| blob | bceb14c7321be526b6a0675d03f424ce87438fd9 |
1 2024-05-21 Release Manager
3 * GCC 13.3.0 released.
5 2024-05-09 David Malcolm <dmalcolm@redhat.com>
7 PR analyzer/114408
8 * engine.cc (impl_run_checkers): Free up any dominance info that
9 we may have created.
10 * kf.cc (class kf_ubsan_handler): New.
11 (register_sanitizer_builtins): New.
12 (register_known_functions): Call register_sanitizer_builtins.
14 2024-05-09 David Malcolm <dmalcolm@redhat.com>
16 Backported from master:
17 2024-03-27 David Malcolm <dmalcolm@redhat.com>
19 PR analyzer/114473
20 * call-summary.cc
21 (call_summary_replay::convert_svalue_from_summary): Assert that
22 the types match.
23 (call_summary_replay::convert_region_from_summary): Likewise.
24 (call_summary_replay::convert_region_from_summary_1): Add missing
25 cast for the deref of RK_SYMBOLIC case.
27 2024-05-09 David Malcolm <dmalcolm@redhat.com>
29 PR analyzer/109251
30 * sm-malloc.cc (deref_before_check::emit): Reject cases where the
31 check is in a loop header within a macro expansion.
32 (deref_before_check::loop_header_p): New.
34 2024-05-09 David Malcolm <dmalcolm@redhat.com>
36 PR analyzer/111289
37 * varargs.cc (representable_in_integral_type_p): New.
38 (va_arg_compatible_types_p): Add "arg_sval" param. Handle integer
39 types.
40 (kf_va_arg::impl_call_pre): Pass arg_sval to
41 va_arg_compatible_types_p.
43 2024-05-09 David Malcolm <dmalcolm@redhat.com>
45 Backported from master:
46 2024-01-31 David Malcolm <dmalcolm@redhat.com>
47 PR analyzer/113253
48 * region-model.cc (region_model::on_stmt_pre): Add gcc_unreachable
49 for debug statements.
50 * state-purge.cc
51 (state_purge_per_ssa_name::state_purge_per_ssa_name): Skip any
52 debug stmts in the FOR_EACH_IMM_USE_FAST list.
53 * supergraph.cc (supergraph::supergraph): Don't add debug stmts
54 to the supernodes.
56 2024-05-09 David Malcolm <dmalcolm@redhat.com>
58 PR analyzer/112969
59 * store.cc (binding_cluster::maybe_get_compound_binding): When
60 populating default_map, express the bit-range of the default key
61 for REG relative to REG, rather than to the base region.
63 2024-05-09 David Malcolm <dmalcolm@redhat.com>
65 PR analyzer/113333
66 * region-model-manager.cc
67 (region_model_manager::maybe_fold_unaryop): Casting all zeroes
68 should give all zeroes.
70 2024-05-09 David Malcolm <dmalcolm@redhat.com>
72 PR analyzer/112790
73 * checker-event.cc (class inlining_info): Move to...
74 * inlining-iterator.h (class inlining_info): ...here.
75 * sm-malloc.cc: Include "analyzer/inlining-iterator.h".
76 (maybe_complain_about_deref_before_check): Reject stmts that were
77 inlined from another function.
79 2024-05-09 David Malcolm <dmalcolm@redhat.com>
81 PR analyzer/112889
82 * store.h (concrete_binding::concrete_binding): Strengthen
83 assertion to require size to be be positive, rather than just
84 non-zero.
85 (concrete_binding::mark_deleted): Use size rather than start bit
86 offset.
87 (concrete_binding::mark_empty): Likewise.
88 (concrete_binding::is_deleted): Likewise.
89 (concrete_binding::is_empty): Likewise.
91 2024-05-09 David Malcolm <dmalcolm@redhat.com>
93 Backported from master:
94 2023-08-03 David Malcolm <dmalcolm@redhat.com>
96 PR analyzer/110882
97 * region.cc (int_size_in_bits): Fail on zero-sized types.
99 2024-05-09 David Malcolm <dmalcolm@redhat.com>
101 Backported from master:
102 2023-07-19 David Malcolm <dmalcolm@redhat.com>
104 PR analyzer/110700
105 * region-model-manager.cc
106 (region_model_manager::get_or_create_int_cst): Assert that we have
107 an integral or pointer type.
