gcc/analyzer/ChangeLog

   1 2021-12-06  David Malcolm  <dmalcolm@redhat.com>
   2
   3         PR analyzer/103533
   4         * constraint-manager.cc (equiv_class::contains_non_constant_p):
   5         New.
   6         (constraint_manager::canonicalize): Call it when determining
   7         redundant ECs.
   8         (selftest::test_purging): New selftest.
   9         (selftest::run_constraint_manager_tests): Likewise.
  10         * constraint-manager.h (equiv_class::contains_non_constant_p):
  11         New decl.
  12
  13 2021-12-01  David Malcolm  <dmalcolm@redhat.com>
  14
  15         PR analyzer/102471
  16         * region-model-reachability.cc (reachable_regions::handle_parm):
  17         Treat all svalues within a compound parm has reachable, and those
  18         wrapped in a cast.
  19
  20 2021-11-29  David Malcolm  <dmalcolm@redhat.com>
  21
  22         PR analyzer/103217
  23         * store.cc (binding_cluster::can_merge_p): For the "key is bound"
  24         vs "key is not bound" merger case, check that the bound svalue
  25         is mergeable before merging it to "unknown", rejecting the merger
  26         otherwise.
  27
  28 2021-11-19  David Malcolm  <dmalcolm@redhat.com>
  29
  30         PR analyzer/103217
  31         * engine.cc (exploded_graph::get_or_create_node): Pass in
  32         m_ext_state to program_state::can_merge_with_p.
  33         (exploded_graph::process_worklist): Likewise.
  34         (exploded_graph::maybe_process_run_of_before_supernode_enodes):
  35         Likewise.
  36         (exploded_graph::process_node): Add missing call to detect_leaks
  37         when handling phi nodes.
  38         * program-state.cc (program_state::can_merge_with_p): Add
  39         "ext_state" param.  Pass it and state ptrs to
  40         region_model::can_merge_with_p.
  41         (selftest::test_program_state_merging): Update for new ext_state
  42         param of program_state::can_merge_with_p.
  43         (selftest::test_program_state_merging_2): Likewise.
  44         * program-state.h (program_state::can_purge_p): Make const.
  45         (program_state::can_merge_with_p): Add "ext_state" param.
  46         * region-model.cc: Include "analyzer/program-state.h".
  47         (region_model::can_merge_with_p): Add params "ext_state",
  48         "state_a", and "state_b", use them when creating model_merger
  49         object.
  50         (model_merger::mergeable_svalue_p): New.
  51         * region-model.h (region_model::can_merge_with_p): Add params
  52         "ext_state", "state_a", and "state_b".
  53         (model_merger::model_merger) Likewise, initializing new fields.
  54         (model_merger::mergeable_svalue_p): New decl.
  55         (model_merger::m_ext_state): New field.
  56         (model_merger::m_state_a): New field.
  57         (model_merger::m_state_b): New field.
  58         * svalue.cc (svalue::can_merge_p): Call
  59         model_merger::mergeable_svalue_p on both states and reject the
  60         merger accordingly.
  61
  62 2021-11-17  David Malcolm  <dmalcolm@redhat.com>
  63
  64         PR analyzer/102695
  65         * region-model-impl-calls.cc (region_model::impl_call_strchr): New.
  66         * region-model-manager.cc
  67         (region_model_manager::maybe_fold_unaryop): Simplify cast to
  68         pointer type of an existing pointer to a region.
  69         * region-model.cc (region_model::on_call_pre): Handle
  70         BUILT_IN_STRCHR and "strchr".
  71         (write_to_const_diagnostic::emit): Add auto_diagnostic_group.  Add
  72         alternate wordings for functions and labels.
  73         (write_to_const_diagnostic::describe_final_event): Add alternate
  74         wordings for functions and labels.
  75         (region_model::check_for_writable_region): Handle RK_FUNCTION and
  76         RK_LABEL.
  77         * region-model.h (region_model::impl_call_strchr): New decl.
  78
  79 2021-11-16  David Malcolm  <dmalcolm@redhat.com>
  80
  81         PR analyzer/102662
  82         * constraint-manager.cc (bounded_range::operator==): Require the
  83         types to be the same for equality.
  84
  85 2021-11-13  David Malcolm  <dmalcolm@redhat.com>
  86
  87         * analyzer.opt (Wanalyzer-tainted-allocation-size): New.
  88         (Wanalyzer-tainted-divisor): New.
  89         (Wanalyzer-tainted-offset): New.
  90         (Wanalyzer-tainted-size): New.
  91         * engine.cc (impl_region_model_context::get_taint_map): New.
  92         * exploded-graph.h (impl_region_model_context::get_taint_map):
  93         New decl.
  94         * program-state.cc (sm_state_map::get_state): Call
  95         alt_get_inherited_state.
  96         (sm_state_map::impl_set_state): Modify states within
  97         compound svalues.
  98         (program_state::impl_call_analyzer_dump_state): Undo casts.
  99         (selftest::test_program_state_1): Update for new context param of
 100         create_region_for_heap_alloc.
 101         (selftest::test_program_state_merging): Likewise.
 102         * region-model-impl-calls.cc (region_model::impl_call_alloca):
 103         Likewise.
 104         (region_model::impl_call_calloc): Likewise.
 105         (region_model::impl_call_malloc): Likewise.
 106         (region_model::impl_call_operator_new): Likewise.
 107         (region_model::impl_call_realloc): Likewise.
 108         * region-model.cc (region_model::check_region_access): Call
 109         check_region_for_taint.
 110         (region_model::get_representative_path_var_1): Handle binops.
 111         (region_model::create_region_for_heap_alloc): Add "ctxt" param and
 112         pass it to set_dynamic_extents.
 113         (region_model::create_region_for_alloca): Likewise.
 114         (region_model::set_dynamic_extents): Add "ctxt" param and use it
 115         to call check_dynamic_size_for_taint.
 116         (selftest::test_state_merging): Update for new context param of
 117         create_region_for_heap_alloc.
 118         (selftest::test_malloc_constraints): Likewise.
 119         (selftest::test_malloc): Likewise.
 120         (selftest::test_alloca): Likewise for create_region_for_alloca.
 121         * region-model.h (region_model::create_region_for_heap_alloc): Add
 122         "ctxt" param.
 123         (region_model::create_region_for_alloca): Likewise.
 124         (region_model::set_dynamic_extents): Likewise.
 125         (region_model::check_dynamic_size_for_taint): New decl.
 126         (region_model::check_region_for_taint): New decl.
 127         (region_model_context::get_taint_map): New vfunc.
 128         (noop_region_model_context::get_taint_map): New.
 129         * sm-taint.cc: Remove include of "diagnostic-event-id.h"; add
 130         includes of "gimple-iterator.h", "tristate.h", "selftest.h",
 131         "ordered-hash-map.h", "cgraph.h", "cfg.h", "digraph.h",
 132         "analyzer/supergraph.h", "analyzer/call-string.h",
 133         "analyzer/program-point.h", "analyzer/store.h",
 134         "analyzer/region-model.h", and "analyzer/program-state.h".
 135         (enum bounds): Move to top of file.
 136         (class taint_diagnostic): New.
 137         (class tainted_array_index): Convert to subclass of taint_diagnostic.
 138         (tainted_array_index::emit): Add CWE-129.  Reword warning to use
 139         "attacker-controlled" rather than "tainted".
 140         (tainted_array_index::describe_state_change): Move to
 141         taint_diagnostic::describe_state_change.
 142         (tainted_array_index::describe_final_event): Reword to use
 143         "attacker-controlled" rather than "tainted".
 144         (class tainted_offset): New.
 145         (class tainted_size): New.
 146         (class tainted_divisor): New.
 147         (class tainted_allocation_size): New.
 148         (taint_state_machine::alt_get_inherited_state): New.
 149         (taint_state_machine::on_stmt): In assignment handling, remove
 150         ARRAY_REF handling in favor of check_region_for_taint.  Add
 151         detection of tainted divisors.
 152         (taint_state_machine::get_taint): New.
 153         (taint_state_machine::combine_states): New.
 154         (region_model::check_region_for_taint): New.
 155         (region_model::check_dynamic_size_for_taint): New.
 156         * sm.h (state_machine::alt_get_inherited_state): New.
 157
 158 2021-11-12  David Malcolm  <dmalcolm@redhat.com>
 159
 160         * engine.cc (exploded_node::on_stmt_pre): Return when handling
 161         "__analyzer_dump_state".
 162
 163 2021-11-11  Richard Biener  <rguenther@suse.de>
 164
 165         * supergraph.cc: Include bitmap.h.
 166
 167 2021-11-04  David Malcolm  <dmalcolm@redhat.com>
 168
 169         * program-state.cc (sm_state_map::dump): Use default_tree_printer
 170         as format decoder.
 171
 172 2021-09-16  Maxim Blinov  <maxim.blinov@embecosm.com>
 173
 174         PR bootstrap/102242
 175         * engine.cc (INCLUDE_UNIQUE_PTR): Define.
 176
 177 2021-09-08  David Malcolm  <dmalcolm@redhat.com>
 178
 179         PR analyzer/102225
 180         * analyzer.h (compat_types_p): New decl.
 181         * constraint-manager.cc
 182         (constraint_manager::get_or_add_equiv_class): Guard against NULL
 183         type when checking for pointer types.
 184         * region-model-impl-calls.cc (region_model::impl_call_realloc):
 185         Guard against NULL lhs type/region.  Guard against the size value
 186         not being of a compatible type for dynamic extents.
 187         * region-model.cc (compat_types_p): Make non-static.
 188
 189 2021-08-30  David Malcolm  <dmalcolm@redhat.com>
 190
 191         PR analyzer/99260
 192         * analyzer.h (class custom_edge_info): New class, adapted from
 193         exploded_edge::custom_info_t.  Make member functions const.
 194         Make update_model return bool, converting edge param from
 195         reference to a pointer, and adding a ctxt param.
 196         (class path_context): New class.
 197         * call-info.cc: New file.
 198         * call-info.h: New file.
 199         * engine.cc: Include "analyzer/call-info.h" and <memory>.
 200         (impl_region_model_context::impl_region_model_context): Update for
 201         new m_path_ctxt field.
 202         (impl_region_model_context::bifurcate): New.
 203         (impl_region_model_context::terminate_path): New.
 204         (impl_region_model_context::get_malloc_map): New.
 205         (impl_sm_context::impl_sm_context): Update for new m_path_ctxt
 206         field.
 207         (impl_sm_context::get_fndecl_for_call): Likewise.
 208         (impl_sm_context::set_next_state): Likewise.
 209         (impl_sm_context::warn): Likewise.
 210         (impl_sm_context::is_zero_assignment): Likewise.
 211         (impl_sm_context::get_path_context): New.
 212         (impl_sm_context::m_path_ctxt): New.
 213         (impl_region_model_context::on_condition): Update for new
 214         path_ctxt param.  Handle m_enode_for_diag being NULL.
 215         (impl_region_model_context::on_phi): Update for new path_ctxt
 216         param.
 217         (exploded_node::on_stmt): Add path_ctxt param, updating ctor calls
 218         to use it as necessary.  Use it to bail out after sm-handling,
 219         if needed.
 220         (exploded_node::detect_leaks): Update for new path_ctxt param.
 221         (dynamic_call_info_t::update_model): Update for conversion of
 222         exploded_edge::custom_info_t to custom_edge_info.
 223         (dynamic_call_info_t::add_events_to_path): Likewise.
 224         (rewind_info_t::update_model): Likewise.
 225         (rewind_info_t::add_events_to_path): Likewise.
 226         (exploded_edge::exploded_edge): Likewise.
 227         (exploded_graph::add_edge): Likewise.
 228         (exploded_graph::maybe_process_run_of_before_supernode_enodes):
 229         Update for new path_ctxt param.
 230         (class impl_path_context): New.
 231         (exploded_graph::process_node): Update for new path_ctxt param.
 232         Create an impl_path_context and pass it to exploded_node::on_stmt.
 233         Use it to terminate iterating stmts if terminate_path is called
 234         on it.  After processing a run of stmts, query path_ctxt to
 235         potentially terminate the analysis path, and/or to "bifurcate" the
 236         analysis into multiple additional paths.
 237         (feasibility_state::maybe_update_for_edge): Update for new
 238         update_model ctxt param.
 239         * exploded-graph.h
 240         (impl_region_model_context::impl_region_model_context): Add
 241         path_ctxt param.
 242         (impl_region_model_context::bifurcate): New.
 243         (impl_region_model_context::terminate_path): New
 244         (impl_region_model_context::get_ext_state): New.
 245         (impl_region_model_context::get_malloc_map): New.
 246         (impl_region_model_context::m_path_ctxt): New field.
 247         (exploded_node::on_stmt): Add path_ctxt param.
 248         (class exploded_edge::custom_info_t): Move to analyzer.h, renaming
 249         to custom_edge_info, and making the changes as noted in analyzer.h
 250         above.
 251         (exploded_edge::exploded_edge): Update for these changes to
 252         exploded_edge::custom_info_t.
 253         (exploded_edge::m_custom_info): Likewise.
 254         (class dynamic_call_info_t): Likewise.
 255         (class rewind_info_t): Likewise.
 256         (exploded_graph::add_edge): Likewise.
 257         * program-state.cc (program_state::on_edge): Update for new
 258         path_ctxt param.
 259         (program_state::push_call): Likewise.
 260         (program_state::returning_call): Likewise.
 261         (program_state::prune_for_point): Likewise.
 262         * region-model-impl-calls.cc: Include "analyzer/call-info.h".
 263         (call_details::get_fndecl_for_call): New.
 264         (region_model::impl_call_realloc): Reimplement.
 265         * region-model.cc (region_model::on_call_pre): Move call to
 266         impl_call_realloc to...
 267         (region_model::on_call_post): ...here.  Consolidate creation
 268         of call_details instance.
 269         (noop_region_model_context::bifurcate): New.
 270         (noop_region_model_context::terminate_path): New.
 271         * region-model.h (call_details::get_call_stmt): New.
 272         (call_details::get_fndecl_for_call): New.
 273         (region_model::on_realloc_with_move): New.
 274         (region_model_context::bifurcate): New.
 275         (region_model_context::terminate_path): New.
 276         (region_model_context::get_ext_state): New.
 277         (region_model_context::get_malloc_map): New.
 278         (noop_region_model_context::bifurcate): New.
 279         (noop_region_model_context::terminate_path): New.
 280         (noop_region_model_context::get_ext_state): New.
 281         (noop_region_model_context::get_malloc_map): New.
 282         * sm-malloc.cc: Include "analyzer/program-state.h".
 283         (malloc_state_machine::on_realloc_call): Reimplement.
 284         (malloc_state_machine::on_realloc_with_move): New.
 285         (region_model::on_realloc_with_move): New.
 286         * sm-signal.cc (class signal_delivery_edge_info_t): Update for
 287         conversion from exploded_edge::custom_info_t to custom_edge_info.
 288         * sm.h (sm_context::get_path_context): New.
 289         * svalue.cc (svalue::maybe_get_constant): Call
 290         unwrap_any_unmergeable.
 291
 292 2021-08-25  Ankur Saini  <arsenic@sourceware.org>
 293
 294         PR analyzer/101980
 295         * engine.cc (exploded_graph::maybe_create_dynamic_call): Don't create
 296         calls if max recursion limit is reached.
 297
 298 2021-08-23  David Malcolm  <dmalcolm@redhat.com>
 299
 300         * analyzer.h (struct rejected_constraint): Convert to...
 301         (class rejected_constraint): ...this.
 302         (class bounded_ranges): New forward decl.
 303         (class bounded_ranges_manager): New forward decl.
 304         * constraint-manager.cc: Include "analyzer/analyzer-logging.h" and
 305         "tree-pretty-print.h".
 306         (can_plus_one_p): New.
 307         (plus_one): New.
 308         (can_minus_one_p): New.
 309         (minus_one): New.
 310         (bounded_range::bounded_range): New.
 311         (dump_cst): New.
 312         (bounded_range::dump_to_pp): New.
 313         (bounded_range::dump): New.
 314         (bounded_range::to_json): New.
 315         (bounded_range::set_json_attr): New.
 316         (bounded_range::contains_p): New.
 317         (bounded_range::intersects_p): New.
 318         (bounded_range::operator==): New.
 319         (bounded_range::cmp): New.
 320         (bounded_ranges::bounded_ranges): New.
 321         (bounded_ranges::bounded_ranges): New.
 322         (bounded_ranges::bounded_ranges): New.
 323         (bounded_ranges::canonicalize): New.
 324         (bounded_ranges::validate): New.
 325         (bounded_ranges::operator==): New.
 326         (bounded_ranges::dump_to_pp): New.
 327         (bounded_ranges::dump): New.
 328         (bounded_ranges::to_json): New.
 329         (bounded_ranges::eval_condition): New.
 330         (bounded_ranges::contain_p): New.
 331         (bounded_ranges::cmp): New.
 332         (bounded_ranges_manager::~bounded_ranges_manager): New.
 333         (bounded_ranges_manager::get_or_create_empty): New.
 334         (bounded_ranges_manager::get_or_create_point): New.
 335         (bounded_ranges_manager::get_or_create_range): New.
 336         (bounded_ranges_manager::get_or_create_union): New.
 337         (bounded_ranges_manager::get_or_create_intersection): New.
 338         (bounded_ranges_manager::get_or_create_inverse): New.
 339         (bounded_ranges_manager::consolidate): New.
 340         (bounded_ranges_manager::get_or_create_ranges_for_switch): New.
 341         (bounded_ranges_manager::create_ranges_for_switch): New.
 342         (bounded_ranges_manager::make_case_label_ranges): New.
 343         (bounded_ranges_manager::log_stats): New.
 344         (bounded_ranges_constraint::print): New.
 345         (bounded_ranges_constraint::to_json): New.
 346         (bounded_ranges_constraint::operator==): New.
 347         (bounded_ranges_constraint::add_to_hash): New.
 348         (constraint_manager::constraint_manager): Update for new field
 349         m_bounded_ranges_constraints.
 350         (constraint_manager::operator=): Likewise.
 351         (constraint_manager::hash): Likewise.
 352         (constraint_manager::operator==): Likewise.
 353         (constraint_manager::print): Likewise.
 354         (constraint_manager::dump_to_pp): Likewise.
 355         (constraint_manager::to_json): Likewise.
 356         (constraint_manager::add_unknown_constraint): Update the lhs_ec_id
 357         if necessary in existing constraints when combining equivalence
 358         classes.  Add similar code for handling
 359         m_bounded_ranges_constraints.
 360         (constraint_manager::add_constraint_internal): Add comment.
 361         (constraint_manager::add_bounded_ranges): New.
 362         (constraint_manager::eval_condition): Use new field
 363         m_bounded_ranges_constraints.
 364         (constraint_manager::purge): Update bounded_ranges_constraint
 365         instances.
 366         (constraint_manager::canonicalize): Update for new field.
 367         (merger_fact_visitor::on_ranges): New.
 368         (constraint_manager::for_each_fact): Use new field
 369         m_bounded_ranges_constraints.
 370         (constraint_manager::validate):  Fix off-by-one error needed due
 371         to bug fixed above in add_unknown_constraint.  Validate the EC IDs
 372         in m_bounded_ranges_constraints.
 373         (constraint_manager::get_range_manager): New.
 374         (selftest::assert_dump_bounded_range_eq): New.
 375         (ASSERT_DUMP_BOUNDED_RANGE_EQ): New.
 376         (selftest::test_bounded_range): New.
 377         (selftest::assert_dump_bounded_ranges_eq): New.
 378         (ASSERT_DUMP_BOUNDED_RANGES_EQ): New.
 379         (selftest::test_bounded_ranges): New.
 380         (selftest::run_constraint_manager_tests): Call the new selftests.
 381         * constraint-manager.h (struct bounded_range): New.
 382         (struct bounded_ranges): New.
 383         (template <> struct default_hash_traits<bounded_ranges::key_t>): New.
 384         (class bounded_ranges_manager): New.
 385         (fact_visitor::on_ranges): New pure virtual function.
 386         (class bounded_ranges_constraint): New.
 387         (constraint_manager::add_bounded_ranges): New decl.
 388         (constraint_manager::get_range_manager): New decl.
 389         (constraint_manager::m_bounded_ranges_constraints): New field.
 390         * diagnostic-manager.cc (epath_finder::process_worklist_item):
 391         Transfer ownership of rc to add_feasibility_problem.
 392         * engine.cc (feasibility_problem::dump_to_pp): Use get_model.
 393         * feasible-graph.cc (infeasible_node::dump_dot): Update for
 394         conversion of m_rc to a pointer.
 395         (feasible_graph::add_feasibility_problem): Pass RC by pointer and
 396         take ownership.
 397         * feasible-graph.h (infeasible_node::infeasible_node): Pass RC by
 398         pointer and take ownership.
 399         (infeasible_node::~infeasible_node): New.
 400         (infeasible_node::m_rc): Convert to a pointer.
 401         (feasible_graph::add_feasibility_problem): Pass RC by pointer and
 402         take ownership.
 403         * region-model-manager.cc: Include
 404         "analyzer/constraint-manager.h".
 405         (region_model_manager::region_model_manager): Initializer new
 406         field m_range_mgr.
 407         (region_model_manager::~region_model_manager): Delete it.
 408         (region_model_manager::log_stats): Call log_stats on it.
 409         * region-model.cc (region_model::add_constraint): Use new subclass
 410         rejected_op_constraint.
 411         (region_model::apply_constraints_for_gswitch): Reimplement using
 412         bounded_ranges_manager.
 413         (rejected_constraint::dump_to_pp): Convert to...
 414         (rejected_op_constraint::dump_to_pp): ...this.
 415         (rejected_ranges_constraint::dump_to_pp): New.
 416         * region-model.h (struct purge_stats): Add field
 417         m_num_bounded_ranges_constraints.
 418         (region_model_manager::get_range_manager): New.
 419         (region_model_manager::m_range_mgr): New.
 420         (region_model::get_range_manager): New.
 421         (struct rejected_constraint): Split into...
 422         (class rejected_constraint):...this new abstract base class,
 423         and...
 424         (class rejected_op_constraint): ...this new concrete subclass.
 425         (class rejected_ranges_constraint): New.
 426         * supergraph.cc: Include "tree-cfg.h".
 427         (supergraph::supergraph): Drop idx param from add_cfg_edge.
 428         (supergraph::add_cfg_edge): Drop idx param.
 429         (switch_cfg_superedge::switch_cfg_superedge): Move here from
 430         header.  Populate m_case_labels with all cases which go to DST.
 431         (switch_cfg_superedge::dump_label_to_pp): Reimplement to use
 432         m_case_labels.
 433         (switch_cfg_superedge::get_case_label): Delete.
 434         * supergraph.h (supergraphadd_cfg_edge): Drop "idx" param.
 435         (switch_cfg_superedge::switch_cfg_superedge): Drop idx param and
 436         move implementation to supergraph.cc.
 437         (switch_cfg_superedge::get_case_label): Delete.
 438         (switch_cfg_superedge::get_case_labels): New.
 439         (switch_cfg_superedge::m_idx): Delete.
 440         (switch_cfg_superedge::m_case_labels): New field.
 441
 442 2021-08-23  David Malcolm  <dmalcolm@redhat.com>
 443
 444         PR analyzer/101875
 445         * sm-file.cc (file_diagnostic::describe_state_change): Handle
 446         change.m_expr being NULL.
 447
 448 2021-08-23  David Malcolm  <dmalcolm@redhat.com>
 449
 450         PR analyzer/101837
 451         * analyzer.cc (maybe_reconstruct_from_def_stmt): Bail if fn is
 452         NULL, and assert that it's non-NULL before passing it to
 453         build_call_array_loc.
 454
 455 2021-08-23  David Malcolm  <dmalcolm@redhat.com>
 456
 457         PR analyzer/101962
 458         * region-model.cc (region_model::eval_condition_without_cm):
 459         Refactor comparison against zero, adding a check for
 460         POINTER_PLUS_EXPR of non-NULL.
 461
 462 2021-08-23  David Malcolm  <dmalcolm@redhat.com>
 463
 464         * store.cc (bit_range::intersects_p): New overload.
 465         (bit_range::operator-): New.
 466         (binding_cluster::maybe_get_compound_binding): Handle the partial
 467         overlap case.
 468         (selftest::test_bit_range_intersects_p): Add test coverage for
 469         new overload of bit_range::intersects_p.
 470         * store.h (bit_range::intersects_p): New overload.
 471         (bit_range::operator-): New.
 472
 473 2021-08-23  Ankur Saini  <arsenic@sourceware.org>
 474
 475         PR analyzer/102020
 476         * diagnostic-manager.cc
 477         (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Fix typo.
 478
 479 2021-08-21  Ankur Saini  <arsenic@sourceware.org>
 480
 481         PR analyzer/101980
 482         * diagnostic-manager.cc
 483         (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Use
 484         caller_model only when the supergraph_edge doesn't exixt.
 485         (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
 486         Likewise.
 487         * engine.cc (exploded_graph::create_dynamic_call): Rename to...
 488         (exploded_graph::maybe_create_dynamic_call): ...this, return call
 489         creation status.
 490         (exploded_graph::process_node): Handle calls which were not dynamically
 491         discovered.
 492         * exploded-graph.h (exploded_graph::create_dynamic_call): Rename to...
 493         (exploded_graph::maybe_create_dynamic_call): ...this.
 494         * region-model.cc (region_model::update_for_gcall): New param, use it
 495         to push call to frame.
 496         (region_model::update_for_call_superedge): Pass callee function to
 497         update_for_gcall.
 498         * region-model.h (region_model::update_for_gcall): New param.
 499
 500 2021-08-18  Ankur Saini  <arsenic@sourceware.org>
 501
 502         PR analyzer/97114
 503         * region-model.cc (region_model::get_rvalue_1): Add case for
 504         OBJ_TYPE_REF.
 505
 506 2021-08-18  Ankur Saini  <arsenic@sourceware.org>
 507
 508         PR analyzer/100546
 509         * analysis-plan.cc (analysis_plan::use_summary_p): Don't use call
 510         summaries if there is no callgraph edge
 511         * checker-path.cc (call_event::call_event): Handle calls events that
 512         are not represented by a supergraph call edge
 513         (return_event::return_event): Likewise.
 514         (call_event::get_desc): Work with new call_event structure.
 515         (return_event::get_desc): Likeise.
 516         * checker-path.h (call_event::m_src_snode): New field.
 517         (call_event::m_dest_snode): New field.
 518         (return_event::m_src_snode): New field.
 519         (return_event::m_dest_snode): New field.
 520         * diagnostic-manager.cc
 521         (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>:
 522         Refactor to work with edges without callgraph edge.
 523         (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
 524         Likewise.
 525         * engine.cc (dynamic_call_info_t::update_model): New function.
 526         (dynamic_call_info_t::add_events_to_path): New function.
 527         (exploded_graph::create_dynamic_call): New function.
 528         (exploded_graph::process_node): Work with dynamically discovered calls.
 529         * exploded-graph.h (class dynamic_call_info_t): New class.
 530         (exploded_graph::create_dynamic_call): New decl.
 531         * program-point.cc (program_point::push_to_call_stack): New function.
 532         (program_point::pop_from_call_stack): New function.
 533         * program-point.h (program_point::push_to_call_stack): New decl.
 534         (program_point::pop_from_call_stack): New decl.
 535         * program-state.cc (program_state::push_call): New function.
 536         (program_state::returning_call): New function.
 537         * program-state.h (program_state::push_call): New decl.
 538         (program_state::returning_call): New decl.
 539         * region-model.cc (region_model::update_for_gcall) New function.
 540         (region_model::update_for_return_gcall): New function.
 541         (egion_model::update_for_call_superedge): Get the underlying gcall and
 542         update for gcall.
 543         (region_model::update_for_return_superedge): Likewise.
 544         * region-model.h (region_model::update_for_gcall): New decl.
 545         (region_model::update_for_return_gcall): New decl.
 546         * state-purge.cc (state_purge_per_ssa_name::process_point): Update to
 547         work with calls without underlying cgraph edge.
 548         * supergraph.cc (supergraph::supergraph) Split snodes at every callsite.
 549         * supergraph.h (supernode::get_returning_call) New accessor.
 550
 551 2021-08-04  David Malcolm  <dmalcolm@redhat.com>
 552
 553         PR analyzer/101570
 554         * analyzer.cc (maybe_reconstruct_from_def_stmt): Add GIMPLE_ASM
 555         case.
 556         * analyzer.h (class asm_output_svalue): New forward decl.
 557         (class reachable_regions): New forward decl.
 558         * complexity.cc (complexity::from_vec_svalue): New.
 559         * complexity.h (complexity::from_vec_svalue): New decl.
 560         * engine.cc (feasibility_state::maybe_update_for_edge): Handle
 561         asm stmts by calling on_asm_stmt.
 562         * region-model-asm.cc: New file.
 563         * region-model-manager.cc
 564         (region_model_manager::maybe_fold_asm_output_svalue): New.
 565         (region_model_manager::get_or_create_asm_output_svalue): New.
 566         (region_model_manager::log_stats): Log m_asm_output_values_map.
 567         * region-model.cc (region_model::on_stmt_pre): Handle GIMPLE_ASM.
 568         * region-model.h (visitor::visit_asm_output_svalue): New.
 569         (region_model_manager::get_or_create_asm_output_svalue): New decl.
 570         (region_model_manager::maybe_fold_asm_output_svalue): New decl.
 571         (region_model_manager::asm_output_values_map_t): New typedef.
 572         (region_model_manager::m_asm_output_values_map): New field.
 573         (region_model::on_asm_stmt): New.
 574         * store.cc (binding_cluster::on_asm): New.
 575         * store.h (binding_cluster::on_asm): New decl.
 576         * svalue.cc (svalue::cmp_ptr): Handle SK_ASM_OUTPUT.
 577         (asm_output_svalue::dump_to_pp): New.
 578         (asm_output_svalue::dump_input): New.
 579         (asm_output_svalue::input_idx_to_asm_idx): New.
 580         (asm_output_svalue::accept): New.
 581         * svalue.h (enum svalue_kind): Add SK_ASM_OUTPUT.
 582         (svalue::dyn_cast_asm_output_svalue): New.
 583         (class asm_output_svalue): New.
 584         (is_a_helper <const asm_output_svalue *>::test): New.
 585         (struct default_hash_traits<asm_output_svalue::key_t>): New.
 586
 587 2021-08-03  Jakub Jelinek  <jakub@redhat.com>
 588
 589         PR analyzer/101721
 590         * sm-malloc.cc (known_allocator_p): Only check DECL_FUNCTION_CODE on
 591         BUILT_IN_NORMAL builtins.
 592
 593 2021-07-29  Ankur Saini  <arsenic@sourceware.org>
 594
 595         * call-string.cc (call_string::element_t::operator==): New operator.
 596         (call_String::element_t::operator!=): New operator.
 597         (call_string::element_t::get_caller_function): New function.
 598         (call_string::element_t::get_callee_function): New function.
 599         (call_string::call_string): Refactor to Initialise m_elements.
 600         (call_string::operator=): Refactor to work with m_elements.
 601         (call_string::operator==): Likewise.
 602         (call_string::to_json): Likewise.
 603         (call_string::hash): Refactor to hash e.m_caller.
 604         (call_string::push_call): Refactor to work with m_elements.
 605         (call_string::push_call): New overload to push call via supernodes.
 606         (call_string::pop): Refactor to work with m_elements.
 607         (call_string::calc_recursion_depth): Likewise.
 608         (call_string::cmp): Likewise.
 609         (call_string::validate): Likewise.
 610         (call_string::operator[]): Likewise.
 611         * call-string.h (class supernode): New forward decl.
 612         (struct call_string::element_t): New struct.
 613         (call_string::call_string): Refactor to initialise m_elements.
 614         (call_string::bool empty_p): Refactor to work with m_elements.
 615         (call_string::get_callee_node): New decl.
 616         (call_string::get_caller_node): New decl.
 617         (m_elements): Replaces m_return_edges.
 618         * program-point.cc (program_point::get_function_at_depth): Refactor to
 619         work with new call-string format.
 620         (program_point::validate): Likewise.
 621         (program_point::on_edge): Likewise.
 622
 623 2021-07-28  David Malcolm  <dmalcolm@redhat.com>
 624
 625         * region-model.cc (region_model::on_call_pre): Treat
 626         IFN_UBSAN_BOUNDS, BUILT_IN_STACK_SAVE, and BUILT_IN_STACK_RESTORE
 627         as no-ops, rather than handling them as unknown functions.
 628
 629 2021-07-28  David Malcolm  <dmalcolm@redhat.com>
 630
 631         * region-model-impl-calls.cc (region_model::impl_call_alloca):
 632         Drop redundant return value.
 633         (region_model::impl_call_builtin_expect): Likewise.
 634         (region_model::impl_call_calloc): Likewise.
 635         (region_model::impl_call_malloc): Likewise.
 636         (region_model::impl_call_memset): Likewise.
 637         (region_model::impl_call_operator_new): Likewise.
 638         (region_model::impl_call_operator_delete): Likewise.
 639         (region_model::impl_call_strlen): Likewise.
 640         * region-model.cc (region_model::on_call_pre): Fix return value of
 641         known functions that don't have unknown side-effects.
 642         * region-model.h (region_model::impl_call_alloca): Drop redundant
 643         return value.
 644         (region_model::impl_call_builtin_expect): Likewise.
 645         (region_model::impl_call_calloc): Likewise.
 646         (region_model::impl_call_malloc): Likewise.
 647         (region_model::impl_call_memset): Likewise.
 648         (region_model::impl_call_strlen): Likewise.
 649         (region_model::impl_call_operator_new): Likewise.
 650         (region_model::impl_call_operator_delete): Likewise.
 651
 652 2021-07-28  Siddhesh Poyarekar  <siddhesh@gotplt.org>
 653
 654         * analyzer.cc (is_named_call_p, is_std_named_call_p): Make
 655         first argument a const_tree.
 656         * analyzer.h (is_named_call_p, -s_std_named_call_p): Likewise.
 657         * sm-malloc.cc (known_allocator_p): New function.
 658         (malloc_state_machine::on_stmt): Use it.
 659
 660 2021-07-28  Siddhesh Poyarekar  <siddhesh@gotplt.org>
 661
 662         * sm-malloc.cc
 663         (malloc_state_machine::get_or_create_deallocator): Recognize
 664         __builtin_free.
 665
 666 2021-07-26  David Malcolm  <dmalcolm@redhat.com>
 667
 668         * region-model.cc (region_model::on_call_pre): Always set conjured
 669         LHS, not just for SSA names.
 670
 671 2021-07-23  David Malcolm  <dmalcolm@redhat.com>
 672
 673         * diagnostic-manager.cc
 674         (class auto_disable_complexity_checks): New.
 675         (epath_finder::explore_feasible_paths): Use it to disable
 676         complexity checks whilst processing the worklist.
 677         * region-model-manager.cc
 678         (region_model_manager::region_model_manager): Initialize
 679         m_check_complexity.
 680         (region_model_manager::reject_if_too_complex): Bail if
 681         m_check_complexity is false.
 682         * region-model.h
 683         (region_model_manager::enable_complexity_check): New.
 684         (region_model_manager::disable_complexity_check): New.
 685         (region_model_manager::m_check_complexity): New.
 686
 687 2021-07-21  David Malcolm  <dmalcolm@redhat.com>
 688
 689         PR analyzer/101547
 690         * sm-file.cc (file_leak::emit): Handle m_arg being NULL.
 691         (file_leak::describe_final_event): Handle ev.m_expr being NULL.
 692
 693 2021-07-21  David Malcolm  <dmalcolm@redhat.com>
 694
 695         PR analyzer/101522
 696         * store.cc (binding_cluster::purge_state_involving): Don't change
 697         m_map whilst iterating through it.
 698
 699 2021-07-21  David Malcolm  <dmalcolm@redhat.com>
 700
 701         * region-model.cc (region_model::handle_phi): Add "old_state"
 702         param and use it.
 703         (region_model::update_for_phis): Update so that all of the phi
 704         stmts are effectively handled simultaneously, rather than in
 705         order.
 706         * region-model.h (region_model::handle_phi): Add "old_state"
 707         param.
 708         * state-purge.cc (self_referential_phi_p): Replace with...
 709         (name_used_by_phis_p): ...this new function.
 710         (state_purge_per_ssa_name::process_point): Update to use the
 711         above, so that all phi stmts at a basic block are effectively
 712         considered simultaneously, and only consider the phi arguments for
 713         the pertinent in-edge.
 714         * supergraph.cc (cfg_superedge::get_phi_arg_idx): New.
 715         (cfg_superedge::get_phi_arg): Use the above.
 716         * supergraph.h (cfg_superedge::get_phi_arg_idx): New decl.
 717
 718 2021-07-21  David Malcolm  <dmalcolm@redhat.com>
 719
 720         * state-purge.cc (state_purge_annotator::add_node_annotations):
 721         Rather than erroneously always using the NULL in-edge, determine
 722         each relevant in-edge, and print the appropriate data for each
 723         in-edge.  Use print_needed to print the data as comma-separated
 724         lists of SSA names.
 725         (print_vec_of_names): Add "within_table" param and use it.
 726         (state_purge_annotator::add_stmt_annotations): Factor out
 727         collation and printing code into...
 728         (state_purge_annotator::print_needed): ...this new function.
 729         * state-purge.h (state_purge_annotator::print_needed): New decl.
 730
 731 2021-07-21  David Malcolm  <dmalcolm@redhat.com>
 732
 733         * program-point.cc (function_point::print): Show src BB index at
 734         BEFORE_SUPERNODE.
 735
 736 2021-07-21  David Malcolm  <dmalcolm@redhat.com>
 737
 738         * svalue.cc (infix_p): New.
 739         (binop_svalue::dump_to_pp): Use it to print MIN_EXPR and MAX_EXPR
 740         in prefix form, rather than infix.
 741
 742 2021-07-19  David Malcolm  <dmalcolm@redhat.com>
 743
 744         PR analyzer/101503
 745         * constraint-manager.cc (constraint_manager::add_constraint): Use
 746         can_have_associated_state_p rather than testing for unknown.
 747         (constraint_manager::get_or_add_equiv_class): Likewise.
 748         * program-state.cc (sm_state_map::set_state): Likewise.
 749         (sm_state_map::impl_set_state): Add assertion.
 750         * region-model-manager.cc
 751         (region_model_manager::maybe_fold_unaryop): Handle poisoned
 752         values.
 753         (region_model_manager::maybe_fold_binop): Move handling of unknown
 754         values...
 755         (region_model_manager::get_or_create_binop): ...to here, and
 756         generalize to use can_have_associated_state_p.
 757         (region_model_manager::maybe_fold_sub_svalue): Use
 758         can_have_associated_state_p rather than testing for unknown.
 759         (region_model_manager::maybe_fold_repeated_svalue): Use unknown
 760         when the size or repeated value is "unknown"/"poisoned".
