_for_type): Delete.
4025 (region_model::add_region_for_type): Delete.
4026 (region_model::on_top_level_param): New.
4027 (class restrict_to_used_svalues): Delete.
4028 (region_model::purge_unused_svalues): Delete.
4029 (region_model::push_frame): New.
4030 (region_model::remap_svalue_ids): Delete.
4031 (region_model::remap_region_ids): Delete.
4032 (region_model::purge_regions): Delete.
4033 (region_model::get_descendents): Delete.
4034 (region_model::delete_region_and_descendents): Delete.
4035 (region_model::poison_any_pointers_to_bad_regions): Delete.
4036 (region_model::can_merge_with_p): Delete.
4037 (region_model::get_current_function): New.
4038 (region_model::get_value_by_name): Delete.
4039 (region_model::convert_byte_offset_to_array_index): Delete.
4040 (region_model::pop_frame): New.
4041 (region_model::get_or_create_mem_ref): Delete.
4042 (region_model::get_stack_depth): New.
4043 (region_model::get_frame_at_index): New.
4044 (region_model::unbind_region_and_descendents): New.
4045 (struct bad_pointer_finder): New.
4046 (region_model::get_or_create_pointer_plus_expr): Delete.
4047 (region_model::poison_any_pointers_to_descendents): New.
4048 (region_model::get_or_create_view): Delete.
4049 (region_model::can_merge_with_p): New.
4050 (region_model::get_fndecl_for_call): Port from svalue_id to
4051 const svalue *.
4052 (struct append_ssa_names_cb_data): New.
4053 (get_ssa_name_regions_for_current_frame): New.
4054 (region_model::append_ssa_names_cb): New.
4055 (model_merger::dump_to_pp): Add "simple" param. Drop dumping of
4056 remappings.
4057 (model_merger::dump): Add "simple" param to both overloads.
4058 (model_merger::can_merge_values_p): Delete.
4059 (model_merger::record_regions): Delete.
4060 (model_merger::record_svalues): Delete.
4061 (svalue_id_merger_mapping::svalue_id_merger_mapping): Delete.
4062 (svalue_id_merger_mapping::dump_to_pp): Delete.
4063 (svalue_id_merger_mapping::dump): Delete.
4064 (region_model::create_region_for_heap_alloc): New.
4065 (region_model::create_region_for_alloca): New.
4066 (region_model::record_dynamic_extents): New.
4067 (canonicalization::canonicalization): Delete.
4068 (canonicalization::walk_rid): Delete.
4069 (canonicalization::walk_sid): Delete.
4070 (canonicalization::dump_to_pp): Delete.
4071 (canonicalization::dump): Delete.
4072 (inchash::add): Delete overloads for svalue_id and region_id.
4073 (engine::log_stats): New.
4074 (assert_condition): Add overload comparing svalues.
4075 (assert_dump_eq): Pass "true" for multiline.
4076 (selftest::test_dump): Update for rewrite of region_model.
4077 (selftest::test_dump_2): Rename to...
4078 (selftest::test_struct): ...this. Provide a region_model_manager
4079 when creating region_model instance. Remove dump test. Add
4080 checks for get_offset.
4081 (selftest::test_dump_3): Rename to...
4082 (selftest::test_array_1): ...this. Provide a region_model_manager
4083 when creating region_model instance. Remove dump test.
4084 (selftest::test_get_representative_tree): Port from svalue_id to
4085 new API. Add test coverage for various expressions.
4086 (selftest::test_unique_constants): Provide a region_model_manager
4087 for the region_model. Add test coverage for comparing const vs
4088 non-const.
4089 (selftest::test_svalue_equality): Delete.
4090 (selftest::test_region_equality): Delete.
4091 (selftest::test_unique_unknowns): New.
4092 (class purge_all_svalue_ids): Delete.
4093 (class purge_one_svalue_id): Delete.
4094 (selftest::test_purging_by_criteria): Delete.
4095 (selftest::test_initial_svalue_folding): New.
4096 (selftest::test_unaryop_svalue_folding): New.
4097 (selftest::test_binop_svalue_folding): New.
4098 (selftest::test_sub_svalue_folding): New.
4099 (selftest::test_purge_unused_svalues): Delete.
4100 (selftest::test_descendent_of_p): New.
4101 (selftest::test_assignment): Provide a region_model_manager for
4102 the region_model. Drop the dump test.
4103 (selftest::test_compound_assignment): Likewise.
4104 (selftest::test_stack_frames): Port to new implementation.
4105 (selftest::test_get_representative_path_var): Likewise.
4106 (selftest::test_canonicalization_1): Rename to...
4107 (selftest::test_equality_1): ...this. Port to new API, and add
4108 (selftest::test_canonicalization_2): Provide a
4109 region_model_manager when creating region_model instances.
4110 Remove redundant canicalization.
4111 (selftest::test_canonicalization_3): Provide a
4112 region_model_manager when creating region_model instances.
4113 Remove param from calls to region_model::canonicalize.
4114 (selftest::test_canonicalization_4): Likewise.
4115 (selftest::assert_region_models_merge): Constify
4116 out_merged_svalue. Port to new API.
4117 (selftest::test_state_merging): Provide a
4118 region_model_manager when creating region_model instances.
4119 Provide a program_point point when merging them. Replace
4120 set_to_new_unknown_value with usage of placeholder_svalues.
4121 Drop get_value_by_name. Port from svalue_id to const svalue *.
4122 Add test of heap allocation.
4123 (selftest::test_constraint_merging): Provide a
4124 region_model_manager when creating region_model instances.
4125 Provide a program_point point when merging them. Eliminate use
4126 of set_to_new_unknown_value.
4127 (selftest::test_widening_constraints): New.
4128 (selftest::test_iteration_1): New.
4129 (selftest::test_malloc_constraints): Port to store-based
4130 implementation.
4131 (selftest::test_var): New test.
4132 (selftest::test_array_2): New test.
4133 (selftest::test_mem_ref): New test.
4134 (selftest::test_POINTER_PLUS_EXPR_then_MEM_REF): New.
4135 (selftest::test_malloc): New.
4136 (selftest::test_alloca): New.
4137 (selftest::analyzer_region_model_cc_tests): Update for renamings.
4138 Call new functions.
4139 * region-model.h (class path_var): Move to analyzer.h.
4140 (class svalue_id): Delete.
4141 (class region_id): Delete.
4142 (class id_map): Delete.
4143 (svalue_id_map): Delete.
4144 (region_id_map): Delete.
4145 (id_map<T>::id_map): Delete.
4146 (id_map<T>::put): Delete.
4147 (id_map<T>::get_dst_for_src): Delete.
4148 (id_map<T>::get_src_for_dst): Delete.
4149 (id_map<T>::dump_to_pp): Delete.
4150 (id_map<T>::dump): Delete.
4151 (id_map<T>::update): Delete.
4152 (one_way_svalue_id_map): Delete.
4153 (one_way_region_id_map): Delete.
4154 (class region_id_set): Delete.
4155 (class svalue_id_set): Delete.
4156 (struct complexity): New.
4157 (class visitor): New.
4158 (enum svalue_kind): Add SK_SETJMP, SK_INITIAL, SK_UNARYOP,
4159 SK_BINOP, SK_SUB,SK_UNMERGEABLE, SK_PLACEHOLDER, SK_WIDENING,
4160 SK_COMPOUND, and SK_CONJURED.
4161 (svalue::operator==): Delete.
4162 (svalue::operator!=): Delete.
4163 (svalue::clone): Delete.
4164 (svalue::hash): Delete.
4165 (svalue::dump_dot_to_pp): Delete.
4166 (svalue::dump_to_pp): New.
4167 (svalue::dump): New.
4168 (svalue::get_desc): New.
4169 (svalue::dyn_cast_initial_svalue): New.
4170 (svalue::dyn_cast_unaryop_svalue): New.
4171 (svalue::dyn_cast_binop_svalue): New.
4172 (svalue::dyn_cast_sub_svalue): New.
4173 (svalue::dyn_cast_unmergeable_svalue): New.
4174 (svalue::dyn_cast_widening_svalue): New.
4175 (svalue::dyn_cast_compound_svalue): New.
4176 (svalue::dyn_cast_conjured_svalue): New.
4177 (svalue::maybe_undo_cast): New.
4178 (svalue::unwrap_any_unmergeable): New.
4179 (svalue::remap_region_ids): Delete
4180 (svalue::can_merge_p): New.
4181 (svalue::walk_for_canonicalization): Delete
4182 (svalue::get_complexity): New.
4183 (svalue::get_child_sid): Delete
4184 (svalue::accept): New.
4185 (svalue::live_p): New.
4186 (svalue::implicitly_live_p): New.
4187 (svalue::svalue): Add complexity param.
4188 (svalue::add_to_hash): Delete
4189 (svalue::print_details): Delete
4190 (svalue::m_complexity): New field.
4191 (region_svalue::key_t): New struct.
4192 (region_svalue::region_svalue): Port from region_id to
4193 const region_id *. Add complexity.
4194 (region_svalue::compare_fields): Delete.
4195 (region_svalue::clone): Delete.
4196 (region_svalue::dump_dot_to_pp): Delete.
4197 (region_svalue::get_pointee): Port from region_id to
4198 const region_id *.
4199 (region_svalue::remap_region_ids): Delete.
4200 (region_svalue::merge_values): Delete.
4201 (region_svalue::dump_to_pp): New.
4202 (region_svalue::accept): New.
4203 (region_svalue::walk_for_canonicalization): Delete.
4204 (region_svalue::eval_condition): Make params const.
4205 (region_svalue::add_to_hash): Delete.
4206 (region_svalue::print_details): Delete.
4207 (region_svalue::m_rid): Replace with...
4208 (region_svalue::m_reg): ...this.
4209 (is_a_helper <region_svalue *>::test): Convert to...
4210 (is_a_helper <const region_svalue *>::test): ...this.
4211 (template <> struct default_hash_traits<region_svalue::key_t>):
4212 New.
4213 (constant_svalue::constant_svalue): Add complexity.
4214 (constant_svalue::compare_fields): Delete.
4215 (constant_svalue::clone): Delete.
4216 (constant_svalue::add_to_hash): Delete.
4217 (constant_svalue::dump_to_pp): New.
4218 (constant_svalue::accept): New.
4219 (constant_svalue::implicitly_live_p): New.
4220 (constant_svalue::merge_values): Delete.
4221 (constant_svalue::eval_condition): Make params const.
4222 (constant_svalue::get_child_sid): Delete.
4223 (constant_svalue::print_details): Delete.
4224 (is_a_helper <constant_svalue *>::test): Convert to...
4225 (is_a_helper <const constant_svalue *>::test): ...this.
4226 (class unknown_svalue): Update leading comment.
4227 (unknown_svalue::unknown_svalue): Add complexity.
4228 (unknown_svalue::compare_fields): Delete.
4229 (unknown_svalue::add_to_hash): Delete.
4230 (unknown_svalue::dyn_cast_unknown_svalue): Delete.
4231 (unknown_svalue::print_details): Delete.
4232 (unknown_svalue::dump_to_pp): New.
4233 (unknown_svalue::accept): New.
4234 (poisoned_svalue::key_t): New struct.
4235 (poisoned_svalue::poisoned_svalue): Add complexity.
4236 (poisoned_svalue::compare_fields): Delete.
4237 (poisoned_svalue::clone): Delete.
4238 (poisoned_svalue::add_to_hash): Delete.
4239 (poisoned_svalue::dump_to_pp): New.
4240 (poisoned_svalue::accept): New.
4241 (poisoned_svalue::print_details): Delete.
4242 (is_a_helper <poisoned_svalue *>::test): Convert to...
4243 (is_a_helper <const poisoned_svalue *>::test): ...this.
4244 (template <> struct default_hash_traits<poisoned_svalue::key_t>):
4245 New.
4246 (setjmp_record::add_to_hash): New.
4247 (setjmp_svalue::key_t): New struct.
4248 (setjmp_svalue::compare_fields): Delete.
4249 (setjmp_svalue::clone): Delete.
4250 (setjmp_svalue::add_to_hash): Delete.
4251 (setjmp_svalue::setjmp_svalue): Add complexity.
4252 (setjmp_svalue::dump_to_pp): New.
4253 (setjmp_svalue::accept): New.