108 * sm-taint.cc (taint_state_machine::check_for_tainted_divisor):
109 Don't check non-integral types.
111 2024-05-09 Tim Lange <mail@tim-lange.me>
113 Backported from master:
114 2023-06-09 Tim Lange <mail@tim-lange.me>
116 PR analyzer/109577
117 * constraint-manager.cc (class sval_finder): Visitor to find
118 childs in svalue trees.
119 (constraint_manager::sval_constrained_p): Add new function to
120 check whether a sval might be part of an constraint.
121 * constraint-manager.h: Add sval_constrained_p function.
122 * region-model.cc (class size_visitor): Reverse behavior to not
123 emit a warning on not explicitly considered cases.
124 (region_model::check_region_size):
125 Adapt to size_visitor changes.
127 2024-05-09 David Malcolm <dmalcolm@redhat.com>
129 Backported from master:
130 2023-06-09 David Malcolm <dmalcolm@redhat.com>
132 PR analyzer/110112
133 * region-model.cc (region_model::get_initial_value_for_global):
134 Move code to region::calc_initial_value_at_main.
135 * region.cc (region::get_initial_value_at_main): New function.
136 (region::calc_initial_value_at_main): New function, based on code
137 in region_model::get_initial_value_for_global.
138 (region::region): Initialize m_cached_init_sval_at_main.
139 (decl_region::get_svalue_for_constructor): Add a cache, splitting
140 out body to...
141 (decl_region::calc_svalue_for_constructor): ...this new function.
142 * region.h (region::get_initial_value_at_main): New decl.
143 (region::calc_initial_value_at_main): New decl.
144 (region::m_cached_init_sval_at_main): New field.
145 (decl_region::decl_region): Initialize m_ctor_svalue.
146 (decl_region::calc_svalue_for_constructor): New decl.
147 (decl_region::m_ctor_svalue): New field.
149 2023-07-27 Release Manager
151 * GCC 13.2.0 released.
153 2023-04-26 Release Manager
155 * GCC 13.1.0 released.
157 2023-03-22 David Malcolm <dmalcolm@redhat.com>
159 PR analyzer/109239
160 * program-point.cc: Include "analyzer/inlining-iterator.h".
161 (program_point::effectively_intraprocedural_p): New function.
162 * program-point.h (program_point::effectively_intraprocedural_p):
163 New decl.
164 * sm-malloc.cc (deref_before_check::emit): Use it when rejecting
165 interprocedural cases, so that we reject interprocedural cases
166 that have become intraprocedural due to inlining.
168 2023-03-18 David Malcolm <dmalcolm@redhat.com>
170 PR analyzer/109094
171 * region-model.cc (region_model::on_longjmp): Pass false for
172 new "eval_return_svalue" param of pop_frame.
173 (region_model::pop_frame): Add new "eval_return_svalue" param and
174 use it to suppress the call to get_rvalue on the result when
175 needed by on_longjmp.
176 * region-model.h (region_model::pop_frame): Add new
177 "eval_return_svalue" param.
179 2023-03-10 David Malcolm <dmalcolm@redhat.com>
181 PR analyzer/109059
182 * region-model.cc (region_model::mark_region_as_unknown): Gather a
183 set of maybe-live svalues and call on_maybe_live_values with it.
184 * store.cc (binding_map::remove_overlapping_bindings): Add new
185 "maybe_live_values" param; add any removed svalues to it.
186 (binding_cluster::clobber_region): Add NULL as new param of
187 remove_overlapping_bindings.
188 (binding_cluster::mark_region_as_unknown): Add "maybe_live_values"
189 param and pass it to remove_overlapping_bindings.
190 (binding_cluster::maybe_get_compound_binding): Add NULL for new
191 param of binding_map::remove_overlapping_bindings.
192 (binding_cluster::remove_overlapping_bindings): Add
193 "maybe_live_values" param and pass to
194 binding_map::remove_overlapping_bindings.
195 (store::set_value): Capture a set of maybe-live svalues, and call
196 on_maybe_live_values with it.
197 (store::on_maybe_live_values): New.