 761         * region-model.cc (region_model::purge_state_involving): Reject
 762         attempts to purge unknown/poisoned svalues, as these svalues
 763         should not have state associated with them.
 764         * svalue.cc (sub_svalue::sub_svalue): Assert that we're building
 765         on top of an svalue with can_have_associated_state_p.
 766         (repeated_svalue::repeated_svalue): Likewise.
 767         (bits_within_svalue::bits_within_svalue): Likewise.
 768         * svalue.h (svalue::can_have_associated_state_p): New.
 769         (unknown_svalue::can_have_associated_state_p): New.
 770         (poisoned_svalue::can_have_associated_state_p): New.
 771         (unaryop_svalue::unaryop_svalue): Assert that we're building on
 772         top of an svalue with can_have_associated_state_p.
 773         (binop_svalue::binop_svalue): Likewise.
 774         (widening_svalue::widening_svalue): Likewise.
 775
 776 2021-07-16  David Malcolm  <dmalcolm@redhat.com>
 777
 778         * analyzer.h (enum access_direction): New.
 779         * engine.cc (exploded_node::on_longjmp): Update for new param of
 780         get_store_value.
 781         * program-state.cc (program_state::prune_for_point): Likewise.
 782         * region-model-impl-calls.cc (region_model::impl_call_memcpy):
 783         Replace call to check_for_writable_region with call to
 784         check_region_for_write.
 785         (region_model::impl_call_memset): Likewise.
 786         (region_model::impl_call_strcpy): Likewise.
 787         * region-model-reachability.cc (reachable_regions::add): Update
 788         for new param of get_store_value.
 789         * region-model.cc (region_model::get_rvalue_1): Likewise, also for
 790         get_rvalue_for_bits.
 791         (region_model::get_store_value): Add ctxt param and use it to call
 792         check_region_for_read.
 793         (region_model::get_rvalue_for_bits): Add ctxt param and use it to
 794         call get_store_value.
 795         (region_model::check_region_access): New.
 796         (region_model::check_region_for_write): New.
 797         (region_model::check_region_for_read): New.
 798         (region_model::set_value): Update comment.  Replace call to
 799         check_for_writable_region with call to check_region_for_write.
 800         * region-model.h (region_model::get_rvalue_for_bits): Add ctxt
 801         param.
 802         (region_model::get_store_value): Add ctxt param.
 803         (region_model::check_region_access): New decl.
 804         (region_model::check_region_for_write): New decl.
 805         (region_model::check_region_for_read): New decl.
 806         * region.cc (region_model::copy_region): Update call to
 807         get_store_value.
 808         * svalue.cc (initial_svalue::implicitly_live_p): Likewise.
 809
 810 2021-07-16  David Malcolm  <dmalcolm@redhat.com>
 811
 812         * engine.cc (exploded_node::on_stmt_pre): Handle
 813         __analyzer_dump_state.
 814         * program-state.cc (extrinsic_state::get_sm_idx_by_name): New.
 815         (program_state::impl_call_analyzer_dump_state): New.
 816         * program-state.h (extrinsic_state::get_sm_idx_by_name): New decl.
 817         (program_state::impl_call_analyzer_dump_state): New decl.
 818         * region-model-impl-calls.cc
 819         (call_details::get_arg_string_literal): New.
 820         * region-model.h (call_details::get_arg_string_literal): New decl.
 821
 822 2021-07-16  David Malcolm  <dmalcolm@redhat.com>
 823
 824         * program-state.cc (program_state::detect_leaks): Simplify using
 825         svalue::maybe_get_region.
 826         * region-model-impl-calls.cc (region_model::impl_call_fgets): Likewise.
 827         (region_model::impl_call_fread): Likewise.
 828         (region_model::impl_call_free): Likewise.
 829         (region_model::impl_call_operator_delete): Likewise.
 830         * region-model.cc (selftest::test_stack_frames): Likewise.
 831         (selftest::test_state_merging): Likewise.
 832         * svalue.cc (svalue::maybe_get_region): New.
 833         * svalue.h (svalue::maybe_get_region): New decl.
 834
 835 2021-07-15  David Malcolm  <dmalcolm@redhat.com>
 836
 837         * svalue.h (is_a_helper <placeholder_svalue *>::test): Make
 838         param and template param const.
 839         (is_a_helper <widening_svalue *>::test): Likewise.
 840         (is_a_helper <compound_svalue *>::test): Likewise.
 841         (is_a_helper <conjured_svalue *>::test): Likewise.
 842
 843 2021-07-15  David Malcolm  <dmalcolm@redhat.com>
 844
 845         PR analyzer/95006
 846         PR analyzer/94713
 847         PR analyzer/94714
 848         * analyzer.cc (maybe_reconstruct_from_def_stmt): Split out
 849         GIMPLE_ASSIGN case into...
 850         (get_diagnostic_tree_for_gassign_1): New.
 851         (get_diagnostic_tree_for_gassign): New.
 852         * analyzer.h (get_diagnostic_tree_for_gassign): New decl.
 853         * analyzer.opt (Wanalyzer-write-to-string-literal): New.
 854         * constraint-manager.cc (class svalue_purger): New.
 855         (constraint_manager::purge_state_involving): New.
 856         * constraint-manager.h
 857         (constraint_manager::purge_state_involving): New.
 858         * diagnostic-manager.cc (saved_diagnostic::supercedes_p): New.
 859         (dedupe_winners::handle_interactions): New.
 860         (diagnostic_manager::emit_saved_diagnostics): Call it.
 861         * diagnostic-manager.h (saved_diagnostic::supercedes_p): New decl.
 862         * engine.cc (impl_region_model_context::warn): Convert return type
 863         to bool.  Return false if the diagnostic isn't saved.
 864         (impl_region_model_context::purge_state_involving): New.
 865         (impl_sm_context::get_state): Use NULL ctxt when querying old
 866         rvalue.
 867         (impl_sm_context::set_next_state): Use new sval when querying old
 868         state.
 869         (class dump_path_diagnostic): Move to region-model.cc
 870         (exploded_node::on_stmt): Move to on_stmt_pre and on_stmt_post.
 871         Remove call to purge_state_involving.
 872         (exploded_node::on_stmt_pre): New, based on the above.  Move most
 873         of it to region_model::on_stmt_pre.
 874         (exploded_node::on_stmt_post): Likewise, moving to
 875         region_model::on_stmt_post.
 876         (class stale_jmp_buf): Fix parent class to use curiously recurring
 877         template pattern.
 878         (feasibility_state::maybe_update_for_edge): Call on_call_pre and
 879         on_call_post on gcalls.
 880         * exploded-graph.h (impl_region_model_context::warn): Return bool.
 881         (impl_region_model_context::purge_state_involving): New decl.
 882         (exploded_node::on_stmt_pre): New decl.
 883         (exploded_node::on_stmt_post): New decl.
 884         * pending-diagnostic.h (pending_diagnostic::use_of_uninit_p): New.
 885         (pending_diagnostic::supercedes_p): New.
 886         * program-state.cc (sm_state_map::get_state): Inherit state for
 887         conjured_svalue as well as initial_svalue.
 888         (sm_state_map::purge_state_involving): Also support SK_CONJURED.
 889         * region-model-impl-calls.cc (call_details::get_uncertainty):
 890         Handle m_ctxt being NULL.
 891         (call_details::get_or_create_conjured_svalue): New.
 892         (region_model::impl_call_fgets): New.
 893         (region_model::impl_call_fread): New.
 894         * region-model-manager.cc
 895         (region_model_manager::get_or_create_initial_value): Return an
 896         uninitialized poisoned value for regions that can't have initial
 897         values.
 898         * region-model-reachability.cc
 899         (reachable_regions::mark_escaped_clusters): Handle ctxt being
 900         NULL.
 901         * region-model.cc (region_to_value_map::purge_state_involving): New.
 902         (poisoned_value_diagnostic::use_of_uninit_p): New.
 903         (poisoned_value_diagnostic::emit): Handle POISON_KIND_UNINIT.
 904         (poisoned_value_diagnostic::describe_final_event): Likewise.
 905         (region_model::check_for_poison): New.
 906         (region_model::on_assignment): Call it.
 907         (class dump_path_diagnostic): Move here from engine.cc.
 908         (region_model::on_stmt_pre): New, based on exploded_node::on_stmt.
 909         (region_model::on_call_pre): Move the setting of the LHS to a
 910         conjured svalue to before the checks for specific functions.
 911         Handle "fgets", "fgets_unlocked", and "fread".
 912         (region_model::purge_state_involving): New.
 913         (region_model::handle_unrecognized_call): Handle ctxt being NULL.
 914         (region_model::get_rvalue): Call check_for_poison.
 915         (selftest::test_stack_frames): Use NULL for context when getting
 916         uninitialized rvalue.
 917         (selftest::test_alloca): Likewise.
 918         * region-model.h (region_to_value_map::purge_state_involving): New
 919         decl.
 920         (call_details::get_or_create_conjured_svalue): New decl.
 921         (region_model::on_stmt_pre): New decl.
 922         (region_model::purge_state_involving): New decl.
 923         (region_model::impl_call_fgets): New decl.
 924         (region_model::impl_call_fread): New decl.
 925         (region_model::check_for_poison): New decl.
 926         (region_model_context::warn): Return bool.
 927         (region_model_context::purge_state_involving): New.
 928         (noop_region_model_context::warn): Return bool.
 929         (noop_region_model_context::purge_state_involving): New.
 930         (test_region_model_context:: warn): Return bool.
 931         * region.cc (region::get_memory_space): New.
 932         (region::can_have_initial_svalue_p): New.
 933         (region::involves_p): New.
 934         * region.h (enum memory_space): New.
 935         (region::get_memory_space): New decl.
 936         (region::can_have_initial_svalue_p): New decl.
 937         (region::involves_p): New decl.
 938         * sm-malloc.cc (use_after_free::supercedes_p): New.
 939         * store.cc (binding_cluster::purge_state_involving): New.
 940         (store::purge_state_involving): New.
 941         * store.h (class symbolic_binding): New forward decl.
 942         (binding_key::dyn_cast_symbolic_binding): New.
 943         (symbolic_binding::dyn_cast_symbolic_binding): New.
 944         (binding_cluster::purge_state_involving): New.
 945         (store::purge_state_involving): New.
 946         * svalue.cc (svalue::can_merge_p): Reject attempts to merge
 947         poisoned svalues with other svalues, so that we identify
 948         paths in which a variable is conditionally uninitialized.
 949         (involvement_visitor::visit_conjured_svalue): New.
 950         (svalue::involves_p): Also handle SK_CONJURED.
 951         (poison_kind_to_str): Handle POISON_KIND_UNINIT.
 952         (poisoned_svalue::maybe_fold_bits_within): New.
 953         * svalue.h (enum poison_kind): Add POISON_KIND_UNINIT.
 954         (poisoned_svalue::maybe_fold_bits_within): New decl.
 955
 956 2021-07-15  David Malcolm  <dmalcolm@redhat.com>
 957
 958         * analyzer.opt (fdump-analyzer-exploded-paths): New.
 959         * diagnostic-manager.cc
 960         (diagnostic_manager::emit_saved_diagnostic): Implement it.
 961         * engine.cc (exploded_path::dump_to_pp): Add ext_state param and
 962         use it to dump states if non-NULL.
 963         (exploded_path::dump): Likewise.
 964         (exploded_path::dump_to_file): New.
 965         * exploded-graph.h (exploded_path::dump_to_pp): Add ext_state
 966         param.
 967         (exploded_path::dump): Likewise.
 968         (exploded_path::dump): Likewise.
 969         (exploded_path::dump_to_file): New.
 970
 971 2021-07-15  David Malcolm  <dmalcolm@redhat.com>
 972
 973         * analyzer.cc (fixup_tree_for_diagnostic_1): Use DECL_DEBUG_EXPR
 974         if it's available.
 975         * engine.cc (readability): Likewise.
 976
 977 2021-07-15  David Malcolm  <dmalcolm@redhat.com>
 978
 979         * state-purge.cc (self_referential_phi_p): New.
 980         (state_purge_per_ssa_name::process_point): Don't purge an SSA name
 981         at its def-stmt if the def-stmt is self-referential.
 982
 983 2021-07-07  David Malcolm  <dmalcolm@redhat.com>
 984
 985         * diagnostic-manager.cc (null_assignment_sm_context::get_state):
 986         New overload.
 987         (null_assignment_sm_context::set_next_state): New overload.
 988         (null_assignment_sm_context::get_diagnostic_tree): New.
 989         * engine.cc (impl_sm_context::get_state): New overload.
 990         (impl_sm_context::set_next_state): New overload.
 991         (impl_sm_context::get_diagnostic_tree): New overload.
 992         (impl_region_model_context::on_condition): Convert params from
 993         tree to const svalue *.
 994         * exploded-graph.h (impl_region_model_context::on_condition):
 995         Likewise.
 996         * region-model.cc (region_model::on_call_pre): Move handling of
 997         internal calls to before checking for get_fndecl_for_call.
 998         (region_model::add_constraints_from_binop): New.
 999         (region_model::add_constraint): Split out into a new overload
1000         working on const svalue * rather than tree.  Call
1001         add_constraints_from_binop.  Drop call to
1002         add_any_constraints_from_ssa_def_stmt.
1003         (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
1004         (region_model::add_any_constraints_from_gassign): Delete.
1005         (region_model::add_any_constraints_from_gcall): Delete.
1006         * region-model.h
1007         (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
1008         (region_model::add_any_constraints_from_gassign): Delete.
1009         (region_model::add_any_constraints_from_gcall): Delete.
1010         (region_model::add_constraint): Add overload decl.
1011         (region_model::add_constraints_from_binop): New decl.
1012         (region_model_context::on_condition): Convert params from tree to
1013         const svalue *.
1014         (noop_region_model_context::on_condition): Likewise.
1015         * sm-file.cc (fileptr_state_machine::condition): Likewise.
1016         * sm-malloc.cc (malloc_state_machine::on_condition): Likewise.
1017         * sm-pattern-test.cc: Include tristate.h, selftest.h,
1018         analyzer/call-string.h, analyzer/program-point.h,
1019         analyzer/store.h, and analyzer/region-model.h.
1020         (pattern_test_state_machine::on_condition): Convert params from tree to
1021         const svalue *.
1022         * sm-sensitive.cc (sensitive_state_machine::on_condition): Delete.
1023         * sm-signal.cc (signal_state_machine::on_condition): Delete.
1024         * sm-taint.cc (taint_state_machine::on_condition): Convert params
1025         from tree to const svalue *.
1026         * sm.cc: Include tristate.h, selftest.h, analyzer/call-string.h,
1027         analyzer/program-point.h, analyzer/store.h, and
1028         analyzer/region-model.h.
1029         (any_pointer_p): Add overload taking const svalue *sval.
1030         * sm.h (any_pointer_p): Add overload taking const svalue *sval.
1031         (state_machine::on_condition): Convert params from tree to
1032         const svalue *.  Provide no-op default implementation.
1033         (sm_context::get_state): Add overload taking const svalue *sval.
1034         (sm_context::set_next_state): Likewise.
1035         (sm_context::on_transition): Likewise.
1036         (sm_context::get_diagnostic_tree): Likewise.
1037         * svalue.cc (svalue::all_zeroes_p): New.
1038         (constant_svalue::all_zeroes_p): New.
1039         (repeated_svalue::all_zeroes_p): Convert to vfunc.
1040         * svalue.h (svalue::all_zeroes_p): New decl.
1041         (constant_svalue::all_zeroes_p): New decl.
1042         (repeated_svalue::all_zeroes_p): Convert decl to vfunc.
1043
1044 2021-06-30  David Malcolm  <dmalcolm@redhat.com>
1045
1046         PR analyzer/95006
1047         * analyzer.h (class repeated_svalue): New forward decl.
1048         (class bits_within_svalue): New forward decl.
1049         (class sized_region): New forward decl.
1050         (get_field_at_bit_offset): New forward decl.
1051         * engine.cc (exploded_graph::get_or_create_node): Validate the
1052         merged state.
1053         (exploded_graph::maybe_process_run_of_before_supernode_enodes):
1054         Validate the states at each stage.
1055         * program-state.cc (program_state::validate): Validate
1056         m_region_model.
1057         * region-model-impl-calls.cc (region_model::impl_call_memset):
1058         Replace special-case logic for handling constant sizes with
1059         a call to fill_region of a sized_region with the given fill value.
1060         * region-model-manager.cc (maybe_undo_optimize_bit_field_compare):
1061         Drop DK_direct.
1062         (region_model_manager::maybe_fold_sub_svalue):  Fold element-based
1063         subregions of an initial value into initial values of an element.
1064         Fold subvalues of repeated svalues.
1065         (region_model_manager::maybe_fold_repeated_svalue): New.
1066         (region_model_manager::get_or_create_repeated_svalue): New.
1067         (get_bit_range_for_field): New.
1068         (get_byte_range_for_field): New.
1069         (get_field_at_byte_range): New.
1070         (region_model_manager::maybe_fold_bits_within_svalue): New.
1071         (region_model_manager::get_or_create_bits_within): New.
1072         (region_model_manager::get_sized_region): New.
1073         (region_model_manager::log_stats): Update for addition of
1074         m_repeated_values_map, m_bits_within_values_map, and
1075         m_sized_regions.
1076         * region-model.cc (region_model::validate): New.
1077         (region_model::on_assignment): Drop enum binding_kind.
1078         (region_model::get_initial_value_for_global): Likewise.
1079         (region_model::get_rvalue_for_bits): Replace body with call to
1080         get_or_create_bits_within.
1081         (region_model::get_capacity): Handle RK_SIZED.
1082         (region_model::set_value): Drop enum binding_kind.
1083         (region_model::fill_region): New.
1084         (region_model::get_representative_path_var_1): Handle RK_SIZED.
1085         * region-model.h (visitor::visit_repeated_svalue): New.
1086         (visitor::visit_bits_within_svalue): New.
1087         (region_model_manager::get_or_create_repeated_svalue): New decl.
1088         (region_model_manager::get_or_create_bits_within): New decl.
1089         (region_model_manager::get_sized_region): New decl.
1090         (region_model_manager::maybe_fold_repeated_svalue): New decl.
1091         (region_model_manager::maybe_fold_bits_within_svalue): New decl.
1092         (region_model_manager::repeated_values_map_t): New typedef.
1093         (region_model_manager::m_repeated_values_map): New field.
1094         (region_model_manager::bits_within_values_map_t): New typedef.
1095         (region_model_manager::m_bits_within_values_map): New field.
1096         (region_model_manager::m_sized_regions): New field.
1097         (region_model::fill_region): New decl.
1098         * region.cc (region::get_base_region): Handle RK_SIZED.
1099         (region::base_region_p): Likewise.
1100         (region::get_byte_size_sval): New.
1101         (get_field_at_bit_offset): Make non-static.
1102         (region::calc_offset): Move implementation of cases to
1103         get_relative_concrete_offset vfunc implementations.  Handle
1104         RK_SIZED.
1105         (region::get_relative_concrete_offset): New.
1106         (decl_region::get_svalue_for_initializer): Drop enum binding_kind.
1107         (field_region::get_relative_concrete_offset): New, from
1108         region::calc_offset.
1109         (element_region::get_relative_concrete_offset): Likewise.
1110         (offset_region::get_relative_concrete_offset): Likewise.
1111         (sized_region::accept): New.
1112         (sized_region::dump_to_pp): New.
1113         (sized_region::get_byte_size): New.
1114         (sized_region::get_bit_size): New.
1115         * region.h (enum region_kind): Add RK_SIZED.
1116         (region::dyn_cast_sized_region): New.
1117         (region::get_byte_size): Make virtual.
1118         (region::get_bit_size): Likewise.
1119         (region::get_byte_size_sval): New decl.
1120         (region::get_relative_concrete_offset): New decl.
1121         (field_region::get_relative_concrete_offset): New decl.
1122         (element_region::get_relative_concrete_offset): Likewise.
1123         (offset_region::get_relative_concrete_offset): Likewise.
1124         (class sized_region): New.
1125         * store.cc (binding_kind_to_string): Delete.
1126         (binding_key::make): Drop enum binding_kind.
1127         (binding_key::dump_to_pp): Delete.
1128         (binding_key::cmp_ptrs): Drop enum binding_kind.
1129         (bit_range::contains_p): New.
1130         (byte_range::dump): New.
1131         (byte_range::contains_p): New.
1132         (byte_range::cmp): New.
1133         (concrete_binding::dump_to_pp): Drop enum binding_kind.
1134         (concrete_binding::cmp_ptr_ptr): Likewise.
1135         (symbolic_binding::dump_to_pp): Likewise.
1136         (symbolic_binding::cmp_ptr_ptr): Likewise.
1137         (binding_map::apply_ctor_val_to_range): Likewise.
1138         (binding_map::apply_ctor_pair_to_child_region): Likewise.
1139         (binding_map::get_overlapping_bindings): New.
1140         (binding_map::remove_overlapping_bindings): New.
1141         (binding_cluster::validate): New.
1142         (binding_cluster::bind): Drop enum binding_kind.
1143         (binding_cluster::bind_compound_sval): Likewise.
1144         (binding_cluster::purge_region): Likewise.
1145         (binding_cluster::zero_fill_region): Reimplement in terms of...
1146         (binding_cluster::fill_region): New.
1147         (binding_cluster::mark_region_as_unknown): Drop enum binding_kind.
1148         (binding_cluster::get_binding): Likewise.
1149         (binding_cluster::get_binding_recursive): Likewise.
1150         (binding_cluster::get_any_binding): Likewise.
1151         (binding_cluster::maybe_get_compound_binding): Reimplement.
1152         (binding_cluster::get_overlapping_bindings): Delete.
1153         (binding_cluster::remove_overlapping_bindings): Reimplement in
1154         terms of binding_map::remove_overlapping_bindings.
1155         (binding_cluster::can_merge_p): Update for removal of
1156         enum binding_kind.
1157         (binding_cluster::on_unknown_fncall): Drop enum binding_kind.
1158         (binding_cluster::maybe_get_simple_value): Likewise.
1159         (store_manager::get_concrete_binding): Likewise.
1160         (store_manager::get_symbolic_binding): Likewise.
1161         (store::validate): New.
1162         (store::set_value): Drop enum binding_kind.
1163         (store::zero_fill_region): Reimplement in terms of...
1164         (store::fill_region): New.
1165         (selftest::test_binding_key_overlap): Drop enum binding_kind.
1166         * store.h (enum binding_kind): Delete.
1167         (binding_kind_to_string): Delete decl.
1168         (binding_key::make): Drop enum binding_kind.
1169         (binding_key::dump_to_pp): Make pure virtual.
1170         (binding_key::get_kind): Delete.
1171         (binding_key::mark_deleted): Delete.
1172         (binding_key::mark_empty): Delete.
1173         (binding_key::is_deleted): Delete.
1174         (binding_key::is_empty): Delete.
1175         (binding_key::binding_key): Delete.
1176         (binding_key::impl_hash): Delete.
1177         (binding_key::impl_eq): Delete.
1178         (binding_key::m_kind): Delete.
1179         (bit_range::get_last_bit_offset): New.
1180         (bit_range::contains_p): New.
1181         (byte_range::contains_p): New.
1182         (byte_range::operator==): New.
1183         (byte_range::get_start_byte_offset): New.
1184         (byte_range::get_next_byte_offset): New.
1185         (byte_range::get_last_byte_offset): New.
1186         (byte_range::as_bit_range): New.
1187         (byte_range::cmp): New.
1188         (concrete_binding::concrete_binding): Drop enum binding_kind.
1189         (concrete_binding::hash): Likewise.
1190         (concrete_binding::operator==): Likewise.
1191         (concrete_binding::mark_deleted): New.
1192         (concrete_binding::mark_empty): New.
1193         (concrete_binding::is_deleted): New.
1194         (concrete_binding::is_empty): New.
1195         (default_hash_traits<ana::concrete_binding>::empty_zero_p): Make false.
1196         (symbolic_binding::symbolic_binding): Drop enum binding_kind.
1197         (symbolic_binding::hash): Likewise.
1198         (symbolic_binding::operator==): Likewise.
1199         (symbolic_binding::mark_deleted): New.
1200         (symbolic_binding::mark_empty): New.
1201         (symbolic_binding::is_deleted): New.
1202         (symbolic_binding::is_empty): New.
1203         (binding_map::remove_overlapping_bindings): New decl.
1204         (binding_map::get_overlapping_bindings): New decl.
1205         (binding_cluster::validate): New decl.
1206         (binding_cluster::bind): Drop enum binding_kind.
1207         (binding_cluster::fill_region): New decl.
1208         (binding_cluster::get_binding): Drop enum binding_kind.
1209         (binding_cluster::get_binding_recursive): Likewise.
1210         (binding_cluster::get_overlapping_bindings): Delete.
1211         (store::validate): New decl.
1212         (store::set_value): Drop enum binding_kind.
1213         (store::fill_region): New decl.
1214         (store_manager::get_concrete_binding): Drop enum binding_kind.
1215         (store_manager::get_symbolic_binding): Likewise.
1216         * svalue.cc (svalue::cmp_ptr): Handle SK_REPEATED and
1217         SK_BITS_WITHIN.
1218         (svalue::extract_bit_range): New.
1219         (svalue::maybe_fold_bits_within): New.
1220         (constant_svalue::maybe_fold_bits_within): New.
1221         (unknown_svalue::maybe_fold_bits_within): New.
1222         (unaryop_svalue::maybe_fold_bits_within): New.
1223         (repeated_svalue::repeated_svalue): New.
1224         (repeated_svalue::dump_to_pp): New.
1225         (repeated_svalue::accept): New.
1226         (repeated_svalue::all_zeroes_p): New.
1227         (repeated_svalue::maybe_fold_bits_within): New.
1228         (bits_within_svalue::bits_within_svalue): New.
1229         (bits_within_svalue::dump_to_pp): New.
1230         (bits_within_svalue::maybe_fold_bits_within): New.
1231         (bits_within_svalue::accept): New.
1232         (bits_within_svalue::implicitly_live_p): New.
1233         (compound_svalue::maybe_fold_bits_within): New.
1234         * svalue.h (enum svalue_kind): Add SK_REPEATED and SK_BITS_WITHIN.
1235         (svalue::dyn_cast_repeated_svalue): New.
1236         (svalue::dyn_cast_bits_within_svalue): New.
1237         (svalue::extract_bit_range): New decl.
1238         (svalue::maybe_fold_bits_within): New vfunc decl.
1239         (region_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
1240         (region_svalue::key_t::is_empty): Likewise.
1241         (default_hash_traits<region_svalue::key_t>::empty_zero_p): Make false.
1242         (constant_svalue::maybe_fold_bits_within): New.
1243         (unknown_svalue::maybe_fold_bits_within): New.
1244         (poisoned_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
1245         (poisoned_svalue::key_t::is_empty): Likewise.
1246         (default_hash_traits<poisoned_svalue::key_t>::empty_zero_p): Make
1247         false.
1248         (setjmp_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
1249         (setjmp_svalue::key_t::is_empty): Likewise.
1250         (default_hash_traits<setjmp_svalue::key_t>::empty_zero_p): Make
1251         false.
1252         (unaryop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
1253         (unaryop_svalue::key_t::is_empty): Likewise.
1254         (unaryop_svalue::maybe_fold_bits_within): New.
1255         (default_hash_traits<unaryop_svalue::key_t>::empty_zero_p): Make
1256         false.
1257         (binop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
1258         (binop_svalue::key_t::is_empty): Likewise.
1259         (default_hash_traits<binop_svalue::key_t>::empty_zero_p): Make
1260         false.
1261         (sub_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
1262         (sub_svalue::key_t::is_empty): Likewise.
1263         (default_hash_traits<sub_svalue::key_t>::empty_zero_p): Make
1264         false.
1265         (class repeated_svalue): New.
1266         (is_a_helper <const repeated_svalue *>::test): New.
1267         (struct default_hash_traits<repeated_svalue::key_t>): New.
1268         (class bits_within_svalue): New.
1269         (is_a_helper <const bits_within_svalue *>::test): New.
1270         (struct default_hash_traits<bits_within_svalue::key_t>): New.
1271         (widening_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
1272         (widening_svalue::key_t::is_empty): Likewise.
1273         (default_hash_traits<widening_svalue::key_t>::empty_zero_p): Make
1274         false.
1275         (compound_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
1276         (compound_svalue::key_t::is_empty): Likewise.
1277         (compound_svalue::maybe_fold_bits_within): New.
1278         (default_hash_traits<compound_svalue::key_t>::empty_zero_p): Make
1279         false.
1280
1281 2021-06-28  David Malcolm  <dmalcolm@redhat.com>
1282
1283         * analyzer.h (byte_offset_t): New typedef.
1284         * store.cc (bit_range::dump_to_pp): Dump as a byte range if
1285         possible.
1286         (bit_range::as_byte_range): New.
1287         (byte_range::dump_to_pp): New.
1288         * store.h (class byte_range): New forward decl.
1289         (struct bit_range): Add comment.
1290         (bit_range::as_byte_range): New decl.
1291         (struct byte_range): New.
1292
1293 2021-06-22  David Malcolm  <dmalcolm@redhat.com>
1294
1295         PR analyzer/101143
1296         * region-model.cc (compat_types_p): New function.
1297         (region_model::create_region_for_heap_alloc): Convert assertion to
1298         an error check.
1299         (region_model::create_region_for_alloca): Likewise.
1300
1301 2021-06-18  David Malcolm  <dmalcolm@redhat.com>
1302
1303         * store.cc (binding_cluster::get_any_binding): Make symbolic reads
1304         from a cluster with concrete bindings return unknown.
1305
1306 2021-06-18  David Malcolm  <dmalcolm@redhat.com>
1307
1308         * region-model-manager.cc
1309         (region_model_manager::get_or_create_int_cst): New.
1310         (region_model_manager::maybe_undo_optimize_bit_field_compare): Use
1311         it to simplify away a local tree.
1312         * region-model.cc (region_model::on_setjmp): Likewise.
1313         (region_model::on_longjmp): Likewise.
1314         * region-model.h (region_model_manager::get_or_create_int_cst):
1315         New decl.
1316         * store.cc (binding_cluster::zero_fill_region): Use it to simplify
1317         away a local tree.
1318
1319 2021-06-18  David Malcolm  <dmalcolm@redhat.com>
1320
1321         * checker-path.cc (class custom_event): Make abstract to allow for
1322         custom vfuncs, splitting existing implementation into...
1323         (class precanned_custom_event): New subclass.
1324         (custom_event::get_desc): Move to...
1325         (precanned_custom_event::get_desc): ...subclass.
1326         * checker-path.h (class custom_event): Make abstract to allow for
1327         custom vfuncs, splitting existing implementation into...
1328         (class precanned_custom_event): New subclass.
1329         * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
1330         Use precanned_custom_event.
1331         * engine.cc
1332         (stale_jmp_buf::maybe_add_custom_events_for_superedge): Likewise.
1333         * sm-signal.cc (signal_delivery_edge_info_t::add_events_to_path):
1334         Likewise.
1335
1336 2021-06-15  David Malcolm  <dmalcolm@redhat.com>
1337
1338         PR analyzer/99212
1339         PR analyzer/101082
1340         * engine.cc: Include "target.h".
1341         (impl_run_checkers): Log BITS_BIG_ENDIAN, BYTES_BIG_ENDIAN, and
1342         WORDS_BIG_ENDIAN.
1343         * region-model-manager.cc
1344         (region_model_manager::maybe_fold_binop): Move support for masking
1345         via ARG0 & CST into...
1346         (region_model_manager::maybe_undo_optimize_bit_field_compare):
1347         ...this new function.  Flatten by converting from nested
1348         conditionals to a series of early return statements to reject
1349         failures.  Reject if type is not unsigned_char_type_node.
1350         Handle BYTES_BIG_ENDIAN when determining which bits are bound
1351         in the binding_map.
1352         * region-model.h
1353         (region_model_manager::maybe_undo_optimize_bit_field_compare):
1354         New decl.
1355         * store.cc (bit_range::dump): New function.
1356         * store.h (bit_range::dump): New decl.
1357
1358 2021-06-15  David Malcolm  <dmalcolm@redhat.com>
1359
1360         * engine.cc (exploded_node::on_stmt): Handle __analyzer_dump_capacity.
1361         (exploded_node::on_stmt): Drop m_sm_changes from on_stmt_flags.
1362         (state_change_requires_new_enode_p): New function...
1363         (exploded_graph::process_node): Call it, rather than querying
1364         flags.m_sm_changes, so that dynamic-extent differences can also
1365         trigger the splitting of nodes.
1366         * exploded-graph.h (struct on_stmt_flags): Drop field m_sm_changes.
1367         * program-state.cc (program_state::detect_leaks): Purge dead
1368         heap-allocated regions from dynamic extents.
1369         (selftest::test_program_state_1): Fix type of "size_in_bytes".
1370         (selftest::test_program_state_merging): Likewise.
1371         * region-model-impl-calls.cc
1372         (region_model::impl_call_analyzer_dump_capacity): New.
1373         (region_model::impl_call_free): Remove dynamic extents from the
1374         freed region.
1375         * region-model-reachability.h
1376         (reachable_regions::begin_mutable_base_regs): New.
1377         (reachable_regions::end_mutable_base_regs): New.
1378         * region-model.cc: Include "tree-object-size.h".
1379         (region_model::region_model): Support new field m_dynamic_extents.
1380         (region_model::operator=): Likewise.
1381         (region_model::operator==): Likewise.
1382         (region_model::dump_to_pp): Dump sizes of dynamic regions.
1383         (region_model::handle_unrecognized_call): Purge dynamic extents
1384         from any regions that have escaped mutably:.
1385         (region_model::get_capacity): New function.
1386         (region_model::add_constraint): Unset dynamic extents when a
1387         heap-allocated region's address is NULL.
1388         (region_model::unbind_region_and_descendents): Purge dynamic
1389         extents of unbound regions.
1390         (region_model::can_merge_with_p): Call
1391         m_dynamic_extents.can_merge_with_p.
1392         (region_model::create_region_for_heap_alloc): Assert that
1393         size_in_bytes's type is compatible with size_type_node.  Update
1394         for renaming of record_dynamic_extents to set_dynamic_extents.
1395         (region_model::create_region_for_alloca): Likewise.
1396         (region_model::record_dynamic_extents): Rename to...
1397         (region_model::set_dynamic_extents): ...this.  Assert that
1398         size_in_bytes's type is compatible with size_type_node.  Add it
1399         to the m_dynamic_extents map.
1400         (region_model::get_dynamic_extents): New.
1401         (region_model::unset_dynamic_extents): New.
1402         (selftest::test_state_merging): Fix type of "size".
1403         (selftest::test_malloc_constraints): Likewise.
1404         (selftest::test_malloc): Verify dynamic extents.
1405         (selftest::test_alloca): Likewise.
1406         * region-model.h (region_to_value_map::is_empty): New.
1407         (region_model::dynamic_extents_t): New typedef.
1408         (region_model::impl_call_analyzer_dump_capacity): New decl.
1409         (region_model::get_dynamic_extents): New function.
1410         (region_model::get_dynamic_extents): New decl.
1411         (region_model::set_dynamic_extents): New decl.
1412         (region_model::unset_dynamic_extents): New decl.
1413         (region_model::get_capacity): New decl.
1414         (region_model::record_dynamic_extents): Rename to set_dynamic_extents.
1415         (region_model::m_dynamic_extents): New field.
1416
1417 2021-06-15  David Malcolm  <dmalcolm@redhat.com>
1418
1419         * region-model.cc (region_to_value_map::operator=): New.
1420         (region_to_value_map::operator==): New.
1421         (region_to_value_map::dump_to_pp): New.
1422         (region_to_value_map::dump): New.
1423         (region_to_value_map::can_merge_with_p): New.
1424         * region-model.h (class region_to_value_map): New class.
1425
1426 2021-06-13  Trevor Saunders  <tbsaunde@tbsaunde.org>
1427
1428         * call-string.cc (call_string::call_string): Use range based for
1429         to iterate over vec<>.
1430         (call_string::to_json): Likewise.
1431         (call_string::hash): Likewise.
1432         (call_string::calc_recursion_depth): Likewise.
1433         * checker-path.cc (checker_path::fixup_locations): Likewise.
1434         * constraint-manager.cc (equiv_class::equiv_class): Likewise.
1435         (equiv_class::to_json): Likewise.
1436         (equiv_class::hash): Likewise.
1437         (constraint_manager::to_json): Likewise.
1438         * engine.cc (impl_region_model_context::on_svalue_leak):
1439         Likewise.
1440         (on_liveness_change): Likewise.
1441         (impl_region_model_context::on_unknown_change): Likewise.
1442         * program-state.cc (sm_state_map::set_state): Likewise.
1443         * region-model.cc (test_canonicalization_4): Likewise.
1444
1445 2021-06-11  David Malcolm  <dmalcolm@redhat.com>
1446
1447         * engine.cc (worklist::key_t::cmp): Move sort by call_string to
1448         before SCC.
1449
1450 2021-06-09  David Malcolm  <dmalcolm@redhat.com>
1451
1452         * region-model.cc (region_model::get_lvalue_1): Make const.
1453         (region_model::get_lvalue): Likewise.
1454         (region_model::get_rvalue_1): Likewise.
1455         (region_model::get_rvalue): Likewise.
1456         (region_model::deref_rvalue): Likewise.
1457         (region_model::get_rvalue_for_bits): Likewise.
1458         * region-model.h (region_model::get_lvalue): Likewise.
1459         (region_model::get_rvalue): Likewise.
1460         (region_model::deref_rvalue): Likewise.
1461         (region_model::get_rvalue_for_bits): Likewise.
1462         (region_model::get_lvalue_1): Likewise.
1463         (region_model::get_rvalue_1): Likewise.
1464
1465 2021-06-08  David Malcolm  <dmalcolm@redhat.com>
1466
1467         PR analyzer/99212
1468         * region-model-manager.cc
1469         (region_model_manager::maybe_fold_binop): Add support for folding
1470         BIT_AND_EXPR of compound_svalue and a mask constant.
1471         * region-model.cc (region_model::get_rvalue_1): Implement
1472         BIT_FIELD_REF in terms of...
1473         (region_model::get_rvalue_for_bits): New function.
1474         * region-model.h (region_model::get_rvalue_for_bits): New decl.
1475         * store.cc (bit_range::from_mask): New function.
1476         (selftest::test_bit_range_intersects_p): New selftest.
1477         (selftest::assert_bit_range_from_mask_eq): New.
1478         (ASSERT_BIT_RANGE_FROM_MASK_EQ): New macro.
1479         (selftest::assert_no_bit_range_from_mask_eq): New.
1480         (ASSERT_NO_BIT_RANGE_FROM_MASK): New macro.
1481         (selftest::test_bit_range_from_mask): New selftest.
1482         (selftest::analyzer_store_cc_tests): Call the new selftests.
1483         * store.h (bit_range::intersects_p): New.
1484         (bit_range::from_mask): New decl.
1485         (concrete_binding::get_bit_range): New accessor.