4254 (setjmp_svalue::void print_details): Delete.
4255 (is_a_helper <const setjmp_svalue *>::test): New.
4256 (template <> struct default_hash_traits<setjmp_svalue::key_t>): New.
4257 (class initial_svalue : public svalue): New.
4258 (is_a_helper <const initial_svalue *>::test): New.
4259 (class unaryop_svalue): New.
4260 (is_a_helper <const unaryop_svalue *>::test): New.
4261 (template <> struct default_hash_traits<unaryop_svalue::key_t>): New.
4262 (class binop_svalue): New.
4263 (is_a_helper <const binop_svalue *>::test): New.
4264 (template <> struct default_hash_traits<binop_svalue::key_t>): New.
4265 (class sub_svalue): New.
4266 (is_a_helper <const sub_svalue *>::test): New.
4267 (template <> struct default_hash_traits<sub_svalue::key_t>): New.
4268 (class unmergeable_svalue): New.
4269 (is_a_helper <const unmergeable_svalue *>::test): New.
4270 (class placeholder_svalue): New.
4271 (is_a_helper <placeholder_svalue *>::test): New.
4272 (class widening_svalue): New.
4273 (is_a_helper <widening_svalue *>::test): New.
4274 (template <> struct default_hash_traits<widening_svalue::key_t>): New.
4275 (class compound_svalue): New.
4276 (is_a_helper <compound_svalue *>::test): New.
4277 (template <> struct default_hash_traits<compound_svalue::key_t>): New.
4278 (class conjured_svalue): New.
4279 (is_a_helper <conjured_svalue *>::test): New.
4280 (template <> struct default_hash_traits<conjured_svalue::key_t>): New.
4281 (enum region_kind): Delete RK_PRIMITIVE, RK_STRUCT, RK_UNION, and
4282 RK_ARRAY. Add RK_LABEL, RK_DECL, RK_FIELD, RK_ELEMENT, RK_OFFSET,
4283 RK_CAST, RK_HEAP_ALLOCATED, RK_ALLOCA, RK_STRING, and RK_UNKNOWN.
4284 (region_kind_to_str): Delete.
4285 (region::~region): Move implementation to region.cc.
4286 (region::operator==): Delete.
4287 (region::operator!=): Delete.
4288 (region::clone): Delete.
4289 (region::get_id): New.
4290 (region::cmp_ids): New.
4291 (region::dyn_cast_map_region): Delete.
4292 (region::dyn_cast_array_region): Delete.
4293 (region::region_id get_parent): Delete.
4294 (region::get_parent_region): Convert to a simple accessor.
4295 (region::void set_value): Delete.
4296 (region::svalue_id get_value): Delete.
4297 (region::svalue_id get_value_direct): Delete.
4298 (region::svalue_id get_inherited_child_sid): Delete.
4299 (region::dyn_cast_frame_region): New.
4300 (region::dyn_cast_function_region): New.
4301 (region::dyn_cast_decl_region): New.
4302 (region::dyn_cast_field_region): New.
4303 (region::dyn_cast_element_region): New.
4304 (region::dyn_cast_offset_region): New.
4305 (region::dyn_cast_cast_region): New.
4306 (region::dyn_cast_string_region): New.
4307 (region::accept): New.
4308 (region::get_base_region): New.
4309 (region::base_region_p): New.
4310 (region::descendent_of_p): New.
4311 (region::maybe_get_frame_region): New.
4312 (region::maybe_get_decl): New.
4313 (region::hash): Delete.
4314 (region::rint): Delete.
4315 (region::dump_dot_to_pp): Delete.
4316 (region::get_desc): New.
4317 (region::dump_to_pp): Convert to vfunc, changing signature.
4318 (region::dump_child_label): Delete.
4319 (region::remap_svalue_ids): Delete.
4320 (region::remap_region_ids): Delete.
4321 (region::dump): New.
4322 (region::walk_for_canonicalization): Delete.
4323 (region::non_null_p): Drop region_model param.
4324 (region::add_view): Delete.
4325 (region::get_view): Delete.
4326 (region::get_active_view): Delete.
4327 (region::is_view_p): Delete.
4328 (region::cmp_ptrs): New.
4329 (region::validate): Delete.
4330 (region::get_offset): New.
4331 (region::get_byte_size): New.
4332 (region::get_bit_size): New.
4333 (region::get_subregions_for_binding): New.
4334 (region::region): Add complexity param. Convert parent from
4335 region_id to const region *. Drop svalue_id. Drop copy ctor.
4336 (region::symbolic_for_unknown_ptr_p): New.
4337 (region::add_to_hash): Delete.
4338 (region::print_fields): Delete.
4339 (region::get_complexity): New accessor.
4340 (region::become_active_view): Delete.
4341 (region::deactivate_any_active_view): Delete.
4342 (region::deactivate_view): Delete.
4343 (region::calc_offset): New.
4344 (region::m_parent_rid): Delete.
4345 (region::m_sval_id): Delete.
4346 (region::m_complexity): New.
4347 (region::m_id): New.
4348 (region::m_parent): New.
4349 (region::m_view_rids): Delete.
4350 (region::m_is_view): Delete.
4351 (region::m_active_view_rid): Delete.
4352 (region::m_cached_offset): New.
4353 (is_a_helper <region *>::test): Convert to...
4354 (is_a_helper <const region *>::test): ... this.
4355 (class primitive_region): Delete.
4356 (class space_region): New.
4357 (class map_region): Delete.
4358 (is_a_helper <map_region *>::test): Delete.
4359 (class frame_region): Reimplement.
4360 (template <> struct default_hash_traits<frame_region::key_t>):
4361 New.
4362 (class globals_region): Reimplement.
4363 (is_a_helper <globals_region *>::test): Convert to...
4364 (is_a_helper <const globals_region *>::test): ...this.
4365 (class struct_or_union_region): Delete.
4366 (is_a_helper <struct_or_union_region *>::test): Delete.
4367 (class code_region): Reimplement.
4368 (is_a_helper <const code_region *>::test): New.
4369 (class struct_region): Delete.
4370 (is_a_helper <struct_region *>::test): Delete.
4371 (class function_region): Reimplement.
4372 (is_a_helper <function_region *>::test): Convert to...
4373 (is_a_helper <const function_region *>::test): ...this.
4374 (class union_region): Delete.
4375 (is_a_helper <union_region *>::test): Delete.
4376 (class label_region): New.
4377 (is_a_helper <const label_region *>::test): New.
4378 (class scope_region): Delete.
4379 (class stack_region): Reimplement.
4380 (is_a_helper <stack_region *>::test): Convert to...
4381 (is_a_helper <const stack_region *>::test): ...this.
4382 (class heap_region): Reimplement.
4383 (is_a_helper <heap_region *>::test): Convert to...
4384 (is_a_helper <const heap_region *>::test): ...this.
4385 (class root_region): Reimplement.
4386 (is_a_helper <root_region *>::test): Convert to...
4387 (is_a_helper <const root_region *>::test): ...this.
4388 (class symbolic_region): Reimplement.
4389 (is_a_helper <const symbolic_region *>::test): New.
4390 (template <> struct default_hash_traits<symbolic_region::key_t>):
4391 New.
4392 (class decl_region): New.
4393 (is_a_helper <const decl_region *>::test): New.
4394 (class field_region): New.
4395 (template <> struct default_hash_traits<field_region::key_t>): New.
4396 (class array_region): Delete.
4397 (class element_region): New.
4398 (is_a_helper <array_region *>::test): Delete.
4399 (is_a_helper <const element_region *>::test): New.
4400 (template <> struct default_hash_traits<element_region::key_t>):
4401 New.
4402 (class offset_region): New.
4403 (is_a_helper <const offset_region *>::test): New.
4404 (template <> struct default_hash_traits<offset_region::key_t>):
4405 New.
4406 (class cast_region): New.
4407 (is_a_helper <const cast_region *>::test): New.
4408 (template <> struct default_hash_traits<cast_region::key_t>): New.
4409 (class heap_allocated_region): New.
4410 (class alloca_region): New.
4411 (class string_region): New.
4412 (is_a_helper <const string_region *>::test): New.
4413 (class unknown_region): New.
4414 (class region_model_manager): New.
4415 (struct append_ssa_names_cb_data): New.
4416 (class call_details): New.
4417 (region_model::region_model): Add region_model_manager param.
4418 (region_model::print_svalue): Delete.
4419 (region_model::dump_dot_to_pp): Delete.
4420 (region_model::dump_dot_to_file): Delete.
4421 (region_model::dump_dot): Delete.
4422 (region_model::dump_to_pp): Drop summarize param in favor of
4423 simple and multiline.
4424 (region_model::dump): Likewise.
4425 (region_model::summarize_to_pp): Delete.
4426 (region_model::summarize): Delete.
4427 (region_model::void canonicalize): Drop ctxt param.
4428 (region_model::void check_for_poison): Delete.
4429 (region_model::get_gassign_result): New.
4430 (region_model::impl_call_alloca): New.
4431 (region_model::impl_call_analyzer_describe): New.
4432 (region_model::impl_call_analyzer_eval): New.
4433 (region_model::impl_call_builtin_expect): New.
4434 (region_model::impl_call_calloc): New.
4435 (region_model::impl_call_free): New.
4436 (region_model::impl_call_malloc): New.
4437 (region_model::impl_call_memset): New.
4438 (region_model::impl_call_strlen): New.
4439 (region_model::get_reachable_svalues): New.
4440 (region_model::handle_phi): Drop is_back_edge param.
4441 (region_model::region_id get_root_rid): Delete.
4442 (region_model::root_region *get_root_region): Delete.
4443 (region_model::region_id get_stack_region_id): Delete.
4444 (region_model::push_frame): Convert from region_id and svalue_id
4445 to const region * and const svalue *.
4446 (region_model::get_current_frame_id): Replace with...
4447 (region_model::get_current_frame): ...this.
4448 (region_model::pop_frame): Convert from region_id to
4449 const region *. Drop purge and stats param. Add out_result.
4450 (region_model::function *get_function_at_depth): Delete.
4451 (region_model::get_globals_region_id): Delete.
4452 (region_model::add_svalue): Delete.
4453 (region_model::replace_svalue): Delete.
4454 (region_model::add_region): Delete.
4455 (region_model::add_region_for_type): Delete.
4456 (region_model::get_svalue): Delete.
4457 (region_model::get_region): Delete.
4458 (region_model::get_lvalue): Convert from region_id to
4459 const region *.
4460 (region_model::get_rvalue): Convert from svalue_id to
4461 const svalue *.
4462 (region_model::get_or_create_ptr_svalue): Delete.
4463 (region_model::get_or_create_constant_svalue): Delete.
4464 (region_model::get_svalue_for_fndecl): Delete.
4465 (region_model::get_svalue_for_label): Delete.
4466 (region_model::get_region_for_fndecl): Delete.
4467 (region_model::get_region_for_label): Delete.
4468 (region_model::get_frame_at_index (int index) const;): New.
4469 (region_model::maybe_cast): Delete.
4470 (region_model::maybe_cast_1): Delete.
4471 (region_model::get_field_region): Delete.
4472 (region_model::id deref_rvalue): Convert from region_id and
4473 svalue_id to const region * and const svalue *. Drop overload,
4474 passing in both a tree and an svalue.
4475 (region_model::set_value): Convert from region_id and svalue_id to
4476 const region * and const svalue *.
4477 (region_model::set_to_new_unknown_value): Delete.
4478 (region_model::clobber_region (const region *reg);): New.
4479 (region_model::purge_region (const region *reg);): New.
4480 (region_model::zero_fill_region (const region *reg);): New.
4481 (region_model::mark_region_as_unknown (const region *reg);): New.
4482 (region_model::copy_region): Convert from region_id to
4483 const region *.
4484 (region_model::eval_condition): Convert from svalue_id to
4485 const svalue *.
4486 (region_model::eval_condition_without_cm): Likewise.
4487 (region_model::compare_initial_and_pointer): New.
4488 (region_model:maybe_get_constant): Delete.
4489 (region_model::add_new_malloc_region): Delete.
4490 (region_model::get_representative_tree): Convert from svalue_id to
4491 const svalue *.