198 (store::mark_region_as_unknown): Add "maybe_live_values" param
199 and pass it to binding_cluster::mark_region_as_unknown.
200 (store::remove_overlapping_bindings): Pass NULL for new param of
201 binding_cluster::remove_overlapping_bindings.
202 * store.h (binding_map::remove_overlapping_bindings): Add
203 "maybe_live_values" param.
204 (binding_cluster::mark_region_as_unknown): Likewise.
205 (binding_cluster::remove_overlapping_bindings): Likewise.
206 (store::mark_region_as_unknown): Likewise.
207 (store::on_maybe_live_values): New decl.
209 2023-03-10 David Malcolm <dmalcolm@redhat.com>
211 PR analyzer/108475
212 PR analyzer/109060
213 * sm-malloc.cc (deref_before_check::deref_before_check):
214 Initialize new field m_deref_expr. Assert that arg is non-NULL.
215 (deref_before_check::emit): Reject cases where the spelling of the
216 thing that was dereferenced differs from that of what is checked,
217 or if the dereference expression was not found. Remove code to
218 handle NULL m_arg.
219 (deref_before_check::describe_state_change): Remove code to handle
220 NULL m_arg.
221 (deref_before_check::describe_final_event): Likewise.
222 (deref_before_check::sufficiently_similar_p): New.
223 (deref_before_check::m_deref_expr): New field.
224 (malloc_state_machine::maybe_complain_about_deref_before_check):
225 Don't warn if the diag_ptr is NULL.
227 2023-03-03 David Malcolm <dmalcolm@redhat.com>
229 * kf.cc (class kf_sprintf): New.
230 (register_known_functions): Register it.
232 2023-03-02 David Malcolm <dmalcolm@redhat.com>
234 PR analyzer/108968
235 * region-model.cc (region_model::get_rvalue_1): Handle VAR_DECLs
236 with a DECL_HARD_REGISTER by returning UNKNOWN.
238 2023-03-02 Hans-Peter Nilsson <hp@axis.com>
240 * kf.cc (register_known_functions): Add __errno function for newlib.
242 2023-03-01 David Malcolm <dmalcolm@redhat.com>
244 PR analyzer/107565
245 * region-model.cc (region_model::on_call_pre): Flatten logic by
246 returning early. Consolidate logic for detecting const and pure
247 functions. When considering whether an unhandled built-in
248 function has side-effects, consider all kinds of builtin, rather
249 than just BUILT_IN_NORMAL, and don't require
250 gimple_builtin_call_types_compatible_p.
252 2023-03-01 David Malcolm <dmalcolm@redhat.com>
254 PR analyzer/108935
255 * infinite-recursion.cc (contains_unknown_p): New.
256 (sufficiently_different_region_binding_p): New function, splitting
257 out inner loop from...
258 (sufficiently_different_p): ...here. Extend detection of unknown
259 svalues to also include svalues that contain unknown. Treat
260 changes in frames below the entry to the recursion as being
261 sufficiently different to reject being an infinite recursion.
263 2023-02-21 David Malcolm <dmalcolm@redhat.com>
265 PR analyzer/108830
266 * analyzer.opt (fanalyzer-suppress-followups): New option.
267 * engine.cc (impl_region_model_context::warn): Terminate the path
268 if the diagnostic's terminate_path_p vfunc returns true and
269 -fanalyzer-suppress-followups is true (the default).
270 (impl_sm_context::warn): Likewise, for both overloads.
271 * pending-diagnostic.h (pending_diagnostic::terminate_path_p): New
272 vfunc.
273 * program-state.cc (program_state::on_edge): Terminate the path if
274 the ctxt requests it during updating the edge.
275 * region-model.cc (poisoned_value_diagnostic::terminate_path_p):
276 New vfunc.
277 * sm-malloc.cc (null_deref::terminate_path_p): New vfunc.
278 (null_arg::terminate_path_p): New vfunc.
280 2023-02-16 David Malcolm <dmalcolm@redhat.com>
282 PR analyzer/108806
283 * constraint-manager.cc (bounded_range::dump_to_pp): Use
284 bounded_range::singleton_p.
285 (constraint_manager::add_bounded_ranges): Handle singleton ranges
286 by adding an EQ_EXPR constraint.