1486         (store_manager::get_concrete_binding): New overload taking
1487         const bit_range &.
1488
1489 2021-06-08  David Malcolm  <dmalcolm@redhat.com>
1490
1491         * analyzer.h (int_size_in_bits): New decl.
1492         * region.cc (int_size_in_bits): New function.
1493         (region::get_bit_size): Reimplement in terms of the above.
1494
1495 2021-06-08  David Malcolm  <dmalcolm@redhat.com>
1496
1497         * store.cc (concrete_binding::dump_to_pp): Move bulk of
1498         implementation to...
1499         (bit_range::dump_to_pp): ...this new function.
1500         (bit_range::cmp): New.
1501         (concrete_binding::overlaps_p): Update for use of bit_range.
1502         (concrete_binding::cmp_ptr_ptr): Likewise.
1503         * store.h (struct bit_range): New.
1504         (class concrete_binding): Replace fields m_start_bit_offset and
1505         m_size_in_bits with new field m_bit_range.
1506
1507 2021-06-08  David Malcolm  <dmalcolm@redhat.com>
1508
1509         * svalue.h (conjured_svalue::iterator_t): Delete.
1510
1511 2021-06-03  David Malcolm  <dmalcolm@redhat.com>
1512
1513         * store.h (store::get_direct_binding): Remove unused decl.
1514         (store::get_default_binding): Likewise.
1515
1516 2021-06-03  David Malcolm  <dmalcolm@redhat.com>
1517
1518         * svalue.cc (poisoned_svalue::dump_to_pp): Dump type.
1519         (compound_svalue::dump_to_pp): Dump any type.
1520
1521 2021-05-18  David Malcolm  <dmalcolm@redhat.com>
1522
1523         PR analyzer/100615
1524         * sm-malloc.cc: Include "analyzer/function-set.h".
1525         (malloc_state_machine::on_stmt): Call unaffected_by_call_p and
1526         bail on the functions it recognizes.
1527         (malloc_state_machine::unaffected_by_call_p): New.
1528
1529 2021-05-10  Martin Liska  <mliska@suse.cz>
1530
1531         * sm-file.cc (is_file_using_fn_p): Use startswith
1532         function instead of strncmp.
1533
1534 2021-05-10  Martin Liska  <mliska@suse.cz>
1535
1536         * program-state.cc (program_state::operator=): Remove
1537         __cplusplus >= 201103.
1538         (program_state::program_state): Likewise.
1539         * program-state.h: Likewise.
1540         * region-model.h (class region_model): Remove dead code.
1541
1542 2021-04-24  David Malcolm  <dmalcolm@redhat.com>
1543
1544         PR analyzer/100244
1545         * sm-malloc.cc (free_of_non_heap::describe_state_change):
1546         Bulletproof against change.m_expr being NULL.
1547
1548 2021-04-13  David Malcolm  <dmalcolm@redhat.com>
1549
1550         PR analyzer/98599
1551         * supergraph.cc (saved_uids::make_uid_unique): New.
1552         (saved_uids::restore_uids): New.
1553         (supergraph::supergraph): Replace assignments to stmt->uid with
1554         calls to m_stmt_uids.make_uid_unique.
1555         (supergraph::~supergraph): New.
1556         * supergraph.h (class saved_uids): New.
1557         (supergraph::~supergraph): New decl.
1558         (supergraph::m_stmt_uids): New field.
1559
1560 2021-04-10  David Malcolm  <dmalcolm@redhat.com>
1561
1562         PR analyzer/100011
1563         * region-model.cc (region_model::on_assignment): Avoid NULL
1564         dereference if ctxt is NULL when assigning from a STRING_CST.
1565
1566 2021-04-08  David Malcolm  <dmalcolm@redhat.com>
1567
1568         PR analyzer/99042
1569         PR analyzer/99774
1570         * engine.cc
1571         (impl_region_model_context::impl_region_model_context): Add
1572         uncertainty param and use it to initialize m_uncertainty.
1573         (impl_region_model_context::get_uncertainty): New.
1574         (impl_sm_context::get_fndecl_for_call): Add NULL for new
1575         uncertainty param when constructing impl_region_model_context.
1576         (impl_sm_context::get_state): Likewise.
1577         (impl_sm_context::set_next_state): Likewise.
1578         (impl_sm_context::warn): Likewise.
1579         (exploded_node::on_stmt): Add uncertainty param
1580         and use it when constructing impl_region_model_context.
1581         (exploded_node::on_edge): Add uncertainty param and pass
1582         to on_edge call.
1583         (exploded_node::detect_leaks): Create uncertainty_t and pass to
1584         impl_region_model_context.
1585         (exploded_graph::get_or_create_node): Create uncertainty_t and
1586         pass to prune_for_point.
1587         (maybe_process_run_of_before_supernode_enodes): Create
1588         uncertainty_t and pass to impl_region_model_context.
1589         (exploded_graph::process_node): Create uncertainty_t instances and
1590         pass around as needed.
1591         * exploded-graph.h
1592         (impl_region_model_context::impl_region_model_context): Add
1593         uncertainty param.
1594         (impl_region_model_context::get_uncertainty): New decl.
1595         (impl_region_model_context::m_uncertainty): New field.
1596         (exploded_node::on_stmt): Add uncertainty param.
1597         (exploded_node::on_edge): Likewise.
1598         * program-state.cc (sm_state_map::on_liveness_change): Get
1599         uncertainty from context and use it to unset sm-state from
1600         svalues as appropriate.
1601         (program_state::on_edge): Add uncertainty param and use it when
1602         constructing impl_region_model_context.  Fix indentation.
1603         (program_state::prune_for_point): Add uncertainty param and use it
1604         when constructing impl_region_model_context.
1605         (program_state::detect_leaks): Get any uncertainty from ctxt and
1606         use it to get maybe-live svalues for dest_state, rather than
1607         definitely-live ones; use this when determining which svalues
1608         have leaked.
1609         (selftest::test_program_state_merging): Create uncertainty_t and
1610         pass to impl_region_model_context.
1611         * program-state.h (program_state::on_edge): Add uncertainty param.
1612         (program_state::prune_for_point): Likewise.
1613         * region-model-impl-calls.cc (call_details::get_uncertainty): New.
1614         (region_model::impl_call_memcpy): Pass uncertainty to
1615         mark_region_as_unknown call.
1616         (region_model::impl_call_memset): Likewise.
1617         (region_model::impl_call_strcpy): Likewise.
1618         * region-model-reachability.cc (reachable_regions::handle_sval):
1619         Also add sval to m_mutable_svals.
1620         * region-model.cc (region_model::on_assignment): Pass any
1621         uncertainty from ctxt to the store::set_value call.
1622         (region_model::handle_unrecognized_call): Get any uncertainty from
1623         ctxt and use it to record mutable svalues at the unknown call.
1624         (region_model::get_reachable_svalues): Add uncertainty param and
1625         use it to mark any maybe-bound svalues as being reachable.
1626         (region_model::set_value): Pass any uncertainty from ctxt to the
1627         store::set_value call.
1628         (region_model::mark_region_as_unknown): Add uncertainty param and
1629         pass it on to the store::mark_region_as_unknown call.
1630         (region_model::update_for_call_summary): Add uncertainty param and
1631         pass it on to the region_model::mark_region_as_unknown call.
1632         * region-model.h (call_details::get_uncertainty): New decl.
1633         (region_model::get_reachable_svalues): Add uncertainty param.
1634         (region_model::mark_region_as_unknown): Add uncertainty param.
1635         (region_model_context::get_uncertainty): New vfunc.
1636         (noop_region_model_context::get_uncertainty): New vfunc
1637         implementation.
1638         * store.cc (dump_svalue_set): New.
1639         (uncertainty_t::dump_to_pp): New.
1640         (uncertainty_t::dump): New.
1641         (binding_cluster::clobber_region): Pass NULL for uncertainty to
1642         remove_overlapping_bindings.
1643         (binding_cluster::mark_region_as_unknown): Add uncertainty param
1644         and pass it to remove_overlapping_bindings.
1645         (binding_cluster::remove_overlapping_bindings): Add uncertainty param.
1646         Use it to record any svalues that were in clobbered bindings.
1647         (store::set_value): Add uncertainty param.  Pass it to
1648         binding_cluster::mark_region_as_unknown when handling symbolic
1649         regions.
1650         (store::mark_region_as_unknown): Add uncertainty param and pass it
1651         to binding_cluster::mark_region_as_unknown.
1652         (store::remove_overlapping_bindings): Add uncertainty param and
1653         pass it to binding_cluster::remove_overlapping_bindings.
1654         * store.h (binding_cluster::mark_region_as_unknown): Add
1655         uncertainty param.
1656         (binding_cluster::remove_overlapping_bindings): Likewise.
1657         (store::set_value): Likewise.
1658         (store::mark_region_as_unknown): Likewise.
1659
1660 2021-04-05  David Malcolm  <dmalcolm@redhat.com>
1661
1662         PR analyzer/99906
1663         * analyzer.cc (maybe_reconstruct_from_def_stmt): Fix NULL
1664         dereference on calls with zero arguments.
1665         * sm-malloc.cc (malloc_state_machine::on_stmt): When handling
1666         __attribute__((nonnull)), only call get_diagnostic_tree if the
1667         result will be used.
1668
1669 2021-04-05  David Malcolm  <dmalcolm@redhat.com>
1670
1671         PR analyzer/99886
1672         * diagnostic-manager.cc
1673         (diagnostic_manager::prune_interproc_events): Use signed integers
1674         when subtracting one from path->num_events ().
1675         (diagnostic_manager::consolidate_conditions): Likewise.  Convert
1676         next_idx to a signed int.
1677
1678 2021-04-01  David Malcolm  <dmalcolm@redhat.com>
1679
1680         * diagnostic-manager.cc (diagnostic_manager::add_diagnostic): Make
1681         enode param non-constant, and call add_diagnostic on it.  Add
1682         enode index to log message.
1683         (diagnostic_manager::add_diagnostic): Make enode param
1684         non-constant.
1685         * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
1686         Likewise for both decls.
1687         * engine.cc
1688         (impl_region_model_context::impl_region_model_context): Likewise
1689         for enode_for_diag.
1690         (impl_sm_context::impl_sm_context): Likewise.
1691         (impl_sm_context::m_enode_for_diag): Likewise.
1692         (exploded_node::dump_dot): Don't pass the diagnostic manager
1693         to dump_saved_diagnostics.
1694         (exploded_node::dump_saved_diagnostics): Drop param.  Iterate
1695         directly through all saved diagnostics for the enode, rather
1696         than all saved diagnostics in the diagnostic_manager and
1697         filtering.
1698         (exploded_node::on_stmt): Make non-const.
1699         (exploded_node::on_edge): Likewise.
1700         (exploded_node::on_longjmp): Likewise.
1701         (exploded_node::detect_leaks): Likewise.
1702         (exploded_graph::get_or_create_node): Make enode_for_diag param
1703         non-const.
1704         (exploded_graph_annotator::print_enode): Iterate
1705         directly through all saved diagnostics for the enode, rather
1706         than all saved diagnostics in the diagnostic_manager and
1707         filtering.
1708         * exploded-graph.h
1709         (impl_region_model_context::impl_region_model_context): Make
1710         enode_for_diag param non-constant.
1711         (impl_region_model_context::m_enode_for_diag): Likewise.
1712         (exploded_node::dump_saved_diagnostics): Drop param.
1713         (exploded_node::on_stmt): Make non-const.
1714         (exploded_node::on_edge): Likewise.
1715         (exploded_node::on_longjmp): Likewise.
1716         (exploded_node::detect_leaks): Likewise.
1717         (exploded_node::add_diagnostic): New.
1718         (exploded_node::get_num_diagnostics): New.
1719         (exploded_node::get_saved_diagnostic): New.
1720         (exploded_node::m_saved_diagnostics): New.
1721         (exploded_graph::get_or_create_node): Make enode_for_diag param
1722         non-constant.
1723         * feasible-graph.cc (feasible_node::dump_dot): Drop
1724         diagnostic_manager from call to dump_saved_diagnostics.
1725         * program-state.cc (program_state::on_edge): Convert enode param
1726         to non-const pointer.
1727         (program_state::prune_for_point): Likewise for enode_for_diag
1728         param.
1729         * program-state.h (program_state::on_edge): Convert enode param
1730         to non-const pointer.
1731         (program_state::prune_for_point): Likewise for enode_for_diag
1732         param.
1733
1734 2021-03-31  David Malcolm  <dmalcolm@redhat.com>
1735
1736         PR analyzer/99771
1737         * analyzer.cc (maybe_reconstruct_from_def_stmt): New.
1738         (fixup_tree_for_diagnostic_1): New.
1739         (fixup_tree_for_diagnostic): New.
1740         * analyzer.h (fixup_tree_for_diagnostic): New decl.
1741         * checker-path.cc (call_event::get_desc): Call
1742         fixup_tree_for_diagnostic and use it for the call_with_state call.
1743         (warning_event::get_desc): Likewise for the final_event and
1744         make_label_text calls.
1745         * engine.cc (impl_region_model_context::on_state_leak): Likewise
1746         for the on_leak and add_diagnostic calls.
1747         * region-model.cc (region_model::get_representative_tree):
1748         Likewise for the result.
1749
1750 2021-03-30  David Malcolm  <dmalcolm@redhat.com>
1751
1752         * region.h (region::dump_to_pp): Remove old decl.
1753
1754 2021-03-30  David Malcolm  <dmalcolm@redhat.com>
1755
1756         * sm-file.cc (fileptr_state_machine::on_stmt): Only call
1757         get_diagnostic_tree if the result will be used.
1758         * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
1759         (malloc_state_machine::on_deallocator_call): Likewise.
1760         (malloc_state_machine::on_realloc_call): Likewise.
1761         (malloc_state_machine::on_realloc_call): Likewise.
1762         * sm-sensitive.cc
1763         (sensitive_state_machine::warn_for_any_exposure): Likewise.
1764         * sm-taint.cc (taint_state_machine::on_stmt): Likewise.
1765
1766 2021-03-25  David Malcolm  <dmalcolm@redhat.com>
1767
1768         PR analyzer/93695
1769         PR analyzer/99044
1770         PR analyzer/99716
1771         * engine.cc (exploded_node::on_stmt): Clear sm-state involving
1772         an SSA name at the def-stmt of that SSA name.
1773         * program-state.cc (sm_state_map::purge_state_involving): New.
1774         * program-state.h (sm_state_map::purge_state_involving): New decl.
1775         * region-model.cc (selftest::test_involves_p): New.
1776         (selftest::analyzer_region_model_cc_tests): Call it.
1777         * svalue.cc (class involvement_visitor): New class
1778         (svalue::involves_p): New.
1779         * svalue.h (svalue::involves_p): New decl.
1780
1781 2021-03-19  David Malcolm  <dmalcolm@redhat.com>
1782
1783         PR analyzer/99614
1784         * diagnostic-manager.cc (class epath_finder): Add
1785         DISABLE_COPY_AND_ASSIGN.
1786
1787 2021-03-15  Martin Liska  <mliska@suse.cz>
1788
1789         * sm-file.cc (get_file_using_fns): Add missing comma in initializer.
1790
1791 2021-03-11  David Malcolm  <dmalcolm@redhat.com>
1792
1793         PR analyzer/96374
1794         * analyzer.opt (-param=analyzer-max-infeasible-edges=): New param.
1795         (fdump-analyzer-feasibility): New flag.
1796         * diagnostic-manager.cc: Include "analyzer/trimmed-graph.h" and
1797         "analyzer/feasible-graph.h".
1798         (epath_finder::epath_finder): Convert m_sep to a pointer and
1799         only create it if !flag_analyzer_feasibility.
1800         (epath_finder::~epath_finder): New.
1801         (epath_finder::m_sep): Convert to a pointer.
1802         (epath_finder::get_best_epath): Add param "diag_idx" and use it
1803         when logging.  Rather than finding the shortest path and then
1804         checking feasibility, instead use explore_feasible_paths unless
1805         !flag_analyzer_feasibility, in which case simply use the shortest
1806         path, and note if it is infeasible.  Update for m_sep becoming a
1807         pointer.
1808         (class feasible_worklist): New.
1809         (epath_finder::explore_feasible_paths): New.
1810         (epath_finder::process_worklist_item): New.
1811         (class dump_eg_with_shortest_path): New.
1812         (epath_finder::dump_trimmed_graph): New.
1813         (epath_finder::dump_feasible_graph): New.
1814         (saved_diagnostic::saved_diagnostic): Add "idx" param, using it
1815         on new field m_idx.
1816         (saved_diagnostic::to_json): Dump m_idx.
1817         (saved_diagnostic::calc_best_epath): Pass m_idx to get_best_epath.
1818         Remove assertion that m_problem was set when m_best_epath is NULL.
1819         (diagnostic_manager::add_diagnostic): Pass an index when created
1820         saved_diagnostic instances.
1821         * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add
1822         "idx" param.
1823         (saved_diagnostic::get_index): New accessor.
1824         (saved_diagnostic::m_idx): New field.
1825         * engine.cc (exploded_node::dump_dot): Call args.dump_extra_info.
1826         Move code to...
1827         (exploded_node::dump_processed_stmts): ...this new function and...
1828         (exploded_node::dump_saved_diagnostics): ...this new function.
1829         Add index of each diagnostic.
1830         (exploded_edge::dump_dot):  Move bulk of code to...
1831         (exploded_edge::dump_dot_label): ...this new function.
1832         * exploded-graph.h (eg_traits::dump_args_t::dump_extra_info): New
1833         vfunc.
1834         (exploded_node::dump_processed_stmts): New decl.
1835         (exploded_node::dump_saved_diagnostics): New decl.
1836         (exploded_edge::dump_dot_label): New decl.
1837         * feasible-graph.cc: New file.
1838         * feasible-graph.h: New file.
1839         * trimmed-graph.cc: New file.
1840         * trimmed-graph.h: New file.
1841
1842 2021-03-11  David Malcolm  <dmalcolm@redhat.com>
1843
1844         * diagnostic-manager.cc (epath_finder::epath_finder):
1845         Update shortest_paths init for new param.
1846
1847 2021-03-10  David Malcolm  <dmalcolm@redhat.com>
1848
1849         PR analyzer/96374
1850         * engine.cc (exploded_path::feasible_p): Move "snodes_visited" and
1851         "model" locals into a new class feasibility_state.  Move heart
1852         of per-edge processing into
1853         feasibility_state::maybe_update_for_edge.
1854         (feasibility_state::feasibility_state): New.
1855         (feasibility_state::maybe_update_for_edge): New, based on loop
1856         body in exploded_path::feasible_p.
1857         * exploded-graph.h (class feasibility_state): New.
1858
1859 2021-03-10  David Malcolm  <dmalcolm@redhat.com>
1860
1861         * supergraph.h
1862         (callgraph_superedge::dyn_cast_callgraph_superedge): New.
1863         (call_superedge::dyn_cast_callgraph_superedge): Delete.
1864         (return_superedge::dyn_cast_callgraph_superedge): Delete.
1865
1866 2021-03-02  Martin Liska  <mliska@suse.cz>
1867
1868         * diagnostic-manager.cc (diagnostic_manager::emit_saved_diagnostics):
1869         Do not pass engine.
1870
1871 2021-02-26  David Malcolm  <dmalcolm@redhat.com>
1872
1873         * engine.cc (exploded_path::exploded_path): New copy-ctor.
1874         * exploded-graph.h (exploded_path::operator=): Drop decl.
1875
1876 2021-02-26  David Malcolm  <dmalcolm@redhat.com>
1877
1878         PR analyzer/96374
1879         * diagnostic-manager.cc (class epath_finder): New.
1880         (epath_finder::get_best_epath): New.
1881         (saved_diagnostic::saved_diagnostic): Update for replacement of
1882         m_state and m_epath_length with m_best_epath.
1883         (saved_diagnostic::~saved_diagnostic): Delete m_best_epath.
1884         (saved_diagnostic::to_json): Update "path_length" to be optional.
1885         (saved_diagnostic::calc_best_epath): New, based on
1886         dedupe_winners::add and parts of dedupe_key::dedupe_key.
1887         (saved_diagnostic::get_epath_length): New.
1888         (saved_diagnostic::add_duplicate): New.
1889         (dedupe_key::dedupe_key): Drop epath param.  Move invocation of
1890         stmt_finder to saved_diagnostic::calc_best_epath.
1891         (class dedupe_candidate): Delete.
1892         (class dedupe_hash_map_traits): Update to use saved_diagnotic *
1893         rather than dedupe_candidate * as the value_type/compare_type.
1894         (dedupe_winners::~dedupe_winners): Don't delete the values.
1895         (dedupe_winners::add): Convert param from shortest_exploded_paths to
1896         epath_finder.  Drop "eg" param.  Drop dedupe_candidate, moving
1897         path generation and feasiblity checking to
1898         epath_finder::get_best_epath.  Update winner-selection for move
1899         of epaths from dedupe_candidate to saved_diagnostic.
1900         (dedupe_winners::emit_best):  Update for removal of class
1901         dedupe_candidate.
1902         (dedupe_winners::map_t): Update to use saved_diagnotic * rather
1903         than dedupe_candidate * as the value_type/compare_type.
1904         (diagnostic_manager::emit_saved_diagnostics): Move
1905         shortest_exploded_paths instance into epath_finder and pass that
1906         around instead.
1907         (diagnostic_manager::emit_saved_diagnostic): Drop epath, stmt
1908         and num_dupes params, instead getting these from the
1909         saved_diagnostic.  Use correct location in inform_n call.
1910         * diagnostic-manager.h (class epath_finder): New forward decl.
1911         (saved_diagnostic::status): Drop enum.
1912         (saved_diagnostic::set_feasible): Drop.
1913         (saved_diagnostic::set_infeasible): Drop.
1914         (saved_diagnostic::get_status): Drop.
1915         (saved_diagnostic::calc_best_epath): New decl.
1916         (saved_diagnostic::get_best_epath): New decl.
1917         (saved_diagnostic::get_epath_length): New decl.
1918         (saved_diagnostic::set_epath_length): Drop.
1919         (saved_diagnostic::get_epath_length): Drop inline implementation.
1920         (saved_diagnostic::add_duplicate): New.
1921         (saved_diagnostic::get_num_dupes): New.
1922         (saved_diagnostic::m_d): Document ownership.
1923         (saved_diagnostic::m_trailing_eedge): Make const.
1924         (saved_diagnostic::m_status): Drop field.
1925         (saved_diagnostic::m_epath_length): Drop field.
1926         (saved_diagnostic::m_best_epath): New field.
1927         (saved_diagnostic::m_problem): Document ownership.
1928         (saved_diagnostic::m_duplicates): New field.
1929         (diagnostic_manager::emit_saved_diagnostic): Drop params epath,
1930         stmt, and num_dupes.
1931         * engine.cc (exploded_graph_annotator::print_saved_diagnostic):
1932         Update for changes to saved_diagnostic class.
1933         * exploded-graph.h (exploded_path::feasible_p): Drop unused
1934         overloaded decl.
1935
1936 2021-02-25  David Malcolm  <dmalcolm@redhat.com>
1937
1938         PR analyzer/99193
1939         * region-model-impl-calls.cc (region_model::impl_call_realloc): New.
1940         * region-model.cc (region_model::on_call_pre): Call it.
1941         * region-model.h (region_model::impl_call_realloc): New decl.
1942         * sm-malloc.cc (enum wording): Add WORDING_REALLOCATED.
1943         (malloc_state_machine::m_realloc): New field.
1944         (use_after_free::describe_state_change): Add case for
1945         WORDING_REALLOCATED.
1946         (use_after_free::describe_final_event): Likewise.
1947         (malloc_state_machine::malloc_state_machine): Initialize
1948         m_realloc.
1949         (malloc_state_machine::on_stmt): Handle realloc by calling...
1950         (malloc_state_machine::on_realloc_call): New.
1951
1952 2021-02-22  David Malcolm  <dmalcolm@redhat.com>
1953
1954         PR analyzer/99196
1955         * engine.cc (exploded_node::on_stmt): Provide terminate_path
1956         flag as a way for on_call_pre to terminate the current analysis
1957         path.
1958         * region-model-impl-calls.cc (call_details::num_args): New.
1959         (region_model::impl_call_error): New.
1960         * region-model.cc (region_model::on_call_pre): Add param
1961         "out_terminate_path".  Handle "error" and "error_at_line".
1962         * region-model.h (call_details::num_args): New decl.
1963         (region_model::on_call_pre): Add param "out_terminate_path".
1964         (region_model::impl_call_error): New decl.
1965
1966 2021-02-17  David Malcolm  <dmalcolm@redhat.com>
1967
1968         PR analyzer/98969
1969         * constraint-manager.cc (dead_svalue_purger::should_purge_p):
1970         Update for change to svalue::live_p.
1971         * program-state.cc (sm_state_map::on_liveness_change): Likewise.
1972         (program_state::detect_leaks): Likewise.
1973         * region-model-reachability.cc (reachable_regions::init_cluster):
1974         When dealing with a symbolic region, if the underlying pointer is
1975         implicitly live, add the region to the reachable regions.
1976         * region-model.cc (region_model::compare_initial_and_pointer):
1977         Move logic for detecting initial values of params to
1978         initial_svalue::initial_value_of_param_p.
1979         * svalue.cc (svalue::live_p): Convert "live_svalues" from a
1980         reference to a pointer; support it being NULL.
1981         (svalue::implicitly_live_p): Convert first param from a
1982         refererence to a pointer.
1983         (region_svalue::implicitly_live_p): Likewise.
1984         (constant_svalue::implicitly_live_p): Likewise.
1985         (initial_svalue::implicitly_live_p): Likewise.  Treat the initial
1986         values of params for the top level frame as still live.
1987         (initial_svalue::initial_value_of_param_p): New function, taken
1988         from a test in region_model::compare_initial_and_pointer.
1989         (unaryop_svalue::implicitly_live_p): Convert first param from a
1990         refererence to a pointer.
1991         (binop_svalue::implicitly_live_p): Likewise.
1992         (sub_svalue::implicitly_live_p): Likewise.
1993         (unmergeable_svalue::implicitly_live_p): Likewise.
1994         * svalue.h (svalue::live_p): Likewise.
1995         (svalue::implicitly_live_p): Likewise.
1996         (region_svalue::implicitly_live_p): Likewise.
1997         (constant_svalue::implicitly_live_p): Likewise.
1998         (initial_svalue::implicitly_live_p): Likewise.
1999         (initial_svalue::initial_value_of_param_p): New decl.
2000         (unaryop_svalue::implicitly_live_p): Convert first param from a
2001         refererence to a pointer.
2002         (binop_svalue::implicitly_live_p): Likewise.
2003         (sub_svalue::implicitly_live_p): Likewise.
2004         (unmergeable_svalue::implicitly_live_p): Likewise.
2005
2006 2021-02-12  David Malcolm  <dmalcolm@redhat.com>
2007
2008         PR analyzer/98969
2009         * engine.cc (readability): Add names for the various arbitrary
2010         values.  Handle NOP_EXPR and INTEGER_CST.
2011         (readability_comparator): Combine the readability tests for
2012         tree and stack depth, rather than performing them sequentially.
2013         (impl_region_model_context::on_state_leak): Strip off top-level
2014         casts.
2015         * region-model.cc (region_model::get_representative_path_var): Add
2016         type-checking, moving the bulk of the implementation to...
2017         (region_model::get_representative_path_var_1): ...here.  Respect
2018         types in casts by recursing and re-adding the cast, rather than
2019         merely stripping them off.  Use the correct type when handling
2020         region_svalue.
2021         (region_model::get_representative_tree): Strip off any top-level
2022         cast.
2023         (region_model::get_representative_path_var): Add type-checking,
2024         moving the bulk of the implementation to...
2025         (region_model::get_representative_path_var_1): ...here.
2026         * region-model.h (region_model::get_representative_path_var_1):
2027         New decl
2028         (region_model::get_representative_path_var_1): New decl.
2029         * store.cc (append_pathvar_with_type): New.
2030         (binding_cluster::get_representative_path_vars): Cast path_vars
2031         to the correct type when adding them to *OUT_PVS.
2032
2033 2021-02-09  David Malcolm  <dmalcolm@redhat.com>
2034
2035         PR analyzer/98575
2036         * sm-file.cc (is_file_using_fn_p): Support "_IO_"-prefixed
2037         variants.
2038
2039 2021-02-09  David Malcolm  <dmalcolm@redhat.com>
2040
2041         PR analyzer/98575
2042         * store.cc (store::set_value): Treat a pointer written to *UNKNOWN
2043         as having escaped.
2044
2045 2021-02-02  David Malcolm  <dmalcolm@redhat.com>
2046
2047         PR analyzer/93355
2048         PR analyzer/96374
2049         * engine.cc (toplevel_function_p): Simplify so that
2050         we only reject functions with a "__analyzer_" prefix.
2051         (add_any_callbacks): Delete.
2052         (exploded_graph::build_initial_worklist): Update for
2053         dropped param of toplevel_function_p.
2054         (exploded_graph::build_initial_worklist): Don't bother
2055         looking for callbacks that are reachable from global
2056         initializers.
2057
2058 2021-02-01  David Malcolm  <dmalcolm@redhat.com>
2059
2060         PR analyzer/98918
2061         * region-model-manager.cc
2062         (region_model_manager::get_or_create_initial_value):
2063         Fold the initial value of *UNKNOWN_PTR to an UNKNOWN value.
2064         (region_model_manager::get_field_region): Fold the value
2065         of UNKNOWN_PTR->FIELD to *UNKNOWN_PTR_OF_&FIELD_TYPE.
2066
2067 2021-01-29  David Malcolm  <dmalcolm@redhat.com>
2068
2069         * checker-path.cc (event_kind_to_string): Handle
2070         EK_START_CONSOLIDATED_CFG_EDGES and
2071         EK_END_CONSOLIDATED_CFG_EDGES.
2072         (start_consolidated_cfg_edges_event::get_desc): New.
2073         (checker_path::cfg_edge_pair_at_p): New.
2074         * checker-path.h (enum event_kind): Add
2075         EK_START_CONSOLIDATED_CFG_EDGES and
2076         EK_END_CONSOLIDATED_CFG_EDGES.
2077         (class start_consolidated_cfg_edges_event): New class.
2078         (class end_consolidated_cfg_edges_event): New class.
2079         (checker_path::delete_events): New.
2080         (checker_path::replace_event): New.
2081         (checker_path::cfg_edge_pair_at_p): New decl.
2082         * diagnostic-manager.cc (diagnostic_manager::prune_path): Call
2083         consolidate_conditions.
2084         (same_line_as_p): New.
2085         (diagnostic_manager::consolidate_conditions): New.
2086         * diagnostic-manager.h
2087         (diagnostic_manager::consolidate_conditions): New decl.
2088
2089 2021-01-18  David Malcolm  <dmalcolm@redhat.com>
2090
2091         * analyzer.h (is_std_named_call_p): New decl.
2092         * diagnostic-manager.cc (path_builder::get_sm): New.
2093         (state_change_event_creator::state_change_event_creator): Add "pb"
2094         param.
2095         (state_change_event_creator::on_global_state_change): Don't consider
2096         state changes affecting other state_machines.
2097         (state_change_event_creator::on_state_change): Likewise.
2098         (state_change_event_creator::m_pb): New field.
2099         (diagnostic_manager::add_events_for_eedge): Pass pb to visitor
2100         ctor.
2101         * region-model-impl-calls.cc
2102         (region_model::impl_deallocation_call): New.
2103         * region-model.cc: Include "attribs.h".
2104         (region_model::on_call_post): Handle fndecls referenced by
2105         __attribute__((deallocated_by(FOO))).
2106         * region-model.h (region_model::impl_deallocation_call): New decl.
2107         * sm-malloc.cc: Include "stringpool.h" and "attribs.h".  Add
2108         leading comment.
2109         (class api): Delete.
2110         (enum resource_state): Update comment for change from api to
2111         deallocator and deallocator_set.
2112         (allocation_state::allocation_state): Drop api param.  Add
2113         "deallocators" and "deallocator".
2114         (allocation_state::m_api): Drop field in favor of...
2115         (allocation_state::m_deallocators): New field.
2116         (allocation_state::m_deallocator): New field.
2117         (enum wording): Add WORDING_DEALLOCATED.
2118         (struct deallocator): New.
2119         (struct standard_deallocator): New.
2120         (struct custom_deallocator): New.
2121         (struct deallocator_set): New.
2122         (struct custom_deallocator_set): New.
2123         (struct standard_deallocator_set): New.
2124         (struct deallocator_set_map_traits): New.
2125         (malloc_state_machine::m_malloc): Drop field
2126         (malloc_state_machine::m_scalar_new): Likewise.
2127         (malloc_state_machine::m_vector_new): Likewise.
2128         (malloc_state_machine::m_free): New field
2129         (malloc_state_machine::m_scalar_delete): Likewise.
2130         (malloc_state_machine::m_vector_delete): Likewise.
2131         (malloc_state_machine::deallocator_map_t): New typedef.
2132         (malloc_state_machine::m_deallocator_map): New field.
2133         (malloc_state_machine::deallocator_set_cache_t): New typedef.
2134         (malloc_state_machine::m_custom_deallocator_set_cache): New field.
2135         (malloc_state_machine::custom_deallocator_set_map_t): New typedef.
2136         (malloc_state_machine::m_custom_deallocator_set_map): New field.
2137         (malloc_state_machine::m_dynamic_sets): New field.
2138         (malloc_state_machine::m_dynamic_deallocators): New field.
2139         (api::api): Delete.
2140         (deallocator::deallocator): New ctor.
2141         (deallocator::hash): New.
2142         (deallocator::dump_to_pp): New.
2143         (deallocator::cmp): New.
2144         (deallocator::cmp_ptr_ptr): New.
2145         (standard_deallocator::standard_deallocator): New ctor.
2146         (deallocator_set::deallocator_set): New ctor.
2147         (deallocator_set::dump): New.
2148         (custom_deallocator_set::custom_deallocator_set): New ctor.
2149         (custom_deallocator_set::contains_p): New.
2150         (custom_deallocator_set::maybe_get_single): New.
2151         (custom_deallocator_set::dump_to_pp): New.
2152         (standard_deallocator_set::standard_deallocator_set): New ctor.
2153         (standard_deallocator_set::contains_p): New.
2154         (standard_deallocator_set::maybe_get_single): New.
2155         (standard_deallocator_set::dump_to_pp): New.
2156         (start_p): New.
2157         (class mismatching_deallocation): Update for conversion from api
2158         to deallocator_set and deallocator.
2159         (double_free::emit): Use %qs.
2160         (class use_after_free): Update for conversion from api to
2161         deallocator_set and deallocator.
2162         (malloc_leak::describe_state_change): Only emit "allocated here" on
2163         a start->nonnull transition, rather than on other transitions to
2164         nonnull.
2165         (allocation_state::dump_to_pp): Update for conversion from api to
2166         deallocator_set.
2167         (allocation_state::get_nonnull): Likewise.
2168         (malloc_state_machine::malloc_state_machine): Likewise.
2169         (malloc_state_machine::~malloc_state_machine): New.
2170         (malloc_state_machine::add_state): Update for conversion from api
2171         to deallocator_set.
2172         (malloc_state_machine::get_or_create_custom_deallocator_set): New.
2173         (malloc_state_machine::maybe_create_custom_deallocator_set): New.
2174         (malloc_state_machine::get_or_create_deallocator): New.
2175         (malloc_state_machine::on_stmt): Update for conversion from api
2176         to deallocator_set.  Handle "__attribute__((malloc(FOO)))", and
2177         the special attribute set on FOO.
2178         (malloc_state_machine::on_allocator_call): Update for conversion
2179         from api to deallocator_set.  Add "returns_nonnull" param and use
2180         it to affect which state to transition to.
2181         (malloc_state_machine::on_deallocator_call): Update for conversion
2182         from api to deallocator_set.
2183
2184 2021-01-14  David Malcolm  <dmalcolm@redhat.com>
2185
2186         * engine.cc (strongly_connected_components::to_json): New.
2187         (worklist::to_json): New.
2188         (exploded_graph::to_json): JSON-ify the worklist.
2189         * exploded-graph.h (strongly_connected_components::to_json): New
2190         decl.
2191         (worklist::to_json): New decl.
2192         * store.cc (store::to_json): Fix comment.
2193         * supergraph.cc (supernode::to_json): Fix reference to
2194         "returning_call" in comment.  Add optional "fun" to JSON.
2195         (edge_kind_to_string): New.
2196         (superedge::to_json): Add "kind" to JSON.
2197
2198 2021-01-14  David Malcolm  <dmalcolm@redhat.com>
2199
2200         PR analyzer/98679
2201         * analyzer.h (region_offset::operator==): Make const.
2202         * pending-diagnostic.h (pending_diagnostic::equal_p): Likewise.
2203         * store.h (binding_cluster::for_each_value): Likewise.
2204         (binding_cluster::for_each_binding): Likewise.
2205
2206 2021-01-12  David Malcolm  <dmalcolm@redhat.com>
2207
2208         PR analyzer/98628
2209         * store.cc (binding_cluster::make_unknown_relative_to): Don't mark
2210         dereferenced unknown pointers as having escaped.
2211
2212 2021-01-07  David Malcolm  <dmalcolm@redhat.com>
2213
2214         PR analyzer/98580
2215         * region.cc (decl_region::get_svalue_for_initializer): Gracefully
2216         handle when LTO writes out DECL_INITIAL as error_mark_node.
2217
2218 2021-01-07  David Malcolm  <dmalcolm@redhat.com>
2219
2220         PR analyzer/97074
2221         * store.cc (binding_cluster::can_merge_p): Add "out_store" param
2222         and pass to calls to binding_cluster::make_unknown_relative_to.
2223         (binding_cluster::make_unknown_relative_to): Add "out_store"
2224         param.  Use it to mark base regions that are pointed to by
2225         pointers that become unknown as having escaped.
2226         (store::can_merge_p): Pass out_store to
2227         binding_cluster::can_merge_p.
2228         * store.h (binding_cluster::can_merge_p): Add "out_store" param.
2229         (binding_cluster::make_unknown_relative_to): Likewise.
2230         * svalue.cc (region_svalue::implicitly_live_p): New vfunc.
2231         * svalue.h (region_svalue::implicitly_live_p): New vfunc decl.
2232
2233 2021-01-07  David Malcolm  <dmalcolm@redhat.com>
2234
2235         PR analyzer/98564
2236         * engine.cc (exploded_path::feasible_p): Add missing call to
2237         bitmap_clear.
2238
2239 2021-01-06  David Malcolm  <dmalcolm@redhat.com>
2240
2241         PR analyzer/97072
2242         * region-model-reachability.cc (reachable_regions::init_cluster):
2243         Convert symbolic region handling to a switch statement.  Add cases
2244         to handle SK_UNKNOWN and SK_CONJURED.