4492 (region_model::get_representative_path_var): Delete decl taking a
4493 region_id in favor of two decls, for svalue vs region, with an
4494 svalue_set to ensure termination.
4495 (region_model::get_path_vars_for_svalue): Delete.
4496 (region_model::create_region_for_heap_alloc): New.
4497 (region_model::create_region_for_alloca): New.
4498 (region_model::purge_unused_svalues): Delete.
4499 (region_model::remap_svalue_ids): Delete.
4500 (region_model::remap_region_ids): Delete.
4501 (region_model::purge_regions): Delete.
4502 (region_model::get_num_svalues): Delete.
4503 (region_model::get_num_regions): Delete.
4504 (region_model::get_descendents): Delete.
4505 (region_model::get_store): New.
4506 (region_model::delete_region_and_descendents): Delete.
4507 (region_model::get_manager): New.
4508 (region_model::unbind_region_and_descendents): New.
4509 (region_model::can_merge_with_p): Add point param. Drop
4510 svalue_id_merger_mapping.
4511 (region_model::get_value_by_name): Delete.
4512 (region_model::convert_byte_offset_to_array_index): Delete.
4513 (region_model::get_or_create_mem_ref): Delete.
4514 (region_model::get_or_create_pointer_plus_expr): Delete.
4515 (region_model::get_or_create_view): Delete.
4516 (region_model::get_lvalue_1): Convert from region_id to
4517 const region *.
4518 (region_model::get_rvalue_1): Convert from svalue_id to
4519 const svalue *.
4520 (region_model::get_ssa_name_regions_for_current_frame): New.
4521 (region_model::append_ssa_names_cb): New.
4522 (region_model::get_store_value): New.
4523 (region_model::copy_struct_region): Delete.
4524 (region_model::copy_union_region): Delete.
4525 (region_model::copy_array_region): Delete.
4526 (region_model::region_exists_p): New.
4527 (region_model::make_region_for_unexpected_tree_code): Delete.
4528 (region_model::loop_replay_fixup): New.
4529 (region_model::poison_any_pointers_to_bad_regions): Delete.
4530 (region_model::poison_any_pointers_to_descendents): New.
4531 (region_model::dump_summary_of_rep_path_vars): Delete.
4532 (region_model::on_top_level_param): New.
4533 (region_model::record_dynamic_extents): New.
4534 (region_model::m_mgr;): New.
4535 (region_model::m_store;): New.
4536 (region_model::m_svalues;): Delete.
4537 (region_model::m_regions;): Delete.
4538 (region_model::m_root_rid;): Delete.
4539 (region_model::m_current_frame;): New.
4540 (region_model_context::remap_svalue_ids): Delete.
4541 (region_model_context::can_purge_p): Delete.
4542 (region_model_context::on_svalue_leak): New.
4543 (region_model_context::on_svalue_purge): Delete.
4544 (region_model_context::on_liveness_change): New.
4545 (region_model_context::on_inherited_svalue): Delete.
4546 (region_model_context::on_cast): Delete.
4547 (region_model_context::on_unknown_change): Convert from svalue_id to
4548 const svalue * and add is_mutable.
4549 (class noop_region_model_context): Update for region_model_context
4550 changes.
4551 (model_merger::model_merger): Add program_point. Drop
4552 svalue_id_merger_mapping.
4553 (model_merger::dump_to_pp): Add "simple" param.
4554 (model_merger::dump): Likewise.
4555 (model_merger::get_region_a): Delete.
4556 (model_merger::get_region_b): Delete.
4557 (model_merger::can_merge_values_p): Delete.
4558 (model_merger::record_regions): Delete.
4559 (model_merger::record_svalues): Delete.
4560 (model_merger::m_point): New field.
4561 (model_merger::m_map_regions_from_a_to_m): Delete.
4562 (model_merger::m_map_regions_from_b_to_m): Delete.
4563 (model_merger::m_sid_mapping): Delete.
4564 (struct svalue_id_merger_mapping): Delete.
4565 (class engine): New.
4566 (struct canonicalization): Delete.
4567 (inchash::add): Delete decls for hashing svalue_id and region_id.
4568 (test_region_model_context::on_unexpected_tree_code): Require t to
4569 be non-NULL.
4570 (selftest::assert_condition): Add overload comparing a pair of
4571 const svalue *.
4572 * sm-file.cc: Include "tristate.h", "selftest.h",
4573 "analyzer/call-string.h", "analyzer/program-point.h",
4574 "analyzer/store.h", and "analyzer/region-model.h".
4575 (fileptr_state_machine::get_default_state): New.
4576 (fileptr_state_machine::on_stmt): Remove calls to
4577 get_readable_tree in favor of get_diagnostic_tree.
4578 * sm-malloc.cc: Include "tristate.h", "selftest.h",
4579 "analyzer/call-string.h", "analyzer/program-point.h",
4580 "analyzer/store.h", and "analyzer/region-model.h".
4581 (malloc_state_machine::get_default_state): New.
4582 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New.
4583 (malloc_diagnostic::describe_state_change): Handle change.m_expr
4584 being NULL.
4585 (null_arg::emit): Avoid printing "NULL '0'".
4586 (null_arg::describe_final_event): Avoid printing "(0) NULL".
4587 (malloc_leak::emit): Handle m_arg being NULL.
4588 (malloc_leak::describe_final_event): Handle ev.m_expr being NULL.
4589 (malloc_state_machine::on_stmt): Don't call get_readable_tree.
4590 Call get_diagnostic_tree when creating pending diagnostics.
4591 Update for is_zero_assignment becoming a member function of
4592 sm_ctxt.
4593 Don't transition to m_non_heap for ADDR_EXPR(MEM_REF()).
4594 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New
4595 vfunc implementation.
4596 * sm-sensitive.cc (sensitive_state_machine::warn_for_any_exposure): Call
4597 get_diagnostic_tree and pass the result to warn_for_state.
4598 * sm-signal.cc: Move includes of "analyzer/call-string.h" and
4599 "analyzer/program-point.h" to before "analyzer/region-model.h",
4600 and also include "analyzer/store.h" before it.
4601 (signal_unsafe_call::describe_state_change): Use
4602 get_dest_function to get handler.
4603 (update_model_for_signal_handler): Pass manager to region_model
4604 ctor.
4605 (register_signal_handler::impl_transition): Update for changes to
4606 get_or_create_node and add_edge.
4607 * sm-taint.cc (taint_state_machine::on_stmt): Remove calls to
4608 get_readable_tree, replacing them when calling warn_for_state with
4609 calls to get_diagnostic_tree.
4610 * sm.cc (is_zero_assignment): Delete.
4611 (any_pointer_p): Move to within namespace ana.
4612 * sm.h (is_zero_assignment): Remove decl.
4613 (any_pointer_p): Move decl to within namespace ana.
4614 (state_machine::get_default_state): New vfunc.
4615 (state_machine::reset_when_passed_to_unknown_fn_p): New vfunc.
4616 (sm_context::get_readable_tree): Rename to...
4617 (sm_context::get_diagnostic_tree): ...this.
4618 (sm_context::is_zero_assignment): New vfunc.
4619 * store.cc: New file.
4620 * store.h: New file.
4621 * svalue.cc: New file.
4623 2020-05-22 Mark Wielaard <mark@klomp.org>
4625 * sm-signal.cc(signal_unsafe_call::emit): Possibly add
4626 gcc_rich_location note for replacement.
4627 (signal_unsafe_call::get_replacement_fn): New private function.
4628 (get_async_signal_unsafe_fns): Add "exit".
4630 2020-04-28 David Malcolm <dmalcolm@redhat.com>
4632 PR analyzer/94816
4633 * engine.cc (impl_region_model_context::on_unexpected_tree_code):
4634 Handle NULL tree.
4635 * region-model.cc (region_model::add_region_for_type): Handle
4636 NULL type.
4637 * region-model.h
4638 (test_region_model_context::on_unexpected_tree_code): Handle NULL
4639 tree.
4641 2020-04-28 David Malcolm <dmalcolm@redhat.com>
4643 PR analyzer/94447
4644 PR analyzer/94639
4645 PR analyzer/94732
4646 PR analyzer/94754
4647 * analyzer.opt (Wanalyzer-use-of-uninitialized-value): Delete.
4648 * program-state.cc (selftest::test_program_state_dumping): Update
4649 expected dump result for removal of "uninit".
4650 * region-model.cc (poison_kind_to_str): Delete POISON_KIND_UNINIT
4651 case.
4652 (root_region::ensure_stack_region): Initialize stack with null
4653 svalue_id rather than with a typeless POISON_KIND_UNINIT value.
4654 (root_region::ensure_heap_region): Likewise for the heap.
4655 (region_model::dump_summary_of_rep_path_vars): Remove
4656 summarization of uninit values.
4657 (region_model::validate): Remove check that the stack has a
4658 POISON_KIND_UNINIT value.
4659 (poisoned_value_diagnostic::emit): Remove POISON_KIND_UNINIT
4660 case.
4661 (poisoned_value_diagnostic::describe_final_event): Likewise.
4662 (selftest::test_dump): Update expected dump result for removal of
4663 "uninit".
4664 (selftest::test_svalue_equality): Remove "uninit" and "freed".
4665 * region-model.h (enum poison_kind): Remove POISON_KIND_UNINIT.
4667 2020-04-01 David Malcolm <dmalcolm@redhat.com>
4669 PR analyzer/94378
4670 * checker-path.cc: Include "bitmap.h".
4671 * constraint-manager.cc: Likewise.
4672 * diagnostic-manager.cc: Likewise.
4673 * engine.cc: Likewise.
4674 (exploded_node::detect_leaks): Pass null region_id to pop_frame.
4675 * program-point.cc: Include "bitmap.h".
4676 * program-state.cc: Likewise.
4677 * region-model.cc (id_set<region_id>::id_set): Convert to...
4678 (region_id_set::region_id_set): ...this.
4679 (svalue_id_set::svalue_id_set): New ctor.
4680 (region_model::copy_region): New function.
4681 (region_model::copy_struct_region): New function.
4682 (region_model::copy_union_region): New function.
4683 (region_model::copy_array_region): New function.
4684 (stack_region::pop_frame): Drop return value. Add
4685 "result_dst_rid" param; if it is non-null, use copy_region to copy
4686 the result to it. Rather than capture and pass a single "known
4687 used" return value to be used by purge_unused_values, instead
4688 gather and pass a set of known used return values.
4689 (root_region::pop_frame): Drop return value. Add "result_dst_rid"
4690 param.
4691 (region_model::on_assignment): Use copy_region.
4692 (region_model::on_return): Likewise for the result.
4693 (region_model::on_longjmp): Pass null for pop_frame's
4694 result_dst_rid.
4695 (region_model::update_for_return_superedge): Pass the region for the
4696 return value of the call, if any, to pop_frame, rather than setting
4697 the lvalue for the lhs of the result.
4698 (region_model::pop_frame): Drop return value. Add
4699 "result_dst_rid" param.
4700 (region_model::purge_unused_svalues): Convert third param from an
4701 svalue_id * to an svalue_id_set *, updating the initial populating
4702 of the "used" bitmap accordingly. Don't remap it when done.
4703 (struct selftest::coord_test): New selftest fixture, extracted from...
4704 (selftest::test_dump_2): ...here.
4705 (selftest::test_compound_assignment): New selftest.
4706 (selftest::test_stack_frames): Pass null to new param of pop_frame.
4707 (selftest::analyzer_region_model_cc_tests): Call the new selftest.
4708 * region-model.h (class id_set): Delete template.
4709 (class region_id_set): Reimplement, using old id_set implementation.
4710 (class svalue_id_set): Likewise. Convert from auto_sbitmap to
4711 auto_bitmap.
4712 (region::get_active_view): New accessor.
4713 (stack_region::pop_frame): Drop return value. Add
4714 "result_dst_rid" param.
4715 (root_region::pop_frame): Likewise.
4716 (region_model::pop_frame): Likewise.
4717 (region_model::copy_region): New decl.
4718 (region_model::purge_unused_svalues): Convert third param from an
4719 svalue_id * to an svalue_id_set *.
4720 (region_model::copy_struct_region): New decl.
4721 (region_model::copy_union_region): New decl.
4722 (region_model::copy_array_region): New decl.