287 (constraint_manager::impossible_derived_conditions_p): New.
288 (constraint_manager::eval_condition): Reject EQ_EXPR when it would
289 imply impossible derived conditions.
290 (selftest::test_bits): New.
291 (selftest::run_constraint_manager_tests): Run it.
292 * constraint-manager.h (bounded_range::singleton_p): New.
293 (constraint_manager::impossible_derived_conditions_p): New decl.
294 * region-model.cc (region_model::get_rvalue_1): Handle
295 BIT_AND_EXPR, BIT_IOR_EXPR, and BIT_XOR_EXPR.
297 2023-02-15 David Malcolm <dmalcolm@redhat.com>
299 PR analyzer/108664
300 PR analyzer/108666
301 PR analyzer/108725
302 * diagnostic-manager.cc (epath_finder::get_best_epath): Add
303 "target_stmt" param.
304 (epath_finder::explore_feasible_paths): Likewise.
305 (epath_finder::process_worklist_item): Likewise.
306 (saved_diagnostic::calc_best_epath): Pass m_stmt to
307 epath_finder::get_best_epath.
308 * engine.cc (feasibility_state::maybe_update_for_edge): Move
309 per-stmt logic to...
310 (feasibility_state::update_for_stmt): ...this new function.
311 * exploded-graph.h (feasibility_state::update_for_stmt): New decl.
312 * feasible-graph.cc (feasible_node::get_state_at_stmt): New.
313 * feasible-graph.h: Include "analyzer/exploded-graph.h".
314 (feasible_node::get_state_at_stmt): New decl.
315 * infinite-recursion.cc
316 (infinite_recursion_diagnostic::check_valid_fpath_p): Update for
317 vfunc signature change.
318 * pending-diagnostic.h (pending_diagnostic::check_valid_fpath_p):
319 Convert first param to a reference. Add stmt param.
320 * region-model.cc: Include "analyzer/feasible-graph.h".
321 (poisoned_value_diagnostic::poisoned_value_diagnostic): Add
322 "check_expr" param.
323 (poisoned_value_diagnostic::check_valid_fpath_p): New.
324 (poisoned_value_diagnostic::m_check_expr): New field.
325 (region_model::check_for_poison): Attempt to supply a check_expr
326 to the diagnostic
327 (region_model::deref_rvalue): Add NULL for new check_expr param
328 of poisoned_value_diagnostic.
329 (region_model::get_or_create_region_for_heap_alloc): Don't reuse
330 regions that are marked as TOUCHED.
332 2023-02-10 David Malcolm <dmalcolm@redhat.com>
334 PR analyzer/108745
335 * sm-malloc.cc (deref_before_check::emit): Reject the warning if
336 the check occurs within a macro defintion.
338 2023-02-09 David Malcolm <dmalcolm@redhat.com>
340 PR analyzer/108733
341 * state-purge.cc (get_candidate_for_purging): Add ADDR_EXPR
342 and MEM_REF.
344 2023-02-08 David Malcolm <dmalcolm@redhat.com>
346 PR analyzer/108704
347 * state-purge.cc (state_purge_per_decl::process_point_backwards):
348 Don't stop processing the decl if it's fully overwritten by
349 this stmt if it's also used by this stmt.
351 2023-02-07 David Malcolm <dmalcolm@redhat.com>
353 PR analyzer/108661
354 * sm-fd.cc (class kf_read): New.
355 (register_known_fd_functions): Register "read".
356 * sm-file.cc (class kf_fread): Update comment.
358 2023-02-02 David Malcolm <dmalcolm@redhat.com>
360 PR analyzer/108633
361 * sm-fd.cc (fd_state_machine::check_for_fd_attrs): Add missing
362 "continue".
363 (fd_state_machine::on_listen): Don't issue phase-mismatch or
364 type-mismatch warnings for the "invalid" state.
366 2023-02-01 David Malcolm <dmalcolm@redhat.com>
368 PR analyzer/108616
369 * pending-diagnostic.cc (fixup_location_in_macro_p): Add "alloca"
370 to macros that we shouldn't unwind inside.
372 2023-01-26 David Malcolm <dmalcolm@redhat.com>
374 PR analyzer/108524
375 * analyzer.h (class feasible_node): New forward decl.