2245
2246 2021-01-05  David Malcolm  <dmalcolm@redhat.com>
2247
2248         PR analyzer/98293
2249         * store.cc (binding_map::apply_ctor_to_region): When "index" is
2250         NULL, iterate through the fields for RECORD_TYPEs, rather than
2251         creating an INTEGER_CST index.
2252
2253 2020-11-30  David Malcolm  <dmalcolm@redhat.com>
2254
2255         * analyzer-pass.cc: Include "analyzer/analyzer.h" for the
2256         declaration of sorry_no_analyzer; include "tree.h" and
2257         "function.h" as these are needed by it.
2258
2259 2020-11-30  David Malcolm  <dmalcolm@redhat.com>
2260
2261         * analyzer-pass.cc (pass_analyzer::execute): Move sorry call to...
2262         (sorry_no_analyzer): New.
2263         * analyzer.h (class state_machine): New forward decl.
2264         (class logger): New forward decl.
2265         (class plugin_analyzer_init_iface): New.
2266         (sorry_no_analyzer): New decl.
2267         * checker-path.cc (checker_path::fixup_locations): New.
2268         * checker-path.h (checker_event::set_location): New.
2269         (checker_path::fixup_locations): New decl.
2270         * diagnostic-manager.cc
2271         (diagnostic_manager::emit_saved_diagnostic): Call
2272         checker_path::fixup_locations, and call fixup_location
2273         on the primary location.
2274         * engine.cc: Include "plugin.h".
2275         (class plugin_analyzer_init_impl): New.
2276         (impl_run_checkers): Invoke PLUGIN_ANALYZER_INIT callbacks.
2277         * pending-diagnostic.h (pending_diagnostic::fixup_location): New
2278         vfunc.
2279
2280 2020-11-18  David Malcolm  <dmalcolm@redhat.com>
2281
2282         PR analyzer/97893
2283         * sm-malloc.cc (null_deref::emit): Use CWE-476 rather than
2284         CWE-690, as this isn't due to an unchecked return value.
2285         (null_arg::emit): Likewise.
2286
2287 2020-11-12  David Malcolm  <dmalcolm@redhat.com>
2288
2289         * checker-path.h (checker_event::get_id_ptr): New.
2290         * diagnostic-manager.cc (path_builder::path_builder): Add "sd"
2291         param and use it to initialize new field "m_sd".
2292         (path_builder::get_pending_diagnostic): New.
2293         (path_builder::m_sd): New field.
2294         (diagnostic_manager::emit_saved_diagnostic): Pass sd to
2295         path_builder ctor.
2296         (diagnostic_manager::add_events_for_superedge): Call new
2297         maybe_add_custom_events_for_superedge vfunc.
2298         * engine.cc (stale_jmp_buf::stale_jmp_buf): Add "setjmp_point"
2299         param and use it to initialize new field "m_setjmp_point".
2300         Initialize new field "m_stack_pop_event".
2301         (stale_jmp_buf::maybe_add_custom_events_for_superedge): New vfunc
2302         implementation.
2303         (stale_jmp_buf::describe_final_event): New vfunc implementation.
2304         (stale_jmp_buf::m_setjmp_point): New field.
2305         (stale_jmp_buf::m_stack_pop_event): New field.
2306         (exploded_node::on_longjmp): Pass setjmp_point to stale_jmp_buf
2307         ctor.
2308         * pending-diagnostic.h
2309         (pending_diagnostic::maybe_add_custom_events_for_superedge): New
2310         vfunc.
2311
2312 2020-11-12  David Malcolm  <dmalcolm@redhat.com>
2313
2314         PR tree-optimization/97424
2315         * analyzer.opt (Wanalyzer-shift-count-negative): New.
2316         (Wanalyzer-shift-count-overflow): New.
2317         * region-model.cc (class shift_count_negative_diagnostic): New.
2318         (class shift_count_overflow_diagnostic): New.
2319         (region_model::get_gassign_result): Complain about shift counts that
2320         are negative or are >= the operand's type's width.
2321
2322 2020-11-10  Martin Liska  <mliska@suse.cz>
2323
2324         * constraint-manager.cc (constraint_manager::merge): Remove
2325         unused code.
2326         * constraint-manager.h: Likewise.
2327         * program-state.cc (sm_state_map::sm_state_map): Likewise.
2328         (program_state::program_state): Likewise.
2329         (test_sm_state_map): Likewise.
2330         * program-state.h: Likewise.
2331         * region-model-reachability.cc (reachable_regions::reachable_regions): Likewise.
2332         * region-model-reachability.h: Likewise.
2333         * region-model.cc (region_model::handle_unrecognized_call): Likewise.
2334         (region_model::get_reachable_svalues): Likewise.
2335         (region_model::can_merge_with_p): Likewise.
2336
2337 2020-11-05  David Malcolm  <dmalcolm@redhat.com>
2338
2339         PR analyzer/97668
2340         * svalue.cc (cmp_cst): Handle COMPLEX_CST.
2341
2342 2020-10-29  David Malcolm  <dmalcolm@redhat.com>
2343
2344         * program-state.cc (sm_state_map::on_liveness_change): Sort the
2345         leaking svalues before calling on_state_leak.
2346         (program_state::detect_leaks): Likewise when calling
2347         on_svalue_leak.
2348         * region-model-reachability.cc
2349         (reachable_regions::mark_escaped_clusters): Likewise when
2350         calling on_escaped_function.
2351
2352 2020-10-29  David Malcolm  <dmalcolm@redhat.com>
2353
2354         PR analyzer/97608
2355         * region-model-reachability.cc (reachable_regions::handle_sval):
2356         Operands of reachable reversible operations are reachable.
2357
2358 2020-10-29  David Malcolm  <dmalcolm@redhat.com>
2359
2360         * analyzer.h (class state_machine): New forward decl.
2361         (class logger): Likewise.
2362         (class visitor): Likewise.
2363         * complexity.cc: New file, taken from svalue.cc.
2364         * complexity.h: New file, taken from region-model.h.
2365         * region-model.h: Include "analyzer/svalue.h" and
2366         "analyzer/region.h".  Move struct complexity to complexity.h.
2367         Move svalue, its subclasses and supporting decls to svalue.h.
2368         Move region, its subclasses and supporting decls to region.h.
2369         * region.cc: Include "analyzer/region.h".
2370         (symbolic_region::symbolic_region): Move here from region-model.h.
2371         * region.h: New file, based on material from region-model.h.
2372         * svalue.cc: Include "analyzer/svalue.h".
2373         (complexity::complexity): Move to complexity.cc.
2374         (complexity::from_pair): Likewise.
2375         * svalue.h: New file, based on material from region-model.h.
2376
2377 2020-10-29  David Malcolm  <dmalcolm@redhat.com>
2378
2379         * program-state.cc (sm_state_map::print): Guard the printing of
2380         the origin pointer with !flag_dump_noaddr.
2381         * region.cc (string_region::dump_to_pp): Likewise for
2382         m_string_cst.
2383
2384 2020-10-27  David Malcolm  <dmalcolm@redhat.com>
2385
2386         PR analyzer/97568
2387         * region-model.cc (region_model::get_initial_value_for_global):
2388         Move check that !DECL_EXTERNAL from here to...
2389         * region.cc (decl_region::get_svalue_for_initializer): ...here,
2390         using it to reject zero initialization.
2391
2392 2020-10-27  Markus Böck  <markus.boeck02@gmail.com>
2393
2394         PR analyzer/96608
2395         * store.h (hash): Cast to intptr_t instead of long
2396
2397 2020-10-27  David Malcolm  <dmalcolm@redhat.com>
2398
2399         * constraint-manager.cc (svalue_cmp_by_ptr): Delete.
2400         (equiv_class::canonicalize): Use svalue::cmp_ptr_ptr instead.
2401         (equiv_class_cmp): Eliminate pointer comparison.
2402         * diagnostic-manager.cc (dedupe_key::comparator): If they are at
2403         the same location, also compare epath ength and pending_diagnostic
2404         kind.
2405         * engine.cc (readability_comparator): If two path_vars have the
2406         same readability, then impose an arbitrary ordering on them.
2407         (worklist::key_t::cmp): If two points have the same plan ordering,
2408         continue the comparison.  Call sm_state_map::cmp rather than
2409         comparing hash values.
2410         * program-state.cc (sm_state_map::entry_t::cmp): New.
2411         (sm_state_map::cmp): New.
2412         * program-state.h (sm_state_map::entry_t::cmp): New decl.
2413         (sm_state_map::elements): New.
2414         (sm_state_map::cmp): New.
2415
2416 2020-10-27  David Malcolm  <dmalcolm@redhat.com>
2417
2418         * engine.cc (setjmp_record::cmp): New.
2419         (supernode_cluster::dump_dot): Avoid embedding pointer in cluster
2420         name.
2421         (supernode_cluster::cmp_ptr_ptr): New.
2422         (function_call_string_cluster::dump_dot): Avoid embedding pointer
2423         in cluster name.  Sort m_map when dumping child clusters.
2424         (function_call_string_cluster::cmp_ptr_ptr): New.
2425         (root_cluster::dump_dot): Sort m_map when dumping child clusters.
2426         * program-point.cc (function_point::cmp): New.
2427         (function_point::cmp_ptr): New.
2428         * program-point.h (function_point::cmp): New decl.
2429         (function_point::cmp_ptr): New decl.
2430         * program-state.cc (sm_state_map::print): Sort the values.  Guard
2431         the printing of pointers with !flag_dump_noaddr.
2432         (program_state::prune_for_point): Sort the regions.
2433         (log_set_of_svalues): Sort the values.  Guard the printing of
2434         pointers with !flag_dump_noaddr.
2435         * region-model-manager.cc (log_uniq_map): Sort the values.
2436         * region-model-reachability.cc (dump_set): New function template.
2437         (reachable_regions::dump_to_pp): Use it.
2438         * region-model.h (svalue::cmp_ptr): New decl.
2439         (svalue::cmp_ptr_ptr): New decl.
2440         (setjmp_record::cmp): New decl.
2441         (placeholder_svalue::get_name): New accessor.
2442         (widening_svalue::get_point): New accessor.
2443         (compound_svalue::get_map): New accessor.
2444         (conjured_svalue::get_stmt): New accessor.
2445         (conjured_svalue::get_id_region): New accessor.
2446         (region::cmp_ptrs): Rename to...
2447         (region::cmp_ptr_ptr): ...this.
2448         * region.cc (region::cmp_ptrs): Rename to...
2449         (region::cmp_ptr_ptr): ...this.
2450         * state-purge.cc
2451         (state_purge_per_ssa_name::state_purge_per_ssa_name): Sort
2452         m_points_needing_name when dumping.
2453         * store.cc (concrete_binding::cmp_ptr_ptr): New.
2454         (symbolic_binding::cmp_ptr_ptr): New.
2455         (binding_map::cmp): New.
2456         (get_sorted_parent_regions): Update for renaming of
2457         region::cmp_ptrs to region::cmp_ptr_ptr.
2458         (store::dump_to_pp): Likewise.
2459         (store::to_json): Likewise.
2460         (store::can_merge_p): Sort the base regions before considering
2461         them.
2462         * store.h (concrete_binding::cmp_ptr_ptr): New decl.
2463         (symbolic_binding::cmp_ptr_ptr): New decl.
2464         (binding_map::cmp): New decl.
2465         * supergraph.cc (supergraph::supergraph): Assign UIDs to the
2466         gimple stmts.
2467         * svalue.cc (cmp_cst): New.
2468         (svalue::cmp_ptr): New.
2469         (svalue::cmp_ptr_ptr): New.
2470
2471 2020-10-27  David Malcolm  <dmalcolm@redhat.com>
2472
2473         * engine.cc (exploded_graph::get_or_create_node): Fix off-by-one
2474         when imposing param_analyzer_max_enodes_per_program_point limit.
2475
2476 2020-10-27  David Malcolm  <dmalcolm@redhat.com>
2477
2478         * region-model.cc (region_model::get_representative_path_var):
2479         Implement case RK_LABEL.
2480         * region-model.h (label_region::get_label): New accessor.
2481
2482 2020-10-22  David Malcolm  <dmalcolm@redhat.com>
2483
2484         PR analyzer/97514
2485         * engine.cc (exploded_graph::add_function_entry): Handle failure
2486         to create an enode, rather than asserting.
2487
2488 2020-10-22  David Malcolm  <dmalcolm@redhat.com>
2489
2490         PR analyzer/97489
2491         * engine.cc (exploded_graph::add_function_entry): Assert that we
2492         have a function body.
2493         (exploded_graph::on_escaped_function): Reject fndecls that don't
2494         have a function body.
2495
2496 2020-10-14  David Malcolm  <dmalcolm@redhat.com>
2497
2498         PR analyzer/93388
2499         * region-model.cc (region_model::get_initial_value_for_global):
2500         Fall back to returning an initial_svalue if
2501         decl_region::get_svalue_for_initializer fails.
2502         * region.cc (decl_region::get_svalue_for_initializer): Don't
2503         attempt to create a compound_svalue if the region has an unknown
2504         size.
2505
2506 2020-10-14  David Malcolm  <dmalcolm@redhat.com>
2507
2508         PR analyzer/93723
2509         * store.cc (binding_map::apply_ctor_to_region): Remove redundant
2510         assertion.
2511
2512 2020-10-12  David Malcolm  <dmalcolm@redhat.com>
2513
2514         PR analyzer/97258
2515         * engine.cc (impl_region_model_context::on_escaped_function): New
2516         vfunc.
2517         (exploded_graph::add_function_entry): Use m_functions_with_enodes
2518         to implement idempotency.
2519         (add_any_callbacks): New.
2520         (exploded_graph::build_initial_worklist): Use the above to find
2521         callbacks that are reachable from global initializers.
2522         (exploded_graph::on_escaped_function): New.
2523         * exploded-graph.h
2524         (impl_region_model_context::on_escaped_function): New decl.
2525         (exploded_graph::on_escaped_function): New decl.
2526         (exploded_graph::m_functions_with_enodes): New field.
2527         * region-model-reachability.cc
2528         (reachable_regions::reachable_regions): Replace "store" param with
2529         "model" param; use it to initialize m_model.
2530         (reachable_regions::add): When getting the svalue for the region,
2531         call get_store_value on the model rather than using an initial
2532         value.
2533         (reachable_regions::mark_escaped_clusters): Add ctxt param and
2534         use it to call on_escaped_function when a function_region escapes.
2535         * region-model-reachability.h
2536         (reachable_regions::reachable_regions): Replace "store" param with
2537         "model" param.
2538         (reachable_regions::mark_escaped_clusters): Add ctxt param.
2539         (reachable_regions::m_model): New field.
2540         * region-model.cc (region_model::handle_unrecognized_call): Update
2541         for change in reachable_regions ctor.
2542         (region_model::handle_unrecognized_call): Pass ctxt to
2543         mark_escaped_clusters.
2544         (region_model::get_reachable_svalues): Update for change in
2545         reachable_regions ctor.
2546         (region_model::get_initial_value_for_global): Read-only variables
2547         keep their initial values.
2548         * region-model.h (region_model_context::on_escaped_function): New
2549         vfunc.
2550         (noop_region_model_context::on_escaped_function): New.
2551
2552 2020-10-12  David Malcolm  <dmalcolm@redhat.com>
2553
2554         * analyzer.opt (Wanalyzer-write-to-const): New.
2555         (Wanalyzer-write-to-string-literal): New.
2556         * region-model-impl-calls.cc (region_model::impl_call_memcpy):
2557         Call check_for_writable_region.
2558         (region_model::impl_call_memset): Likewise.
2559         (region_model::impl_call_strcpy): Likewise.
2560         * region-model.cc (class write_to_const_diagnostic): New.
2561         (class write_to_string_literal_diagnostic): New.
2562         (region_model::check_for_writable_region): New.
2563         (region_model::set_value): Call check_for_writable_region.
2564         * region-model.h (region_model::check_for_writable_region): New
2565         decl.
2566
2567 2020-10-07  David Malcolm  <dmalcolm@redhat.com>
2568
2569         PR analyzer/97116
2570         * sm-malloc.cc (method_p): New.
2571         (describe_argument_index): New.
2572         (inform_nonnull_attribute): Use describe_argument_index.
2573         (possible_null_arg::describe_final_event): Likewise.
2574         (null_arg::describe_final_event): Likewise.
2575
2576 2020-09-29  David Malcolm  <dmalcolm@redhat.com>
2577
2578         PR analyzer/95188
2579         * engine.cc (stmt_requires_new_enode_p): Split enodes before
2580         "signal" calls.
2581
2582 2020-09-29  David Malcolm  <dmalcolm@redhat.com>
2583
2584         * constraint-manager.cc
2585         (constraint_manager::add_constraint_internal): Whitespace fixes.
2586         Silence -Wsign-compare warning.
2587         * engine.cc (maybe_process_run_of_before_supernode_enodes):
2588         Silence -Wsign-compare warning.
2589
2590 2020-09-28  David Malcolm  <dmalcolm@redhat.com>
2591
2592         * region-model.h (binop_svalue::dyn_cast_binop_svalue): Remove
2593         redundant "virtual".  Add FINAL OVERRIDE.
2594         (widening_svalue::dyn_cast_widening_svalue): Add FINAL OVERRIDE.
2595         (compound_svalue::dyn_cast_compound_svalue): Likewise.
2596         (conjured_svalue::dyn_cast_conjured_svalue): Likewise.
2597
2598 2020-09-28  David Malcolm  <dmalcolm@redhat.com>
2599
2600         * diagnostic-manager.cc (null_assignment_sm_context::m_visitor):
2601         Remove unused field.
2602
2603 2020-09-28  David Malcolm  <dmalcolm@redhat.com>
2604
2605         PR analyzer/97233
2606         * analyzer.cc (is_longjmp_call_p): Require the initial argument
2607         to be a pointer.
2608         * engine.cc (exploded_node::on_longjmp): Likewise.
2609
2610 2020-09-28  David Malcolm  <dmalcolm@redhat.com>
2611
2612         * program-state.cc (sm_state_map::print): Update check
2613         for m_global_state being the start state.
2614
2615 2020-09-26  David Malcolm  <dmalcolm@redhat.com>
2616
2617         PR analyzer/96646
2618         PR analyzer/96841
2619         * region-model.cc (region_model::get_representative_path_var):
2620         When handling offset_region, wrap the MEM_REF's first argument in
2621         an ADDR_EXPR of pointer type, rather than simply using the tree
2622         for the parent region.  Require the MEM_REF's second argument to
2623         be an integer constant.
2624
2625 2020-09-24  David Malcolm  <dmalcolm@redhat.com>
2626
2627         * analyzer.h (struct rejected_constraint): New decl.
2628         * analyzer.opt (fanalyzer-feasibility): New option.
2629         * diagnostic-manager.cc (path_builder::path_builder): Add
2630         "problem" param and use it to initialize new field.
2631         (path_builder::get_feasibility_problem): New accessor.
2632         (path_builder::m_feasibility_problem): New field.
2633         (dedupe_winners::add): Remove inversion of logic in "if" clause,
2634         swapping if/else suites.  In the !feasible_p suite, inspect
2635         flag_analyzer_feasibility and add code to handle when this
2636         is off, accepting the infeasible path, but recording the
2637         feasibility_problem.
2638         (diagnostic_manager::emit_saved_diagnostic): Pass the
2639         feasibility_problem to the path_builder.
2640         (diagnostic_manager::add_events_for_eedge): If we have
2641         a feasibility_problem at this edge, use it to add a custom event.
2642         * engine.cc (exploded_path::feasible_p): Pass a
2643         rejected_constraint ** to model.maybe_update_for_edge and transfer
2644         ownership of any created instance to any feasibility_problem.
2645         (feasibility_problem::dump_to_pp): New.
2646         * exploded-graph.h (feasibility_problem::feasibility_problem):
2647         Drop "model" param; add rejected_constraint * param.
2648         (feasibility_problem::~feasibility_problem): New.
2649         (feasibility_problem::dump_to_pp): New decl.
2650         (feasibility_problem::m_model): Drop field.
2651         (feasibility_problem::m_rc): New field.
2652         * program-point.cc (function_point::get_location): Handle
2653         PK_BEFORE_SUPERNODE and PK_AFTER_SUPERNODE.
2654         * program-state.cc (program_state::on_edge): Pass NULL to new
2655         param of region_model::maybe_update_for_edge.
2656         * region-model.cc (region_model::add_constraint): New overload
2657         adding a rejected_constraint ** param.
2658         (region_model::maybe_update_for_edge): Add rejected_constraint **
2659         param and pass it to the various apply_constraints_for_ calls.
2660         (region_model::apply_constraints_for_gcond): Add
2661         rejected_constraint ** param and pass it to add_constraint calls.
2662         (region_model::apply_constraints_for_gswitch): Likewise.
2663         (region_model::apply_constraints_for_exception): Likewise.
2664         (rejected_constraint::dump_to_pp): New.
2665         * region-model.h (region_model::maybe_update_for_edge):
2666         Add rejected_constraint ** param.
2667         (region_model::add_constraint): New overload adding a
2668         rejected_constraint ** param.
2669         (region_model::apply_constraints_for_gcond): Add
2670         rejected_constraint ** param.
2671         (region_model::apply_constraints_for_gswitch): Likewise.
2672         (region_model::apply_constraints_for_exception): Likewise.
2673         (struct rejected_constraint): New.
2674
2675 2020-09-23  David Malcolm  <dmalcolm@redhat.com>
2676
2677         PR analyzer/97178
2678         * engine.cc (impl_run_checkers): Update for change to ext_state
2679         ctor.
2680         * program-state.cc (selftest::test_sm_state_map): Pass an engine
2681         instance to ext_state ctor.
2682         (selftest::test_program_state_1): Likewise.
2683         (selftest::test_program_state_2): Likewise.
2684         (selftest::test_program_state_merging): Likewise.
2685         (selftest::test_program_state_merging_2): Likewise.
2686         * program-state.h (extrinsic_state::extrinsic_state): Remove NULL
2687         default value for "eng" param.
2688
2689 2020-09-23  Tobias Burnus  <tobias@codesourcery.com>
2690
2691         * analyzer-logging.cc: Guard '#pragma ... ignored "-Wformat-diag"'
2692         by '#if __GNUC__ >= 10'
2693         * analyzer.h: Likewise.
2694         * call-string.cc: Likewise.
2695
2696 2020-09-23  David Malcolm  <dmalcolm@redhat.com>
2697
2698         * engine.cc (exploded_node::on_stmt): Replace sequence of dyn_cast
2699         with switch.
2700
2701 2020-09-22  David Malcolm  <dmalcolm@redhat.com>
2702
2703         * analysis-plan.cc: Include "json.h".
2704         * analyzer.opt (fdump-analyzer-json): New.
2705         * call-string.cc: Include "json.h".
2706         (call_string::to_json): New.
2707         * call-string.h (call_string::to_json): New decl.
2708         * checker-path.cc: Include "json.h".
2709         * constraint-manager.cc: Include "json.h".
2710         (equiv_class::to_json): New.
2711         (constraint::to_json): New.
2712         (constraint_manager::to_json): New.
2713         * constraint-manager.h (equiv_class::to_json): New decl.
2714         (constraint::to_json): New decl.
2715         (constraint_manager::to_json): New decl.
2716         * diagnostic-manager.cc: Include "json.h".
2717         (saved_diagnostic::to_json): New.
2718         (diagnostic_manager::to_json): New.
2719         * diagnostic-manager.h (saved_diagnostic::to_json): New decl.
2720         (diagnostic_manager::to_json): New decl.
2721         * engine.cc: Include "json.h", <zlib.h>.
2722         (exploded_node::status_to_str): New.
2723         (exploded_node::to_json): New.
2724         (exploded_edge::to_json): New.
2725         (exploded_graph::to_json): New.
2726         (dump_analyzer_json): New.
2727         (impl_run_checkers): Call it.
2728         * exploded-graph.h (exploded_node::status_to_str): New decl.
2729         (exploded_node::to_json): New.
2730         (exploded_edge::to_json): New.
2731         (exploded_graph::to_json): New.
2732         * pending-diagnostic.cc: Include "json.h".
2733         * program-point.cc: Include "json.h".
2734         (program_point::to_json): New.
2735         * program-point.h (program_point::to_json): New decl.
2736         * program-state.cc: Include "json.h".
2737         (extrinsic_state::to_json): New.
2738         (sm_state_map::to_json): New.
2739         (program_state::to_json): New.
2740         * program-state.h (extrinsic_state::to_json): New decl.
2741         (sm_state_map::to_json): New decl.
2742         (program_state::to_json): New decl.
2743         * region-model-impl-calls.cc: Include "json.h".
2744         * region-model-manager.cc: Include "json.h".
2745         * region-model-reachability.cc: Include "json.h".
2746         * region-model.cc: Include "json.h".
2747         * region-model.h (svalue::to_json): New decl.
2748         (region::to_json): New decl.
2749         * region.cc: Include "json.h".
2750         (region::to_json: New.
2751         * sm-file.cc: Include "json.h".
2752         * sm-malloc.cc: Include "json.h".
2753         * sm-pattern-test.cc: Include "json.h".
2754         * sm-sensitive.cc: Include "json.h".
2755         * sm-signal.cc: Include "json.h".
2756         (signal_delivery_edge_info_t::to_json): New.
2757         * sm-taint.cc: Include "json.h".
2758         * sm.cc: Include "diagnostic.h", "tree-diagnostic.h", and
2759         "json.h".
2760         (state_machine::state::to_json): New.
2761         (state_machine::to_json): New.
2762         * sm.h (state_machine::state::to_json): New.
2763         (state_machine::to_json): New.
2764         * state-purge.cc: Include "json.h".
2765         * store.cc: Include "json.h".
2766         (binding_key::get_desc): New.
2767         (binding_map::to_json): New.
2768         (binding_cluster::to_json): New.
2769         (store::to_json): New.
2770         * store.h (binding_key::get_desc): New decl.
2771         (binding_map::to_json): New decl.
2772         (binding_cluster::to_json): New decl.
2773         (store::to_json): New decl.
2774         * supergraph.cc: Include "json.h".
2775         (supergraph::to_json): New.
2776         (supernode::to_json): New.
2777         (superedge::to_json): New.
2778         * supergraph.h (supergraph::to_json): New decl.
2779         (supernode::to_json): New decl.
2780         (superedge::to_json): New decl.
2781         * svalue.cc: Include "json.h".
2782         (svalue::to_json): New.
2783
2784 2020-09-21  David Malcolm  <dmalcolm@redhat.com>
2785
2786         PR analyzer/97130
2787         * region-model-impl-calls.cc (call_details::get_arg_type): New.
2788         * region-model.cc (region_model::on_call_pre): Check that the
2789         initial arg is a pointer before calling impl_call_memset and
2790         impl_call_strlen.
2791         * region-model.h (call_details::get_arg_type): New decl.
2792
2793 2020-09-21  David Malcolm  <dmalcolm@redhat.com>
2794
2795         PR analyzer/93355
2796         * sm-malloc.cc (malloc_state_machine::get_default_state): Look at
2797         the base region when considering pointers.  Treat pointers to
2798         decls as being non-heap.
2799
2800 2020-09-18  David Malcolm  <dmalcolm@redhat.com>
2801
2802         * checker-path.cc (warning_event::get_desc): Handle global state
2803         changes.
2804
2805 2020-09-18  David Malcolm  <dmalcolm@redhat.com>
2806
2807         * sm-malloc.cc (malloc_state_machine::on_stmt): Handle strdup and
2808         strndup as being malloc-like allocators.
2809
2810 2020-09-16  David Malcolm  <dmalcolm@redhat.com>
2811
2812         * engine.cc (strongly_connected_components::strong_connect): Only
2813         consider intraprocedural edges when creating SCCs.
2814         (worklist::key_t::cmp): Add comment.  Treat call_string
2815         differences as more important than differences of program_point
2816         within a supernode.
2817
2818 2020-09-16  David Malcolm  <dmalcolm@redhat.com>
2819
2820         * engine.cc (supernode_cluster::dump_dot): Show the SCC id
2821         in the per-supernode clusters in FILENAME.eg.dot output.
2822         (exploded_graph_annotator::add_node_annotations):
2823         Show the SCC of the supernode in FILENAME.supernode.eg.dot output.
2824         * exploded-graph.h (worklist::scc_id): New.
2825         (exploded_graph::get_scc_id): New.
2826
2827 2020-09-16  David Malcolm  <dmalcolm@redhat.com>
2828
2829         * engine.cc (exploded_node::dump_dot): Show STATUS_BULK_MERGED.
2830         (exploded_graph::process_worklist): Call
2831         maybe_process_run_of_before_supernode_enodes.
2832         (exploded_graph::maybe_process_run_of_before_supernode_enodes):
2833         New.
2834         (exploded_graph_annotator::print_enode): Show STATUS_BULK_MERGED.
2835         * exploded-graph.h (enum exploded_node::status): Add
2836         STATUS_BULK_MERGED.
2837
2838 2020-09-16  David Malcolm  <dmalcolm@redhat.com>
2839
2840         * engine.cc
2841         (exploded_graph::process_node) <case PK_BEFORE_SUPERNODE>:
2842         Simplify by using program_point::get_next.
2843         * program-point.cc (program_point::get_next): New.
2844         * program-point.h (program_point::get_next): New decl.
2845
2846 2020-09-16  David Malcolm  <dmalcolm@redhat.com>
2847
2848         * engine.cc (exploded_graph::get_or_create_node): Show the
2849         program point when issuing -Wanalyzer-too-complex due to hitting
2850         the per-program-point limit.
2851
2852 2020-09-16  David Malcolm  <dmalcolm@redhat.com>
2853
2854         * region-model.cc (region_model::on_call_pre): Treat getchar as
2855         having no side-effects.
2856
2857 2020-09-15  David Malcolm  <dmalcolm@redhat.com>
2858
2859         PR analyzer/96650
2860         * constraint-manager.cc (merger_fact_visitor::on_fact): Replace
2861         assertion that add_constraint succeeded with an assertion that
2862         if it fails, -fanalyzer-transitivity is off.
2863
2864 2020-09-14  David Malcolm  <dmalcolm@redhat.com>
2865
2866         * analyzer.opt (-param=analyzer-max-constraints=): New param.
2867         * constraint-manager.cc
2868         (constraint_manager::add_constraint_internal): Silently reject
2869         attempts to add constraints when the above limit is reached.
2870
2871 2020-09-14  David Malcolm  <dmalcolm@redhat.com>
2872
2873         PR analyzer/96653
2874         * constraint-manager.cc
2875         (constraint_manager::get_or_add_equiv_class): Don't accumulate
2876         transitive closure of all constraints on constants.
2877
2878 2020-09-14  David Malcolm  <dmalcolm@redhat.com>
2879
2880         PR analyzer/97029
2881         * analyzer.cc (is_setjmp_call_p): Require the initial arg to be a
2882         pointer.
2883         * region-model.cc (region_model::deref_rvalue): Assert that the
2884         svalue is of pointer type.
2885
2886 2020-09-11  David Malcolm  <dmalcolm@redhat.com>
2887
2888         PR analyzer/96798
2889         * region-model-impl-calls.cc (region_model::impl_call_memcpy):
2890         New.
2891         (region_model::impl_call_strcpy): New.
2892         * region-model.cc (region_model::on_call_pre): Flag unhandled
2893         builtins that are non-pure as having unknown side-effects.
2894         Implement BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_STRCPY,
2895         BUILT_IN_STRCPY_CHK, BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED,
2896         BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_FPUTC,
2897         BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
2898         BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
2899         BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR,
2900         BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED,
2901         BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF.
2902         * region-model.h (region_model::impl_call_memcpy): New decl.
2903         (region_model::impl_call_strcpy): New decl.
2904
2905 2020-09-09  David Malcolm  <dmalcolm@redhat.com>
2906
2907         PR analyzer/94355
2908         * analyzer.opt (Wanalyzer-mismatching-deallocation): New warning.
2909         * region-model-impl-calls.cc
2910         (region_model::impl_call_operator_new): New.
2911         (region_model::impl_call_operator_delete): New.
2912         * region-model.cc (region_model::on_call_pre): Detect operator new
2913         and operator delete.
2914         (region_model::on_call_post): Likewise.
2915         (region_model::maybe_update_for_edge): Detect EH edges and call...
2916         (region_model::apply_constraints_for_exception): New function.
2917         * region-model.h (region_model::impl_call_operator_new): New decl.
2918         (region_model::impl_call_operator_delete): New decl.
2919         (region_model::apply_constraints_for_exception): New decl.
2920         * sm-malloc.cc (enum resource_state): New.
2921         (struct allocation_state): New state subclass.
2922         (enum wording): New.
2923         (struct api): New.
2924         (malloc_state_machine::custom_data_t): New typedef.
2925         (malloc_state_machine::add_state): New decl.
2926         (malloc_state_machine::m_unchecked)
2927         (malloc_state_machine::m_nonnull)
2928         (malloc_state_machine::m_freed): Delete these states in favor
2929         of...
2930         (malloc_state_machine::m_malloc)
2931         (malloc_state_machine::m_scalar_new)
2932         (malloc_state_machine::m_vector_new): ...this new api instances,
2933         which own their own versions of these states.
2934         (malloc_state_machine::on_allocator_call): New decl.
2935         (malloc_state_machine::on_deallocator_call): New decl.
2936         (api::api): New ctor.
2937         (dyn_cast_allocation_state): New.
2938         (as_a_allocation_state): New.
2939         (get_rs): New.
2940         (unchecked_p): New.
2941         (nonnull_p): New.
2942         (freed_p): New.
2943         (malloc_diagnostic::describe_state_change): Use unchecked_p and
2944         nonnull_p.
2945         (class mismatching_deallocation): New.
2946         (double_free::double_free): Add funcname param for initializing
2947         m_funcname.
2948         (double_free::emit): Use m_funcname in warning message rather
2949         than hardcoding "free".
2950         (double_free::describe_state_change): Likewise.  Use freed_p.
2951         (double_free::describe_call_with_state): Use freed_p.
2952         (double_free::describe_final_event): Use m_funcname in message
2953         rather than hardcoding "free".
2954         (double_free::m_funcname): New field.
2955         (possible_null::describe_state_change): Use unchecked_p.
2956         (possible_null::describe_return_of_state): Likewise.
2957         (use_after_free::use_after_free): Add param for initializing m_api.
2958         (use_after_free::emit): Use m_api->m_dealloc_funcname in message
2959         rather than hardcoding "free".
2960         (use_after_free::describe_state_change): Use freed_p.  Change the
2961         wording of the message based on the API.
2962         (use_after_free::describe_final_event): Use
2963         m_api->m_dealloc_funcname in message rather than hardcoding
2964         "free".  Change the wording of the message based on the API.
2965         (use_after_free::m_api): New field.
2966         (malloc_leak::describe_state_change): Use unchecked_p.  Update
2967         for renaming of m_malloc_event to m_alloc_event.
2968         (malloc_leak::describe_final_event): Update for renaming of
2969         m_malloc_event to m_alloc_event.
2970         (malloc_leak::m_malloc_event): Rename...
2971         (malloc_leak::m_alloc_event): ...to this.
2972         (free_of_non_heap::free_of_non_heap): Add param for initializing
2973         m_funcname.
2974         (free_of_non_heap::emit): Use m_funcname in message rather than
2975         hardcoding "free".
2976         (free_of_non_heap::describe_final_event): Likewise.
2977         (free_of_non_heap::m_funcname): New field.
2978         (allocation_state::dump_to_pp): New.
2979         (allocation_state::get_nonnull): New.
2980         (malloc_state_machine::malloc_state_machine): Update for changes
2981         to state fields and new api fields.
2982         (malloc_state_machine::add_state): New.
2983         (malloc_state_machine::on_stmt): Move malloc/calloc handling to
2984         on_allocator_call and call it, passing in the API pointer.
2985         Likewise for free, moving it to on_deallocator_call.  Handle calls
2986         to operator new and delete in an analogous way.  Use unchecked_p
2987         when testing for possibly-null-arg and possibly-null-deref, and
2988         transition to the non-null for the correct API.  Remove redundant
2989         node param from call to on_zero_assignment.  Use freed_p for
2990         use-after-free check, and pass in API.
2991         (malloc_state_machine::on_allocator_call): New, based on code in
2992         on_stmt.
2993         (malloc_state_machine::on_deallocator_call): Likewise.
2994         (malloc_state_machine::on_phi): Mark node param with
2995         ATTRIBUTE_UNUSED; don't pass it to on_zero_assignment.
2996         (malloc_state_machine::on_condition): Mark node param with
2997         ATTRIBUTE_UNUSED.  Replace on_transition calls with get_state and
2998         set_next_state pairs, transitioning to the non-null state for the
2999         appropriate API.
3000         (malloc_state_machine::can_purge_p): Port to new state approach.
3001         (malloc_state_machine::on_zero_assignment): Replace on_transition
3002         calls with get_state and set_next_state pairs.  Drop redundant
3003         node param.
3004         * sm.h (state_machine::add_custom_state): New.
3005
3006 2020-09-09  David Malcolm  <dmalcolm@redhat.com>
3007
3008         * diagnostic-manager.cc
3009         (null_assignment_sm_context::warn_for_state): Replace with...
3010         (null_assignment_sm_context::warn): ...this.
3011         * engine.cc (impl_sm_context::warn_for_state): Replace with...
3012         (impl_sm_context::warn): ...this.
3013         * sm-file.cc (fileptr_state_machine::on_stmt): Replace
3014         warn_for_state and on_transition calls with a get_state
3015         test guarding warn and set_next_state calls.
3016         * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
3017         * sm-pattern-test.cc (pattern_test_state_machine::on_condition):
3018         Replace warn_for_state call with warn call.
3019         * sm-sensitive.cc
3020         (sensitive_state_machine::warn_for_any_exposure): Replace
3021         warn_for_state call with a get_state test guarding a warn call.
3022         * sm-signal.cc (signal_state_machine::on_stmt): Likewise.
3023         * sm-taint.cc (taint_state_machine::on_stmt):  Replace
3024         warn_for_state and on_transition calls with a get_state
3025         test guarding warn and set_next_state calls.
3026         * sm.h (sm_context::warn_for_state): Replace with...
3027         (sm_context::warn): ...this.
3028
3029 2020-09-09  David Malcolm  <dmalcolm@redhat.com>
3030
3031         * diagnostic-manager.cc
3032         (null_assignment_sm_context::null_assignment_sm_context): Add old_state
3033         and ext_state params, initializing m_old_state and m_ext_state.
3034         (null_assignment_sm_context::on_transition): Split into...
3035         (null_assignment_sm_context::get_state): ...this new vfunc
3036         implementation and...
3037         (null_assignment_sm_context::set_next_state): ...this new vfunc
3038         implementation.
3039         (null_assignment_sm_context::m_old_state): New field.
3040         (null_assignment_sm_context::m_ext_state): New field.
3041         (diagnostic_manager::add_events_for_eedge): Pass in old state and
3042         ext_state when creating sm_ctxt.
3043         * engine.cc (impl_sm_context::on_transition): Split into...