4724 2020-03-27 David Malcolm <dmalcolm@redhat.com>
4726 * program-state.cc (selftest::test_program_state_dumping): Update
4727 expected dump to include symbolic_region's possibly_null field.
4728 * region-model.cc (symbolic_region::print_fields): New vfunc
4729 implementation.
4730 (region_model::add_constraint): Clear m_possibly_null from
4731 symbolic_regions now known to be non-NULL.
4732 (selftest::test_malloc_constraints): New selftest.
4733 (selftest::analyzer_region_model_cc_tests): Call it.
4734 * region-model.h (region::dyn_cast_symbolic_region): Add non-const
4735 overload.
4736 (symbolic_region::dyn_cast_symbolic_region): Implement it.
4737 (symbolic_region::print_fields): New vfunc override decl.
4739 2020-03-27 David Malcolm <dmalcolm@redhat.com>
4741 * analyzer.h (class feasibility_problem): New forward decl.
4742 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
4743 Initialize new fields m_status, m_epath_length, and m_problem.
4744 (saved_diagnostic::~saved_diagnostic): Delete m_problem.
4745 (dedupe_candidate::dedupe_candidate): Convert "sd" param from a
4746 const ref to a mutable ptr.
4747 (dedupe_winners::add): Convert "sd" param from a const ref to a
4748 mutable ptr. Record the length of the exploded_path. Record the
4749 feasibility/infeasibility of sd into sd, capturing a
4750 feasibility_problem when feasible_p fails, and storing it in sd.
4751 (diagnostic_manager::emit_saved_diagnostics): Update for pass by
4752 ptr rather than by const ref.
4753 * diagnostic-manager.h (class saved_diagnostic): Add new enum
4754 status. Add fields m_status, m_epath_length and m_problem.
4755 (saved_diagnostic::set_feasible): New member function.
4756 (saved_diagnostic::set_infeasible): New member function.
4757 (saved_diagnostic::get_feasibility_problem): New accessor.
4758 (saved_diagnostic::get_status): New accessor.
4759 (saved_diagnostic::set_epath_length): New member function.
4760 (saved_diagnostic::get_epath_length): New accessor.
4761 * engine.cc: Include "gimple-pretty-print.h".
4762 (exploded_path::feasible_p): Add OUT param and, if non-NULL, write
4763 a new feasibility_problem to it on failure.
4764 (viz_callgraph_node::dump_dot): Convert begin_tr calls to
4765 begin_trtd. Convert end_tr calls to end_tdtr.
4766 (class exploded_graph_annotator): New subclass of dot_annotator.
4767 (impl_run_checkers): Add a second -fdump-analyzer-supergraph dump
4768 after the analysis runs, using exploded_graph_annotator. dumping
4769 to DUMP_BASE_NAME.supergraph-eg.dot.
4770 * exploded-graph.h (exploded_node::get_dot_fillcolor): Make
4771 public.
4772 (exploded_path::feasible_p): Add OUT param.
4773 (class feasibility_problem): New class.
4774 * state-purge.cc (state_purge_annotator::add_node_annotations):
4775 Return a bool, add a "within_table" param.
4776 (print_vec_of_names): Convert begin_tr calls to begin_trtd.
4777 Convert end_tr calls to end_tdtr.
4778 (state_purge_annotator::add_stmt_annotations): Add "within_row"
4779 param.
4780 * state-purge.h ((state_purge_annotator::add_node_annotations):
4781 Return a bool, add a "within_table" param.
4782 (state_purge_annotator::add_stmt_annotations): Add "within_row"
4783 param.
4784 * supergraph.cc (supernode::dump_dot): Call add_node_annotations
4785 twice: as before, passing false for "within_table", then again
4786 with true when within the TABLE element. Convert some begin_tr
4787 calls to begin_trtd, and some end_tr calls to end_tdtr.
4788 Repeat each add_stmt_annotations call, distinguishing between
4789 calls that add TRs and those that add TDs to an existing TR.
4790 Add a call to add_after_node_annotations.
4791 * supergraph.h (dot_annotator::add_node_annotations): Add a
4792 "within_table" param.
4793 (dot_annotator::add_stmt_annotations): Add a "within_row" param.
4794 (dot_annotator::add_after_node_annotations): New vfunc.
4796 2020-03-27 David Malcolm <dmalcolm@redhat.com>
4798 * diagnostic-manager.cc (dedupe_winners::add): Show the
4799 exploded_node index in the log messages.
4800 (diagnostic_manager::emit_saved_diagnostics): Log a summary of
4801 m_saved_diagnostics at entry.
4803 2020-03-27 David Malcolm <dmalcolm@redhat.com>
4805 * supergraph.cc (superedge::dump): Add space before description;
4806 move newline to non-pretty_printer overload.
4808 2020-03-18 David Malcolm <dmalcolm@redhat.com>
4810 * region-model.cc: Include "stor-layout.h".
4811 (region_model::dump_to_pp): Rather than calling
4812 dump_summary_of_map on each of the current frame and the globals,
4813 instead get a vec of representative path_vars for all regions,
4814 and then dump a summary of all of them.
4815 (region_model::dump_summary_of_map): Delete, rewriting into...
4816 (region_model::dump_summary_of_rep_path_vars): ...this new
4817 function, working on a vec of path_vars.
4818 (region_model::set_value): New overload.
4819 (region_model::get_representative_path_var): Rename
4820 "parent_region" local to "parent_reg" and consolidate with other
4821 local. Guard test for grandparent being stack on parent_reg being
4822 non-NULL. Move handling for parent being an array_region to
4823 within guard for parent_reg being non-NULL.
4824 (selftest::make_test_compound_type): New function.
4825 (selftest::test_dump_2): New selftest.
4826 (selftest::test_dump_3): New selftest.
4827 (selftest::test_stack_frames): Update expected output from
4828 simplified dump to show "a" and "b" from parent frame and "y" in
4829 child frame.
4830 (selftest::analyzer_region_model_cc_tests): Call test_dump_2 and
4831 test_dump_3.
4832 * region-model.h (region_model::set_value): New overload decl.
4833 (region_model::dump_summary_of_map): Delete.
4834 (region_model::dump_summary_of_rep_path_vars): New.
4836 2020-03-18 David Malcolm <dmalcolm@redhat.com>
4838 * region-model.h (class noop_region_model_context): New subclass
4839 of region_model_context.
4840 (class tentative_region_model_context): Inherit from
4841 noop_region_model_context rather than from region_model_context;
4842 drop redundant vfunc implementations.
4843 (class test_region_model_context): Likewise.
4845 2020-03-18 David Malcolm <dmalcolm@redhat.com>
4847 * engine.cc (exploded_node::exploded_node): Move implementation
4848 here from header; accept point_and_state by const reference rather
4849 than by value.
4850 * exploded-graph.h (exploded_node::exploded_node): Pass
4851 point_and_state by const reference rather than by value. Move
4852 body to engine.cc.
4854 2020-03-18 Jakub Jelinek <jakub@redhat.com>
4856 * sm-malloc.cc (malloc_state_machine::on_stmt): Fix up duplicated word
4857 issue in a comment.
4858 * region-model.cc (region_model::make_region_for_unexpected_tree_code,
4859 region_model::delete_region_and_descendents): Likewise.
4860 * engine.cc (class exploded_cluster): Likewise.
4861 * diagnostic-manager.cc (class path_builder): Likewise.
4863 2020-03-13 David Malcolm <dmalcolm@redhat.com>
4865 PR analyzer/94099
4866 PR analyzer/94105
4867 * diagnostic-manager.cc (for_each_state_change): Bulletproof
4868 against errors in get_rvalue by passing a
4869 tentative_region_model_context and rejecting if there's an error.
4870 * region-model.cc (region_model::get_lvalue_1): When handling
4871 ARRAY_REF, handle results of error-handling. Handle NOP_EXPR.
4873 2020-03-06 David Malcolm <dmalcolm@redhat.com>
4875 * analyzer.h (class array_region): New forward decl.
4876 * program-state.cc (selftest::test_program_state_dumping_2): New.
4877 (selftest::analyzer_program_state_cc_tests): Call it.
4878 * region-model.cc (array_region::constant_from_key): New.
4879 (region_model::get_representative_tree): Handle region_svalue by
4880 generating an ADDR_EXPR.
4881 (region_model::get_representative_path_var): In view handling,
4882 remove erroneous TREE_TYPE when determining the type of the tree.
4883 Handle array regions and STRING_CST.
4884 (selftest::assert_dump_tree_eq): New.
4885 (ASSERT_DUMP_TREE_EQ): New macro.
4886 (selftest::test_get_representative_tree): New selftest.
4887 (selftest::analyzer_region_model_cc_tests): Call it.
4888 * region-model.h (region::dyn_cast_array_region): New vfunc.
4889 (array_region::dyn_cast_array_region): New vfunc implementation.
4890 (array_region::constant_from_key): New decl.
4892 2020-03-06 David Malcolm <dmalcolm@redhat.com>
4894 * analyzer.h (dump_quoted_tree): New decl.
4895 * engine.cc (exploded_node::dump_dot): Pass region model to
4896 sm_state_map::print.
4897 * program-state.cc: Include diagnostic-core.h.
4898 (sm_state_map::print): Add "model" param and use it to print
4899 representative trees. Only print origin information if non-null.
4900 (sm_state_map::dump): Pass NULL for model to print call.
4901 (program_state::print): Pass region model to sm_state_map::print.
4902 (program_state::dump_to_pp): Use spaces rather than newlines when
4903 summarizing. Pass region_model to sm_state_map::print.
4904 (ana::selftest::assert_dump_eq): New function.
4905 (ASSERT_DUMP_EQ): New macro.
4906 (ana::selftest::test_program_state_dumping): New function.
4907 (ana::selftest::analyzer_program_state_cc_tests): Call it.
4908 * program-state.h (program_state::print): Add model param.
4909 * region-model.cc (dump_quoted_tree): New function.
4910 (map_region::print_fields): Use dump_quoted_tree rather than
4911 %qE to avoid lang-dependent output.
4912 (map_region::dump_child_label): Likewise.
4913 (region_model::dump_summary_of_map): For SK_REGION, when
4914 get_representative_path_var fails, print the region id rather than
4915 erroneously printing NULL.
4916 * sm.cc (state_machine::get_state_by_name): New function.
4917 * sm.h (state_machine::get_state_by_name): New decl.
4919 2020-03-04 David Malcolm <dmalcolm@redhat.com>
4921 * region-model.cc (region::validate): Convert model param from ptr
4922 to reference. Update comment to reflect that it's now a vfunc.
4923 (map_region::validate): New vfunc implementation.
4924 (array_region::validate): New vfunc implementation.
4925 (stack_region::validate): New vfunc implementation.
4926 (root_region::validate): New vfunc implementation.
4927 (region_model::validate): Pass a reference rather than a pointer
4928 to the region::validate vfunc.
4929 * region-model.h (region::validate): Make virtual. Convert model
4930 param from ptr to reference.
4931 (map_region::validate): New vfunc decl.
4932 (array_region::validate): New vfunc decl.
4933 (stack_region::validate): New vfunc decl.
4934 (root_region::validate): New vfunc decl.
4936 2020-03-04 David Malcolm <dmalcolm@redhat.com>
4938 PR analyzer/93993
4939 * region-model.cc (region_model::on_call_pre): Handle
4940 BUILT_IN_EXPECT and its variants.
4941 (region_model::add_any_constraints_from_ssa_def_stmt): Split out
4942 gassign handling into add_any_constraints_from_gassign; add gcall
4943 handling.
4944 (region_model::add_any_constraints_from_gassign): New function,
4945 based on the above. Add handling for NOP_EXPR.
4946 (region_model::add_any_constraints_from_gcall): New function.
4947 (region_model::get_representative_path_var): Handle views.
4948 * region-model.h
4949 (region_model::add_any_constraints_from_ssa_def_stmt): New decl.
4950 (region_model::add_any_constraints_from_gassign): New decl.
4952 2020-03-04 David Malcolm <dmalcolm@redhat.com>
4954 PR analyzer/93993
4955 * checker-path.h (state_change_event::get_lvalue): Add ctxt param
4956 and pass it to region_model::get_value call.
4957 * diagnostic-manager.cc (get_any_origin): Pass a
4958 tentative_region_model_context to the calls to get_lvalue and reject
4959 the comparison if errors occur.