376 * diagnostic-manager.cc (epath_finder::get_best_epath): Add "pd"
377 param.
378 (epath_finder::explore_feasible_paths): Likewise.
379 (epath_finder::process_worklist_item): Likewise. Use it to call
380 pending_diagnostic::check_valid_fpath_p on the final fpath to
381 give pending_diagnostic a way to add additional restrictions on
382 feasibility.
383 (saved_diagnostic::calc_best_epath): Pass pending_diagnostic to
384 epath_finder::get_best_epath.
385 * infinite-recursion.cc: Include "analyzer/feasible-graph.h".
386 (infinite_recursion_diagnostic::check_valid_fpath_p): New.
387 (infinite_recursion_diagnostic::fedge_uses_conjured_svalue_p): New.
388 (infinite_recursion_diagnostic::expr_uses_conjured_svalue_p): New.
389 * pending-diagnostic.h (pending_diagnostic::check_valid_fpath_p):
390 New vfunc.
392 2023-01-19 David Malcolm <dmalcolm@redhat.com>
394 PR analyzer/108455
395 * analyzer.h (class checker_event): New forward decl.
396 (class state_change_event): Indent.
397 (class warning_event): New forward decl.
398 * checker-event.cc (state_change_event::state_change_event): Add
399 "enode" param.
400 (warning_event::get_desc): Update for new param of
401 evdesc::final_event ctor.
402 * checker-event.h (state_change_event::state_change_event): Add
403 "enode" param.
404 (state_change_event::get_exploded_node): New accessor.
405 (state_change_event::m_enode): New field.
406 (warning_event::warning_event): New "enode" param.
407 (warning_event::get_exploded_node): New accessor.
408 (warning_event::m_enode): New field.
409 * diagnostic-manager.cc
410 (state_change_event_creator::on_global_state_change): Pass
411 src_node to state_change_event ctor.
412 (state_change_event_creator::on_state_change): Likewise.
413 (null_assignment_sm_context::set_next_state): Pass NULL for
414 new param of state_change_event ctor.
415 * infinite-recursion.cc
416 (infinite_recursion_diagnostic::add_final_event): Update for new
417 param of warning_event ctor.
418 * pending-diagnostic.cc (pending_diagnostic::add_final_event):
419 Pass enode to warning_event ctor.
420 * pending-diagnostic.h (evdesc::final_event): Add reference to
421 warning_event.
422 * sm-malloc.cc: Include "analyzer/checker-event.h" and
423 "analyzer/exploded-graph.h".
424 (deref_before_check::deref_before_check): Initialize new fields.
425 (deref_before_check::emit): Reject warnings in which we were
426 unable to determine the enodes of the dereference and the check.
427 Reject warnings interprocedural warnings. Reject warnings in which
428 the dereference doesn't dominate the check.
429 (deref_before_check::describe_state_change): Set m_deref_enode.
430 (deref_before_check::describe_final_event): Set m_check_enode.
431 (deref_before_check::m_deref_enode): New field.
432 (deref_before_check::m_check_enode): New field.
434 2023-01-13 David Malcolm <dmalcolm@redhat.com>
436 PR analyzer/105273
437 * region-model.cc (has_nondefault_case_for_value_p): New.
438 (has_nondefault_cases_for_all_enum_values_p): New.
439 (region_model::apply_constraints_for_gswitch): Skip
440 implicitly-created "default" when switching on an enum
441 and all enum values have non-default cases.
442 (rejected_default_case::dump_to_pp): New.
443 * region-model.h (region_model_context::possibly_tainted_p): New
444 decl.
445 (class rejected_default_case): New.
446 * sm-taint.cc (region_model_context::possibly_tainted_p): New.
447 * supergraph.cc (switch_cfg_superedge::dump_label_to_pp): Dump
448 when implicitly_created_default_p.
449 (switch_cfg_superedge::implicitly_created_default_p): New.
450 * supergraph.h
451 (switch_cfg_superedge::implicitly_created_default_p): New decl.
453 2023-01-11 David Malcolm <dmalcolm@redhat.com>
455 PR analyzer/108252
456 * kf.cc (class kf_strdup): New.
457 (class kf_strndup): New.