3044         (impl_sm_context::get_state): ...this new vfunc
3045         implementation and...
3046         (impl_sm_context::set_next_state): ...this new vfunc
3047         implementation.
3048         * sm.h (sm_context::get_state): New pure virtual function.
3049         (sm_context::set_next_state): Likewise.
3050         (sm_context::on_transition): Convert from a pure virtual function
3051         to a regular function implemented in terms of get_state and
3052         set_next_state.
3053
3054 2020-09-09  David Malcolm  <dmalcolm@redhat.com>
3055
3056         * checker-path.cc (state_change_event::get_desc): Update
3057         state_machine::get_state_name calls to state::get_name.
3058         (warning_event::get_desc): Likewise.
3059         * diagnostic-manager.cc
3060         (null_assignment_sm_context::on_transition): Update comparison
3061         against 0 with comparison with m_sm.get_start_state.
3062         (diagnostic_manager::prune_for_sm_diagnostic): Update
3063         state_machine::get_state_name calls to state::get_name.
3064         * engine.cc (impl_sm_context::on_transition): Likewise.
3065         (exploded_node::get_dot_fillcolor): Use get_id when summing
3066         the sm states.
3067         * program-state.cc (sm_state_map::sm_state_map): Don't hardcode
3068         0 as the start state when initializing m_global_state.
3069         (sm_state_map::print): Use dump_to_pp rather than get_state_name
3070         when dumping states.
3071         (sm_state_map::is_empty_p): Don't hardcode 0 as the start state
3072         when examining m_global_state.
3073         (sm_state_map::hash): Use get_id when hashing states.
3074         (selftest::test_sm_state_map): Use state objects rather than
3075         arbitrary hardcoded integers.
3076         (selftest::test_program_state_merging): Likewise.
3077         (selftest::test_program_state_merging_2): Likewise.
3078         * sm-file.cc (fileptr_state_machine::m_start): Move to base class.
3079         (file_diagnostic::describe_state_change): Use get_start_state.
3080         (fileptr_state_machine::fileptr_state_machine): Drop m_start
3081         initialization.
3082         * sm-malloc.cc (malloc_state_machine::m_start): Move to base
3083         class.
3084         (malloc_diagnostic::describe_state_change): Use get_start_state.
3085         (possible_null::describe_state_change): Likewise.
3086         (malloc_state_machine::malloc_state_machine): Drop m_start
3087         initialization.
3088         * sm-pattern-test.cc (pattern_test_state_machine::m_start): Move
3089         to base class.
3090         (pattern_test_state_machine::pattern_test_state_machine): Drop
3091         m_start initialization.
3092         * sm-sensitive.cc (sensitive_state_machine::m_start): Move to base
3093         class.
3094         (sensitive_state_machine::sensitive_state_machine): Drop m_start
3095         initialization.
3096         * sm-signal.cc (signal_state_machine::m_start): Move to base
3097         class.
3098         (signal_state_machine::signal_state_machine): Drop m_start
3099         initialization.
3100         * sm-taint.cc (taint_state_machine::m_start): Move to base class.
3101         (taint_state_machine::taint_state_machine): Drop m_start
3102         initialization.
3103         * sm.cc (state_machine::state::dump_to_pp): New.
3104         (state_machine::state_machine): Move here from sm.h.  Initialize
3105         m_next_state_id and m_start.
3106         (state_machine::add_state): Reimplement in terms of state objects.
3107         (state_machine::get_state_name): Delete.
3108         (state_machine::get_state_by_name): Reimplement in terms of state
3109         objects.  Make const.
3110         (state_machine::validate): Delete.
3111         (state_machine::dump_to_pp): Reimplement in terms of state
3112         objects.
3113         * sm.h (state_machine::state): New class.
3114         (state_machine::state_t): Convert typedef from "unsigned" to
3115         "const state_machine::state *".
3116         (state_machine::state_machine): Move to sm.cc.
3117         (state_machine::get_default_state): Use m_start rather than
3118         hardcoding 0.
3119         (state_machine::get_state_name): Delete.
3120         (state_machine::get_state_by_name): Make const.
3121         (state_machine::get_start_state): New accessor.
3122         (state_machine::alloc_state_id): New.
3123         (state_machine::m_state_names): Drop in favor of...
3124         (state_machine::m_states): New field
3125         (state_machine::m_start): New field
3126         (start_start_p): Delete.
3127
3128 2020-09-08  David Malcolm  <dmalcolm@redhat.com>
3129
3130         PR analyzer/96949
3131         * store.cc (binding_map::apply_ctor_val_to_range): Add
3132         error-handling for the cases where we have symbolic offsets.
3133
3134 2020-09-08  David Malcolm  <dmalcolm@redhat.com>
3135
3136         PR analyzer/96950
3137         * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
3138         where min_index == max_index.
3139         (binding_map::apply_ctor_val_to_range): Replace assertion that we
3140         don't have a CONSTRUCTOR value with error-handling.
3141
3142 2020-09-08  David Malcolm  <dmalcolm@redhat.com>
3143
3144         PR analyzer/96962
3145         * region-model.cc (region_model::on_call_pre): Fix guard on switch
3146         on built-ins to only consider BUILT_IN_NORMAL, rather than other
3147         kinds of build-ins.
3148
3149 2020-09-01  David Malcolm  <dmalcolm@redhat.com>
3150
3151         PR analyzer/96792
3152         * region-model.cc (region_model::deref_rvalue): Add the constraint
3153         that PTR_SVAL is non-NULL.
3154
3155 2020-08-31  David Malcolm  <dmalcolm@redhat.com>
3156
3157         PR analyzer/96798
3158         * region-model.cc (region_model::on_call_pre): Handle
3159         BUILT_IN_MEMSET_CHK.
3160
3161 2020-08-31  David Malcolm  <dmalcolm@redhat.com>
3162
3163         * region-model.cc (region_model::on_call_pre): Gather handling of
3164         builtins and of internal fns into switch statements.  Handle
3165         "alloca" and BUILT_IN_ALLOCA_WITH_ALIGN.
3166
3167 2020-08-31  David Malcolm  <dmalcolm@redhat.com>
3168
3169         PR analyzer/96860
3170         * region.cc (decl_region::get_svalue_for_constructor): Support
3171         apply_ctor_to_region failing.
3172         * store.cc (binding_map::apply_ctor_to_region): Add failure
3173         handling.
3174         (binding_map::apply_ctor_val_to_range): Likewise.
3175         (binding_map::apply_ctor_pair_to_child_region): Likewise.  Replace
3176         assertion that child_base_offset is not symbolic with error
3177         handling.
3178         * store.h (binding_map::apply_ctor_to_region): Convert return type
3179         from void to bool.
3180         (binding_map::apply_ctor_val_to_range): Likewise.
3181         (binding_map::apply_ctor_pair_to_child_region): Likewise.
3182
3183 2020-08-31  David Malcolm  <dmalcolm@redhat.com>
3184
3185         PR analyzer/96763
3186         * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
3187         by calling a new binding_map::apply_ctor_val_to_range subroutine.
3188         Split out the existing non-CONSTRUCTOR-handling code to a new
3189         apply_ctor_pair_to_child_region subroutine.
3190         (binding_map::apply_ctor_val_to_range): New.
3191         (binding_map::apply_ctor_pair_to_child_region): New, split out
3192         from binding_map::apply_ctor_to_region as noted above.
3193         * store.h (binding_map::apply_ctor_val_to_range): New decl.
3194         (binding_map::apply_ctor_pair_to_child_region): New decl.
3195
3196 2020-08-31  David Malcolm  <dmalcolm@redhat.com>
3197
3198         PR analyzer/96764
3199         * region-model-manager.cc
3200         (region_model_manager::maybe_fold_unaryop): Handle VIEW_CONVERT_EXPR.
3201         (region_model_manager::get_or_create_cast): Move logic for
3202         real->integer casting to...
3203         (get_code_for_cast): ...this new function, and add logic for
3204         real->non-integer casts.
3205         (region_model_manager::maybe_fold_sub_svalue): Handle
3206         VIEW_CONVERT_EXPR.
3207         * region-model.cc
3208         (region_model::add_any_constraints_from_gassign): Likewise.
3209         * svalue.cc (svalue::maybe_undo_cast): Likewise.
3210         (unaryop_svalue::dump_to_pp): Likewise.
3211
3212 2020-08-26  David Malcolm  <dmalcolm@redhat.com>
3213
3214         PR analyzer/94858
3215         * region-model-manager.cc
3216         (region_model_manager::get_or_create_widening_svalue): Assert that
3217         neither of the inputs are themselves widenings.
3218         * store.cc (store::eval_alias_1): The initial value of a pointer
3219         can't point to a region that was allocated on the heap after the
3220         beginning of the path.  A widened pointer value can't alias anything
3221         that the initial pointer value can't alias.
3222         * svalue.cc (svalue::can_merge_p): Merge BINOP (X, OP, CST) with X
3223         to a widening svalue.  Merge
3224         BINOP(WIDENING(BASE, BINOP(BASE, X)), X) and BINOP(BASE, X) to
3225         to the LHS of the first BINOP.
3226
3227 2020-08-26  David Malcolm  <dmalcolm@redhat.com>
3228
3229         PR analyzer/96777
3230         * region-model.h (class compound_svalue): Document that all keys
3231         must be concrete.
3232         (compound_svalue::compound_svalue): Move definition to svalue.cc.
3233         * store.cc (binding_map::apply_ctor_to_region): Handle
3234         initializers for trailing arrays with incomplete size.
3235         * svalue.cc (compound_svalue::compound_svalue): Move definition
3236         here from region-model.h.  Add assertion that all keys are
3237         concrete.
3238
3239 2020-08-22  David Malcolm  <dmalcolm@redhat.com>
3240
3241         PR analyzer/94851
3242         * region-model-manager.cc
3243         (region_model_manager::maybe_fold_binop): Fold bitwise "& 0" to 0.
3244
3245 2020-08-22  David Malcolm  <dmalcolm@redhat.com>
3246
3247         * store.cc (store::eval_alias): Make const.  Split out 2nd half
3248         into store::eval_alias_1 and call it twice for symmetry, avoiding
3249         test duplication.
3250         (store::eval_alias_1): New function, split out from the above.
3251         * store.h (store::eval_alias): Make const.
3252         (store::eval_alias_1): New decl.
3253
3254 2020-08-22  David Malcolm  <dmalcolm@redhat.com>
3255
3256         * region-model.cc (region_model::push_frame): Bind the default
3257         SSA name for each parm if it exists, falling back to the parm
3258         itself otherwise, rather than doing both.
3259
3260 2020-08-20  David Malcolm  <dmalcolm@redhat.com>
3261
3262         PR analyzer/96723
3263         * region-model-manager.cc
3264         (region_model_manager::get_field_region): Assert that field is a
3265         FIELD_DECL.
3266         * region.cc (region::get_subregions_for_binding): In
3267         union-handling, filter the TYPE_FIELDS traversal to just FIELD_DECLs.
3268
3269 2020-08-20  David Malcolm  <dmalcolm@redhat.com>
3270
3271         PR analyzer/96713
3272         * region-model.cc (region_model::get_gassign_result): For
3273         comparisons, only use eval_condition when the lhs has boolean
3274         type, and use get_or_create_constant_svalue on the boolean
3275         constants directly rather than via get_rvalue.
3276
3277 2020-08-19  David Malcolm  <dmalcolm@redhat.com>
3278
3279         PR analyzer/96643
3280         * region-model.cc (region_model::deref_rvalue): Rather than
3281         attempting to handle all svalue kinds in the switch, only cover
3282         the special cases, and move symbolic-region handling to after
3283         the switch, thus implicitly handling the missing case SK_COMPOUND.
3284
3285 2020-08-19  David Malcolm  <dmalcolm@redhat.com>
3286
3287         PR analyzer/96705
3288         * region-model-manager.cc
3289         (region_model_manager::maybe_fold_binop): Check that we have an
3290         integral type before calling build_int_cst.
3291
3292 2020-08-19  David Malcolm  <dmalcolm@redhat.com>
3293
3294         PR analyzer/96699
3295         * region-model-manager.cc
3296         (region_model_manager::get_or_create_cast): Use FIX_TRUNC_EXPR for
3297         casting from REAL_TYPE to INTEGER_TYPE.
3298
3299 2020-08-19  David Malcolm  <dmalcolm@redhat.com>
3300
3301         PR analyzer/96651
3302         * region-model.cc (region_model::called_from_main_p): New.
3303         (region_model::get_store_value): Move handling for globals into...
3304         (region_model::get_initial_value_for_global): ...this new
3305         function, and add logic for extracting values from decl
3306         initializers.
3307         * region-model.h (decl_region::get_svalue_for_constructor): New
3308         decl.
3309         (decl_region::get_svalue_for_initializer): New decl.
3310         (region_model::called_from_main_p): New decl.
3311         (region_model::get_initial_value_for_global): New.
3312         * region.cc (decl_region::maybe_get_constant_value): Move logic
3313         for getting an svalue from a CONSTRUCTOR node to...
3314         (decl_region::get_svalue_for_constructor): ...this new function.
3315         (decl_region::get_svalue_for_initializer): New.
3316         * store.cc (get_svalue_for_ctor_val): Rewrite in terms of
3317         region_model::get_rvalue.
3318         * store.h (binding_cluster::get_map): New accessor.
3319
3320 2020-08-19  David Malcolm  <dmalcolm@redhat.com>
3321
3322         PR analyzer/96648
3323         * region.cc (get_field_at_bit_offset): Gracefully handle negative
3324         values for bit_offset.
3325
3326 2020-08-18  David Malcolm  <dmalcolm@redhat.com>
3327
3328         * region-model.cc (region_model::get_rvalue_1): Fix name of local.
3329
3330 2020-08-18  David Malcolm  <dmalcolm@redhat.com>
3331
3332         PR analyzer/96641
3333         * region-model.cc (region_model::get_rvalue_1): Handle
3334         unrecognized tree codes by returning "UNKNOWN.
3335
3336 2020-08-18  David Malcolm  <dmalcolm@redhat.com>
3337
3338         PR analyzer/96640
3339         * region-model.cc (region_model::get_gassign_result): Handle various
3340         VEC_* tree codes by returning UNKNOWN.
3341         (region_model::on_assignment): Handle unrecognized tree codes by
3342         setting lhs to an unknown value, rather than issuing a "sorry" and
3343         asserting.
3344
3345 2020-08-17  David Malcolm  <dmalcolm@redhat.com>
3346
3347         PR analyzer/96644
3348         * region-model-manager.cc (get_region_for_unexpected_tree_code):
3349         Handle ctxt being NULL.
3350
3351 2020-08-17  David Malcolm  <dmalcolm@redhat.com>
3352
3353         PR analyzer/96639
3354         * region.cc (region::get_subregions_for_binding): Check for "type"
3355         being NULL.
3356
3357 2020-08-17  David Malcolm  <dmalcolm@redhat.com>
3358
3359         PR analyzer/96642
3360         * store.cc (get_svalue_for_ctor_val): New.
3361         (binding_map::apply_ctor_to_region): Call it.
3362
3363 2020-08-14  David Malcolm  <dmalcolm@redhat.com>
3364
3365         PR testsuite/96609
3366         PR analyzer/96616
3367         * region-model.cc (region_model::get_store_value): Call
3368         maybe_get_constant_value on decl_regions first.
3369         * region-model.h (decl_region::maybe_get_constant_value): New decl.
3370         * region.cc (decl_region::get_stack_depth): Likewise.
3371         (decl_region::maybe_get_constant_value): New.
3372         * store.cc (get_subregion_within_ctor): New.
3373         (binding_map::apply_ctor_to_region): New.
3374         * store.h (binding_map::apply_ctor_to_region): New decl.
3375
3376 2020-08-14  David Malcolm  <dmalcolm@redhat.com>
3377
3378         PR analyzer/96611
3379         * store.cc (store::mark_as_escaped): Reject attempts to
3380         get a cluster for an unknown pointer.
3381
3382 2020-08-13  David Malcolm  <dmalcolm@redhat.com>
3383
3384         PR analyzer/93032
3385         PR analyzer/93938
3386         PR analyzer/94011
3387         PR analyzer/94099
3388         PR analyzer/94399
3389         PR analyzer/94458
3390         PR analyzer/94503
3391         PR analyzer/94640
3392         PR analyzer/94688
3393         PR analyzer/94689
3394         PR analyzer/94839
3395         PR analyzer/95026
3396         PR analyzer/95042
3397         PR analyzer/95240
3398         * analyzer-logging.cc: Ignore "-Wformat-diag".
3399         (logger::enter_scope): Use inc_indent in both overloads.
3400         (logger::exit_scope): Use dec_indent.
3401         * analyzer-logging.h (logger::inc_indent): New.
3402         (logger::dec_indent): New.
3403         * analyzer-selftests.cc (run_analyzer_selftests): Call
3404         analyzer_store_cc_tests.
3405         * analyzer-selftests.h (analyzer_store_cc_tests): New decl.
3406         * analyzer.cc (get_stmt_location): New function.
3407         * analyzer.h (class initial_svalue): New forward decl.
3408         (class unaryop_svalue): New forward decl.
3409         (class binop_svalue): New forward decl.
3410         (class sub_svalue): New forward decl.
3411         (class unmergeable_svalue): New forward decl.
3412         (class placeholder_svalue): New forward decl.
3413         (class widening_svalue): New forward decl.
3414         (class compound_svalue): New forward decl.
3415         (class conjured_svalue): New forward decl.
3416         (svalue_set): New typedef.
3417         (class map_region): Delete.
3418         (class array_region): Delete.
3419         (class frame_region): New forward decl.
3420         (class function_region): New forward decl.
3421         (class label_region): New forward decl.
3422         (class decl_region): New forward decl.
3423         (class element_region): New forward decl.
3424         (class offset_region): New forward decl.
3425         (class cast_region): New forward decl.
3426         (class field_region): New forward decl.
3427         (class string_region): New forward decl.
3428         (class region_model_manager): New forward decl.
3429         (class store_manager): New forward decl.
3430         (class store): New forward decl.
3431         (class call_details): New forward decl.
3432         (struct svalue_id_merger_mapping): Delete.
3433         (struct canonicalization): Delete.
3434         (class function_point): New forward decl.
3435         (class engine): New forward decl.
3436         (dump_tree): New function decl.
3437         (print_quoted_type): New function decl.
3438         (readability_comparator): New function decl.
3439         (tree_cmp): New function decl.
3440         (class path_var): Move here from region-model.h
3441         (bit_offset_t, bit_size_t, byte_size_t): New typedefs.
3442         (class region_offset): New class.
3443         (get_stmt_location): New decl.
3444         (struct member_function_hash_traits): New struct.
3445         (class consolidation_map): New class.
3446         Ignore "-Wformat-diag".
3447         * analyzer.opt (-param=analyzer-max-svalue-depth=): New param.
3448         (-param=analyzer-max-enodes-for-full-dump=): New param.
3449         * call-string.cc: Ignore -Wformat-diag.
3450         * checker-path.cc: Move includes of "analyzer/call-string.h" and
3451         "analyzer/program-point.h" to before "analyzer/region-model.h",
3452         and also include "analyzer/store.h" before it.
3453         (state_change_event::state_change_event): Replace "tree var" param
3454         with "const svalue *sval".  Convert "origin" param from tree to
3455         "const svalue *".
3456         (state_change_event::get_desc): Call get_representative_tree to
3457         convert the var and origin from const svalue * to tree.  Use
3458         svalue::get_desc rather than %qE when describing state changes.
3459         (checker_path::add_final_event): Use get_stmt_location.
3460         * checker-path.h (state_change_event::state_change_event): Port
3461         from tree to const svalue *.
3462         (state_change_event::get_lvalue): Delete.
3463         (state_change_event::get_dest_function): New.
3464         (state_change_event::m_var): Replace with...
3465         (state_change_event::m_sval): ...this.
3466         (state_change_event::m_origin): Convert from tree to
3467         const svalue *.
3468         * constraint-manager.cc: Include "analyzer/call-string.h",
3469         "analyzer/program-point.h", and "analyzer/store.h" before
3470         "analyzer/region-model.h".
3471         (struct bound, struct range): Move to constraint-manager.h.
3472         (compare_constants): New function.
3473         (range::dump): Rename to...
3474         (range::dump_to_pp): ...this.  Support NULL constants.
3475         (range::dump): Reintroduce for dumping to stderr.
3476         (range::constrained_to_single_element): Return result, rather than
3477         writing to *OUT.
3478         (range::eval_condition): New.
3479         (range::below_lower_bound): New.
3480         (range::above_upper_bound): New.
3481         (equiv_class::equiv_class): Port from svalue_id to const svalue *.
3482         (equiv_class::print): Likewise.
3483         (equiv_class::hash): Likewise.
3484         (equiv_class::operator==): Port from svalue_id to const svalue *.
3485         (equiv_class::add): Port from svalue_id to const svalue *. Drop
3486         "cm" param.
3487         (equiv_class::del): Port from svalue_id to const svalue *.
3488         (equiv_class::get_representative): Likewise.
3489         (equiv_class::remap_svalue_ids): Delete.
3490         (svalue_id_cmp_by_id): Rename to...
3491         (svalue_cmp_by_ptr): ...this, porting from svalue_id to
3492         const svalue *.
3493         (equiv_class::canonicalize): Update qsort comparator.
3494         (constraint::implied_by): New.
3495         (constraint_manager::constraint_manager): Copy m_mgr in copy ctor.
3496         (constraint_manager::dump_to_pp): Add "multiline" param
3497         (constraint_manager::dump): Pass "true" for "multiline".
3498         (constraint_manager::add_constraint): Port from svalue_id to
3499         const svalue *.  Split out second part into...
3500         (constraint_manager::add_unknown_constraint): ...this new
3501         function.  Remove self-constraints when merging equivalence
3502         classes.
3503         (constraint_manager::add_constraint_internal): Remove constraints
3504         that would be implied by the new constraint.  Port from svalue_id
3505         to const svalue *.
3506         (constraint_manager::get_equiv_class_by_sid): Rename to...
3507         (constraint_manager::get_equiv_class_by_svalue): ...this, porting
3508         from svalue_id to const svalue *.
3509         (constraint_manager::get_or_add_equiv_class): Port from svalue_id
3510         to const svalue *.
3511         (constraint_manager::eval_condition): Make const.  Call
3512         compare_constants and return early if it provides a known result.
3513         (constraint_manager::get_ec_bounds): New.
3514         (constraint_manager::eval_condition): New overloads.  Make
3515         existing one const, and use compare_constants.
3516         (constraint_manager::purge): Convert "p" param to a template
3517         rather that an abstract base class.  Port from svalue_id to
3518         const svalue *.
3519         (class dead_svalue_purger): New class.
3520         (constraint_manager::remap_svalue_ids): Delete.
3521         (constraint_manager::on_liveness_change): New.
3522         (equiv_class_cmp): Port from svalue_id to const svalue *.
3523         (constraint_manager::canonicalize): Likewise.  Combine with
3524         purging of redundant equivalence classes and constraints.
3525         (class cleaned_constraint_manager): Delete.
3526         (class merger_fact_visitor): Make "m_cm_b" const.  Add "m_merger"
3527         field.
3528         (merger_fact_visitor::fact): Port from svalue_id to const svalue *.
3529         Add special case for widening.
3530         (constraint_manager::merge): Port from svalue_id to const svalue *.
3531         (constraint_manager::clean_merger_input): Delete.
3532         (constraint_manager::for_each_fact): Port from svalue_id to
3533         const svalue *.
3534         (constraint_manager::validate): Likewise.
3535         (selftest::test_constraint_conditions): Provide a
3536         region_model_manager when creating region_model instances.
3537         Add test for self-equality not creating equivalence classes.
3538         (selftest::test_transitivity): Provide a region_model_manager when
3539         creating region_model instances.  Verify that EC-merging happens
3540         when constraints are implied.
3541         (selftest::test_constant_comparisons):  Provide a
3542         region_model_manager when creating region_model instances.
3543         (selftest::test_constraint_impl): Likewise.  Remove over-specified
3544         assertions.
3545         (selftest::test_equality): Provide a region_model_manager when
3546         creating region_model instances.
3547         (selftest::test_many_constants): Likewise.  Provide a
3548         program_point when testing merging.
3549         (selftest::run_constraint_manager_tests): Move call to
3550         test_constant_comparisons to outside the transitivity guard.
3551         * constraint-manager.h (struct bound): Move here from
3552         constraint-manager.cc.
3553         (struct range): Likewise.
3554         (struct::eval_condition): New decl.
3555         (struct::below_lower_bound): New decl.
3556         (struct::above_upper_bound): New decl.
3557         (equiv_class::add): Port from svalue_id to const svalue *.
3558         (equiv_class::del): Likewise.
3559         (equiv_class::get_representative): Likewise.
3560         (equiv_class::remap_svalue_ids): Drop.
3561         (equiv_class::m_cst_sid): Convert to..
3562         (equiv_class::m_cst_sval): ...this.
3563         (equiv_class::m_vars): Port from svalue_id to const svalue *.
3564         (constraint::bool implied_by): New decl.
3565         (fact_visitor::on_fact): Port from svalue_id to const svalue *.
3566         (constraint_manager::constraint_manager): Add mgr param.
3567         (constraint_manager::clone): Delete.
3568         (constraint_manager::maybe_get_constant): Delete.
3569         (constraint_manager::get_sid_for_constant): Delete.
3570         (constraint_manager::get_num_svalues): Delete.
3571         (constraint_manager::dump_to_pp): Add "multiline" param.
3572         (constraint_manager::get_equiv_class): Port from svalue_id to
3573         const svalue *.
3574         (constraint_manager::add_constraint):  Likewise.
3575         (constraint_manager::get_equiv_class_by_sid): Rename to...
3576         (constraint_manager::get_equiv_class_by_svalue): ...this, porting
3577         from svalue_id to const svalue *.
3578         (constraint_manager::add_unknown_constraint): New decl.
3579         (constraint_manager::get_or_add_equiv_class): Port from svalue_id
3580         to const svalue *.
3581         (constraint_manager::eval_condition): Likewise.  Add overloads.
3582         (constraint_manager::get_ec_bounds): New decl.
3583         (constraint_manager::purge): Convert to template.
3584         (constraint_manager::remap_svalue_ids): Delete.
3585         (constraint_manager::on_liveness_change): New decl.
3586         (constraint_manager::canonicalize): Drop param.
3587         (constraint_manager::clean_merger_input): Delete.
3588         (constraint_manager::m_mgr): New field.
3589         * diagnostic-manager.cc: Move includes of
3590         "analyzer/call-string.h" and "analyzer/program-point.h" to before
3591         "analyzer/region-model.h", and also include "analyzer/store.h"
3592         before it.
3593         (saved_diagnostic::saved_diagnostic): Add "sval" param.
3594         (diagnostic_manager::diagnostic_manager): Add engine param.
3595         (diagnostic_manager::add_diagnostic): Add "sval" param, passing it
3596         to saved_diagnostic ctor.  Update overload to pass NULL for it.
3597         (dedupe_winners::dedupe_winners): Add engine param.
3598         (dedupe_winners::add): Add "eg" param.  Pass m_engine to
3599         feasible_p.
3600         (dedupe_winner::m_engine): New field.
3601         (diagnostic_manager::emit_saved_diagnostics): Pass engine to
3602         dedupe_winners.  Pass &eg when adding candidates.  Pass svalue
3603         rather than tree to prune_path.  Use get_stmt_location to get
3604         primary location of diagnostic.
3605         (diagnostic_manager::emit_saved_diagnostic): Likewise.
3606         (get_any_origin): Drop.
3607         (state_change_event_creator::on_global_state_change): Pass NULL
3608         const svalue * rather than NULL_TREE trees to state_change_event
3609         ctor.
3610         (state_change_event_creator::on_state_change): Port from tree and
3611         svalue_id to const svalue *.
3612         (for_each_state_change): Port from svalue_id to const svalue *.
3613         (struct null_assignment_sm_context): New.
3614         (diagnostic_manager::add_events_for_eedge):  Add state change
3615         events for assignment to NULL.
3616         (diagnostic_manager::prune_path): Update param from tree to
3617         const svalue *.
3618         (diagnostic_manager::prune_for_sm_diagnostic): Port from tracking
3619         by tree to by const svalue *.
3620         * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add sval
3621         param.
3622         (saved_diagnostic::m_sval): New field.
3623         (diagnostic_manager::diagnostic_manager): Add engine param.
3624         (diagnostic_manager::get_engine): New.
3625         (diagnostic_manager::add_diagnostic): Add "sval" param.
3626         (diagnostic_manager::prune_path): Likewise.
3627         (diagnostic_manager::prune_for_sm_diagnostic): New overload.
3628         (diagnostic_manager::m_eng): New field.
3629         * engine.cc: Move includes of "analyzer/call-string.h" and
3630         "analyzer/program-point.h" to before "analyzer/region-model.h",
3631         and also include "analyzer/store.h" before it.
3632         (impl_region_model_context::impl_region_model_context): Update for
3633         removal of m_change field.
3634         (impl_region_model_context::remap_svalue_ids): Delete.
3635         (impl_region_model_context::on_svalue_leak): New.
3636         (impl_region_model_context::on_svalue_purge): Delete.
3637         (impl_region_model_context::on_liveness_change): New.
3638         (impl_region_model_context::on_unknown_change): Update param
3639         from svalue_id to const svalue *.  Add is_mutable param.
3640         (setjmp_svalue::compare_fields): Delete.
3641         (setjmp_svalue::accept): New.
3642         (setjmp_svalue::add_to_hash): Delete.
3643         (setjmp_svalue::dump_to_pp): New.
3644         (setjmp_svalue::print_details): Delete.
3645         (impl_sm_context::impl_sm_context): Drop "change" param.
3646         (impl_sm_context::get_fndecl_for_call): Drop "m_change".
3647         (impl_sm_context::on_transition): Drop ATTRIBUTE_UNUSED from
3648         "stmt" param.  Drop m_change.  Port from svalue_id to
3649         const svalue *.
3650         (impl_sm_context::warn_for_state): Drop m_change.  Port from
3651         svalue_id to const svalue *.
3652         (impl_sm_context::get_readable_tree): Rename to...
3653         (impl_sm_context::get_diagnostic_tree): ...this.  Port from
3654         svalue_id to const svalue *.
3655         (impl_sm_context::is_zero_assignment): New.
3656         (impl_sm_context::m_change): Delete field.
3657         (leak_stmt_finder::find_stmt): Handle m_var being NULL.
3658         (readability):  Increase penalty for MEM_REF.  For SSA_NAMEs,
3659         slightly favor the underlying var over the SSA name.  Heavily
3660         penalize temporaries.  Handle RESULT_DECL.
3661         (readability_comparator): Make non-static.  Consider stack depths.
3662         (impl_region_model_context::on_state_leak): Convert from svalue_id
3663         to const svalue *, updating for region_model changes.  Use
3664         id_equal.
3665         (impl_region_model_context::on_inherited_svalue): Delete.
3666         (impl_region_model_context::on_cast): Delete.
3667         (impl_region_model_context::on_condition):  Drop m_change.
3668         (impl_region_model_context::on_phi): Likewise.
3669         (impl_region_model_context::on_unexpected_tree_code): Handle t
3670         being NULL.
3671         (point_and_state::validate): Update stack checking for
3672         region_model changes.
3673         (eg_traits::dump_args_t::show_enode_details_p): New.
3674         (exploded_node::exploded_node): Initialize m_num_processed_stmts.
3675         (exploded_node::get_processed_stmt): New function.
3676         (exploded_node::get_dot_fillcolor): Add more colors.
3677         (exploded_node::dump_dot): Guard the printing of the point and
3678         state with show_enode_details_p.  Print the processed stmts for
3679         this enode after the initial state.
3680         (exploded_node::dump_to_pp): Pass true for new multiline param
3681         of program_state::dump_to_pp.
3682         (exploded_node::on_stmt): Drop "change" param.  Log the stmt.
3683         Set input_location.  Implement __analyzer_describe.  Update
3684         implementation of __analyzer_dump and __analyzer_eval.
3685         Remove purging of sm-state for unknown fncalls from here.
3686         (exploded_node::on_edge): Drop "change" param.
3687         (exploded_node::on_longjmp): Port from region_id/svalue_id to
3688         const region */const svalue *.  Call program_state::detect_leaks.
3689         Drop state_change.
3690         (exploded_node::detect_leaks): Update for changes to region_model.
3691         Call program_state::detect_leaks.
3692         (exploded_edge::exploded_edge): Drop ext_state and change params.
3693         (exploded_edge::dump_dot): "args" is no longer used.  Drop dumping
3694         of m_change.
3695         (exploded_graph::exploded_graph): Pass engine to
3696         m_diagnostic_manager ctor.  Use program_point::origin.
3697         (exploded_graph::add_function_entry):  Drop ctxt.  Use
3698         program_state::push_frame.  Drop state_change.
3699         (exploded_graph::get_or_create_node): Drop "change" param.  Add
3700         "enode_for_diag" param.  Update dumping calls for API changes.
3701         Pass point to can_merge_with_p.  Show enode indices
3702         within -Wanalyzer-too-complex diagnostic for hitting the per-point
3703         limit.
3704         (exploded_graph::add_edge): Drop "change" param.  Log which nodes
3705         are being connected.  Update for changes to exploded_edge ctor.
3706         (exploded_graph::get_per_program_point_data): New.
3707         (exploded_graph::process_worklist): Pass point to
3708         can_merge_with_p.  Drop state_change.  Update dumping call for API
3709         change.
3710         (exploded_graph::process_node):  Drop state_change.  Split the
3711         node in-place if an sm-state-change occurs.  Update
3712         m_num_processed_stmts.  Update dumping calls for API change.
3713         (exploded_graph::log_stats): Call engine::log_stats.
3714         (exploded_graph::dump_states_for_supernode): Update dumping
3715         call.
3716         (exploded_path::feasible_p): Add "eng" and "eg" params.
3717         Rename "i" to "end_idx".  Pass the manager to the region_model
3718         ctor.  Update for every processed stmt in the enode, not just the
3719         first.  Keep track of which snodes have been visited, and call
3720         loop_replay_fixup when revisiting one.
3721         (enode_label::get_text): Update dump call for new param.
3722         (exploded_graph::dump_exploded_nodes): Likewise.
3723         (exploded_graph::get_node_by_index): New.
3724         (impl_run_checkers): Create engine instance and pass its address
3725         to extrinsic_state ctor.
3726         * exploded-graph.h
3727         (impl_region_model_context::impl_region_model_context): Drop
3728         "change" params.
3729         (impl_region_model_context::void remap_svalue_ids): Delete.
3730         (impl_region_model_context::on_svalue_purge): Delete.
3731         (impl_region_model_context::on_svalue_leak): New.
3732         (impl_region_model_context::on_liveness_change): New.
3733         (impl_region_model_context::on_state_leak): Update signature.
3734         (impl_region_model_context::on_inherited_svalue): Delete.
3735         (impl_region_model_context::on_cast): Delete.
3736         (impl_region_model_context::on_unknown_change): Update signature.
3737         (impl_region_model_context::m_change): Delete.
3738         (eg_traits::dump_args_t::show_enode_details_p): New.
3739         (exploded_node::on_stmt): Drop "change" param.
3740         (exploded_node::on_edge): Likewise.
3741         (exploded_node::get_processed_stmt): New decl.
3742         (exploded_node::m_num_processed_stmts): New field.
3743         (exploded_edge::exploded_edge): Drop ext_state and change params.
3744         (exploded_edge::m_change): Delete.
3745         (exploded_graph::get_engine): New accessor.
3746         (exploded_graph::get_or_create_node): Drop "change" param.  Add
3747         "enode_for_diag" param.
3748         (exploded_graph::add_edge): Drop "change" param.
3749         (exploded_graph::get_per_program_point_data): New decl.
3750         (exploded_graph::get_node_by_index): New decl.
3751         (exploded_path::feasible_p): Add "eng" and "eg" params.
3752         * program-point.cc: Include "analyzer/store.h" before including
3753         "analyzer/region-model.h".
3754         (function_point::function_point): Move here from
3755         program-point.h.
3756         (function_point::get_function): Likewise.
3757         (function_point::from_function_entry): Likewise.
3758         (function_point::before_supernode): Likewise.
3759         (function_point::next_stmt): New function.
3760         * program-point.h (function_point::function_point): Move
3761         implementation from here to program-point.cc.
3762         (function_point::get_function): Likewise.
3763         (function_point::from_function_entry): Likewise.
3764         (function_point::before_supernode): Likewise.
3765         (function_point::next_stmt): New decl.
3766         (program_point::operator!=): New.
3767         (program_point::origin): New.
3768         (program_point::next_stmt): New.
3769         (program_point::m_function_point): Make non-const.
3770         * program-state.cc: Move includes of "analyzer/call-string.h" and
3771         "analyzer/program-point.h" to before "analyzer/region-model.h",
3772         and also include "analyzer/store.h" before it.
3773         (extrinsic_state::get_model_manager): New.
3774         (sm_state_map::sm_state_map): Pass in sm and sm_idx to ctor,
3775         rather than pass the around.
3776         (sm_state_map::clone_with_remapping): Delete.
3777         (sm_state_map::print): Remove "sm" param in favor of "m_sm".  Add
3778         "simple" and "multiline" params and support multiline vs single
3779         line dumping.
3780         (sm_state_map::dump): Remove "sm" param in favor of "m_sm".  Add
3781         "simple" param.
3782         (sm_state_map::hash): Port from svalue_id to const svalue *.
3783         (sm_state_map::operator==): Likewise.
3784         (sm_state_map::get_state): Likewise.  Call canonicalize_svalue on
3785         input.  Handle inheritance of sm-state.  Call get_default_state.
3786         (sm_state_map::get_origin): Port from svalue_id to const svalue *.
3787         (sm_state_map::set_state): Likewise.  Pass in ext_state.  Reject
3788         attempts to set state on UNKNOWN.
3789         (sm_state_map::impl_set_state): Port from svalue_id to
3790         const svalue *.  Pass in ext_state.  Call canonicalize_svalue on
3791         input.
3792         (sm_state_map::purge_for_unknown_fncall): Delete.
3793         (sm_state_map::on_svalue_leak): New.
3794         (sm_state_map::remap_svalue_ids): Delete.
3795         (sm_state_map::on_liveness_change): New.
3796         (sm_state_map::on_unknown_change): Reimplement.
3797         (sm_state_map::on_svalue_purge): Delete.
3798         (sm_state_map::on_inherited_svalue): Delete.
3799         (sm_state_map::on_cast): Delete.
3800         (sm_state_map::validate): Delete.
3801         (sm_state_map::canonicalize_svalue): New.
3802         (program_state::program_state): Update to pass manager to
3803         region_model's ctor.  Constify num_states and pass state machine
3804         and index to sm_state_map ctor.
3805         (program_state::print): Update for changes to dump API.
3806         (program_state::dump_to_pp): Ignore the summarize param.  Add
3807         "multiline" param.
3808         (program_state::dump_to_file): Add "multiline" param.