4960 (can_be_expr_of_interest_p): New function.
4961 (diagnostic_manager::prune_for_sm_diagnostic): Replace checks for
4962 CONSTANT_CLASS_P with calls to update_for_unsuitable_sm_exprs.
4963 Pass a tentative_region_model_context to the calls to
4964 state_change_event::get_lvalue and reject the comparison if errors
4965 occur.
4966 (diagnostic_manager::update_for_unsuitable_sm_exprs): New.
4967 * diagnostic-manager.h
4968 (diagnostic_manager::update_for_unsuitable_sm_exprs): New decl.
4969 * region-model.h (class tentative_region_model_context): New class.
4971 2020-03-04 David Malcolm <dmalcolm@redhat.com>
4973 * engine.cc (worklist::worklist): Remove unused field m_eg.
4974 (class viz_callgraph_edge): Remove unused field m_call_sedge.
4975 (class viz_callgraph): Remove unused field m_sg.
4976 * exploded-graph.h (worklist::::m_eg): Remove unused field.
4978 2020-03-02 David Malcolm <dmalcolm@redhat.com>
4980 * analyzer.opt (fanalyzer-show-duplicate-count): New option.
4981 * diagnostic-manager.cc
4982 (diagnostic_manager::emit_saved_diagnostic): Use the above to
4983 guard the printing of the duplicate count.
4985 2020-03-02 David Malcolm <dmalcolm@redhat.com>
4987 PR analyzer/93959
4988 * analyzer.cc (is_std_function_p): New function.
4989 (is_std_named_call_p): New functions.
4990 * analyzer.h (is_std_named_call_p): New decl.
4991 * sm-malloc.cc (malloc_state_machine::on_stmt): Check for "std::"
4992 variants when checking for malloc, calloc and free.
4994 2020-02-26 David Malcolm <dmalcolm@redhat.com>
4996 PR analyzer/93950
4997 * diagnostic-manager.cc
4998 (diagnostic_manager::prune_for_sm_diagnostic): Assert that var is
4999 either NULL or not a constant. When updating var, bulletproof
5000 against constant values.
5002 2020-02-26 David Malcolm <dmalcolm@redhat.com>
5004 PR analyzer/93947
5005 * region-model.cc (region_model::get_fndecl_for_call): Gracefully
5006 fail for fn_decls that don't have a cgraph_node.
5008 2020-02-26 David Malcolm <dmalcolm@redhat.com>
5010 * bar-chart.cc: New file.
5011 * bar-chart.h: New file.
5012 * engine.cc: Include "analyzer/bar-chart.h".
5013 (stats::log): Only log the m_num_nodes kinds that are non-zero.
5014 (stats::dump): Likewise when dumping.
5015 (stats::get_total_enodes): New.
5016 (exploded_graph::get_or_create_node): Increment the per-point-data
5017 m_excess_enodes when hitting the per-program-point limit on
5018 enodes.
5019 (exploded_graph::print_bar_charts): New.
5020 (exploded_graph::log_stats): Log the number of unprocessed enodes
5021 in the worklist. Call print_bar_charts.
5022 (exploded_graph::dump_stats): Print the number of unprocessed
5023 enodes in the worklist.
5024 * exploded-graph.h (stats::get_total_enodes): New decl.
5025 (struct per_program_point_data): Add field m_excess_enodes.
5026 (exploded_graph::print_bar_charts): New decl.
5027 * supergraph.cc (superedge::dump): New.
5028 (superedge::dump): New.
5029 * supergraph.h (supernode::get_function): New.
5030 (superedge::dump): New decl.
5031 (superedge::dump): New decl.
5033 2020-02-24 David Malcolm <dmalcolm@redhat.com>
5035 * engine.cc (exploded_graph::get_or_create_node): Dump the
5036 program_state to the pp, rather than to stderr.
5038 2020-02-24 David Malcolm <dmalcolm@redhat.com>
5040 PR analyzer/93032
5041 * sm.cc (make_checkers): Require the "taint" checker to be
5042 explicitly enabled.
5044 2020-02-24 David Malcolm <dmalcolm@redhat.com>
5046 PR analyzer/93899
5047 * engine.cc
5048 (impl_region_model_context::impl_region_model_context): Add logger
5049 param.
5050 * engine.cc (exploded_graph::add_function_entry): Create an
5051 impl_region_model_context and pass it to the push_frame call.
5052 Bail if the resulting state is invalid.
5053 (exploded_graph::build_initial_worklist): Likewise.
5054 (exploded_graph::build_initial_worklist): Handle the case where
5055 add_function_entry fails.
5056 * exploded-graph.h
5057 (impl_region_model_context::impl_region_model_context): Add logger
5058 param.
5059 * region-model.cc (map_region::get_or_create): Add ctxt param and
5060 pass it to add_region_for_type.
5061 (map_region::can_merge_p): Pass NULL as a ctxt to call to
5062 get_or_create.
5063 (array_region::get_element): Pass ctxt to call to get_or_create.
5064 (array_region::get_or_create): Add ctxt param and pass it to
5065 add_region_for_type.
5066 (root_region::push_frame): Pass ctxt to get_or_create calls.
5067 (region_model::get_lvalue_1): Likewise.
5068 (region_model::make_region_for_unexpected_tree_code): Assert that
5069 ctxt is non-NULL.
5070 (region_model::get_rvalue_1): Pass ctxt to get_svalue_for_fndecl
5071 and get_svalue_for_label calls.
5072 (region_model::get_svalue_for_fndecl): Add ctxt param and pass it
5073 to get_region_for_fndecl.
5074 (region_model::get_region_for_fndecl): Add ctxt param and pass it
5075 to get_or_create.
5076 (region_model::get_svalue_for_label): Add ctxt param and pass it
5077 to get_region_for_label.
5078 (region_model::get_region_for_label): Add ctxt param and pass it
5079 to get_region_for_fndecl and get_or_create.
5080 (region_model::get_field_region): Add ctxt param and pass it to
5081 get_or_create_view and get_or_create.
5082 (make_region_for_type): Replace gcc_unreachable with return NULL.
5083 (region_model::add_region_for_type): Add ctxt param. Handle a
5084 return of NULL from make_region_for_type by calling
5085 make_region_for_unexpected_tree_code.
5086 (region_model::get_or_create_mem_ref): Pass ctxt to calls to
5087 get_or_create_view.
5088 (region_model::get_or_create_view): Add ctxt param and pass it to
5089 add_region_for_type.
5090 (selftest::test_state_merging): Pass ctxt to get_or_create_view.
5091 * region-model.h (region_model::get_or_create): Add ctxt param.
5092 (region_model::add_region_for_type): Likewise.
5093 (region_model::get_svalue_for_fndecl): Likewise.
5094 (region_model::get_svalue_for_label): Likewise.
5095 (region_model::get_region_for_fndecl): Likewise.
5096 (region_model::get_region_for_label): Likewise.
5097 (region_model::get_field_region): Likewise.
5098 (region_model::get_or_create_view): Likewise.
5100 2020-02-24 David Malcolm <dmalcolm@redhat.com>
5102 * checker-path.cc (superedge_event::should_filter_p): Update
5103 filter for empty descriptions to cover verbosity level 3 as well
5104 as 2.
5105 * diagnostic-manager.cc: Include "analyzer/reachability.h".
5106 (class path_builder): New class.
5107 (diagnostic_manager::emit_saved_diagnostic): Create a path_builder
5108 and pass it to build_emission_path, rather passing eg; similarly
5109 for add_events_for_eedge and ext_state.
5110 (diagnostic_manager::build_emission_path): Replace "eg" param
5111 with a path_builder, pass it to add_events_for_eedge.
5112 (diagnostic_manager::add_events_for_eedge): Replace ext_state
5113 param with path_builder; pass it to add_events_for_superedge.
5114 (diagnostic_manager::significant_edge_p): New.
5115 (diagnostic_manager::add_events_for_superedge): Add path_builder
5116 param. Reject insignificant edges at verbosity levels below 3.
5117 (diagnostic_manager::prune_for_sm_diagnostic): Update highest
5118 verbosity level to 4.
5119 * diagnostic-manager.h (class path_builder): New forward decl.
5120 (diagnostic_manager::build_emission_path): Replace "eg" param
5121 with a path_builder.
5122 (diagnostic_manager::add_events_for_eedge): Replace ext_state
5123 param with path_builder.
5124 (diagnostic_manager::significant_edge_p): New.
5125 (diagnostic_manager::add_events_for_superedge): Add path_builder
5126 param.
5127 * reachability.h: New file.
5129 2020-02-18 David Malcolm <dmalcolm@redhat.com>
5131 PR analyzer/93692
5132 * analyzer.opt (fdump-analyzer-callgraph): Rewrite description.
5134 2020-02-18 David Malcolm <dmalcolm@redhat.com>
5136 PR analyzer/93777
5137 * region-model.cc (region_model::maybe_cast_1): Replace assertion
5138 that build_cast returns non-NULL with a conditional, falling
5139 through to the logic which returns a new unknown value of the
5140 desired type if it fails.
5142 2020-02-18 David Malcolm <dmalcolm@redhat.com>
5144 PR analyzer/93778
5145 * engine.cc (impl_region_model_context::on_unknown_tree_code):
5146 Rename to...
5147 (impl_region_model_context::on_unexpected_tree_code): ...this and
5148 convert first argument from path_var to tree.
5149 (exploded_node::on_stmt): Pass ctxt to purge_for_unknown_fncall.
5150 * exploded-graph.h (region_model_context::on_unknown_tree_code):
5151 Rename to...
5152 (region_model_context::on_unexpected_tree_code): ...this and
5153 convert first argument from path_var to tree.
5154 * program-state.cc (sm_state_map::purge_for_unknown_fncall): Add
5155 ctxt param and pass on to calls to get_rvalue.
5156 * program-state.h (sm_state_map::purge_for_unknown_fncall): Add
5157 ctxt param.
5158 * region-model.cc (region_model::handle_unrecognized_call): Pass
5159 ctxt on to call to get_rvalue.
5160 (region_model::get_lvalue_1): Move body of default case to
5161 region_model::make_region_for_unexpected_tree_code and call it.
5162 Within COMPONENT_REF case, reject attempts to handle types other
5163 than RECORD_TYPE and UNION_TYPE.
5164 (region_model::make_region_for_unexpected_tree_code): New
5165 function, based on default case of region_model::get_lvalue_1.
5166 * region-model.h
5167 (region_model::make_region_for_unexpected_tree_code): New decl.
5168 (region_model::on_unknown_tree_code): Rename to...
5169 (region_model::on_unexpected_tree_code): ...this and convert first
5170 argument from path_var to tree.
5171 (class test_region_model_context): Update vfunc implementation for
5172 above change.
5174 2020-02-18 David Malcolm <dmalcolm@redhat.com>
5176 PR analyzer/93774
5177 * region-model.cc
5178 (region_model::convert_byte_offset_to_array_index): Use
5179 int_size_in_bytes before calling size_in_bytes, to gracefully fail
5180 on incomplete types.
5182 2020-02-17 David Malcolm <dmalcolm@redhat.com>
5184 PR analyzer/93775
5185 * region-model.cc (region_model::get_fndecl_for_call): Handle the
5186 case where the code_region's get_tree_for_child_region returns
5187 NULL.
5189 2020-02-17 David Malcolm <dmalcolm@redhat.com>
5191 PR analyzer/93388
5192 * engine.cc (impl_region_model_context::on_unknown_tree_code):
5193 New.
5194 (exploded_graph::get_or_create_node): Reject invalid states.
5195 * exploded-graph.h
5196 (impl_region_model_context::on_unknown_tree_code): New decl.
5197 (point_and_state::point_and_state): Assert that the state is
5198 valid.
5199 * program-state.cc (program_state::program_state): Initialize
5200 m_valid to true.
5201 (program_state::operator=): Copy m_valid.
5202 (program_state::program_state): Likewise for move constructor.
5203 (program_state::print): Print m_valid.
5204 (program_state::dump_to_pp): Likewise.
5205 * program-state.h (program_state::m_valid): New field.
5206 * region-model.cc (region_model::get_lvalue_1): Implement the
5207 default case by returning a new symbolic region and calling
5208 the context's on_unknown_tree_code, rather than issuing an
5209 internal_error. Implement VIEW_CONVERT_EXPR.