458 (register_known_functions): Register them.
459 * region-model.cc (region_model::on_call_pre): Use
460 &HEAP_ALLOCATED_REGION for the default result of an external
461 function with the "malloc" attribute, rather than CONJURED_SVALUE.
462 (region_model::get_or_create_region_for_heap_alloc): Allow
463 "size_in_bytes" to be NULL.
464 * store.cc (store::set_value): When handling *UNKNOWN = VAL,
465 mark VAL as "maybe bound".
467 2022-12-16 David Malcolm <dmalcolm@redhat.com>
469 PR analyzer/106479
470 * kf.cc (kf_memcpy_memmove::impl_call_pre): Pass in source region
471 to region_model::check_for_poison.
472 * region-model-asm.cc (region_model::on_asm_stmt): Pass NULL
473 region to region_model::check_for_poison.
474 * region-model.cc (region_model::check_for_poison): Add
475 "src_region" param, and pass it to poisoned_value_diagnostic.
476 (region_model::on_assignment): Pass NULL region to
477 region_model::check_for_poison.
478 (region_model::get_rvalue): Likewise.
479 * region-model.h (region_model::check_for_poison): Add
480 "src_region" param.
481 * sm-fd.cc (fd_state_machine::on_accept): Pass in source region
482 to region_model::check_for_poison.
483 * varargs.cc (kf_va_copy::impl_call_pre): Pass NULL region to
484 region_model::check_for_poison.
485 (kf_va_arg::impl_call_pre): Pass in source region to
486 region_model::check_for_poison.
488 2022-12-14 David Malcolm <dmalcolm@redhat.com>
490 PR analyzer/108065
491 * region.cc (decl_region::get_svalue_for_initializer): Bail out to
492 avoid calling binding_key::make with an empty region.
493 * store.cc (binding_map::apply_ctor_val_to_range): Likewise.
494 (binding_map::apply_ctor_pair_to_child_region): Likewise.
495 (binding_cluster::bind): Likewise.
496 (binding_cluster::purge_region): Likewise.
497 (binding_cluster::maybe_get_compound_binding): Likewise.
498 (binding_cluster::maybe_get_simple_value): Likewise.
500 2022-12-09 David Malcolm <dmalcolm@redhat.com>
502 * analyzer.h (class known_function): Expand comment.
503 * region-model-impl-calls.cc: Rename to...
504 * kf.cc: ...this.
505 * known-function-manager.h (class known_function_manager): Add
506 leading comment.
508 2022-12-09 David Malcolm <dmalcolm@redhat.com>
510 PR analyzer/108003
511 * call-summary.cc
512 (call_summary_replay::convert_region_from_summary_1): Convert
513 heap_regs_in_use from auto_sbitmap to auto_bitmap.
514 * region-model-manager.cc
515 (region_model_manager::get_or_create_region_for_heap_alloc):
516 Convert from sbitmap to bitmap.
517 * region-model-manager.h: Likewise.
518 * region-model.cc
519 (region_model::get_or_create_region_for_heap_alloc): Convert from
520 auto_sbitmap to auto_bitmap.
521 (region_model::get_referenced_base_regions): Likewise.
522 * region-model.h: Include "bitmap.h" rather than "sbitmap.h".
523 (region_model::get_referenced_base_regions): Convert from
524 auto_sbitmap to auto_bitmap.
526 2022-12-09 David Malcolm <dmalcolm@redhat.com>
528 * region-model-impl-calls.cc (class kf_memcpy): Rename to...
529 (class kf_memcpy_memmove): ...this.
530 (kf_memcpy::impl_call_pre): Rename to...
531 (kf_memcpy_memmove::impl_call_pre): ...this, and check the src for
532 poison.
533 (register_known_functions): Update for above renaming, and
534 register BUILT_IN_MEMMOVE and BUILT_IN_MEMMOVE_CHK.
536 2022-12-06 David Malcolm <dmalcolm@redhat.com>
538 PR analyzer/107882
539 * region-model.cc (region_model::get_store_value): Return an
540 unknown value for empty regions.
541 (region_model::set_value): Bail on empty regions.
542 * region.cc (region::empty_p): New.
543 * region.h (region::empty_p): New decl.