3809         (program_state::dump): Pass "true" for new "multiline" param.
3810         (program_state::push_frame): New.
3811         (program_state::on_edge): Drop "change" param.  Call
3812         program_state::detect_leaks.
3813         (program_state::prune_for_point): Add enode_for_diag param.
3814         Reimplement based on store class.  Call detect_leaks
3815         (program_state::remap_svalue_ids): Delete.
3816         (program_state::get_representative_tree): Port from svalue_id to
3817         const svalue *.
3818         (program_state::can_merge_with_p): Add "point" param.  Add early
3819         reject for sm-differences.  Drop id remapping.
3820         (program_state::validate): Drop region model and sm_state_map
3821         validation.
3822         (state_change::sm_change::dump): Delete.
3823         (state_change::sm_change::remap_svalue_ids): Delete.
3824         (state_change::sm_change::on_svalue_purge): Delete.
3825         (log_set_of_svalues): New.
3826         (state_change::sm_change::validate): Delete.
3827         (state_change::state_change): Delete.
3828         (state_change::add_sm_change): Delete.
3829         (state_change::affects_p): Delete.
3830         (state_change::dump): Delete.
3831         (state_change::remap_svalue_ids): Delete.
3832         (state_change::on_svalue_purge): Delete.
3833         (state_change::validate): Delete.
3834         (selftest::assert_dump_eq): Delete.
3835         (ASSERT_DUMP_EQ): Delete.
3836         (selftest::test_sm_state_map): Update for changes to region_model
3837         and sm_state_map, porting from svalue_id to const svalue *.
3838         (selftest::test_program_state_dumping): Likewise.  Drop test of
3839         dumping, renaming to...
3840         (selftest::test_program_state_1): ...this.
3841         (selftest::test_program_state_dumping_2): Likewise, renaming to...
3842         (selftest::test_program_state_2): ...this.
3843         (selftest::test_program_state_merging): Update for changes to
3844         region_model.
3845         (selftest::test_program_state_merging_2): Likewise.
3846         (selftest::analyzer_program_state_cc_tests): Update for renamed
3847         tests.
3848         * program-state.h (extrinsic_state::extrinsic_state): Add logger
3849         and engine params.
3850         (extrinsic_state::get_logger): New accessor.
3851         (extrinsic_state::get_engine): New accessor.
3852         (extrinsic_state::get_model_manager): New accessor.
3853         (extrinsic_state::m_logger): New field.
3854         (extrinsic_state::m_engine): New field.
3855         (struct default_hash_traits<svalue_id>): Delete.
3856         (pod_hash_traits<svalue_id>::hash): Delete.
3857         (pod_hash_traits<svalue_id>::equal): Delete.
3858         (pod_hash_traits<svalue_id>::mark_deleted): Delete.
3859         (pod_hash_traits<svalue_id>::mark_empty): Delete.
3860         (pod_hash_traits<svalue_id>::is_deleted): Delete.
3861         (pod_hash_traits<svalue_id>::is_empty): Delete.
3862         (sm_state_map::entry_t::entry_t): Port from svalue_id to
3863         const svalue *.
3864         (sm_state_map::entry_t::m_origin): Likewise.
3865         (sm_state_map::map_t): Likewise.
3866         (sm_state_map::sm_state_map): Add state_machine and index params.
3867         (sm_state_map::clone_with_remapping): Delete.
3868         (sm_state_map::print):  Drop sm param; add simple and multiline
3869         params.
3870         (sm_state_map::dump): Drop sm param; add simple param.
3871         (sm_state_map::get_state): Port from svalue_id to const svalue *.
3872         Add ext_state param.
3873         (sm_state_map::get_origin): Likewise.
3874         (sm_state_map::set_state): Likewise.
3875         (sm_state_map::impl_set_state): Likewise.
3876         (sm_state_map::purge_for_unknown_fncall): Delete.
3877         (sm_state_map::remap_svalue_ids): Delete.
3878         (sm_state_map::on_svalue_purge): Delete.
3879         (sm_state_map::on_svalue_leak): New.
3880         (sm_state_map::on_liveness_change): New.
3881         (sm_state_map::on_inherited_svalue): Delete.
3882         (sm_state_map::on_cast): Delete.
3883         (sm_state_map::validate): Delete.
3884         (sm_state_map::on_unknown_change): Port from svalue_id to
3885         const svalue *.  Add is_mutable and ext_state params.
3886         (sm_state_map::canonicalize_svalue): New.
3887         (sm_state_map::m_sm): New field.
3888         (sm_state_map::m_sm_idx): New field.
3889         (program_state::operator=): Delete.
3890         (program_state::dump_to_pp): Drop "summarize" param, adding
3891         "simple" and "multiline".
3892         (program_state::dump_to_file): Likewise.
3893         (program_state::dump): Rename "summarize" to "simple".
3894         (program_state::push_frame): New.
3895         (program_state::get_current_function): New.
3896         (program_state::on_edge): Drop "change" param.
3897         (program_state::prune_for_point): Likewise.  Add enode_for_diag
3898         param.
3899         (program_state::remap_svalue_ids): Delete.
3900         (program_state::get_representative_tree): Port from svalue_id to
3901         const svalue *.
3902         (program_state::can_purge_p): Likewise.  Pass ext_state to get_state.
3903         (program_state::can_merge_with_p): Add point param.
3904         (program_state::detect_leaks): New.
3905         (state_change_visitor::on_state_change): Port from tree and
3906         svalue_id to a pair of const svalue *.
3907         (class state_change): Delete.
3908         * region.cc: New file.
3909         * region-model-impl-calls.cc: New file.
3910         * region-model-manager.cc: New file.
3911         * region-model-reachability.cc: New file.
3912         * region-model-reachability.h: New file.
3913         * region-model.cc: Include "analyzer/call-string.h",
3914         "analyzer/program-point.h", and "analyzer/store.h" before
3915         "analyzer/region-model.h".  Include
3916         "analyzer/region-model-reachability.h".
3917         (dump_tree): Make non-static.
3918         (dump_quoted_tree): Make non-static.
3919         (print_quoted_type): Make non-static.
3920         (path_var::dump): Delete.
3921         (dump_separator): Delete.
3922         (class impl_constraint_manager): Delete.
3923         (svalue_id::print): Delete.
3924         (svalue_id::dump_node_name_to_pp): Delete.
3925         (svalue_id::validate): Delete.
3926         (region_id::print): Delete.
3927         (region_id::dump_node_name_to_pp): Delete.
3928         (region_id::validate): Delete.
3929         (region_id_set::region_id_set): Delete.
3930         (svalue_id_set::svalue_id_set): Delete.
3931         (svalue::operator==): Delete.
3932         (svalue::hash): Delete.
3933         (svalue::print): Delete.
3934         (svalue::dump_dot_to_pp): Delete.
3935         (svalue::remap_region_ids): Delete.
3936         (svalue::walk_for_canonicalization): Delete.
3937         (svalue::get_child_sid): Delete.
3938         (svalue::maybe_get_constant): Delete.
3939         (region_svalue::compare_fields): Delete.
3940         (region_svalue::add_to_hash): Delete.
3941         (region_svalue::print_details): Delete.
3942         (region_svalue::dump_dot_to_pp): Delete.
3943         (region_svalue::remap_region_ids): Delete.
3944         (region_svalue::merge_values): Delete.
3945         (region_svalue::walk_for_canonicalization): Delete.
3946         (region_svalue::eval_condition): Delete.
3947         (constant_svalue::compare_fields): Delete.
3948         (constant_svalue::add_to_hash): Delete.
3949         (constant_svalue::merge_values): Delete.
3950         (constant_svalue::eval_condition): Move to svalue.cc.
3951         (constant_svalue::print_details): Delete.
3952         (constant_svalue::get_child_sid): Delete.
3953         (unknown_svalue::compare_fields): Delete.
3954         (unknown_svalue::add_to_hash): Delete.
3955         (unknown_svalue::print_details): Delete.
3956         (poison_kind_to_str): Move to svalue.cc.
3957         (poisoned_svalue::compare_fields): Delete.
3958         (poisoned_svalue::add_to_hash): Delete.
3959         (poisoned_svalue::print_details): Delete.
3960         (region_kind_to_str): Move to region.cc and reimplement.
3961         (region::operator==): Delete.
3962         (region::get_parent_region): Delete.
3963         (region::set_value): Delete.
3964         (region::become_active_view): Delete.
3965         (region::deactivate_any_active_view): Delete.
3966         (region::deactivate_view): Delete.
3967         (region::get_value): Delete.
3968         (region::get_inherited_child_sid): Delete.
3969         (region_model::copy_region): Delete.
3970         (region_model::copy_struct_region): Delete.
3971         (region_model::copy_union_region): Delete.
3972         (region_model::copy_array_region): Delete.
3973         (region::hash): Delete.
3974         (region::print): Delete.
3975         (region::dump_dot_to_pp): Delete.
3976         (region::dump_to_pp): Delete.
3977         (region::dump_child_label): Delete.
3978         (region::validate): Delete.
3979         (region::remap_svalue_ids): Delete.
3980         (region::remap_region_ids): Delete.
3981         (region::add_view): Delete.
3982         (region::get_view): Delete.
3983         (region::region): Move to region.cc.
3984         (region::add_to_hash): Delete.
3985         (region::print_fields): Delete.
3986         (region::non_null_p): Delete.
3987         (primitive_region::clone): Delete.
3988         (primitive_region::walk_for_canonicalization): Delete.
3989         (map_region::map_region): Delete.
3990         (map_region::compare_fields): Delete.
3991         (map_region::print_fields): Delete.
3992         (map_region::validate): Delete.
3993         (map_region::dump_dot_to_pp): Delete.
3994         (map_region::dump_child_label): Delete.
3995         (map_region::get_or_create): Delete.
3996         (map_region::get): Delete.
3997         (map_region::add_to_hash): Delete.
3998         (map_region::remap_region_ids): Delete.
3999         (map_region::unbind): Delete.
4000         (map_region::get_tree_for_child_region): Delete.
4001         (map_region::get_tree_for_child_region): Delete.
4002         (tree_cmp): Move to region.cc.
4003         (map_region::can_merge_p): Delete.
4004         (map_region::walk_for_canonicalization): Delete.
4005         (map_region::get_value_by_name): Delete.
4006         (struct_or_union_region::valid_key_p): Delete.
4007         (struct_or_union_region::compare_fields): Delete.
4008         (struct_region::clone): Delete.
4009         (struct_region::compare_fields): Delete.
4010         (union_region::clone): Delete.
4011         (union_region::compare_fields): Delete.
4012         (frame_region::compare_fields): Delete.
4013         (frame_region::clone): Delete.
4014         (frame_region::valid_key_p): Delete.
4015         (frame_region::print_fields): Delete.
4016         (frame_region::add_to_hash): Delete.
4017         (globals_region::compare_fields): Delete.
4018         (globals_region::clone): Delete.
4019         (globals_region::valid_key_p): Delete.
4020         (code_region::compare_fields): Delete.
4021         (code_region::clone): Delete.
4022         (code_region::valid_key_p): Delete.
4023         (array_region::array_region): Delete.
4024         (array_region::get_element): Delete.
4025         (array_region::clone): Delete.
4026         (array_region::compare_fields): Delete.
4027         (array_region::print_fields): Delete.
4028         (array_region::validate): Delete.
4029         (array_region::dump_dot_to_pp): Delete.
4030         (array_region::dump_child_label): Delete.
4031         (array_region::get_or_create): Delete.
4032         (array_region::get): Delete.
4033         (array_region::add_to_hash): Delete.
4034         (array_region::remap_region_ids): Delete.
4035         (array_region::get_key_for_child_region): Delete.
4036         (array_region::key_cmp): Delete.
4037         (array_region::walk_for_canonicalization): Delete.
4038         (array_region::key_from_constant): Delete.
4039         (array_region::constant_from_key): Delete.
4040         (function_region::compare_fields): Delete.
4041         (function_region::clone): Delete.
4042         (function_region::valid_key_p): Delete.
4043         (stack_region::stack_region): Delete.
4044         (stack_region::compare_fields): Delete.
4045         (stack_region::clone): Delete.
4046         (stack_region::print_fields): Delete.
4047         (stack_region::dump_child_label): Delete.
4048         (stack_region::validate): Delete.
4049         (stack_region::push_frame): Delete.
4050         (stack_region::get_current_frame_id): Delete.
4051         (stack_region::pop_frame): Delete.
4052         (stack_region::add_to_hash): Delete.
4053         (stack_region::remap_region_ids): Delete.
4054         (stack_region::can_merge_p): Delete.
4055         (stack_region::walk_for_canonicalization): Delete.
4056         (stack_region::get_value_by_name): Delete.
4057         (heap_region::heap_region): Delete.
4058         (heap_region::compare_fields): Delete.
4059         (heap_region::clone): Delete.
4060         (heap_region::walk_for_canonicalization): Delete.
4061         (root_region::root_region): Delete.
4062         (root_region::compare_fields): Delete.
4063         (root_region::clone): Delete.
4064         (root_region::print_fields): Delete.
4065         (root_region::validate): Delete.
4066         (root_region::dump_child_label): Delete.
4067         (root_region::push_frame): Delete.
4068         (root_region::get_current_frame_id): Delete.
4069         (root_region::pop_frame): Delete.
4070         (root_region::ensure_stack_region): Delete.
4071         (root_region::get_stack_region): Delete.
4072         (root_region::ensure_globals_region): Delete.
4073         (root_region::get_code_region): Delete.
4074         (root_region::ensure_code_region): Delete.
4075         (root_region::get_globals_region): Delete.
4076         (root_region::ensure_heap_region): Delete.
4077         (root_region::get_heap_region): Delete.
4078         (root_region::remap_region_ids): Delete.
4079         (root_region::can_merge_p): Delete.
4080         (root_region::add_to_hash): Delete.
4081         (root_region::walk_for_canonicalization): Delete.
4082         (root_region::get_value_by_name): Delete.
4083         (symbolic_region::symbolic_region): Delete.
4084         (symbolic_region::compare_fields): Delete.
4085         (symbolic_region::clone): Delete.
4086         (symbolic_region::walk_for_canonicalization): Delete.
4087         (symbolic_region::print_fields): Delete.
4088         (region_model::region_model): Add region_model_manager * param.
4089         Reimplement in terms of store, dropping impl_constraint_manager
4090         subclass.
4091         (region_model::operator=): Reimplement in terms of store
4092         (region_model::operator==): Likewise.
4093         (region_model::hash): Likewise.
4094         (region_model::print): Delete.
4095         (region_model::print_svalue): Delete.
4096         (region_model::dump_dot_to_pp): Delete.
4097         (region_model::dump_dot_to_file): Delete.
4098         (region_model::dump_dot): Delete.
4099         (region_model::dump_to_pp): Replace "summarize" param with
4100         "simple" and "multiline".  Port to store-based implementation.
4101         (region_model::dump): Replace "summarize" param with "simple" and
4102         "multiline".
4103         (dump_vec_of_tree): Delete.
4104         (region_model::dump_summary_of_rep_path_vars): Delete.
4105         (region_model::validate): Delete.
4106         (svalue_id_cmp_by_constant_svalue_model): Delete.
4107         (svalue_id_cmp_by_constant_svalue): Delete.
4108         (region_model::canonicalize): Drop "ctxt" param.  Reimplement in
4109         terms of store and constraints.
4110         (region_model::canonicalized_p): Remove NULL arg to canonicalize.
4111         (region_model::loop_replay_fixup): New.
4112         (poisoned_value_diagnostic::emit): Tweak wording of warnings.
4113         (region_model::check_for_poison): Delete.
4114         (region_model::get_gassign_result): New.
4115         (region_model::on_assignment): Port to store-based implementation.
4116         (region_model::on_call_pre): Delete calls to check_for_poison.
4117         Move implementations to region-model-impl-calls.c and port to
4118         store-based implementation.
4119         (region_model::on_call_post): Likewise.
4120         (class reachable_regions): Move to region-model-reachability.h/cc
4121         and port to store-based implementation.
4122         (region_model::handle_unrecognized_call): Port to store-based
4123         implementation.
4124         (region_model::get_reachable_svalues): New.
4125         (region_model::on_setjmp): Port to store-based implementation.
4126         (region_model::on_longjmp): Likewise.
4127         (region_model::handle_phi): Drop is_back_edge param and the logic
4128         using it.
4129         (region_model::get_lvalue_1): Port from region_id to const region *.
4130         (region_model::make_region_for_unexpected_tree_code): Delete.
4131         (assert_compat_types): If the check fails, use internal_error to
4132         show the types.
4133         (region_model::get_lvalue): Port from region_id to const region *.
4134         (region_model::get_rvalue_1): Port from svalue_id to const svalue *.
4135         (region_model::get_rvalue): Likewise.
4136         (region_model::get_or_create_ptr_svalue): Delete.
4137         (region_model::get_or_create_constant_svalue): Delete.
4138         (region_model::get_svalue_for_fndecl): Delete.
4139         (region_model::get_region_for_fndecl): Delete.
4140         (region_model::get_svalue_for_label): Delete.
4141         (region_model::get_region_for_label): Delete.
4142         (build_cast): Delete.
4143         (region_model::maybe_cast_1): Delete.
4144         (region_model::maybe_cast): Delete.
4145         (region_model::get_field_region): Delete.
4146         (region_model::get_store_value): New.
4147         (region_model::region_exists_p): New.
4148         (region_model::deref_rvalue): Port from svalue_id to const svalue *.
4149         (region_model::set_value): Likewise.
4150         (region_model::clobber_region): New.
4151         (region_model::purge_region): New.
4152         (region_model::zero_fill_region): New.
4153         (region_model::mark_region_as_unknown): New.
4154         (region_model::eval_condition): Port from svalue_id to
4155         const svalue *.
4156         (region_model::eval_condition_without_cm): Likewise.
4157         (region_model::compare_initial_and_pointer): New.
4158         (region_model::add_constraint): Port from svalue_id to
4159         const svalue *.
4160         (region_model::maybe_get_constant): Delete.
4161         (region_model::get_representative_path_var): New.
4162         (region_model::add_new_malloc_region): Delete.
4163         (region_model::get_representative_tree): Port to const svalue *.
4164         (region_model::get_representative_path_var): Port to
4165         const region *.
4166         (region_model::get_path_vars_for_svalue): Delete.
4167         (region_model::set_to_new_unknown_value): Delete.
4168         (region_model::update_for_phis): Don't pass is_back_edge to handle_phi.
4169         (region_model::update_for_call_superedge): Port from svalue_id to
4170         const svalue *.
4171         (region_model::update_for_return_superedge): Port to store-based
4172         implementation.
4173         (region_model::update_for_call_summary): Replace
4174         set_to_new_unknown_value with mark_region_as_unknown.
4175         (region_model::get_root_region): Delete.
4176         (region_model::get_stack_region_id): Delete.
4177         (region_model::push_frame): Delete.
4178         (region_model::get_current_frame_id): Delete.
4179         (region_model::get_current_function): Delete.
4180         (region_model::pop_frame): Delete.
4181         (region_model::on_top_level_param): New.
4182         (region_model::get_stack_depth): Delete.
4183         (region_model::get_function_at_depth): Delete.
4184         (region_model::get_globals_region_id): Delete.
4185         (region_model::add_svalue): Delete.
4186         (region_model::replace_svalue): Delete.
4187         (region_model::add_region): Delete.
4188         (region_model::get_svalue): Delete.
4189         (region_model::get_region): Delete.
4190         (make_region_for_type): Delete.
4191         (region_model::add_region_for_type): Delete.
4192         (region_model::on_top_level_param): New.
4193         (class restrict_to_used_svalues): Delete.
4194         (region_model::purge_unused_svalues): Delete.
4195         (region_model::push_frame): New.
4196         (region_model::remap_svalue_ids): Delete.
4197         (region_model::remap_region_ids): Delete.
4198         (region_model::purge_regions): Delete.
4199         (region_model::get_descendents): Delete.
4200         (region_model::delete_region_and_descendents): Delete.
4201         (region_model::poison_any_pointers_to_bad_regions): Delete.
4202         (region_model::can_merge_with_p): Delete.
4203         (region_model::get_current_function): New.
4204         (region_model::get_value_by_name): Delete.
4205         (region_model::convert_byte_offset_to_array_index): Delete.
4206         (region_model::pop_frame): New.
4207         (region_model::get_or_create_mem_ref): Delete.
4208         (region_model::get_stack_depth): New.
4209         (region_model::get_frame_at_index): New.
4210         (region_model::unbind_region_and_descendents): New.
4211         (struct bad_pointer_finder): New.
4212         (region_model::get_or_create_pointer_plus_expr): Delete.
4213         (region_model::poison_any_pointers_to_descendents): New.
4214         (region_model::get_or_create_view): Delete.
4215         (region_model::can_merge_with_p): New.
4216         (region_model::get_fndecl_for_call):  Port from svalue_id to
4217         const svalue *.
4218         (struct append_ssa_names_cb_data): New.
4219         (get_ssa_name_regions_for_current_frame): New.
4220         (region_model::append_ssa_names_cb): New.
4221         (model_merger::dump_to_pp): Add "simple" param.  Drop dumping of
4222         remappings.
4223         (model_merger::dump): Add "simple" param to both overloads.
4224         (model_merger::can_merge_values_p): Delete.
4225         (model_merger::record_regions): Delete.
4226         (model_merger::record_svalues): Delete.
4227         (svalue_id_merger_mapping::svalue_id_merger_mapping): Delete.
4228         (svalue_id_merger_mapping::dump_to_pp): Delete.
4229         (svalue_id_merger_mapping::dump): Delete.
4230         (region_model::create_region_for_heap_alloc): New.
4231         (region_model::create_region_for_alloca): New.
4232         (region_model::record_dynamic_extents): New.
4233         (canonicalization::canonicalization): Delete.
4234         (canonicalization::walk_rid): Delete.
4235         (canonicalization::walk_sid): Delete.
4236         (canonicalization::dump_to_pp): Delete.
4237         (canonicalization::dump): Delete.
4238         (inchash::add): Delete overloads for svalue_id and region_id.
4239         (engine::log_stats): New.
4240         (assert_condition): Add overload comparing svalues.
4241         (assert_dump_eq): Pass "true" for multiline.
4242         (selftest::test_dump): Update for rewrite of region_model.
4243         (selftest::test_dump_2): Rename to...
4244         (selftest::test_struct): ...this.  Provide a region_model_manager
4245         when creating region_model instance.  Remove dump test.  Add
4246         checks for get_offset.
4247         (selftest::test_dump_3): Rename to...
4248         (selftest::test_array_1): ...this.  Provide a region_model_manager
4249         when creating region_model instance.  Remove dump test.
4250         (selftest::test_get_representative_tree): Port from svalue_id to
4251         new API.  Add test coverage for various expressions.
4252         (selftest::test_unique_constants): Provide a region_model_manager
4253         for the region_model.  Add test coverage for comparing const vs
4254         non-const.
4255         (selftest::test_svalue_equality): Delete.
4256         (selftest::test_region_equality): Delete.
4257         (selftest::test_unique_unknowns): New.
4258         (class purge_all_svalue_ids): Delete.
4259         (class purge_one_svalue_id): Delete.
4260         (selftest::test_purging_by_criteria): Delete.
4261         (selftest::test_initial_svalue_folding): New.
4262         (selftest::test_unaryop_svalue_folding): New.
4263         (selftest::test_binop_svalue_folding): New.
4264         (selftest::test_sub_svalue_folding): New.
4265         (selftest::test_purge_unused_svalues): Delete.
4266         (selftest::test_descendent_of_p): New.
4267         (selftest::test_assignment): Provide a region_model_manager for
4268         the region_model.  Drop the dump test.
4269         (selftest::test_compound_assignment): Likewise.
4270         (selftest::test_stack_frames): Port to new implementation.
4271         (selftest::test_get_representative_path_var): Likewise.
4272         (selftest::test_canonicalization_1): Rename to...
4273         (selftest::test_equality_1): ...this.  Port to new API, and add
4274         (selftest::test_canonicalization_2): Provide a
4275         region_model_manager when creating region_model instances.
4276         Remove redundant canicalization.
4277         (selftest::test_canonicalization_3): Provide a
4278         region_model_manager when creating region_model instances.
4279         Remove param from calls to region_model::canonicalize.
4280         (selftest::test_canonicalization_4): Likewise.
4281         (selftest::assert_region_models_merge): Constify
4282         out_merged_svalue.  Port to new API.
4283         (selftest::test_state_merging): Provide a
4284         region_model_manager when creating region_model instances.
4285         Provide a program_point point when merging them.  Replace
4286         set_to_new_unknown_value with usage of placeholder_svalues.
4287         Drop get_value_by_name.  Port from svalue_id to const svalue *.
4288         Add test of heap allocation.
4289         (selftest::test_constraint_merging):  Provide a
4290         region_model_manager when creating region_model instances.
4291         Provide a program_point point when merging them.  Eliminate use
4292         of set_to_new_unknown_value.
4293         (selftest::test_widening_constraints): New.
4294         (selftest::test_iteration_1): New.
4295         (selftest::test_malloc_constraints): Port to store-based
4296         implementation.
4297         (selftest::test_var): New test.
4298         (selftest::test_array_2): New test.
4299         (selftest::test_mem_ref): New test.
4300         (selftest::test_POINTER_PLUS_EXPR_then_MEM_REF): New.
4301         (selftest::test_malloc): New.
4302         (selftest::test_alloca): New.
4303         (selftest::analyzer_region_model_cc_tests): Update for renamings.
4304         Call new functions.
4305         * region-model.h (class path_var): Move to analyzer.h.
4306         (class svalue_id): Delete.
4307         (class region_id): Delete.
4308         (class id_map): Delete.
4309         (svalue_id_map): Delete.
4310         (region_id_map): Delete.
4311         (id_map<T>::id_map): Delete.
4312         (id_map<T>::put): Delete.
4313         (id_map<T>::get_dst_for_src): Delete.
4314         (id_map<T>::get_src_for_dst): Delete.
4315         (id_map<T>::dump_to_pp): Delete.
4316         (id_map<T>::dump): Delete.
4317         (id_map<T>::update): Delete.
4318         (one_way_svalue_id_map): Delete.
4319         (one_way_region_id_map): Delete.
4320         (class region_id_set): Delete.
4321         (class svalue_id_set): Delete.
4322         (struct complexity): New.
4323         (class visitor): New.
4324         (enum svalue_kind): Add SK_SETJMP, SK_INITIAL, SK_UNARYOP,
4325         SK_BINOP, SK_SUB,SK_UNMERGEABLE, SK_PLACEHOLDER, SK_WIDENING,
4326         SK_COMPOUND, and SK_CONJURED.
4327         (svalue::operator==): Delete.
4328         (svalue::operator!=): Delete.
4329         (svalue::clone): Delete.
4330         (svalue::hash): Delete.
4331         (svalue::dump_dot_to_pp): Delete.
4332         (svalue::dump_to_pp): New.
4333         (svalue::dump): New.
4334         (svalue::get_desc): New.
4335         (svalue::dyn_cast_initial_svalue): New.
4336         (svalue::dyn_cast_unaryop_svalue): New.
4337         (svalue::dyn_cast_binop_svalue): New.
4338         (svalue::dyn_cast_sub_svalue): New.
4339         (svalue::dyn_cast_unmergeable_svalue): New.
4340         (svalue::dyn_cast_widening_svalue): New.
4341         (svalue::dyn_cast_compound_svalue): New.
4342         (svalue::dyn_cast_conjured_svalue): New.
4343         (svalue::maybe_undo_cast): New.
4344         (svalue::unwrap_any_unmergeable): New.
4345         (svalue::remap_region_ids): Delete
4346         (svalue::can_merge_p): New.
4347         (svalue::walk_for_canonicalization): Delete
4348         (svalue::get_complexity): New.
4349         (svalue::get_child_sid): Delete
4350         (svalue::accept): New.
4351         (svalue::live_p): New.
4352         (svalue::implicitly_live_p): New.
4353         (svalue::svalue): Add complexity param.
4354         (svalue::add_to_hash): Delete
4355         (svalue::print_details): Delete
4356         (svalue::m_complexity): New field.
4357         (region_svalue::key_t): New struct.
4358         (region_svalue::region_svalue): Port from region_id to
4359         const region_id *.  Add complexity.
4360         (region_svalue::compare_fields): Delete.
4361         (region_svalue::clone): Delete.
4362         (region_svalue::dump_dot_to_pp): Delete.
4363         (region_svalue::get_pointee): Port from region_id to
4364         const region_id *.
4365         (region_svalue::remap_region_ids): Delete.
4366         (region_svalue::merge_values): Delete.
4367         (region_svalue::dump_to_pp): New.
4368         (region_svalue::accept): New.
4369         (region_svalue::walk_for_canonicalization): Delete.
4370         (region_svalue::eval_condition): Make params const.
4371         (region_svalue::add_to_hash): Delete.
4372         (region_svalue::print_details): Delete.
4373         (region_svalue::m_rid): Replace with...
4374         (region_svalue::m_reg): ...this.
4375         (is_a_helper <region_svalue *>::test): Convert to...
4376         (is_a_helper <const region_svalue *>::test): ...this.
4377         (template <> struct default_hash_traits<region_svalue::key_t>):
4378         New.
4379         (constant_svalue::constant_svalue): Add complexity.
4380         (constant_svalue::compare_fields): Delete.
4381         (constant_svalue::clone): Delete.
4382         (constant_svalue::add_to_hash): Delete.
4383         (constant_svalue::dump_to_pp): New.
4384         (constant_svalue::accept): New.
4385         (constant_svalue::implicitly_live_p): New.
4386         (constant_svalue::merge_values): Delete.
4387         (constant_svalue::eval_condition): Make params const.
4388         (constant_svalue::get_child_sid): Delete.
4389         (constant_svalue::print_details): Delete.
4390         (is_a_helper <constant_svalue *>::test): Convert to...
4391         (is_a_helper <const constant_svalue *>::test): ...this.
4392         (class unknown_svalue): Update leading comment.
4393         (unknown_svalue::unknown_svalue): Add complexity.
4394         (unknown_svalue::compare_fields): Delete.
4395         (unknown_svalue::add_to_hash): Delete.
4396         (unknown_svalue::dyn_cast_unknown_svalue): Delete.
4397         (unknown_svalue::print_details): Delete.
4398         (unknown_svalue::dump_to_pp): New.
4399         (unknown_svalue::accept): New.
4400         (poisoned_svalue::key_t): New struct.
4401         (poisoned_svalue::poisoned_svalue): Add complexity.
4402         (poisoned_svalue::compare_fields): Delete.
4403         (poisoned_svalue::clone): Delete.
4404         (poisoned_svalue::add_to_hash): Delete.
4405         (poisoned_svalue::dump_to_pp): New.
4406         (poisoned_svalue::accept): New.
4407         (poisoned_svalue::print_details): Delete.
4408         (is_a_helper <poisoned_svalue *>::test): Convert to...
4409         (is_a_helper <const poisoned_svalue *>::test): ...this.
4410         (template <> struct default_hash_traits<poisoned_svalue::key_t>):
4411         New.
4412         (setjmp_record::add_to_hash): New.
4413         (setjmp_svalue::key_t): New struct.
4414         (setjmp_svalue::compare_fields): Delete.
4415         (setjmp_svalue::clone): Delete.
4416         (setjmp_svalue::add_to_hash): Delete.
4417         (setjmp_svalue::setjmp_svalue): Add complexity.
4418         (setjmp_svalue::dump_to_pp): New.
4419         (setjmp_svalue::accept): New.
4420         (setjmp_svalue::void print_details): Delete.
4421         (is_a_helper <const setjmp_svalue *>::test): New.
4422         (template <> struct default_hash_traits<setjmp_svalue::key_t>): New.
4423         (class initial_svalue : public svalue): New.
4424         (is_a_helper <const initial_svalue *>::test): New.
4425         (class unaryop_svalue): New.
4426         (is_a_helper <const unaryop_svalue *>::test): New.
4427         (template <> struct default_hash_traits<unaryop_svalue::key_t>): New.
4428         (class binop_svalue): New.
4429         (is_a_helper <const binop_svalue *>::test): New.
4430         (template <> struct default_hash_traits<binop_svalue::key_t>): New.
4431         (class sub_svalue): New.
4432         (is_a_helper <const sub_svalue *>::test): New.
4433         (template <> struct default_hash_traits<sub_svalue::key_t>): New.
4434         (class unmergeable_svalue): New.
4435         (is_a_helper <const unmergeable_svalue *>::test): New.
4436         (class placeholder_svalue): New.
4437         (is_a_helper <placeholder_svalue *>::test): New.
4438         (class widening_svalue): New.
4439         (is_a_helper <widening_svalue *>::test): New.
4440         (template <> struct default_hash_traits<widening_svalue::key_t>): New.
4441         (class compound_svalue): New.
4442         (is_a_helper <compound_svalue *>::test): New.
4443         (template <> struct default_hash_traits<compound_svalue::key_t>): New.
4444         (class conjured_svalue): New.
4445         (is_a_helper <conjured_svalue *>::test): New.
4446         (template <> struct default_hash_traits<conjured_svalue::key_t>): New.
4447         (enum region_kind): Delete RK_PRIMITIVE, RK_STRUCT, RK_UNION, and
4448         RK_ARRAY.  Add RK_LABEL, RK_DECL, RK_FIELD, RK_ELEMENT, RK_OFFSET,
4449         RK_CAST, RK_HEAP_ALLOCATED, RK_ALLOCA, RK_STRING, and RK_UNKNOWN.
4450         (region_kind_to_str): Delete.
4451         (region::~region): Move implementation to region.cc.
4452         (region::operator==): Delete.
4453         (region::operator!=): Delete.
4454         (region::clone): Delete.
4455         (region::get_id): New.
4456         (region::cmp_ids): New.
4457         (region::dyn_cast_map_region): Delete.
4458         (region::dyn_cast_array_region): Delete.
4459         (region::region_id get_parent): Delete.
4460         (region::get_parent_region): Convert to a simple accessor.
4461         (region::void set_value): Delete.
4462         (region::svalue_id get_value): Delete.
4463         (region::svalue_id get_value_direct): Delete.
4464         (region::svalue_id get_inherited_child_sid): Delete.
4465         (region::dyn_cast_frame_region): New.
4466         (region::dyn_cast_function_region): New.
4467         (region::dyn_cast_decl_region): New.
4468         (region::dyn_cast_field_region): New.
4469         (region::dyn_cast_element_region): New.
4470         (region::dyn_cast_offset_region): New.
4471         (region::dyn_cast_cast_region): New.
4472         (region::dyn_cast_string_region): New.
4473         (region::accept): New.
4474         (region::get_base_region): New.
4475         (region::base_region_p): New.
4476         (region::descendent_of_p): New.
4477         (region::maybe_get_frame_region): New.
4478         (region::maybe_get_decl): New.
4479         (region::hash): Delete.
4480         (region::rint): Delete.
4481         (region::dump_dot_to_pp): Delete.
4482         (region::get_desc): New.
4483         (region::dump_to_pp): Convert to vfunc, changing signature.
4484         (region::dump_child_label): Delete.
4485         (region::remap_svalue_ids): Delete.
4486         (region::remap_region_ids): Delete.
4487         (region::dump): New.
4488         (region::walk_for_canonicalization): Delete.
4489         (region::non_null_p): Drop region_model param.
4490         (region::add_view): Delete.
4491         (region::get_view): Delete.
4492         (region::get_active_view): Delete.
4493         (region::is_view_p): Delete.
4494         (region::cmp_ptrs): New.
4495         (region::validate): Delete.
4496         (region::get_offset): New.
4497         (region::get_byte_size): New.
4498         (region::get_bit_size): New.
4499         (region::get_subregions_for_binding): New.
4500         (region::region): Add complexity param.  Convert parent from
4501         region_id to const region *.  Drop svalue_id.  Drop copy ctor.
4502         (region::symbolic_for_unknown_ptr_p): New.
4503         (region::add_to_hash): Delete.
4504         (region::print_fields): Delete.
4505         (region::get_complexity): New accessor.
4506         (region::become_active_view): Delete.
4507         (region::deactivate_any_active_view): Delete.
4508         (region::deactivate_view): Delete.
4509         (region::calc_offset): New.
4510         (region::m_parent_rid): Delete.
4511         (region::m_sval_id): Delete.
4512         (region::m_complexity): New.
4513         (region::m_id): New.
4514         (region::m_parent): New.
4515         (region::m_view_rids): Delete.
4516         (region::m_is_view): Delete.
4517         (region::m_active_view_rid): Delete.
4518         (region::m_cached_offset): New.
4519         (is_a_helper <region *>::test): Convert to...
4520         (is_a_helper <const region *>::test): ... this.
4521         (class primitive_region): Delete.
4522         (class space_region): New.
4523         (class map_region): Delete.
4524         (is_a_helper <map_region *>::test): Delete.
4525         (class frame_region): Reimplement.
4526         (template <> struct default_hash_traits<frame_region::key_t>):
4527         New.
4528         (class globals_region): Reimplement.
4529         (is_a_helper <globals_region *>::test): Convert to...
4530         (is_a_helper <const globals_region *>::test): ...this.
4531         (class struct_or_union_region): Delete.
4532         (is_a_helper <struct_or_union_region *>::test): Delete.
4533         (class code_region): Reimplement.
4534         (is_a_helper <const code_region *>::test): New.
4535         (class struct_region): Delete.
4536         (is_a_helper <struct_region *>::test): Delete.
4537         (class function_region): Reimplement.
4538         (is_a_helper <function_region *>::test): Convert to...
4539         (is_a_helper <const function_region *>::test): ...this.
4540         (class union_region): Delete.
4541         (is_a_helper <union_region *>::test): Delete.
4542         (class label_region): New.
4543         (is_a_helper <const label_region *>::test): New.
4544         (class scope_region): Delete.
4545         (class stack_region): Reimplement.
4546         (is_a_helper <stack_region *>::test): Convert to...
4547         (is_a_helper <const stack_region *>::test): ...this.
4548         (class heap_region): Reimplement.
4549         (is_a_helper <heap_region *>::test): Convert to...
4550         (is_a_helper <const heap_region *>::test): ...this.
4551         (class root_region): Reimplement.
4552         (is_a_helper <root_region *>::test): Convert to...
4553         (is_a_helper <const root_region *>::test): ...this.
4554         (class symbolic_region): Reimplement.
4555         (is_a_helper <const symbolic_region *>::test): New.
4556         (template <> struct default_hash_traits<symbolic_region::key_t>):
4557         New.
4558         (class decl_region): New.
4559         (is_a_helper <const decl_region *>::test): New.
4560         (class field_region): New.
4561         (template <> struct default_hash_traits<field_region::key_t>): New.
4562         (class array_region): Delete.
4563         (class element_region): New.
4564         (is_a_helper <array_region *>::test): Delete.
4565         (is_a_helper <const element_region *>::test): New.
4566         (template <> struct default_hash_traits<element_region::key_t>):
4567         New.
4568         (class offset_region): New.