5210 * region-model.h (region_model_context::on_unknown_tree_code): New
5211 vfunc.
5212 (test_region_model_context::on_unknown_tree_code): New.
5214 2020-02-17 David Malcolm <dmalcolm@redhat.com>
5216 * sm-malloc.cc (malloc_diagnostic::describe_state_change): For
5217 transition to the "null" state, only say "assuming" when
5218 transitioning from the "unchecked" state.
5220 2020-02-17 David Malcolm <dmalcolm@redhat.com>
5222 * diagnostic-manager.h (diagnostic_manager::get_saved_diagnostic):
5223 Add const overload.
5224 * engine.cc (exploded_node::dump_dot): Dump saved_diagnostics.
5225 * exploded-graph.h (exploded_graph::get_diagnostic_manager): Add
5226 const overload.
5228 2020-02-11 David Malcolm <dmalcolm@redhat.com>
5230 PR analyzer/93288
5231 * analysis-plan.cc (analysis_plan::use_summary_p): Look through
5232 the ultimate_alias_target when getting the called function.
5233 * engine.cc (exploded_node::on_stmt): Rename second "ctxt" to
5234 "sm_ctxt". Use the region_model's get_fndecl_for_call rather than
5235 gimple_call_fndecl.
5236 * region-model.cc (region_model::get_fndecl_for_call): Use
5237 ultimate_alias_target on fndecl.
5238 * supergraph.cc (get_ultimate_function_for_cgraph_edge): New
5239 function.
5240 (supergraph_call_edge): Use it when rejecting edges without
5241 functions.
5242 (supergraph::supergraph): Use it to get the function for the
5243 cgraph_edge when building interprocedural superedges.
5244 (callgraph_superedge::get_callee_function): Use it.
5245 * supergraph.h (supergraph::get_num_snodes): Make param const.
5246 (supergraph::function_to_num_snodes_t): Make first type param
5247 const.
5249 2020-02-11 David Malcolm <dmalcolm@redhat.com>
5251 PR analyzer/93374
5252 * engine.cc (exploded_edge::exploded_edge): Add ext_state param
5253 and pass it to change.validate.
5254 (exploded_graph::get_or_create_node): Move purging of change
5255 svalues to also cover the case of reusing an existing enode.
5256 (exploded_graph::add_edge): Pass m_ext_state to exploded_edge's
5257 ctor.
5258 * exploded-graph.h (exploded_edge::exploded_edge): Add ext_state
5259 param.
5260 * program-state.cc (state_change::sm_change::validate): Likewise.
5261 Assert that m_sm_idx is sane. Use ext_state to validate
5262 m_old_state and m_new_state.
5263 (state_change::validate): Add ext_state param and pass it to
5264 the sm_change validate calls.
5265 * program-state.h (state_change::sm_change::validate): Add
5266 ext_state param.
5267 (state_change::validate): Likewise.
5269 2020-02-11 David Malcolm <dmalcolm@redhat.com>
5271 PR analyzer/93669
5272 * engine.cc (exploded_graph::dump_exploded_nodes): Handle missing
5273 case of STATUS_WORKLIST in implementation of
5274 "__analyzer_dump_exploded_nodes".
5276 2020-02-11 David Malcolm <dmalcolm@redhat.com>
5278 PR analyzer/93649
5279 * constraint-manager.cc (constraint_manager::add_constraint): When
5280 merging equivalence classes and updating m_constant, also update
5281 m_cst_sid.
5282 (constraint_manager::validate): If m_constant is non-NULL assert
5283 that m_cst_sid is non-null and is valid.
5285 2020-02-11 David Malcolm <dmalcolm@redhat.com>
5287 PR analyzer/93657
5288 * analyzer.opt (fdump-analyzer): Reword description.
5289 (fdump-analyzer-stderr): Likewise.
5291 2020-02-11 David Malcolm <dmalcolm@redhat.com>
5293 * region-model.cc (print_quoted_type): New function.
5294 (svalue::print): Use it to replace %qT.
5295 (region::dump_to_pp): Likewise.
5296 (region::dump_child_label): Likewise.
5297 (region::print_fields): Likewise.
5299 2020-02-10 David Malcolm <dmalcolm@redhat.com>
5301 PR analyzer/93659
5302 * analyzer.opt (-param=analyzer-max-recursion-depth=): Fix "tha"
5303 -> "that" typo.
5304 (Wanalyzer-use-of-uninitialized-value): Fix "initialized" ->
5305 "uninitialized" typo.
5307 2020-02-10 David Malcolm <dmalcolm@redhat.com>
5309 PR analyzer/93350
5310 * region-model.cc (region_model::get_lvalue_1):
5311 Handle BIT_FIELD_REF.
5312 (make_region_for_type): Handle VECTOR_TYPE.
5314 2020-02-10 David Malcolm <dmalcolm@redhat.com>
5316 PR analyzer/93647
5317 * diagnostic-manager.cc
5318 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof against
5319 VAR being constant.
5320 * region-model.cc (region_model::get_lvalue_1): Provide a better
5321 error message when encountering an unhandled tree code.
5323 2020-02-10 David Malcolm <dmalcolm@redhat.com>
5325 PR analyzer/93405
5326 * region-model.cc (region_model::get_lvalue_1): Implement
5327 CONST_DECL.
5329 2020-02-06 David Malcolm <dmalcolm@redhat.com>
5331 * region-model.cc (region_model::maybe_cast_1): Attempt to provide
5332 a region_svalue if either type is a pointer, rather than if both
5333 types are pointers.
5335 2020-02-05 David Malcolm <dmalcolm@redhat.com>
5337 * engine.cc (exploded_node::dump_dot): Show merger enodes.
5338 (worklist::add_node): Assert that the node's m_status is
5339 STATUS_WORKLIST.
5340 (exploded_graph::process_worklist): Likewise for nodes from the
5341 worklist. Set status of merged nodes to STATUS_MERGER.
5342 (exploded_graph::process_node): Set status of node to
5343 STATUS_PROCESSED.
5344 (exploded_graph::dump_exploded_nodes): Rework handling of
5345 "__analyzer_dump_exploded_nodes", splitting enodes by status into
5346 "processed" and "merger", showing the count of just the processed
5347 enodes at the call, rather than the count of all enodes.
5348 * exploded-graph.h (exploded_node::status): New enum.
5349 (exploded_node::exploded_node): Initialize m_status to
5350 STATUS_WORKLIST.
5351 (exploded_node::get_status): New getter.
5352 (exploded_node::set_status): New setter.
5354 2020-02-04 David Malcolm <dmalcolm@redhat.com>
5356 PR analyzer/93543
5357 * engine.cc (pod_hash_traits<function_call_string>::mark_empty):
5358 Eliminate reinterpret_cast.
5359 (pod_hash_traits<function_call_string>::is_empty): Likewise.
5361 2020-02-03 David Malcolm <dmalcolm@redhat.com>
5363 * constraint-manager.cc (range::constrained_to_single_element):
5364 Replace fold_build2 with fold_binary. Remove unnecessary newline.
5365 (constraint_manager::get_or_add_equiv_class): Replace fold_build2
5366 with fold_binary in two places, and remove out-of-date comment.
5367 (constraint_manager::eval_condition): Replace fold_build2 with
5368 fold_binary.
5369 * region-model.cc (constant_svalue::eval_condition): Likewise.
5370 (region_model::on_assignment): Likewise.
5372 2020-02-03 David Malcolm <dmalcolm@redhat.com>
5374 PR analyzer/93544
5375 * diagnostic-manager.cc
5376 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof
5377 against bad choices due to bad paths.
5378 * engine.cc (impl_region_model_context::on_phi): New.
5379 * exploded-graph.h (impl_region_model_context::on_phi): New decl.
5380 * region-model.cc (region_model::on_longjmp): Likewise.
5381 (region_model::handle_phi): Add phi param. Call the ctxt's on_phi
5382 vfunc.
5383 (region_model::update_for_phis): Pass phi to handle_phi.
5384 * region-model.h (region_model::handle_phi): Add phi param.
5385 (region_model_context::on_phi): New vfunc.
5386 (test_region_model_context::on_phi): New.
5387 * sm-malloc.cc (malloc_state_machine::on_phi): New.
5388 (malloc_state_machine::on_zero_assignment): New.
5389 * sm.h (state_machine::on_phi): New vfunc.
5391 2020-02-03 David Malcolm <dmalcolm@redhat.com>
5393 * engine.cc (supernode_cluster::dump_dot): Show BB index as
5394 well as SN index.
5395 * supergraph.cc (supernode::dump_dot): Likewise.
5397 2020-02-03 David Malcolm <dmalcolm@redhat.com>
5399 PR analyzer/93546
5400 * region-model.cc (region_model::on_call_pre): Update for new
5401 param of symbolic_region ctor.
5402 (region_model::deref_rvalue): Likewise.
5403 (region_model::add_new_malloc_region): Likewise.
5404 (make_region_for_type): Likewise, preserving type.
5405 * region-model.h (symbolic_region::symbolic_region): Add "type"
5406 param and pass it to base class ctor.
5408 2020-02-03 David Malcolm <dmalcolm@redhat.com>
5410 PR analyzer/93547
5411 * constraint-manager.cc
5412 (constraint_manager::get_or_add_equiv_class): Ensure types are
5413 compatible before comparing constants.
5415 2020-01-31 David Malcolm <dmalcolm@redhat.com>
5417 PR analyzer/93457
5418 * region-model.cc (make_region_for_type): Use VOID_TYPE_P rather
5419 than checking against void_type_node.
5421 2020-01-31 David Malcolm <dmalcolm@redhat.com>
5423 PR analyzer/93373
5424 * region-model.cc (ASSERT_COMPAT_TYPES): Convert to...
5425 (assert_compat_types): ...this, and bail when either type is NULL,
5426 or when VOID_TYPE_P (dst_type).
5427 (region_model::get_lvalue): Update for above conversion.
5428 (region_model::get_rvalue): Likewise.
5430 2020-01-31 David Malcolm <dmalcolm@redhat.com>
5432 PR analyzer/93379
5433 * region-model.cc (region_model::update_for_return_superedge):
5434 Move check for null result so that it also guards setting the
5435 lhs.
5437 2020-01-31 David Malcolm <dmalcolm@redhat.com>
5439 PR analyzer/93438
5440 * region-model.cc (stack_region::can_merge_p): Split into a two
5441 pass approach, creating all stack regions first, then populating
5442 them.
5443 (selftest::test_state_merging): Add test coverage for (a) the case
5444 of self-merging a model in which a local in an older stack frame
5445 points to a local in a more recent stack frame (which previously
5446 would ICE), and (b) the case of self-merging a model in which a
5447 local points to a global (which previously worked OK).
5449 2020-01-31 David Malcolm <dmalcolm@redhat.com>
5451 * analyzer.cc (is_named_call_p): Replace tests for fndecl being
5452 extern at file scope and having a non-NULL DECL_NAME with a call
5453 to maybe_special_function_p.
5454 * function-set.cc (function_set::contains_decl_p): Add call to
5455 maybe_special_function_p.
5457 2020-01-31 David Malcolm <dmalcolm@redhat.com>
5459 PR analyzer/93450
5460 * constraint-manager.cc
5461 (constraint_manager::get_or_add_equiv_class): Only compare constants
5462 if their types are compatible.
5463 * region-model.cc (constant_svalue::eval_condition): Replace check
5464 for identical types with call to types_compatible_p.
5466 2020-01-30 David Malcolm <dmalcolm@redhat.com>
5468 * program-state.cc (extrinsic_state::dump_to_pp): New.
5469 (extrinsic_state::dump_to_file): New.
5470 (extrinsic_state::dump): New.
5471 * program-state.h (extrinsic_state::dump_to_pp): New decl.
5472 (extrinsic_state::dump_to_file): New decl.
5473 (extrinsic_state::dump): New decl.
5474 * sm.cc: Include "pretty-print.h".
5475 (state_machine::dump_to_pp): New.
5476 * sm.h (state_machine::dump_to_pp): New decl.
5478 2020-01-30 David Malcolm <dmalcolm@redhat.com>
5480 * diagnostic-manager.cc (for_each_state_change): Use
5481 extrinsic_state::get_num_checkers rather than accessing m_checkers
5482 directly.