544 * state-purge.cc (same_binding_p): Bail if either region is empty.
545 * store.cc (binding_key::make): Assert that a concrete binding's
546 bit_size must be > 0.
547 (binding_cluster::mark_region_as_unknown): Bail on empty regions.
548 (binding_cluster::get_binding): Likewise.
549 (binding_cluster::remove_overlapping_bindings): Likewise.
550 (binding_cluster::on_unknown_fncall): Don't conjure values for
551 empty regions.
552 (store::fill_region): Bail on empty regions.
553 * store.h (class concrete_binding): Update comment to reflect that
554 the range of bits must be non-empty.
555 (concrete_binding::concrete_binding): Assert that bit range is
556 non-empty.
558 2022-12-06 David Malcolm <dmalcolm@redhat.com>
560 PR analyzer/106325
561 * region-model-manager.cc
562 (region_model_manager::get_or_create_null_ptr): New.
563 * region-model-manager.h
564 (region_model_manager::get_or_create_null_ptr): New decl.
565 * region-model.cc (region_model::on_top_level_param): Add
566 "nonnull" param and make use of it.
567 (region_model::push_frame): When handling a top-level entrypoint
568 to the analysis, determine which params __attribute__((nonnull))
569 applies to, and pass to on_top_level_param.
570 * region-model.h (region_model::on_top_level_param): Add "nonnull"
571 param.
573 2022-12-06 David Malcolm <dmalcolm@redhat.com>
575 * analyzer.h (register_known_analyzer_functions): New decl.
576 (register_known_functions_lang_cp): New decl.
577 * call-details.cc: New file, split out from
578 region-model-impl-calls.cc.
579 * call-details.h: New file, split out from region-model.h.
580 * call-info.cc: Include "analyzer/call-details.h".
581 * call-summary.h: Likewise.
582 * kf-analyzer.cc: New file, split out from
583 region-model-impl-calls.cc.
584 * kf-lang-cp.cc: Likewise.
585 * known-function-manager.cc: Include "analyzer/call-details.h".
586 * region-model-impl-calls.cc: Move definitions of call_details's
587 member functions to call-details.cc. Move class kf_analyzer_* to
588 kf-analyzer.cc. Move kf_operator_new and kf_operator_delete to
589 kf-lang-cp.cc. Refresh #includes accordingly.
590 (register_known_functions): Replace registration of __analyzer_*
591 functions with a call to register_known_analyzer_functions.
592 Replace registration of C++ support functions with a call to
593 register_known_functions_lang_cp.
594 * region-model.h (class call_details): Move to new call-details.h.
595 * sm-fd.cc: Include "analyzer/call-details.h".
596 * sm-file.cc: Likewise.
597 * sm-malloc.cc: Likewise.
598 * varargs.cc: Likewise.
600 2022-12-02 David Malcolm <dmalcolm@redhat.com>
602 * analyzer.h (struct event_loc_info): New forward decl.
603 * bounds-checking.cc: Use event_loc_info throughout to bundle the
604 loc, fndecl, depth triples.
605 * call-info.cc: Likewise.
606 * checker-event.cc: Likewise.
607 * checker-event.h (struct event_loc_info): New decl. Use it
608 throughout to bundle the loc, fndecl, depth triples.
609 * checker-path.cc: Likewise.
610 * checker-path.h: Likewise.
611 * diagnostic-manager.cc: Likewise.
612 * engine.cc: Likewise.
613 * infinite-recursion.cc: Likewise.
614 * pending-diagnostic.cc: Likewise.
615 * pending-diagnostic.h: Likewise.
616 * region-model.cc: Likewise.
617 * sm-signal.cc: Likewise.
618 * varargs.cc: Likewise.
620 2022-12-02 David Malcolm <dmalcolm@redhat.com>
622 PR analyzer/107851
623 * analyzer.cc (make_label_text_n): Convert param "n" from int to
624 unsigned HOST_WIDE_INT.
625 * analyzer.h (make_label_text_n): Likewise for decl.
626 * bounds-checking.cc: Include "analyzer/checker-event.h" and
627 "analyzer/checker-path.h".
628 (out_of_bounds::add_region_creation_events): New.
629 (concrete_past_the_end::describe_region_creation_event): Replace
630 with...