4569         (is_a_helper <const offset_region *>::test): New.
4570         (template <> struct default_hash_traits<offset_region::key_t>):
4571         New.
4572         (class cast_region): New.
4573         (is_a_helper <const cast_region *>::test): New.
4574         (template <> struct default_hash_traits<cast_region::key_t>): New.
4575         (class heap_allocated_region): New.
4576         (class alloca_region): New.
4577         (class string_region): New.
4578         (is_a_helper <const string_region *>::test): New.
4579         (class unknown_region): New.
4580         (class region_model_manager): New.
4581         (struct append_ssa_names_cb_data): New.
4582         (class call_details): New.
4583         (region_model::region_model): Add region_model_manager param.
4584         (region_model::print_svalue): Delete.
4585         (region_model::dump_dot_to_pp): Delete.
4586         (region_model::dump_dot_to_file): Delete.
4587         (region_model::dump_dot): Delete.
4588         (region_model::dump_to_pp): Drop summarize param in favor of
4589         simple and multiline.
4590         (region_model::dump): Likewise.
4591         (region_model::summarize_to_pp): Delete.
4592         (region_model::summarize): Delete.
4593         (region_model::void canonicalize): Drop ctxt param.
4594         (region_model::void check_for_poison): Delete.
4595         (region_model::get_gassign_result): New.
4596         (region_model::impl_call_alloca): New.
4597         (region_model::impl_call_analyzer_describe): New.
4598         (region_model::impl_call_analyzer_eval): New.
4599         (region_model::impl_call_builtin_expect): New.
4600         (region_model::impl_call_calloc): New.
4601         (region_model::impl_call_free): New.
4602         (region_model::impl_call_malloc): New.
4603         (region_model::impl_call_memset): New.
4604         (region_model::impl_call_strlen): New.
4605         (region_model::get_reachable_svalues): New.
4606         (region_model::handle_phi): Drop is_back_edge param.
4607         (region_model::region_id get_root_rid): Delete.
4608         (region_model::root_region *get_root_region): Delete.
4609         (region_model::region_id get_stack_region_id): Delete.
4610         (region_model::push_frame): Convert from region_id and svalue_id
4611         to const region * and const svalue *.
4612         (region_model::get_current_frame_id): Replace with...
4613         (region_model::get_current_frame): ...this.
4614         (region_model::pop_frame): Convert from region_id to
4615         const region *.  Drop purge and stats param.  Add out_result.
4616         (region_model::function *get_function_at_depth): Delete.
4617         (region_model::get_globals_region_id): Delete.
4618         (region_model::add_svalue): Delete.
4619         (region_model::replace_svalue): Delete.
4620         (region_model::add_region): Delete.
4621         (region_model::add_region_for_type): Delete.
4622         (region_model::get_svalue): Delete.
4623         (region_model::get_region): Delete.
4624         (region_model::get_lvalue): Convert from region_id to
4625         const region *.
4626         (region_model::get_rvalue): Convert from svalue_id to
4627         const svalue *.
4628         (region_model::get_or_create_ptr_svalue): Delete.
4629         (region_model::get_or_create_constant_svalue): Delete.
4630         (region_model::get_svalue_for_fndecl): Delete.
4631         (region_model::get_svalue_for_label): Delete.
4632         (region_model::get_region_for_fndecl): Delete.
4633         (region_model::get_region_for_label): Delete.
4634         (region_model::get_frame_at_index (int index) const;): New.
4635         (region_model::maybe_cast): Delete.
4636         (region_model::maybe_cast_1): Delete.
4637         (region_model::get_field_region): Delete.
4638         (region_model::id deref_rvalue): Convert from region_id and
4639         svalue_id to const region * and const svalue *.  Drop overload,
4640         passing in both a tree and an svalue.
4641         (region_model::set_value): Convert from region_id and svalue_id to
4642         const region * and const svalue *.
4643         (region_model::set_to_new_unknown_value): Delete.
4644         (region_model::clobber_region (const region *reg);): New.
4645         (region_model::purge_region (const region *reg);): New.
4646         (region_model::zero_fill_region (const region *reg);): New.
4647         (region_model::mark_region_as_unknown (const region *reg);): New.
4648         (region_model::copy_region): Convert from region_id to
4649         const region *.
4650         (region_model::eval_condition): Convert from svalue_id to
4651         const svalue *.
4652         (region_model::eval_condition_without_cm): Likewise.
4653         (region_model::compare_initial_and_pointer): New.
4654         (region_model:maybe_get_constant): Delete.
4655         (region_model::add_new_malloc_region): Delete.
4656         (region_model::get_representative_tree): Convert from svalue_id to
4657         const svalue *.
4658         (region_model::get_representative_path_var): Delete decl taking a
4659         region_id in favor of two decls, for svalue vs region, with an
4660         svalue_set to ensure termination.
4661         (region_model::get_path_vars_for_svalue): Delete.
4662         (region_model::create_region_for_heap_alloc): New.
4663         (region_model::create_region_for_alloca): New.
4664         (region_model::purge_unused_svalues): Delete.
4665         (region_model::remap_svalue_ids): Delete.
4666         (region_model::remap_region_ids): Delete.
4667         (region_model::purge_regions): Delete.
4668         (region_model::get_num_svalues): Delete.
4669         (region_model::get_num_regions): Delete.
4670         (region_model::get_descendents): Delete.
4671         (region_model::get_store): New.
4672         (region_model::delete_region_and_descendents): Delete.
4673         (region_model::get_manager): New.
4674         (region_model::unbind_region_and_descendents): New.
4675         (region_model::can_merge_with_p): Add point param.  Drop
4676         svalue_id_merger_mapping.
4677         (region_model::get_value_by_name): Delete.
4678         (region_model::convert_byte_offset_to_array_index): Delete.
4679         (region_model::get_or_create_mem_ref): Delete.
4680         (region_model::get_or_create_pointer_plus_expr): Delete.
4681         (region_model::get_or_create_view): Delete.
4682         (region_model::get_lvalue_1): Convert from region_id to
4683         const region *.
4684         (region_model::get_rvalue_1): Convert from svalue_id to
4685         const svalue *.
4686         (region_model::get_ssa_name_regions_for_current_frame): New.
4687         (region_model::append_ssa_names_cb): New.
4688         (region_model::get_store_value): New.
4689         (region_model::copy_struct_region): Delete.
4690         (region_model::copy_union_region): Delete.
4691         (region_model::copy_array_region): Delete.
4692         (region_model::region_exists_p): New.
4693         (region_model::make_region_for_unexpected_tree_code): Delete.
4694         (region_model::loop_replay_fixup): New.
4695         (region_model::poison_any_pointers_to_bad_regions): Delete.
4696         (region_model::poison_any_pointers_to_descendents): New.
4697         (region_model::dump_summary_of_rep_path_vars): Delete.
4698         (region_model::on_top_level_param): New.
4699         (region_model::record_dynamic_extents): New.
4700         (region_model::m_mgr;): New.
4701         (region_model::m_store;): New.
4702         (region_model::m_svalues;): Delete.
4703         (region_model::m_regions;): Delete.
4704         (region_model::m_root_rid;): Delete.
4705         (region_model::m_current_frame;): New.
4706         (region_model_context::remap_svalue_ids): Delete.
4707         (region_model_context::can_purge_p): Delete.
4708         (region_model_context::on_svalue_leak): New.
4709         (region_model_context::on_svalue_purge): Delete.
4710         (region_model_context::on_liveness_change): New.
4711         (region_model_context::on_inherited_svalue): Delete.
4712         (region_model_context::on_cast): Delete.
4713         (region_model_context::on_unknown_change): Convert from svalue_id to
4714         const svalue * and add is_mutable.
4715         (class noop_region_model_context): Update for region_model_context
4716         changes.
4717         (model_merger::model_merger): Add program_point.  Drop
4718         svalue_id_merger_mapping.
4719         (model_merger::dump_to_pp): Add "simple" param.
4720         (model_merger::dump): Likewise.
4721         (model_merger::get_region_a): Delete.
4722         (model_merger::get_region_b): Delete.
4723         (model_merger::can_merge_values_p): Delete.
4724         (model_merger::record_regions): Delete.
4725         (model_merger::record_svalues): Delete.
4726         (model_merger::m_point): New field.
4727         (model_merger::m_map_regions_from_a_to_m): Delete.
4728         (model_merger::m_map_regions_from_b_to_m): Delete.
4729         (model_merger::m_sid_mapping): Delete.
4730         (struct svalue_id_merger_mapping): Delete.
4731         (class engine): New.
4732         (struct canonicalization): Delete.
4733         (inchash::add): Delete decls for hashing svalue_id and region_id.
4734         (test_region_model_context::on_unexpected_tree_code): Require t to
4735         be non-NULL.
4736         (selftest::assert_condition): Add overload comparing a pair of
4737         const svalue *.
4738         * sm-file.cc: Include "tristate.h", "selftest.h",
4739         "analyzer/call-string.h", "analyzer/program-point.h",
4740         "analyzer/store.h", and "analyzer/region-model.h".
4741         (fileptr_state_machine::get_default_state): New.
4742         (fileptr_state_machine::on_stmt): Remove calls to
4743         get_readable_tree in favor of get_diagnostic_tree.
4744         * sm-malloc.cc: Include "tristate.h", "selftest.h",
4745         "analyzer/call-string.h", "analyzer/program-point.h",
4746         "analyzer/store.h", and "analyzer/region-model.h".
4747         (malloc_state_machine::get_default_state): New.
4748         (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New.
4749         (malloc_diagnostic::describe_state_change): Handle change.m_expr
4750         being NULL.
4751         (null_arg::emit): Avoid printing "NULL '0'".
4752         (null_arg::describe_final_event): Avoid printing "(0) NULL".
4753         (malloc_leak::emit): Handle m_arg being NULL.
4754         (malloc_leak::describe_final_event): Handle ev.m_expr being NULL.
4755         (malloc_state_machine::on_stmt): Don't call get_readable_tree.
4756         Call get_diagnostic_tree when creating pending diagnostics.
4757         Update for is_zero_assignment becoming a member function of
4758         sm_ctxt.
4759         Don't transition to m_non_heap for ADDR_EXPR(MEM_REF()).
4760         (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New
4761         vfunc implementation.
4762         * sm-sensitive.cc (sensitive_state_machine::warn_for_any_exposure): Call
4763         get_diagnostic_tree and pass the result to warn_for_state.
4764         * sm-signal.cc: Move includes of "analyzer/call-string.h" and
4765         "analyzer/program-point.h" to before "analyzer/region-model.h",
4766         and also include "analyzer/store.h" before it.
4767         (signal_unsafe_call::describe_state_change): Use
4768         get_dest_function to get handler.
4769         (update_model_for_signal_handler): Pass manager to region_model
4770         ctor.
4771         (register_signal_handler::impl_transition): Update for changes to
4772         get_or_create_node and add_edge.
4773         * sm-taint.cc (taint_state_machine::on_stmt): Remove calls to
4774         get_readable_tree, replacing them when calling warn_for_state with
4775         calls to get_diagnostic_tree.
4776         * sm.cc (is_zero_assignment): Delete.
4777         (any_pointer_p): Move to within namespace ana.
4778         * sm.h (is_zero_assignment): Remove decl.
4779         (any_pointer_p): Move decl to within namespace ana.
4780         (state_machine::get_default_state): New vfunc.
4781         (state_machine::reset_when_passed_to_unknown_fn_p): New vfunc.
4782         (sm_context::get_readable_tree): Rename to...
4783         (sm_context::get_diagnostic_tree): ...this.
4784         (sm_context::is_zero_assignment): New vfunc.
4785         * store.cc: New file.
4786         * store.h: New file.
4787         * svalue.cc: New file.
4788
4789 2020-05-22  Mark Wielaard  <mark@klomp.org>
4790
4791         * sm-signal.cc(signal_unsafe_call::emit): Possibly add
4792         gcc_rich_location note for replacement.
4793         (signal_unsafe_call::get_replacement_fn): New private function.
4794         (get_async_signal_unsafe_fns): Add "exit".
4795
4796 2020-04-28  David Malcolm  <dmalcolm@redhat.com>
4797
4798         PR analyzer/94816
4799         * engine.cc (impl_region_model_context::on_unexpected_tree_code):
4800         Handle NULL tree.
4801         * region-model.cc (region_model::add_region_for_type): Handle
4802         NULL type.
4803         * region-model.h
4804         (test_region_model_context::on_unexpected_tree_code): Handle NULL
4805         tree.
4806
4807 2020-04-28  David Malcolm  <dmalcolm@redhat.com>
4808
4809         PR analyzer/94447
4810         PR analyzer/94639
4811         PR analyzer/94732
4812         PR analyzer/94754
4813         * analyzer.opt (Wanalyzer-use-of-uninitialized-value): Delete.
4814         * program-state.cc (selftest::test_program_state_dumping): Update
4815         expected dump result for removal of "uninit".
4816         * region-model.cc (poison_kind_to_str): Delete POISON_KIND_UNINIT
4817         case.
4818         (root_region::ensure_stack_region): Initialize stack with null
4819         svalue_id rather than with a typeless POISON_KIND_UNINIT value.
4820         (root_region::ensure_heap_region): Likewise for the heap.
4821         (region_model::dump_summary_of_rep_path_vars): Remove
4822         summarization of uninit values.
4823         (region_model::validate): Remove check that the stack has a
4824         POISON_KIND_UNINIT value.
4825         (poisoned_value_diagnostic::emit): Remove POISON_KIND_UNINIT
4826         case.
4827         (poisoned_value_diagnostic::describe_final_event): Likewise.
4828         (selftest::test_dump): Update expected dump result for removal of
4829         "uninit".
4830         (selftest::test_svalue_equality): Remove "uninit" and "freed".
4831         * region-model.h (enum poison_kind): Remove POISON_KIND_UNINIT.
4832
4833 2020-04-01  David Malcolm  <dmalcolm@redhat.com>
4834
4835         PR analyzer/94378
4836         * checker-path.cc: Include "bitmap.h".
4837         * constraint-manager.cc: Likewise.
4838         * diagnostic-manager.cc: Likewise.
4839         * engine.cc: Likewise.
4840         (exploded_node::detect_leaks): Pass null region_id to pop_frame.
4841         * program-point.cc: Include "bitmap.h".
4842         * program-state.cc: Likewise.
4843         * region-model.cc (id_set<region_id>::id_set): Convert to...
4844         (region_id_set::region_id_set): ...this.
4845         (svalue_id_set::svalue_id_set): New ctor.
4846         (region_model::copy_region): New function.
4847         (region_model::copy_struct_region): New function.
4848         (region_model::copy_union_region): New function.
4849         (region_model::copy_array_region): New function.
4850         (stack_region::pop_frame): Drop return value.  Add
4851         "result_dst_rid" param; if it is non-null, use copy_region to copy
4852         the result to it.  Rather than capture and pass a single "known
4853         used" return value to be used by purge_unused_values, instead
4854         gather and pass a set of known used return values.
4855         (root_region::pop_frame): Drop return value.  Add "result_dst_rid"
4856         param.
4857         (region_model::on_assignment): Use copy_region.
4858         (region_model::on_return): Likewise for the result.
4859         (region_model::on_longjmp): Pass null for pop_frame's
4860         result_dst_rid.
4861         (region_model::update_for_return_superedge): Pass the region for the
4862         return value of the call, if any, to pop_frame, rather than setting
4863         the lvalue for the lhs of the result.
4864         (region_model::pop_frame): Drop return value.  Add
4865         "result_dst_rid" param.
4866         (region_model::purge_unused_svalues): Convert third param from an
4867         svalue_id * to an svalue_id_set *, updating the initial populating
4868         of the "used" bitmap accordingly.  Don't remap it when done.
4869         (struct selftest::coord_test): New selftest fixture, extracted from...
4870         (selftest::test_dump_2): ...here.
4871         (selftest::test_compound_assignment): New selftest.
4872         (selftest::test_stack_frames): Pass null to new param of pop_frame.
4873         (selftest::analyzer_region_model_cc_tests): Call the new selftest.
4874         * region-model.h (class id_set): Delete template.
4875         (class region_id_set): Reimplement, using old id_set implementation.
4876         (class svalue_id_set): Likewise.  Convert from auto_sbitmap to
4877         auto_bitmap.
4878         (region::get_active_view): New accessor.
4879         (stack_region::pop_frame): Drop return value.  Add
4880         "result_dst_rid" param.
4881         (root_region::pop_frame): Likewise.
4882         (region_model::pop_frame): Likewise.
4883         (region_model::copy_region): New decl.
4884         (region_model::purge_unused_svalues): Convert third param from an
4885         svalue_id * to an svalue_id_set *.
4886         (region_model::copy_struct_region): New decl.
4887         (region_model::copy_union_region): New decl.
4888         (region_model::copy_array_region): New decl.
4889
4890 2020-03-27  David Malcolm  <dmalcolm@redhat.com>
4891
4892         * program-state.cc (selftest::test_program_state_dumping): Update
4893         expected dump to include symbolic_region's possibly_null field.
4894         * region-model.cc (symbolic_region::print_fields): New vfunc
4895         implementation.
4896         (region_model::add_constraint): Clear m_possibly_null from
4897         symbolic_regions now known to be non-NULL.
4898         (selftest::test_malloc_constraints): New selftest.
4899         (selftest::analyzer_region_model_cc_tests): Call it.
4900         * region-model.h (region::dyn_cast_symbolic_region): Add non-const
4901         overload.
4902         (symbolic_region::dyn_cast_symbolic_region): Implement it.
4903         (symbolic_region::print_fields): New vfunc override decl.
4904
4905 2020-03-27  David Malcolm  <dmalcolm@redhat.com>
4906
4907         * analyzer.h (class feasibility_problem): New forward decl.
4908         * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
4909         Initialize new fields m_status, m_epath_length, and m_problem.
4910         (saved_diagnostic::~saved_diagnostic): Delete m_problem.
4911         (dedupe_candidate::dedupe_candidate): Convert "sd" param from a
4912         const ref to a mutable ptr.
4913         (dedupe_winners::add): Convert "sd" param from a const ref to a
4914         mutable ptr.  Record the length of the exploded_path.  Record the
4915         feasibility/infeasibility of sd into sd, capturing a
4916         feasibility_problem when feasible_p fails, and storing it in sd.
4917         (diagnostic_manager::emit_saved_diagnostics): Update for pass by
4918         ptr rather than by const ref.
4919         * diagnostic-manager.h (class saved_diagnostic): Add new enum
4920         status.  Add fields m_status, m_epath_length and m_problem.
4921         (saved_diagnostic::set_feasible): New member function.
4922         (saved_diagnostic::set_infeasible): New member function.
4923         (saved_diagnostic::get_feasibility_problem): New accessor.
4924         (saved_diagnostic::get_status): New accessor.
4925         (saved_diagnostic::set_epath_length): New member function.
4926         (saved_diagnostic::get_epath_length): New accessor.
4927         * engine.cc: Include "gimple-pretty-print.h".
4928         (exploded_path::feasible_p): Add OUT param and, if non-NULL, write
4929         a new feasibility_problem to it on failure.
4930         (viz_callgraph_node::dump_dot): Convert begin_tr calls to
4931         begin_trtd.  Convert end_tr calls to end_tdtr.
4932         (class exploded_graph_annotator): New subclass of dot_annotator.
4933         (impl_run_checkers): Add a second -fdump-analyzer-supergraph dump
4934         after the analysis runs, using exploded_graph_annotator. dumping
4935         to DUMP_BASE_NAME.supergraph-eg.dot.
4936         * exploded-graph.h (exploded_node::get_dot_fillcolor): Make
4937         public.
4938         (exploded_path::feasible_p): Add OUT param.
4939         (class feasibility_problem): New class.
4940         * state-purge.cc (state_purge_annotator::add_node_annotations):
4941         Return a bool, add a "within_table" param.
4942         (print_vec_of_names): Convert begin_tr calls to begin_trtd.
4943         Convert end_tr calls to end_tdtr.
4944         (state_purge_annotator::add_stmt_annotations): Add "within_row"
4945         param.
4946         * state-purge.h ((state_purge_annotator::add_node_annotations):
4947         Return a bool, add a "within_table" param.
4948         (state_purge_annotator::add_stmt_annotations): Add "within_row"
4949         param.
4950         * supergraph.cc (supernode::dump_dot): Call add_node_annotations
4951         twice: as before, passing false for "within_table", then again
4952         with true when within the TABLE element.  Convert some begin_tr
4953         calls to begin_trtd, and some end_tr calls to end_tdtr.
4954         Repeat each add_stmt_annotations call, distinguishing between
4955         calls that add TRs and those that add TDs to an existing TR.
4956         Add a call to add_after_node_annotations.
4957         * supergraph.h (dot_annotator::add_node_annotations): Add a
4958         "within_table" param.
4959         (dot_annotator::add_stmt_annotations): Add a "within_row" param.
4960         (dot_annotator::add_after_node_annotations): New vfunc.
4961
4962 2020-03-27  David Malcolm  <dmalcolm@redhat.com>
4963
4964         * diagnostic-manager.cc (dedupe_winners::add): Show the
4965         exploded_node index in the log messages.
4966         (diagnostic_manager::emit_saved_diagnostics): Log a summary of
4967         m_saved_diagnostics at entry.
4968
4969 2020-03-27  David Malcolm  <dmalcolm@redhat.com>
4970
4971         * supergraph.cc (superedge::dump): Add space before description;
4972         move newline to non-pretty_printer overload.
4973
4974 2020-03-18  David Malcolm  <dmalcolm@redhat.com>
4975
4976         * region-model.cc: Include "stor-layout.h".
4977         (region_model::dump_to_pp): Rather than calling
4978         dump_summary_of_map on each of the current frame and the globals,
4979         instead get a vec of representative path_vars for all regions,
4980         and then dump a summary of all of them.
4981         (region_model::dump_summary_of_map): Delete, rewriting into...
4982         (region_model::dump_summary_of_rep_path_vars): ...this new
4983         function, working on a vec of path_vars.
4984         (region_model::set_value): New overload.
4985         (region_model::get_representative_path_var): Rename
4986         "parent_region" local to "parent_reg" and consolidate with other
4987         local.  Guard test for grandparent being stack on parent_reg being
4988         non-NULL.  Move handling for parent being an array_region to
4989         within guard for parent_reg being non-NULL.
4990         (selftest::make_test_compound_type): New function.
4991         (selftest::test_dump_2): New selftest.
4992         (selftest::test_dump_3): New selftest.
4993         (selftest::test_stack_frames): Update expected output from
4994         simplified dump to show "a" and "b" from parent frame and "y" in
4995         child frame.
4996         (selftest::analyzer_region_model_cc_tests): Call test_dump_2 and
4997         test_dump_3.
4998         * region-model.h (region_model::set_value): New overload decl.
4999         (region_model::dump_summary_of_map): Delete.
5000         (region_model::dump_summary_of_rep_path_vars): New.
5001
5002 2020-03-18  David Malcolm  <dmalcolm@redhat.com>
5003
5004         * region-model.h (class noop_region_model_context): New subclass
5005         of region_model_context.
5006         (class tentative_region_model_context): Inherit from
5007         noop_region_model_context rather than from region_model_context;
5008         drop redundant vfunc implementations.
5009         (class test_region_model_context): Likewise.
5010
5011 2020-03-18  David Malcolm  <dmalcolm@redhat.com>
5012
5013         * engine.cc (exploded_node::exploded_node): Move implementation
5014         here from header; accept point_and_state by const reference rather
5015         than by value.
5016         * exploded-graph.h (exploded_node::exploded_node): Pass
5017         point_and_state by const reference rather than by value.  Move
5018         body to engine.cc.
5019
5020 2020-03-18  Jakub Jelinek  <jakub@redhat.com>
5021
5022         * sm-malloc.cc (malloc_state_machine::on_stmt): Fix up duplicated word
5023         issue in a comment.
5024         * region-model.cc (region_model::make_region_for_unexpected_tree_code,
5025         region_model::delete_region_and_descendents): Likewise.
5026         * engine.cc (class exploded_cluster): Likewise.
5027         * diagnostic-manager.cc (class path_builder): Likewise.
5028
5029 2020-03-13  David Malcolm  <dmalcolm@redhat.com>
5030
5031         PR analyzer/94099
5032         PR analyzer/94105
5033         * diagnostic-manager.cc (for_each_state_change): Bulletproof
5034         against errors in get_rvalue by passing a
5035         tentative_region_model_context and rejecting if there's an error.
5036         * region-model.cc (region_model::get_lvalue_1): When handling
5037         ARRAY_REF, handle results of error-handling.  Handle NOP_EXPR.
5038
5039 2020-03-06  David Malcolm  <dmalcolm@redhat.com>
5040
5041         * analyzer.h (class array_region): New forward decl.
5042         * program-state.cc (selftest::test_program_state_dumping_2): New.
5043         (selftest::analyzer_program_state_cc_tests): Call it.
5044         * region-model.cc (array_region::constant_from_key): New.
5045         (region_model::get_representative_tree): Handle region_svalue by
5046         generating an ADDR_EXPR.
5047         (region_model::get_representative_path_var): In view handling,
5048         remove erroneous TREE_TYPE when determining the type of the tree.
5049         Handle array regions and STRING_CST.
5050         (selftest::assert_dump_tree_eq): New.
5051         (ASSERT_DUMP_TREE_EQ): New macro.
5052         (selftest::test_get_representative_tree): New selftest.
5053         (selftest::analyzer_region_model_cc_tests): Call it.
5054         * region-model.h (region::dyn_cast_array_region): New vfunc.
5055         (array_region::dyn_cast_array_region): New vfunc implementation.
5056         (array_region::constant_from_key): New decl.
5057
5058 2020-03-06  David Malcolm  <dmalcolm@redhat.com>
5059
5060         * analyzer.h (dump_quoted_tree): New decl.
5061         * engine.cc (exploded_node::dump_dot): Pass region model to
5062         sm_state_map::print.
5063         * program-state.cc: Include diagnostic-core.h.
5064         (sm_state_map::print): Add "model" param and use it to print
5065         representative trees.  Only print origin information if non-null.
5066         (sm_state_map::dump): Pass NULL for model to print call.
5067         (program_state::print): Pass region model to sm_state_map::print.
5068         (program_state::dump_to_pp): Use spaces rather than newlines when
5069         summarizing.  Pass region_model to sm_state_map::print.
5070         (ana::selftest::assert_dump_eq): New function.
5071         (ASSERT_DUMP_EQ): New macro.
5072         (ana::selftest::test_program_state_dumping): New function.
5073         (ana::selftest::analyzer_program_state_cc_tests): Call it.
5074         * program-state.h (program_state::print): Add model param.
5075         * region-model.cc (dump_quoted_tree): New function.
5076         (map_region::print_fields): Use dump_quoted_tree rather than
5077         %qE to avoid lang-dependent output.
5078         (map_region::dump_child_label): Likewise.
5079         (region_model::dump_summary_of_map): For SK_REGION, when
5080         get_representative_path_var fails, print the region id rather than
5081         erroneously printing NULL.
5082         * sm.cc (state_machine::get_state_by_name): New function.
5083         * sm.h (state_machine::get_state_by_name): New decl.
5084
5085 2020-03-04  David Malcolm  <dmalcolm@redhat.com>
5086
5087         * region-model.cc (region::validate): Convert model param from ptr
5088         to reference.  Update comment to reflect that it's now a vfunc.
5089         (map_region::validate): New vfunc implementation.
5090         (array_region::validate): New vfunc implementation.
5091         (stack_region::validate): New vfunc implementation.
5092         (root_region::validate): New vfunc implementation.
5093         (region_model::validate): Pass a reference rather than a pointer
5094         to the region::validate vfunc.
5095         * region-model.h (region::validate): Make virtual.  Convert model
5096         param from ptr to reference.
5097         (map_region::validate): New vfunc decl.
5098         (array_region::validate): New vfunc decl.
5099         (stack_region::validate): New vfunc decl.
5100         (root_region::validate): New vfunc decl.
5101
5102 2020-03-04  David Malcolm  <dmalcolm@redhat.com>
5103
5104         PR analyzer/93993
5105         * region-model.cc (region_model::on_call_pre): Handle
5106         BUILT_IN_EXPECT and its variants.
5107         (region_model::add_any_constraints_from_ssa_def_stmt): Split out
5108         gassign handling into add_any_constraints_from_gassign; add gcall
5109         handling.
5110         (region_model::add_any_constraints_from_gassign): New function,
5111         based on the above.  Add handling for NOP_EXPR.
5112         (region_model::add_any_constraints_from_gcall): New function.
5113         (region_model::get_representative_path_var): Handle views.
5114         * region-model.h
5115         (region_model::add_any_constraints_from_ssa_def_stmt): New decl.
5116         (region_model::add_any_constraints_from_gassign): New decl.
5117
5118 2020-03-04  David Malcolm  <dmalcolm@redhat.com>
5119
5120         PR analyzer/93993
5121         * checker-path.h (state_change_event::get_lvalue): Add ctxt param
5122         and pass it to region_model::get_value call.
5123         * diagnostic-manager.cc (get_any_origin): Pass a
5124         tentative_region_model_context to the calls to get_lvalue and reject
5125         the comparison if errors occur.
5126         (can_be_expr_of_interest_p): New function.
5127         (diagnostic_manager::prune_for_sm_diagnostic): Replace checks for
5128         CONSTANT_CLASS_P with calls to update_for_unsuitable_sm_exprs.
5129         Pass a tentative_region_model_context to the calls to
5130         state_change_event::get_lvalue and reject the comparison if errors
5131         occur.
5132         (diagnostic_manager::update_for_unsuitable_sm_exprs): New.
5133         * diagnostic-manager.h
5134         (diagnostic_manager::update_for_unsuitable_sm_exprs): New decl.
5135         * region-model.h (class tentative_region_model_context): New class.
5136
5137 2020-03-04  David Malcolm  <dmalcolm@redhat.com>
5138
5139         * engine.cc (worklist::worklist): Remove unused field m_eg.
5140         (class viz_callgraph_edge): Remove unused field m_call_sedge.
5141         (class viz_callgraph): Remove unused field m_sg.
5142         * exploded-graph.h (worklist::::m_eg): Remove unused field.
5143
5144 2020-03-02  David Malcolm  <dmalcolm@redhat.com>
5145
5146         * analyzer.opt (fanalyzer-show-duplicate-count): New option.
5147         * diagnostic-manager.cc
5148         (diagnostic_manager::emit_saved_diagnostic): Use the above to
5149         guard the printing of the duplicate count.
5150
5151 2020-03-02  David Malcolm  <dmalcolm@redhat.com>
5152
5153         PR analyzer/93959
5154         * analyzer.cc (is_std_function_p): New function.
5155         (is_std_named_call_p): New functions.
5156         * analyzer.h (is_std_named_call_p): New decl.
5157         * sm-malloc.cc (malloc_state_machine::on_stmt): Check for "std::"
5158         variants when checking for malloc, calloc and free.
5159
5160 2020-02-26  David Malcolm  <dmalcolm@redhat.com>
5161
5162         PR analyzer/93950
5163         * diagnostic-manager.cc
5164         (diagnostic_manager::prune_for_sm_diagnostic): Assert that var is
5165         either NULL or not a constant.  When updating var, bulletproof
5166         against constant values.
5167
5168 2020-02-26  David Malcolm  <dmalcolm@redhat.com>
5169
5170         PR analyzer/93947
5171         * region-model.cc (region_model::get_fndecl_for_call): Gracefully
5172         fail for fn_decls that don't have a cgraph_node.
5173
5174 2020-02-26  David Malcolm  <dmalcolm@redhat.com>
5175
5176         * bar-chart.cc: New file.
5177         * bar-chart.h: New file.
5178         * engine.cc: Include "analyzer/bar-chart.h".
5179         (stats::log): Only log the m_num_nodes kinds that are non-zero.
5180         (stats::dump): Likewise when dumping.
5181         (stats::get_total_enodes): New.
5182         (exploded_graph::get_or_create_node): Increment the per-point-data
5183         m_excess_enodes when hitting the per-program-point limit on
5184         enodes.
5185         (exploded_graph::print_bar_charts): New.
5186         (exploded_graph::log_stats): Log the number of unprocessed enodes
5187         in the worklist.  Call print_bar_charts.
5188         (exploded_graph::dump_stats): Print the number of unprocessed
5189         enodes in the worklist.
5190         * exploded-graph.h (stats::get_total_enodes): New decl.
5191         (struct per_program_point_data): Add field m_excess_enodes.
5192         (exploded_graph::print_bar_charts): New decl.
5193         * supergraph.cc (superedge::dump): New.
5194         (superedge::dump): New.
5195         * supergraph.h (supernode::get_function): New.
5196         (superedge::dump): New decl.
5197         (superedge::dump): New decl.
5198
5199 2020-02-24  David Malcolm  <dmalcolm@redhat.com>
5200
5201         * engine.cc (exploded_graph::get_or_create_node): Dump the
5202         program_state to the pp, rather than to stderr.
5203
5204 2020-02-24  David Malcolm  <dmalcolm@redhat.com>
5205
5206         PR analyzer/93032
5207         * sm.cc (make_checkers): Require the "taint" checker to be
5208         explicitly enabled.
5209
5210 2020-02-24  David Malcolm  <dmalcolm@redhat.com>
5211
5212         PR analyzer/93899
5213         * engine.cc
5214         (impl_region_model_context::impl_region_model_context): Add logger
5215         param.
5216         * engine.cc (exploded_graph::add_function_entry): Create an
5217         impl_region_model_context and pass it to the push_frame call.
5218         Bail if the resulting state is invalid.
5219         (exploded_graph::build_initial_worklist): Likewise.
5220         (exploded_graph::build_initial_worklist): Handle the case where
5221         add_function_entry fails.
5222         * exploded-graph.h
5223         (impl_region_model_context::impl_region_model_context): Add logger
5224         param.
5225         * region-model.cc (map_region::get_or_create): Add ctxt param and
5226         pass it to add_region_for_type.
5227         (map_region::can_merge_p): Pass NULL as a ctxt to call to
5228         get_or_create.
5229         (array_region::get_element): Pass ctxt to call to get_or_create.
5230         (array_region::get_or_create): Add ctxt param and pass it to
5231         add_region_for_type.
5232         (root_region::push_frame): Pass ctxt to get_or_create calls.
5233         (region_model::get_lvalue_1): Likewise.
5234         (region_model::make_region_for_unexpected_tree_code): Assert that
5235         ctxt is non-NULL.
5236         (region_model::get_rvalue_1): Pass ctxt to get_svalue_for_fndecl
5237         and get_svalue_for_label calls.
5238         (region_model::get_svalue_for_fndecl): Add ctxt param and pass it
5239         to get_region_for_fndecl.
5240         (region_model::get_region_for_fndecl): Add ctxt param and pass it
5241         to get_or_create.
5242         (region_model::get_svalue_for_label): Add ctxt param and pass it
5243         to get_region_for_label.
5244         (region_model::get_region_for_label): Add ctxt param and pass it
5245         to get_region_for_fndecl and get_or_create.
5246         (region_model::get_field_region): Add ctxt param and pass it to
5247         get_or_create_view and get_or_create.
5248         (make_region_for_type): Replace gcc_unreachable with return NULL.
5249         (region_model::add_region_for_type): Add ctxt param.  Handle a
5250         return of NULL from make_region_for_type by calling
5251         make_region_for_unexpected_tree_code.
5252         (region_model::get_or_create_mem_ref): Pass ctxt to calls to
5253         get_or_create_view.
5254         (region_model::get_or_create_view): Add ctxt param and pass it to
5255         add_region_for_type.
5256         (selftest::test_state_merging): Pass ctxt to get_or_create_view.
5257         * region-model.h (region_model::get_or_create): Add ctxt param.
5258         (region_model::add_region_for_type): Likewise.
5259         (region_model::get_svalue_for_fndecl): Likewise.
5260         (region_model::get_svalue_for_label): Likewise.
5261         (region_model::get_region_for_fndecl): Likewise.
5262         (region_model::get_region_for_label): Likewise.
5263         (region_model::get_field_region): Likewise.
5264         (region_model::get_or_create_view): Likewise.
5265
5266 2020-02-24  David Malcolm  <dmalcolm@redhat.com>
5267
5268         * checker-path.cc (superedge_event::should_filter_p): Update
5269         filter for empty descriptions to cover verbosity level 3 as well
5270         as 2.
5271         * diagnostic-manager.cc: Include "analyzer/reachability.h".
5272         (class path_builder): New class.
5273         (diagnostic_manager::emit_saved_diagnostic): Create a path_builder
5274         and pass it to build_emission_path, rather passing eg; similarly
5275         for add_events_for_eedge and ext_state.
5276         (diagnostic_manager::build_emission_path): Replace "eg" param
5277         with a path_builder, pass it to add_events_for_eedge.
5278         (diagnostic_manager::add_events_for_eedge): Replace ext_state
5279         param with path_builder; pass it to add_events_for_superedge.
5280         (diagnostic_manager::significant_edge_p): New.
5281         (diagnostic_manager::add_events_for_superedge): Add path_builder
5282         param.  Reject insignificant edges at verbosity levels below 3.
5283         (diagnostic_manager::prune_for_sm_diagnostic): Update highest
5284         verbosity level to 4.
5285         * diagnostic-manager.h (class path_builder): New forward decl.
5286         (diagnostic_manager::build_emission_path): Replace "eg" param
5287         with a path_builder.
5288         (diagnostic_manager::add_events_for_eedge): Replace ext_state
5289         param with path_builder.
5290         (diagnostic_manager::significant_edge_p): New.
5291         (diagnostic_manager::add_events_for_superedge): Add path_builder
5292         param.
5293         * reachability.h: New file.
5294
5295 2020-02-18  David Malcolm  <dmalcolm@redhat.com>
5296
5297         PR analyzer/93692
5298         * analyzer.opt (fdump-analyzer-callgraph): Rewrite description.
5299
5300 2020-02-18  David Malcolm  <dmalcolm@redhat.com>
5301
5302         PR analyzer/93777
5303         * region-model.cc (region_model::maybe_cast_1): Replace assertion
5304         that build_cast returns non-NULL with a conditional, falling
5305         through to the logic which returns a new unknown value of the
5306         desired type if it fails.
5307
5308 2020-02-18  David Malcolm  <dmalcolm@redhat.com>
5309
5310         PR analyzer/93778
5311         * engine.cc (impl_region_model_context::on_unknown_tree_code):
5312         Rename to...
5313         (impl_region_model_context::on_unexpected_tree_code): ...this and
5314         convert first argument from path_var to tree.
5315         (exploded_node::on_stmt): Pass ctxt to purge_for_unknown_fncall.
5316         * exploded-graph.h (region_model_context::on_unknown_tree_code):
5317         Rename to...
5318         (region_model_context::on_unexpected_tree_code): ...this and
5319         convert first argument from path_var to tree.
5320         * program-state.cc (sm_state_map::purge_for_unknown_fncall): Add
5321         ctxt param and pass on to calls to get_rvalue.