5483 * program-state.cc (program_state::program_state): Likewise.
5484 * program-state.h (extrinsic_state::m_checkers): Make private.
5486 2020-01-30 David Malcolm <dmalcolm@redhat.com>
5488 PR analyzer/93356
5489 * region-model.cc (region_model::eval_condition): In both
5490 overloads, bail out immediately on floating-point types.
5491 (region_model::eval_condition_without_cm): Likewise.
5492 (region_model::add_constraint): Likewise.
5494 2020-01-30 David Malcolm <dmalcolm@redhat.com>
5496 PR analyzer/93450
5497 * program-state.cc (sm_state_map::set_state): For the overload
5498 taking an svalue_id, bail out if the set_state on the ec does
5499 nothing. Convert the latter's return type from void to bool,
5500 returning true if anything changed.
5501 (sm_state_map::impl_set_state): Convert the return type from void
5502 to bool, returning true if the state changed.
5503 * program-state.h (sm_state_map::set_state): Convert return type
5504 from void to bool.
5505 (sm_state_map::impl_set_state): Likewise.
5506 * region-model.cc (constant_svalue::eval_condition): Only call
5507 fold_build2 if the types are the same.
5509 2020-01-29 Jakub Jelinek <jakub@redhat.com>
5511 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Remove.
5512 * constraint-manager.cc: Include diagnostic-core.h before graphviz.h.
5513 (range::dump, equiv_class::print): Don't use PUSH_IGNORE_WFORMAT or
5514 POP_IGNORE_WFORMAT.
5515 * state-purge.cc: Include diagnostic-core.h before
5516 gimple-pretty-print.h.
5517 (state_purge_annotator::add_node_annotations, print_vec_of_names):
5518 Don't use PUSH_IGNORE_WFORMAT or POP_IGNORE_WFORMAT.
5519 * region-model.cc: Move diagnostic-core.h include before graphviz.h.
5520 (path_var::dump, svalue::print, constant_svalue::print_details,
5521 region::dump_to_pp, region::dump_child_label, region::print_fields,
5522 map_region::print_fields, map_region::dump_dot_to_pp,
5523 map_region::dump_child_label, array_region::print_fields,
5524 array_region::dump_dot_to_pp): Don't use PUSH_IGNORE_WFORMAT or
5525 POP_IGNORE_WFORMAT.
5527 2020-01-28 David Malcolm <dmalcolm@redhat.com>
5529 PR analyzer/93316
5530 * engine.cc (rewind_info_t::update_model): Get the longjmp call
5531 stmt via get_longjmp_call () rather than assuming it is the last
5532 stmt in the longjmp's supernode.
5533 (rewind_info_t::add_events_to_path): Get the location_t for the
5534 rewind_from_longjmp_event via get_longjmp_call () rather than from
5535 the supernode's get_end_location ().
5537 2020-01-28 David Malcolm <dmalcolm@redhat.com>
5539 * region-model.cc (poisoned_value_diagnostic::emit): Update for
5540 renaming of warning_at overload to warning_meta.
5541 * sm-file.cc (file_leak::emit): Likewise.
5542 * sm-malloc.cc (double_free::emit): Likewise.
5543 (possible_null_deref::emit): Likewise.
5544 (possible_null_arg::emit): Likewise.
5545 (null_deref::emit): Likewise.
5546 (null_arg::emit): Likewise.
5547 (use_after_free::emit): Likewise.
5548 (malloc_leak::emit): Likewise.
5549 (free_of_non_heap::emit): Likewise.
5550 * sm-sensitive.cc (exposure_through_output_file::emit): Likewise.
5551 * sm-signal.cc (signal_unsafe_call::emit): Likewise.
5552 * sm-taint.cc (tainted_array_index::emit): Likewise.
5554 2020-01-27 David Malcolm <dmalcolm@redhat.com>
5556 PR analyzer/93451
5557 * region-model.cc (tree_cmp): For the REAL_CST case, impose an
5558 arbitrary order on NaNs relative to other NaNs and to non-NaNs;
5559 const-correctness tweak.
5560 (ana::selftests::build_real_cst_from_string): New function.
5561 (ana::selftests::append_interesting_constants): New function.
5562 (ana::selftests::test_tree_cmp_on_constants): New test.
5563 (ana::selftests::test_canonicalization_4): New test.
5564 (ana::selftests::analyzer_region_model_cc_tests): Call the new
5565 tests.
5567 2020-01-27 David Malcolm <dmalcolm@redhat.com>
5569 PR analyzer/93349
5570 * engine.cc (run_checkers): Save and restore input_location.
5572 2020-01-27 David Malcolm <dmalcolm@redhat.com>
5574 * call-string.cc (call_string::cmp_1): Delete, moving body to...
5575 (call_string::cmp): ...here.
5576 * call-string.h (call_string::cmp_1): Delete decl.
5577 * engine.cc (worklist::key_t::cmp_1): Delete, moving body to...
5578 (worklist::key_t::cmp): ...here. Implement hash comparisons
5579 via comparison rather than subtraction to avoid overflow issues.
5580 * exploded-graph.h (worklist::key_t::cmp_1): Delete decl.
5581 * region-model.cc (tree_cmp): Eliminate buggy checking for
5582 symmetry.
5584 2020-01-27 David Malcolm <dmalcolm@redhat.com>
5586 * analyzer.cc (is_named_call_p): Check that fndecl is "extern"
5587 and at file scope. Potentially disregard prefix _ or __ in
5588 fndecl's name. Bail if the identifier is NULL.
5589 (is_setjmp_call_p): Expect a gcall rather than plain gimple.
5590 Remove special-case check for leading prefix, and also check for
5591 sigsetjmp.
5592 (is_longjmp_call_p): Also check for siglongjmp.
5593 (get_user_facing_name): New function.
5594 * analyzer.h (is_setjmp_call_p): Expect a gcall rather than plain
5595 gimple.
5596 (get_user_facing_name): New decl.
5597 * checker-path.cc (setjmp_event::get_desc): Use
5598 get_user_facing_name to avoid hardcoding the function name.
5599 (rewind_event::rewind_event): Add rewind_info param, using it to
5600 initialize new m_rewind_info field, and strengthen the assertion.
5601 (rewind_from_longjmp_event::get_desc): Use get_user_facing_name to
5602 avoid hardcoding the function name.
5603 (rewind_to_setjmp_event::get_desc): Likewise.
5604 * checker-path.h (setjmp_event::setjmp_event): Add setjmp_call
5605 param and use it to initialize...
5606 (setjmp_event::m_setjmp_call): New field.
5607 (rewind_event::rewind_event): Add rewind_info param.
5608 (rewind_event::m_rewind_info): New protected field.
5609 (rewind_from_longjmp_event::rewind_from_longjmp_event): Add
5610 rewind_info param.
5611 (class rewind_to_setjmp_event): Move rewind_info field to parent
5612 class.
5613 * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
5614 Update setjmp-handling for is_setjmp_call_p requiring a gcall;
5615 pass the call to the new setjmp_event.
5616 * engine.cc (exploded_node::on_stmt): Update for is_setjmp_call_p
5617 requiring a gcall.
5618 (stale_jmp_buf::emit): Use get_user_facing_name to avoid
5619 hardcoding the function names.
5620 (exploded_node::on_longjmp): Pass the longjmp_call when
5621 constructing rewind_info.
5622 (rewind_info_t::add_events_to_path): Pass the rewind_info_t to the
5623 rewind_from_longjmp_event's ctor.
5624 * exploded-graph.h (rewind_info_t::rewind_info_t): Add
5625 longjmp_call param.
5626 (rewind_info_t::get_longjmp_call): New.
5627 (rewind_info_t::m_longjmp_call): New.
5628 * region-model.cc (region_model::on_setjmp): Update comment to
5629 indicate this is also for sigsetjmp.
5630 * region-model.h (struct setjmp_record): Likewise.
5631 (class setjmp_svalue): Likewise.
5633 2020-01-27 David Malcolm <dmalcolm@redhat.com>
5635 PR analyzer/93276
5636 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Guard these
5637 macros with GCC_VERSION >= 4006, making them no-op otherwise.
5638 * engine.cc (exploded_edge::exploded_edge): Specify template for
5639 base class initializer.
5640 (exploded_graph::add_edge): Specify template when chaining up to
5641 base class add_edge implementation.
5642 (viz_callgraph_node::dump_dot): Drop redundant "typename".
5643 (viz_callgraph_edge::viz_callgraph_edge): Specify template for
5644 base class initializer.
5645 * program-state.cc (sm_state_map::clone_with_remapping): Drop
5646 redundant "typename".
5647 (sm_state_map::print): Likewise.
5648 (sm_state_map::hash): Likewise.
5649 (sm_state_map::operator==): Likewise.
5650 (sm_state_map::remap_svalue_ids): Likewise.
5651 (sm_state_map::on_svalue_purge): Likewise.
5652 (sm_state_map::validate): Likewise.
5653 * program-state.h (sm_state_map::iterator_t): Likewise.
5654 * supergraph.h (superedge::superedge): Specify template for base
5655 class initializer.
5657 2020-01-23 David Malcolm <dmalcolm@redhat.com>
5659 PR analyzer/93375
5660 * supergraph.cc (callgraph_superedge::get_arg_for_parm): Fail
5661 gracefully is the number of parameters at the callee exceeds the
5662 number of arguments at the call stmt.
5663 (callgraph_superedge::get_parm_for_arg): Likewise.
5665 2020-01-22 David Malcolm <dmalcolm@redhat.com>
5667 PR analyzer/93382
5668 * program-state.cc (sm_state_map::on_svalue_purge): If the
5669 entry survives, but the origin is being purged, then reset the
5670 origin to null.
5672 2020-01-22 David Malcolm <dmalcolm@redhat.com>
5674 * sm-signal.cc: Fix nesting of CHECKING_P and namespace ana.
5676 2020-01-22 David Malcolm <dmalcolm@redhat.com>
5678 PR analyzer/93378
5679 * engine.cc (setjmp_svalue::compare_fields): Update for
5680 replacement of m_enode with m_setjmp_record.
5681 (setjmp_svalue::add_to_hash): Likewise.
5682 (setjmp_svalue::get_index): Rename...
5683 (setjmp_svalue::get_enode_index): ...to this.
5684 (setjmp_svalue::print_details): Update for replacement of m_enode
5685 with m_setjmp_record.
5686 (exploded_node::on_longjmp): Likewise.
5687 * exploded-graph.h (rewind_info_t::m_enode_origin): Replace...
5688 (rewind_info_t::m_setjmp_record): ...with this.
5689 (rewind_info_t::rewind_info_t): Update for replacement of m_enode
5690 with m_setjmp_record.
5691 (rewind_info_t::get_setjmp_point): Likewise.
5692 (rewind_info_t::get_setjmp_call): Likewise.
5693 * region-model.cc (region_model::dump_summary_of_map): Likewise.
5694 (region_model::on_setjmp): Likewise.
5695 * region-model.h (struct setjmp_record): New struct.
5696 (setjmp_svalue::m_enode): Replace...
5697 (setjmp_svalue::m_setjmp_record): ...with this.
5698 (setjmp_svalue::setjmp_svalue): Update for replacement of m_enode
5699 with m_setjmp_record.
5700 (setjmp_svalue::clone): Likewise.
5701 (setjmp_svalue::get_index): Rename...
5702 (setjmp_svalue::get_enode_index): ...to this.
5703 (setjmp_svalue::get_exploded_node): Replace...
5704 (setjmp_svalue::get_setjmp_record): ...with this.
5706 2020-01-22 David Malcolm <dmalcolm@redhat.com>
5708 PR analyzer/93316
5709 * analyzer.cc (is_setjmp_call_p): Check for "setjmp" as well as
5710 "_setjmp".
5712 2020-01-22 David Malcolm <dmalcolm@redhat.com>
5714 PR analyzer/93307
5715 * analysis-plan.h: Wrap everything namespace "ana".
5716 * analyzer-logging.cc: Likewise.
5717 * analyzer-logging.h: Likewise.
5718 * analyzer-pass.cc (pass_analyzer::execute): Update for "ana"
5719 namespace.
5720 * analyzer-selftests.cc: Wrap everything namespace "ana".
5721 * analyzer-selftests.h: Likewise.
5722 * analyzer.h: Likewise for forward decls of types.
5723 * call-string.h: Likewise.
5724 * checker-path.cc: Likewise.
5725 * checker-path.h: Likewise.
5726 * constraint-manager.cc: Likewise.
5727 * constraint-manager.h: Likewise.
5728 * diagnostic-manager.cc: Likewise.
5729 * diagnostic-manager.h: Likewise.
5730 * engine.cc: Likewise.
5731 * engine.h: Likewise.
5732 * exploded-graph.h: Likewise.
5733 * function-set.cc: Likewise.
5734 * function-set.h: Likewise.
5735 * pending-diagnostic.cc: Likewise.
5736 * pending-diagnostic.h: Likewise.
5737 * program-point.cc: Likewise.
5738 * program-point.h: Likewise.
5739 * program-state.cc: Likewise.
5740 * program-state.h: Likewise.
5741 * region-model.cc: Likewise.
5742 * region-model.h: Likewise.
5743 * sm-file.cc: Likewise.
5744 * sm-malloc.cc: Likewise.
5745 * sm-pattern-test.cc: Likewise.
5746 * sm-sensitive.cc: Likewise.
5747 * sm-signal.cc: Likewise.
5748 * sm-taint.cc: Likewise.
5749 * sm.cc: Likewise.
5750 * sm.h: Likewise.
5751 * state-purge.h: Likewise.
5752 * supergraph.cc: Likewise.
5753 * supergraph.h: Likewise.
5755 2020-01-21 David Malcolm <dmalcolm@redhat.com>
5757 PR analyzer/93352
5758 * region-model.cc (int_cmp): Rename to...
5759 (array_region::key_cmp): ...this, using key_t rather than int.
5760 Rewrite in terms of comparisons rather than subtraction to
5761 ensure qsort is anti-symmetric when handling extreme values.
5762 (array_region::walk_for_canonicalization): Update for above
5763 renaming.
5764 * region-model.h (array_region::key_cmp): New decl.
5766 2020-01-17 David Malcolm <dmalcolm@redhat.com>
5768 PR analyzer/93290
5769 * region-model.cc (region_model::eval_condition_without_cm): Avoid
5770 gcc_unreachable for unexpected operations for the case where
5771 we're comparing an svalue against itself.
5773 2020-01-17 David Malcolm <dmalcolm@redhat.com>
5775 PR analyzer/93281
5776 * region-model.cc
5777 (region_model::convert_byte_offset_to_array_index): Convert to
5778 ssizetype before dividing by byte_size. Use fold_binary rather
5779 than fold_build2 to avoid needlessly constructing a tree for the
5780 non-const case.
5782 2020-01-15 David Malcolm <dmalcolm@redhat.com>
5784 * engine.cc (class impl_region_model_context): Fix comment.
5786 2020-01-14 David Malcolm <dmalcolm@redhat.com>
5788 PR analyzer/93212
5789 * region-model.cc (make_region_for_type): Use
5790 FUNC_OR_METHOD_TYPE_P rather than comparing against FUNCTION_TYPE.
5791 * region-model.h (function_region::function_region): Likewise.
5793 2020-01-14 David Malcolm <dmalcolm@redhat.com>
5795 * program-state.cc (sm_state_map::clone_with_remapping): Copy
5796 m_global_state.
5797 (selftest::test_program_state_merging_2): New selftest.
5798 (selftest::analyzer_program_state_cc_tests): Call it.
5800 2020-01-14 David Malcolm <dmalcolm@redhat.com>
5802 * checker-path.h (checker_path::get_checker_event): New function.
5803 (checker_path): Add DISABLE_COPY_AND_ASSIGN; make fields private.
5804 * diagnostic-manager.cc
5805 (diagnostic_manager::prune_for_sm_diagnostic): Replace direct
5806 access to checker_path::m_events with accessor functions. Fix
5807 overlong line.
5808 (diagnostic_manager::prune_interproc_events): Replace direct
5809 access to checker_path::m_events with accessor functions.
5810 (diagnostic_manager::finish_pruning): Likewise.
5812 2020-01-14 David Malcolm <dmalcolm@redhat.com>
5814 * checker-path.h (checker_event::clone): Delete vfunc decl.
5815 (debug_event::clone): Delete vfunc impl.
5816 (custom_event::clone): Delete vfunc impl.
5817 (statement_event::clone): Delete vfunc impl.
5818 (function_entry_event::clone): Delete vfunc impl.
5819 (state_change_event::clone): Delete vfunc impl.
5820 (start_cfg_edge_event::clone): Delete vfunc impl.
5821 (end_cfg_edge_event::clone): Delete vfunc impl.
5822 (call_event::clone): Delete vfunc impl.
5823 (return_event::clone): Delete vfunc impl.
5824 (setjmp_event::clone): Delete vfunc impl.
5825 (rewind_from_longjmp_event::clone): Delete vfunc impl.
5826 (rewind_to_setjmp_event::clone): Delete vfunc impl.
5827 (warning_event::clone): Delete vfunc impl.
5829 2020-01-14 David Malcolm <dmalcolm@redhat.com>
5831 * supergraph.cc (supernode::dump_dot): Ensure that the TABLE
5832 element has at least one TR.
5834 2020-01-14 David Malcolm <dmalcolm@redhat.com>
5836 PR analyzer/58237
5837 * engine.cc (leak_stmt_finder::find_stmt): Use get_pure_location
5838 when comparing against UNKNOWN_LOCATION.
5839 (stmt_requires_new_enode_p): Likewise.
5840 (exploded_graph::dump_exploded_nodes): Likewise.
5841 * supergraph.cc (supernode::get_start_location): Likewise.
5842 (supernode::get_end_location): Likewise.
5844 2020-01-14 David Malcolm <dmalcolm@redhat.com>
5846 PR analyzer/58237
5847 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
5848 selftest::analyzer_sm_file_cc_tests.
5849 * analyzer-selftests.h (selftest::analyzer_sm_file_cc_tests): New
5850 decl.
5851 * sm-file.cc: Include "analyzer/function-set.h" and
5852 "analyzer/analyzer-selftests.h".
5853 (get_file_using_fns): New function.
5854 (is_file_using_fn_p): New function.
5855 (fileptr_state_machine::on_stmt): Return true for known functions.
5856 (selftest::analyzer_sm_file_cc_tests): New function.
5858 2020-01-14 David Malcolm <dmalcolm@redhat.com>
5860 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
5861 selftest::analyzer_sm_signal_cc_tests.
5862 * analyzer-selftests.h (selftest::analyzer_sm_signal_cc_tests):
5863 New decl.
5864 * sm-signal.cc: Include "analyzer/function-set.h" and
5865 "analyzer/analyzer-selftests.h".
5866 (get_async_signal_unsafe_fns): New function.
5867 (signal_unsafe_p): Reimplement in terms of the above.
5868 (selftest::analyzer_sm_signal_cc_tests): New function.
5870 2020-01-14 David Malcolm <dmalcolm@redhat.com>
5872 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
5873 selftest::analyzer_function_set_cc_tests.
5874 * analyzer-selftests.h (selftest::analyzer_function_set_cc_tests):
5875 New decl.
5876 * function-set.cc: New file.
5877 * function-set.h: New file.
5879 2020-01-14 David Malcolm <dmalcolm@redhat.com>
5881 * analyzer.h (fndecl_has_gimple_body_p): New decl.
5882 * engine.cc (impl_region_model_context::on_unknown_change): New
5883 function.
5884 (fndecl_has_gimple_body_p): Make non-static.
5885 (exploded_node::on_stmt): Treat __analyzer_dump_exploded_nodes as
5886 known. Track whether we have a call with unknown side-effects and
5887 pass it to on_call_post.
5888 * exploded-graph.h (impl_region_model_context::on_unknown_change):
5889 New decl.
5890 * program-state.cc (sm_state_map::on_unknown_change): New function.
5891 * program-state.h (sm_state_map::on_unknown_change): New decl.
5892 * region-model.cc: Include "bitmap.h".
5893 (region_model::on_call_pre): Return a bool, capturing whether the
5894 call has unknown side effects.
5895 (region_model::on_call_post): Add arg "bool unknown_side_effects"
5896 and if true, call handle_unrecognized_call.
5897 (class reachable_regions): New class.
5898 (region_model::handle_unrecognized_call): New function.
5899 * region-model.h (region_model::on_call_pre): Return a bool.
5900 (region_model::on_call_post): Add arg "bool unknown_side_effects".
5901 (region_model::handle_unrecognized_call): New decl.
5902 (region_model_context::on_unknown_change): New vfunc.
5903 (test_region_model_context::on_unknown_change): New function.
5905 2020-01-14 David Malcolm <dmalcolm@redhat.com>
5907 * diagnostic-manager.cc (saved_diagnostic::operator==): Move here
5908 from header. Replace pointer equality test on m_var with call to
5909 pending_diagnostic::same_tree_p.
5910 * diagnostic-manager.h (saved_diagnostic::operator==): Move to
5911 diagnostic-manager.cc.
5912 * pending-diagnostic.cc (pending_diagnostic::same_tree_p): New.
5913 * pending-diagnostic.h (pending_diagnostic::same_tree_p): New.
5914 * sm-file.cc (file_diagnostic::subclass_equal_p): Replace pointer
5915 equality on m_arg with call to pending_diagnostic::same_tree_p.
5916 * sm-malloc.cc (malloc_diagnostic::subclass_equal_p): Likewise.
5917 (possible_null_arg::subclass_equal_p): Likewise.
5918 (null_arg::subclass_equal_p): Likewise.
5919 (free_of_non_heap::subclass_equal_p): Likewise.
5920 * sm-pattern-test.cc (pattern_match::operator==): Likewise.
5921 * sm-sensitive.cc (exposure_through_output_file::operator==):
5922 Likewise.
5923 * sm-taint.cc (tainted_array_index::operator==): Likewise.
5925 2020-01-14 David Malcolm <dmalcolm@redhat.com>
5927 * diagnostic-manager.cc (dedupe_winners::add): Add logging
5928 of deduplication decisions made.
5930 2020-01-14 David Malcolm <dmalcolm@redhat.com>
5932 * ChangeLog: New file.
5933 * analyzer-selftests.cc: New file.
5934 * analyzer-selftests.h: New file.
5935 * analyzer.opt: New file.
5936 * analysis-plan.cc: New file.
5937 * analysis-plan.h: New file.
5938 * analyzer-logging.cc: New file.
5939 * analyzer-logging.h: New file.
5940 * analyzer-pass.cc: New file.
5941 * analyzer.cc: New file.
5942 * analyzer.h: New file.
5943 * call-string.cc: New file.
5944 * call-string.h: New file.
5945 * checker-path.cc: New file.
5946 * checker-path.h: New file.
5947 * constraint-manager.cc: New file.
5948 * constraint-manager.h: New file.
5949 * diagnostic-manager.cc: New file.
5950 * diagnostic-manager.h: New file.
5951 * engine.cc: New file.
5952 * engine.h: New file.
5953 * exploded-graph.h: New file.
5954 * pending-diagnostic.cc: New file.
5955 * pending-diagnostic.h: New file.
5956 * program-point.cc: New file.
5957 * program-point.h: New file.
5958 * program-state.cc: New file.
5959 * program-state.h: New file.
5960 * region-model.cc: New file.
5961 * region-model.h: New file.
5962 * sm-file.cc: New file.
5963 * sm-malloc.cc: New file.
5964 * sm-malloc.dot: New file.
5965 * sm-pattern-test.cc: New file.
5966 * sm-sensitive.cc: New file.
5967 * sm-signal.cc: New file.
5968 * sm-taint.cc: New file.
5969 * sm.cc: New file.
5970 * sm.h: New file.
5971 * state-purge.cc: New file.
5972 * state-purge.h: New file.
5973 * supergraph.cc: New file.
5974 * supergraph.h: New file.
5976 2019-12-13 David Malcolm <dmalcolm@redhat.com>
5978 * Initial creation
5980 \f
5981 Copyright (C) 2019-2021 Free Software Foundation, Inc.
5983 Copying and distribution of this file, with or without modification,
5984 are permitted in any medium without royalty provided the copyright
5985 notice and this notice are preserved.