5322         * program-state.h (sm_state_map::purge_for_unknown_fncall): Add
5323         ctxt param.
5324         * region-model.cc (region_model::handle_unrecognized_call): Pass
5325         ctxt on to call to get_rvalue.
5326         (region_model::get_lvalue_1): Move body of default case to
5327         region_model::make_region_for_unexpected_tree_code and call it.
5328         Within COMPONENT_REF case, reject attempts to handle types other
5329         than RECORD_TYPE and UNION_TYPE.
5330         (region_model::make_region_for_unexpected_tree_code): New
5331         function, based on default case of region_model::get_lvalue_1.
5332         * region-model.h
5333         (region_model::make_region_for_unexpected_tree_code): New decl.
5334         (region_model::on_unknown_tree_code): Rename to...
5335         (region_model::on_unexpected_tree_code): ...this and convert first
5336         argument from path_var to tree.
5337         (class test_region_model_context): Update vfunc implementation for
5338         above change.
5339
5340 2020-02-18  David Malcolm  <dmalcolm@redhat.com>
5341
5342         PR analyzer/93774
5343         * region-model.cc
5344         (region_model::convert_byte_offset_to_array_index): Use
5345         int_size_in_bytes before calling size_in_bytes, to gracefully fail
5346         on incomplete types.
5347
5348 2020-02-17  David Malcolm  <dmalcolm@redhat.com>
5349
5350         PR analyzer/93775
5351         * region-model.cc (region_model::get_fndecl_for_call): Handle the
5352         case where the code_region's get_tree_for_child_region returns
5353         NULL.
5354
5355 2020-02-17  David Malcolm  <dmalcolm@redhat.com>
5356
5357         PR analyzer/93388
5358         * engine.cc (impl_region_model_context::on_unknown_tree_code):
5359         New.
5360         (exploded_graph::get_or_create_node): Reject invalid states.
5361         * exploded-graph.h
5362         (impl_region_model_context::on_unknown_tree_code): New decl.
5363         (point_and_state::point_and_state): Assert that the state is
5364         valid.
5365         * program-state.cc (program_state::program_state): Initialize
5366         m_valid to true.
5367         (program_state::operator=): Copy m_valid.
5368         (program_state::program_state): Likewise for move constructor.
5369         (program_state::print): Print m_valid.
5370         (program_state::dump_to_pp): Likewise.
5371         * program-state.h (program_state::m_valid): New field.
5372         * region-model.cc (region_model::get_lvalue_1): Implement the
5373         default case by returning a new symbolic region and calling
5374         the context's on_unknown_tree_code, rather than issuing an
5375         internal_error.  Implement VIEW_CONVERT_EXPR.
5376         * region-model.h (region_model_context::on_unknown_tree_code): New
5377         vfunc.
5378         (test_region_model_context::on_unknown_tree_code): New.
5379
5380 2020-02-17  David Malcolm  <dmalcolm@redhat.com>
5381
5382         * sm-malloc.cc (malloc_diagnostic::describe_state_change): For
5383         transition to the "null" state, only say "assuming" when
5384         transitioning from the "unchecked" state.
5385
5386 2020-02-17  David Malcolm  <dmalcolm@redhat.com>
5387
5388         * diagnostic-manager.h (diagnostic_manager::get_saved_diagnostic):
5389         Add const overload.
5390         * engine.cc (exploded_node::dump_dot): Dump saved_diagnostics.
5391         * exploded-graph.h (exploded_graph::get_diagnostic_manager): Add
5392         const overload.
5393
5394 2020-02-11  David Malcolm  <dmalcolm@redhat.com>
5395
5396         PR analyzer/93288
5397         * analysis-plan.cc (analysis_plan::use_summary_p): Look through
5398         the ultimate_alias_target when getting the called function.
5399         * engine.cc (exploded_node::on_stmt): Rename second "ctxt" to
5400         "sm_ctxt".  Use the region_model's get_fndecl_for_call rather than
5401         gimple_call_fndecl.
5402         * region-model.cc (region_model::get_fndecl_for_call): Use
5403         ultimate_alias_target on fndecl.
5404         * supergraph.cc (get_ultimate_function_for_cgraph_edge): New
5405         function.
5406         (supergraph_call_edge): Use it when rejecting edges without
5407         functions.
5408         (supergraph::supergraph): Use it to get the function for the
5409         cgraph_edge when building interprocedural superedges.
5410         (callgraph_superedge::get_callee_function):  Use it.
5411         * supergraph.h (supergraph::get_num_snodes): Make param const.
5412         (supergraph::function_to_num_snodes_t): Make first type param
5413         const.
5414
5415 2020-02-11  David Malcolm  <dmalcolm@redhat.com>
5416
5417         PR analyzer/93374
5418         * engine.cc (exploded_edge::exploded_edge): Add ext_state param
5419         and pass it to change.validate.
5420         (exploded_graph::get_or_create_node): Move purging of change
5421         svalues to also cover the case of reusing an existing enode.
5422         (exploded_graph::add_edge): Pass m_ext_state to exploded_edge's
5423         ctor.
5424         * exploded-graph.h (exploded_edge::exploded_edge): Add ext_state
5425         param.
5426         * program-state.cc (state_change::sm_change::validate): Likewise.
5427         Assert that m_sm_idx is sane.  Use ext_state to validate
5428         m_old_state and m_new_state.
5429         (state_change::validate): Add ext_state param and pass it to
5430         the sm_change validate calls.
5431         * program-state.h (state_change::sm_change::validate): Add
5432         ext_state param.
5433         (state_change::validate): Likewise.
5434
5435 2020-02-11  David Malcolm  <dmalcolm@redhat.com>
5436
5437         PR analyzer/93669
5438         * engine.cc (exploded_graph::dump_exploded_nodes): Handle missing
5439         case of STATUS_WORKLIST in implementation of
5440         "__analyzer_dump_exploded_nodes".
5441
5442 2020-02-11  David Malcolm  <dmalcolm@redhat.com>
5443
5444         PR analyzer/93649
5445         * constraint-manager.cc (constraint_manager::add_constraint): When
5446         merging equivalence classes and updating m_constant, also update
5447         m_cst_sid.
5448         (constraint_manager::validate): If m_constant is non-NULL assert
5449         that m_cst_sid is non-null and is valid.
5450
5451 2020-02-11  David Malcolm  <dmalcolm@redhat.com>
5452
5453         PR analyzer/93657
5454         * analyzer.opt (fdump-analyzer): Reword description.
5455         (fdump-analyzer-stderr): Likewise.
5456
5457 2020-02-11  David Malcolm  <dmalcolm@redhat.com>
5458
5459         * region-model.cc (print_quoted_type): New function.
5460         (svalue::print): Use it to replace %qT.
5461         (region::dump_to_pp): Likewise.
5462         (region::dump_child_label): Likewise.
5463         (region::print_fields): Likewise.
5464
5465 2020-02-10  David Malcolm  <dmalcolm@redhat.com>
5466
5467         PR analyzer/93659
5468         * analyzer.opt (-param=analyzer-max-recursion-depth=): Fix "tha"
5469         -> "that" typo.
5470         (Wanalyzer-use-of-uninitialized-value): Fix "initialized" ->
5471         "uninitialized" typo.
5472
5473 2020-02-10  David Malcolm  <dmalcolm@redhat.com>
5474
5475         PR analyzer/93350
5476         * region-model.cc (region_model::get_lvalue_1):
5477         Handle BIT_FIELD_REF.
5478         (make_region_for_type): Handle VECTOR_TYPE.
5479
5480 2020-02-10  David Malcolm  <dmalcolm@redhat.com>
5481
5482         PR analyzer/93647
5483         * diagnostic-manager.cc
5484         (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof against
5485         VAR being constant.
5486         * region-model.cc (region_model::get_lvalue_1): Provide a better
5487         error message when encountering an unhandled tree code.
5488
5489 2020-02-10  David Malcolm  <dmalcolm@redhat.com>
5490
5491         PR analyzer/93405
5492         * region-model.cc (region_model::get_lvalue_1): Implement
5493         CONST_DECL.
5494
5495 2020-02-06  David Malcolm  <dmalcolm@redhat.com>
5496
5497         * region-model.cc (region_model::maybe_cast_1): Attempt to provide
5498         a region_svalue if either type is a pointer, rather than if both
5499         types are pointers.
5500
5501 2020-02-05  David Malcolm  <dmalcolm@redhat.com>
5502
5503         * engine.cc (exploded_node::dump_dot): Show merger enodes.
5504         (worklist::add_node): Assert that the node's m_status is
5505         STATUS_WORKLIST.
5506         (exploded_graph::process_worklist): Likewise for nodes from the
5507         worklist.  Set status of merged nodes to STATUS_MERGER.
5508         (exploded_graph::process_node): Set status of node to
5509         STATUS_PROCESSED.
5510         (exploded_graph::dump_exploded_nodes): Rework handling of
5511         "__analyzer_dump_exploded_nodes", splitting enodes by status into
5512         "processed" and "merger", showing the count of just the processed
5513         enodes at the call, rather than the count of all enodes.
5514         * exploded-graph.h (exploded_node::status): New enum.
5515         (exploded_node::exploded_node): Initialize m_status to
5516         STATUS_WORKLIST.
5517         (exploded_node::get_status): New getter.
5518         (exploded_node::set_status): New setter.
5519
5520 2020-02-04  David Malcolm  <dmalcolm@redhat.com>
5521
5522         PR analyzer/93543
5523         * engine.cc (pod_hash_traits<function_call_string>::mark_empty):
5524         Eliminate reinterpret_cast.
5525         (pod_hash_traits<function_call_string>::is_empty): Likewise.
5526
5527 2020-02-03  David Malcolm  <dmalcolm@redhat.com>
5528
5529         * constraint-manager.cc (range::constrained_to_single_element):
5530         Replace fold_build2 with fold_binary.  Remove unnecessary newline.
5531         (constraint_manager::get_or_add_equiv_class): Replace fold_build2
5532         with fold_binary in two places, and remove out-of-date comment.
5533         (constraint_manager::eval_condition): Replace fold_build2 with
5534         fold_binary.
5535         * region-model.cc (constant_svalue::eval_condition): Likewise.
5536         (region_model::on_assignment): Likewise.
5537
5538 2020-02-03  David Malcolm  <dmalcolm@redhat.com>
5539
5540         PR analyzer/93544
5541         * diagnostic-manager.cc
5542         (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof
5543         against bad choices due to bad paths.
5544         * engine.cc (impl_region_model_context::on_phi): New.
5545         * exploded-graph.h (impl_region_model_context::on_phi): New decl.
5546         * region-model.cc (region_model::on_longjmp): Likewise.
5547         (region_model::handle_phi): Add phi param.  Call the ctxt's on_phi
5548         vfunc.
5549         (region_model::update_for_phis): Pass phi to handle_phi.
5550         * region-model.h (region_model::handle_phi): Add phi param.
5551         (region_model_context::on_phi): New vfunc.
5552         (test_region_model_context::on_phi): New.
5553         * sm-malloc.cc (malloc_state_machine::on_phi): New.
5554         (malloc_state_machine::on_zero_assignment): New.
5555         * sm.h (state_machine::on_phi): New vfunc.
5556
5557 2020-02-03  David Malcolm  <dmalcolm@redhat.com>
5558
5559         * engine.cc (supernode_cluster::dump_dot): Show BB index as
5560         well as SN index.
5561         * supergraph.cc (supernode::dump_dot): Likewise.
5562
5563 2020-02-03  David Malcolm  <dmalcolm@redhat.com>
5564
5565         PR analyzer/93546
5566         * region-model.cc (region_model::on_call_pre): Update for new
5567         param of symbolic_region ctor.
5568         (region_model::deref_rvalue): Likewise.
5569         (region_model::add_new_malloc_region): Likewise.
5570         (make_region_for_type): Likewise, preserving type.
5571         * region-model.h (symbolic_region::symbolic_region): Add "type"
5572         param and pass it to base class ctor.
5573
5574 2020-02-03  David Malcolm  <dmalcolm@redhat.com>
5575
5576         PR analyzer/93547
5577         * constraint-manager.cc
5578         (constraint_manager::get_or_add_equiv_class): Ensure types are
5579         compatible before comparing constants.
5580
5581 2020-01-31  David Malcolm  <dmalcolm@redhat.com>
5582
5583         PR analyzer/93457
5584         * region-model.cc (make_region_for_type): Use VOID_TYPE_P rather
5585         than checking against void_type_node.
5586
5587 2020-01-31  David Malcolm  <dmalcolm@redhat.com>
5588
5589         PR analyzer/93373
5590         * region-model.cc (ASSERT_COMPAT_TYPES): Convert to...
5591         (assert_compat_types): ...this, and bail when either type is NULL,
5592         or when VOID_TYPE_P (dst_type).
5593         (region_model::get_lvalue): Update for above conversion.
5594         (region_model::get_rvalue): Likewise.
5595
5596 2020-01-31  David Malcolm  <dmalcolm@redhat.com>
5597
5598         PR analyzer/93379
5599         * region-model.cc (region_model::update_for_return_superedge):
5600         Move check for null result so that it also guards setting the
5601         lhs.
5602
5603 2020-01-31  David Malcolm  <dmalcolm@redhat.com>
5604
5605         PR analyzer/93438
5606         * region-model.cc (stack_region::can_merge_p): Split into a two
5607         pass approach, creating all stack regions first, then populating
5608         them.
5609         (selftest::test_state_merging): Add test coverage for (a) the case
5610         of self-merging a model in which a local in an older stack frame
5611         points to a local in a more recent stack frame (which previously
5612         would ICE), and (b) the case of self-merging a model in which a
5613         local points to a global (which previously worked OK).
5614
5615 2020-01-31  David Malcolm  <dmalcolm@redhat.com>
5616
5617         * analyzer.cc (is_named_call_p): Replace tests for fndecl being
5618         extern at file scope and having a non-NULL DECL_NAME with a call
5619         to maybe_special_function_p.
5620         * function-set.cc (function_set::contains_decl_p): Add call to
5621         maybe_special_function_p.
5622
5623 2020-01-31  David Malcolm  <dmalcolm@redhat.com>
5624
5625         PR analyzer/93450
5626         * constraint-manager.cc
5627         (constraint_manager::get_or_add_equiv_class): Only compare constants
5628         if their types are compatible.
5629         * region-model.cc (constant_svalue::eval_condition): Replace check
5630         for identical types with call to types_compatible_p.
5631
5632 2020-01-30  David Malcolm  <dmalcolm@redhat.com>
5633
5634         * program-state.cc (extrinsic_state::dump_to_pp): New.
5635         (extrinsic_state::dump_to_file): New.
5636         (extrinsic_state::dump): New.
5637         * program-state.h (extrinsic_state::dump_to_pp): New decl.
5638         (extrinsic_state::dump_to_file): New decl.
5639         (extrinsic_state::dump): New decl.
5640         * sm.cc: Include "pretty-print.h".
5641         (state_machine::dump_to_pp): New.
5642         * sm.h (state_machine::dump_to_pp): New decl.
5643
5644 2020-01-30  David Malcolm  <dmalcolm@redhat.com>
5645
5646         * diagnostic-manager.cc (for_each_state_change): Use
5647         extrinsic_state::get_num_checkers rather than accessing m_checkers
5648         directly.
5649         * program-state.cc (program_state::program_state): Likewise.
5650         * program-state.h (extrinsic_state::m_checkers): Make private.
5651
5652 2020-01-30  David Malcolm  <dmalcolm@redhat.com>
5653
5654         PR analyzer/93356
5655         * region-model.cc (region_model::eval_condition): In both
5656         overloads, bail out immediately on floating-point types.
5657         (region_model::eval_condition_without_cm): Likewise.
5658         (region_model::add_constraint): Likewise.
5659
5660 2020-01-30  David Malcolm  <dmalcolm@redhat.com>
5661
5662         PR analyzer/93450
5663         * program-state.cc (sm_state_map::set_state): For the overload
5664         taking an svalue_id, bail out if the set_state on the ec does
5665         nothing.  Convert the latter's return type from void to bool,
5666         returning true if anything changed.
5667         (sm_state_map::impl_set_state): Convert the return type from void
5668         to bool, returning true if the state changed.
5669         * program-state.h (sm_state_map::set_state): Convert return type
5670         from void to bool.
5671         (sm_state_map::impl_set_state): Likewise.
5672         * region-model.cc (constant_svalue::eval_condition): Only call
5673         fold_build2 if the types are the same.
5674
5675 2020-01-29  Jakub Jelinek  <jakub@redhat.com>
5676
5677         * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Remove.
5678         * constraint-manager.cc: Include diagnostic-core.h before graphviz.h.
5679         (range::dump, equiv_class::print): Don't use PUSH_IGNORE_WFORMAT or
5680         POP_IGNORE_WFORMAT.
5681         * state-purge.cc: Include diagnostic-core.h before
5682         gimple-pretty-print.h.
5683         (state_purge_annotator::add_node_annotations, print_vec_of_names):
5684         Don't use PUSH_IGNORE_WFORMAT or POP_IGNORE_WFORMAT.
5685         * region-model.cc: Move diagnostic-core.h include before graphviz.h.
5686         (path_var::dump, svalue::print, constant_svalue::print_details,
5687         region::dump_to_pp, region::dump_child_label, region::print_fields,
5688         map_region::print_fields, map_region::dump_dot_to_pp,
5689         map_region::dump_child_label, array_region::print_fields,
5690         array_region::dump_dot_to_pp): Don't use PUSH_IGNORE_WFORMAT or
5691         POP_IGNORE_WFORMAT.
5692
5693 2020-01-28  David Malcolm  <dmalcolm@redhat.com>
5694
5695         PR analyzer/93316
5696         * engine.cc (rewind_info_t::update_model): Get the longjmp call
5697         stmt via get_longjmp_call () rather than assuming it is the last
5698         stmt in the longjmp's supernode.
5699         (rewind_info_t::add_events_to_path): Get the location_t for the
5700         rewind_from_longjmp_event via get_longjmp_call () rather than from
5701         the supernode's get_end_location ().
5702
5703 2020-01-28  David Malcolm  <dmalcolm@redhat.com>
5704
5705         * region-model.cc (poisoned_value_diagnostic::emit): Update for
5706         renaming of warning_at overload to warning_meta.
5707         * sm-file.cc (file_leak::emit): Likewise.
5708         * sm-malloc.cc (double_free::emit): Likewise.
5709         (possible_null_deref::emit): Likewise.
5710         (possible_null_arg::emit): Likewise.
5711         (null_deref::emit): Likewise.
5712         (null_arg::emit): Likewise.
5713         (use_after_free::emit): Likewise.
5714         (malloc_leak::emit): Likewise.
5715         (free_of_non_heap::emit): Likewise.
5716         * sm-sensitive.cc (exposure_through_output_file::emit): Likewise.
5717         * sm-signal.cc (signal_unsafe_call::emit): Likewise.
5718         * sm-taint.cc (tainted_array_index::emit): Likewise.
5719
5720 2020-01-27  David Malcolm  <dmalcolm@redhat.com>
5721
5722         PR analyzer/93451
5723         * region-model.cc (tree_cmp): For the REAL_CST case, impose an
5724         arbitrary order on NaNs relative to other NaNs and to non-NaNs;
5725         const-correctness tweak.
5726         (ana::selftests::build_real_cst_from_string): New function.
5727         (ana::selftests::append_interesting_constants): New function.
5728         (ana::selftests::test_tree_cmp_on_constants): New test.
5729         (ana::selftests::test_canonicalization_4): New test.
5730         (ana::selftests::analyzer_region_model_cc_tests): Call the new
5731         tests.
5732
5733 2020-01-27  David Malcolm  <dmalcolm@redhat.com>
5734
5735         PR analyzer/93349
5736         * engine.cc (run_checkers): Save and restore input_location.
5737
5738 2020-01-27  David Malcolm  <dmalcolm@redhat.com>
5739
5740         * call-string.cc (call_string::cmp_1): Delete, moving body to...
5741         (call_string::cmp): ...here.
5742         * call-string.h (call_string::cmp_1): Delete decl.
5743         * engine.cc (worklist::key_t::cmp_1): Delete, moving body to...
5744         (worklist::key_t::cmp): ...here.  Implement hash comparisons
5745         via comparison rather than subtraction to avoid overflow issues.
5746         * exploded-graph.h (worklist::key_t::cmp_1): Delete decl.
5747         * region-model.cc (tree_cmp): Eliminate buggy checking for
5748         symmetry.
5749
5750 2020-01-27  David Malcolm  <dmalcolm@redhat.com>
5751
5752         * analyzer.cc  (is_named_call_p): Check that fndecl is "extern"
5753         and at file scope.  Potentially disregard prefix _ or __ in
5754         fndecl's name.  Bail if the identifier is NULL.
5755         (is_setjmp_call_p): Expect a gcall rather than plain gimple.
5756         Remove special-case check for leading prefix, and also check for
5757         sigsetjmp.
5758         (is_longjmp_call_p): Also check for siglongjmp.
5759         (get_user_facing_name): New function.
5760         * analyzer.h (is_setjmp_call_p): Expect a gcall rather than plain
5761         gimple.
5762         (get_user_facing_name): New decl.
5763         * checker-path.cc (setjmp_event::get_desc): Use
5764         get_user_facing_name to avoid hardcoding the function name.
5765         (rewind_event::rewind_event): Add rewind_info param, using it to
5766         initialize new m_rewind_info field, and strengthen the assertion.
5767         (rewind_from_longjmp_event::get_desc): Use get_user_facing_name to
5768         avoid hardcoding the function name.
5769         (rewind_to_setjmp_event::get_desc): Likewise.
5770         * checker-path.h (setjmp_event::setjmp_event): Add setjmp_call
5771         param and use it to initialize...
5772         (setjmp_event::m_setjmp_call): New field.
5773         (rewind_event::rewind_event): Add rewind_info param.
5774         (rewind_event::m_rewind_info): New protected field.
5775         (rewind_from_longjmp_event::rewind_from_longjmp_event): Add
5776         rewind_info param.
5777         (class rewind_to_setjmp_event): Move rewind_info field to parent
5778         class.
5779         * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
5780         Update setjmp-handling for is_setjmp_call_p requiring a gcall;
5781         pass the call to the new setjmp_event.
5782         * engine.cc (exploded_node::on_stmt): Update for is_setjmp_call_p
5783         requiring a gcall.
5784         (stale_jmp_buf::emit): Use get_user_facing_name to avoid
5785         hardcoding the function names.
5786         (exploded_node::on_longjmp): Pass the longjmp_call when
5787         constructing rewind_info.
5788         (rewind_info_t::add_events_to_path): Pass the rewind_info_t to the
5789         rewind_from_longjmp_event's ctor.
5790         * exploded-graph.h (rewind_info_t::rewind_info_t): Add
5791         longjmp_call param.
5792         (rewind_info_t::get_longjmp_call): New.
5793         (rewind_info_t::m_longjmp_call): New.
5794         * region-model.cc (region_model::on_setjmp): Update comment to
5795         indicate this is also for sigsetjmp.
5796         * region-model.h (struct setjmp_record): Likewise.
5797         (class setjmp_svalue): Likewise.
5798
5799 2020-01-27  David Malcolm  <dmalcolm@redhat.com>
5800
5801         PR analyzer/93276
5802         * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Guard these
5803         macros with GCC_VERSION >= 4006, making them no-op otherwise.
5804         * engine.cc (exploded_edge::exploded_edge): Specify template for
5805         base class initializer.
5806         (exploded_graph::add_edge): Specify template when chaining up to
5807         base class add_edge implementation.
5808         (viz_callgraph_node::dump_dot): Drop redundant "typename".
5809         (viz_callgraph_edge::viz_callgraph_edge): Specify template for
5810         base class initializer.
5811         * program-state.cc (sm_state_map::clone_with_remapping): Drop
5812         redundant "typename".
5813         (sm_state_map::print): Likewise.
5814         (sm_state_map::hash): Likewise.
5815         (sm_state_map::operator==): Likewise.
5816         (sm_state_map::remap_svalue_ids): Likewise.
5817         (sm_state_map::on_svalue_purge): Likewise.
5818         (sm_state_map::validate): Likewise.
5819         * program-state.h (sm_state_map::iterator_t): Likewise.
5820         * supergraph.h (superedge::superedge): Specify template for base
5821         class initializer.
5822
5823 2020-01-23  David Malcolm  <dmalcolm@redhat.com>
5824
5825         PR analyzer/93375
5826         * supergraph.cc (callgraph_superedge::get_arg_for_parm): Fail
5827         gracefully is the number of parameters at the callee exceeds the
5828         number of arguments at the call stmt.
5829         (callgraph_superedge::get_parm_for_arg): Likewise.
5830
5831 2020-01-22  David Malcolm  <dmalcolm@redhat.com>
5832
5833         PR analyzer/93382
5834         * program-state.cc (sm_state_map::on_svalue_purge): If the
5835         entry survives, but the origin is being purged, then reset the
5836         origin to null.
5837
5838 2020-01-22  David Malcolm  <dmalcolm@redhat.com>
5839
5840         * sm-signal.cc: Fix nesting of CHECKING_P and namespace ana.
5841
5842 2020-01-22  David Malcolm  <dmalcolm@redhat.com>
5843
5844         PR analyzer/93378
5845         * engine.cc (setjmp_svalue::compare_fields): Update for
5846         replacement of m_enode with m_setjmp_record.
5847         (setjmp_svalue::add_to_hash): Likewise.
5848         (setjmp_svalue::get_index): Rename...
5849         (setjmp_svalue::get_enode_index): ...to this.
5850         (setjmp_svalue::print_details): Update for replacement of m_enode
5851         with m_setjmp_record.
5852         (exploded_node::on_longjmp): Likewise.
5853         * exploded-graph.h (rewind_info_t::m_enode_origin): Replace...
5854         (rewind_info_t::m_setjmp_record): ...with this.
5855         (rewind_info_t::rewind_info_t): Update for replacement of m_enode
5856         with m_setjmp_record.
5857         (rewind_info_t::get_setjmp_point): Likewise.
5858         (rewind_info_t::get_setjmp_call): Likewise.
5859         * region-model.cc (region_model::dump_summary_of_map): Likewise.
5860         (region_model::on_setjmp): Likewise.
5861         * region-model.h (struct setjmp_record): New struct.
5862         (setjmp_svalue::m_enode): Replace...
5863         (setjmp_svalue::m_setjmp_record): ...with this.
5864         (setjmp_svalue::setjmp_svalue): Update for replacement of m_enode
5865         with m_setjmp_record.
5866         (setjmp_svalue::clone): Likewise.
5867         (setjmp_svalue::get_index): Rename...
5868         (setjmp_svalue::get_enode_index): ...to this.
5869         (setjmp_svalue::get_exploded_node): Replace...
5870         (setjmp_svalue::get_setjmp_record): ...with this.
5871
5872 2020-01-22  David Malcolm  <dmalcolm@redhat.com>
5873
5874         PR analyzer/93316
5875         * analyzer.cc (is_setjmp_call_p): Check for "setjmp" as well as
5876         "_setjmp".
5877
5878 2020-01-22  David Malcolm  <dmalcolm@redhat.com>
5879
5880         PR analyzer/93307
5881         * analysis-plan.h: Wrap everything namespace "ana".
5882         * analyzer-logging.cc: Likewise.
5883         * analyzer-logging.h: Likewise.
5884         * analyzer-pass.cc (pass_analyzer::execute): Update for "ana"
5885         namespace.
5886         * analyzer-selftests.cc: Wrap everything namespace "ana".
5887         * analyzer-selftests.h: Likewise.
5888         * analyzer.h: Likewise for forward decls of types.
5889         * call-string.h: Likewise.
5890         * checker-path.cc: Likewise.
5891         * checker-path.h: Likewise.
5892         * constraint-manager.cc: Likewise.
5893         * constraint-manager.h: Likewise.
5894         * diagnostic-manager.cc: Likewise.
5895         * diagnostic-manager.h: Likewise.
5896         * engine.cc: Likewise.
5897         * engine.h: Likewise.
5898         * exploded-graph.h: Likewise.
5899         * function-set.cc: Likewise.
5900         * function-set.h: Likewise.
5901         * pending-diagnostic.cc: Likewise.
5902         * pending-diagnostic.h: Likewise.
5903         * program-point.cc: Likewise.
5904         * program-point.h: Likewise.
5905         * program-state.cc: Likewise.
5906         * program-state.h: Likewise.
5907         * region-model.cc: Likewise.
5908         * region-model.h: Likewise.
5909         * sm-file.cc: Likewise.
5910         * sm-malloc.cc: Likewise.
5911         * sm-pattern-test.cc: Likewise.
5912         * sm-sensitive.cc: Likewise.
5913         * sm-signal.cc: Likewise.
5914         * sm-taint.cc: Likewise.
5915         * sm.cc: Likewise.
5916         * sm.h: Likewise.
5917         * state-purge.h: Likewise.
5918         * supergraph.cc: Likewise.
5919         * supergraph.h: Likewise.
5920
5921 2020-01-21  David Malcolm  <dmalcolm@redhat.com>
5922
5923         PR analyzer/93352
5924         * region-model.cc (int_cmp): Rename to...
5925         (array_region::key_cmp): ...this, using key_t rather than int.
5926         Rewrite in terms of comparisons rather than subtraction to
5927         ensure qsort is anti-symmetric when handling extreme values.
5928         (array_region::walk_for_canonicalization): Update for above
5929         renaming.
5930         * region-model.h (array_region::key_cmp): New decl.
5931
5932 2020-01-17  David Malcolm  <dmalcolm@redhat.com>
5933
5934         PR analyzer/93290
5935         * region-model.cc (region_model::eval_condition_without_cm): Avoid
5936         gcc_unreachable for unexpected operations for the case where
5937         we're comparing an svalue against itself.
5938
5939 2020-01-17  David Malcolm  <dmalcolm@redhat.com>
5940
5941         PR analyzer/93281
5942         * region-model.cc
5943         (region_model::convert_byte_offset_to_array_index): Convert to
5944         ssizetype before dividing by byte_size.  Use fold_binary rather
5945         than fold_build2 to avoid needlessly constructing a tree for the
5946         non-const case.
5947
5948 2020-01-15  David Malcolm  <dmalcolm@redhat.com>
5949
5950         * engine.cc (class impl_region_model_context): Fix comment.
5951
5952 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
5953
5954         PR analyzer/93212
5955         * region-model.cc (make_region_for_type): Use
5956         FUNC_OR_METHOD_TYPE_P rather than comparing against FUNCTION_TYPE.
5957         * region-model.h (function_region::function_region): Likewise.
5958
5959 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
5960
5961         * program-state.cc (sm_state_map::clone_with_remapping): Copy
5962         m_global_state.
5963         (selftest::test_program_state_merging_2): New selftest.
5964         (selftest::analyzer_program_state_cc_tests): Call it.
5965
5966 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
5967
5968         * checker-path.h (checker_path::get_checker_event): New function.
5969         (checker_path): Add DISABLE_COPY_AND_ASSIGN; make fields private.
5970         * diagnostic-manager.cc
5971         (diagnostic_manager::prune_for_sm_diagnostic): Replace direct
5972         access to checker_path::m_events with accessor functions.  Fix
5973         overlong line.
5974         (diagnostic_manager::prune_interproc_events): Replace direct
5975         access to checker_path::m_events with accessor functions.
5976         (diagnostic_manager::finish_pruning): Likewise.
5977
5978 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
5979
5980         * checker-path.h (checker_event::clone): Delete vfunc decl.
5981         (debug_event::clone): Delete vfunc impl.
5982         (custom_event::clone): Delete vfunc impl.
5983         (statement_event::clone): Delete vfunc impl.
5984         (function_entry_event::clone): Delete vfunc impl.
5985         (state_change_event::clone): Delete vfunc impl.
5986         (start_cfg_edge_event::clone): Delete vfunc impl.
5987         (end_cfg_edge_event::clone): Delete vfunc impl.
5988         (call_event::clone): Delete vfunc impl.
5989         (return_event::clone): Delete vfunc impl.
5990         (setjmp_event::clone): Delete vfunc impl.
5991         (rewind_from_longjmp_event::clone): Delete vfunc impl.
5992         (rewind_to_setjmp_event::clone): Delete vfunc impl.
5993         (warning_event::clone): Delete vfunc impl.
5994
5995 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
5996
5997         * supergraph.cc (supernode::dump_dot): Ensure that the TABLE
5998         element has at least one TR.
5999
6000 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
6001
6002         PR analyzer/58237
6003         * engine.cc (leak_stmt_finder::find_stmt): Use get_pure_location
6004         when comparing against UNKNOWN_LOCATION.
6005         (stmt_requires_new_enode_p): Likewise.
6006         (exploded_graph::dump_exploded_nodes): Likewise.
6007         * supergraph.cc (supernode::get_start_location): Likewise.
6008         (supernode::get_end_location): Likewise.
6009
6010 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
6011
6012         PR analyzer/58237
6013         * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
6014         selftest::analyzer_sm_file_cc_tests.
6015         * analyzer-selftests.h (selftest::analyzer_sm_file_cc_tests): New
6016         decl.
6017         * sm-file.cc: Include "analyzer/function-set.h" and
6018         "analyzer/analyzer-selftests.h".
6019         (get_file_using_fns): New function.
6020         (is_file_using_fn_p): New function.
6021         (fileptr_state_machine::on_stmt): Return true for known functions.
6022         (selftest::analyzer_sm_file_cc_tests): New function.
6023
6024 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
6025
6026         * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
6027         selftest::analyzer_sm_signal_cc_tests.
6028         * analyzer-selftests.h (selftest::analyzer_sm_signal_cc_tests):
6029         New decl.
6030         * sm-signal.cc: Include "analyzer/function-set.h" and
6031         "analyzer/analyzer-selftests.h".
6032         (get_async_signal_unsafe_fns): New function.
6033         (signal_unsafe_p): Reimplement in terms of the above.
6034         (selftest::analyzer_sm_signal_cc_tests): New function.
6035
6036 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
6037
6038         * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
6039         selftest::analyzer_function_set_cc_tests.
6040         * analyzer-selftests.h (selftest::analyzer_function_set_cc_tests):
6041         New decl.
6042         * function-set.cc: New file.
6043         * function-set.h: New file.
6044
6045 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
6046
6047         * analyzer.h (fndecl_has_gimple_body_p): New decl.
6048         * engine.cc (impl_region_model_context::on_unknown_change): New
6049         function.
6050         (fndecl_has_gimple_body_p): Make non-static.
6051         (exploded_node::on_stmt): Treat __analyzer_dump_exploded_nodes as
6052         known.  Track whether we have a call with unknown side-effects and
6053         pass it to on_call_post.
6054         * exploded-graph.h (impl_region_model_context::on_unknown_change):
6055         New decl.
6056         * program-state.cc (sm_state_map::on_unknown_change): New function.
6057         * program-state.h (sm_state_map::on_unknown_change): New decl.
6058         * region-model.cc: Include "bitmap.h".
6059         (region_model::on_call_pre): Return a bool, capturing whether the
6060         call has unknown side effects.
6061         (region_model::on_call_post): Add arg "bool unknown_side_effects"
6062         and if true, call handle_unrecognized_call.
6063         (class reachable_regions): New class.
6064         (region_model::handle_unrecognized_call): New function.
6065         * region-model.h (region_model::on_call_pre): Return a bool.
6066         (region_model::on_call_post): Add arg "bool unknown_side_effects".
6067         (region_model::handle_unrecognized_call): New decl.
6068         (region_model_context::on_unknown_change): New vfunc.
6069         (test_region_model_context::on_unknown_change): New function.
6070
6071 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
6072
6073         * diagnostic-manager.cc (saved_diagnostic::operator==): Move here
6074         from header.  Replace pointer equality test on m_var with call to
6075         pending_diagnostic::same_tree_p.
6076         * diagnostic-manager.h (saved_diagnostic::operator==): Move to
6077         diagnostic-manager.cc.
6078         * pending-diagnostic.cc (pending_diagnostic::same_tree_p): New.
6079         * pending-diagnostic.h (pending_diagnostic::same_tree_p): New.
6080         * sm-file.cc (file_diagnostic::subclass_equal_p): Replace pointer
6081         equality on m_arg with call to pending_diagnostic::same_tree_p.
6082         * sm-malloc.cc (malloc_diagnostic::subclass_equal_p): Likewise.
6083         (possible_null_arg::subclass_equal_p): Likewise.
6084         (null_arg::subclass_equal_p): Likewise.
6085         (free_of_non_heap::subclass_equal_p): Likewise.
6086         * sm-pattern-test.cc (pattern_match::operator==): Likewise.
6087         * sm-sensitive.cc (exposure_through_output_file::operator==):
6088         Likewise.
6089         * sm-taint.cc (tainted_array_index::operator==): Likewise.
6090
6091 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
6092
6093         * diagnostic-manager.cc (dedupe_winners::add): Add logging
6094         of deduplication decisions made.
6095
6096 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
6097
6098         * ChangeLog: New file.
6099         * analyzer-selftests.cc: New file.
6100         * analyzer-selftests.h: New file.
6101         * analyzer.opt: New file.
6102         * analysis-plan.cc: New file.
6103         * analysis-plan.h: New file.
6104         * analyzer-logging.cc: New file.
6105         * analyzer-logging.h: New file.
6106         * analyzer-pass.cc: New file.
6107         * analyzer.cc: New file.
6108         * analyzer.h: New file.
6109         * call-string.cc: New file.
6110         * call-string.h: New file.
6111         * checker-path.cc: New file.
6112         * checker-path.h: New file.
6113         * constraint-manager.cc: New file.
6114         * constraint-manager.h: New file.
6115         * diagnostic-manager.cc: New file.
6116         * diagnostic-manager.h: New file.
6117         * engine.cc: New file.
6118         * engine.h: New file.
6119         * exploded-graph.h: New file.
6120         * pending-diagnostic.cc: New file.
6121         * pending-diagnostic.h: New file.
6122         * program-point.cc: New file.
6123         * program-point.h: New file.
6124         * program-state.cc: New file.
6125         * program-state.h: New file.
6126         * region-model.cc: New file.
6127         * region-model.h: New file.
6128         * sm-file.cc: New file.
6129         * sm-malloc.cc: New file.
6130         * sm-malloc.dot: New file.
6131         * sm-pattern-test.cc: New file.
6132         * sm-sensitive.cc: New file.
6133         * sm-signal.cc: New file.
6134         * sm-taint.cc: New file.
6135         * sm.cc: New file.
6136         * sm.h: New file.
6137         * state-purge.cc: New file.
6138         * state-purge.h: New file.
6139         * supergraph.cc: New file.
6140         * supergraph.h: New file.
6141
6142 2019-12-13  David Malcolm  <dmalcolm@redhat.com>
6143
6144         * Initial creation
6145
6146 \f
6147 Copyright (C) 2019-2021 Free Software Foundation, Inc.
6148
6149 Copying and distribution of this file, with or without modification,
6150 are permitted in any medium without royalty provided the copyright
6151 notice and this notice are preserved.