631 (concrete_past_the_end::add_region_creation_events): ...this.
632 (symbolic_past_the_end::describe_region_creation_event): Delete.
633 * checker-event.cc (region_creation_event::region_creation_event):
634 Update for dropping all member data.
635 (region_creation_event::get_desc): Delete, splitting out into
636 region_creation_event_memory_space::get_desc,
637 region_creation_event_capacity::get_desc, and
638 region_creation_event_debug::get_desc.
639 (region_creation_event_memory_space::get_desc): New.
640 (region_creation_event_capacity::get_desc): New.
641 (region_creation_event_allocation_size::get_desc): New.
642 (region_creation_event_debug::get_desc): New.
643 * checker-event.h: Include "analyzer/program-state.h".
644 (enum rce_kind): Delete.
645 (class region_creation_event): Drop all member data.
646 (region_creation_event::region_creation_event): Make protected.
647 (region_creation_event::get_desc): Delete.
648 (class region_creation_event_memory_space): New.
649 (class region_creation_event_capacity): New.
650 (class region_creation_event_allocation_size): New.
651 (class region_creation_event_debug): New.
652 * checker-path.cc (checker_path::add_region_creation_events): Add
653 "pd" param. Call pending_diangnostic::add_region_creation_events.
654 Update for conversion of RCE_DEBUG to region_creation_event_debug.
655 * checker-path.h (checker_path::add_region_creation_events): Add
656 "pd" param.
657 * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
658 Pass pending_diagnostic to
659 emission_path::add_region_creation_events.
660 (diagnostic_manager::build_emission_path): Pass path_builder to
661 add_event_on_final_node.
662 (diagnostic_manager::add_event_on_final_node): Add "pb" param.
663 Pass pending_diagnostic to
664 emission_path::add_region_creation_events.
665 (diagnostic_manager::add_events_for_eedge): Pass
666 pending_diagnostic to emission_path::add_region_creation_events.
667 * diagnostic-manager.h
668 (diagnostic_manager::add_event_on_final_node): Add "pb" param.
669 * pending-diagnostic.cc
670 (pending_diagnostic::add_region_creation_events): New.
671 * pending-diagnostic.h (struct region_creation): Delete.
672 (pending_diagnostic::describe_region_creation_event): Delete.
673 (pending_diagnostic::add_region_creation_events): New vfunc.
674 * region-model.cc: Include "analyzer/checker-event.h" and
675 "analyzer/checker-path.h".
676 (dubious_allocation_size::dubious_allocation_size): Initialize
677 m_has_allocation_event.
678 (dubious_allocation_size::describe_region_creation_event): Delete.
679 (dubious_allocation_size::describe_final_event): Update for
680 replacement of m_allocation_event with m_has_allocation_event.
681 (dubious_allocation_size::add_region_creation_events): New.
682 (dubious_allocation_size::m_allocation_event): Replace with...
683 (dubious_allocation_size::m_has_allocation_event): ...this.
685 2022-12-02 David Malcolm <dmalcolm@redhat.com>
687 PR analyzer/107948
688 * region-model-manager.cc
689 (region_model_manager::maybe_fold_binop): Fold (0 - VAL) to -VAL.
690 * region-model.cc (region_model::eval_condition): Handle e.g.
691 "-X <= 0" as equivalent to X >= 0".
693 2022-12-01 David Malcolm <dmalcolm@redhat.com>
695 PR analyzer/106626
696 * bounds-checking.cc
697 (symbolic_past_the_end::describe_final_event): Delete, moving to
698 symbolic_buffer_overflow::describe_final_event and
699 symbolic_buffer_over_read::describe_final_event, eliminating
700 composition of text strings via "byte_str" and "m_dir_str".
701 (symbolic_past_the_end::m_dir_str): Delete field.
702 (symbolic_buffer_overflow::symbolic_buffer_overflow): Drop
703 m_dir_str.
704 (symbolic_buffer_overflow::describe_final_event): New, as noted
705 above.
706 (symbolic_buffer_over_read::symbolic_buffer_overflow): Drop
707 m_dir_str.
708 (symbolic_buffer_over_read::describe_final_event): New, as noted
709 above.
711 2022-12-01 David Malcolm <dmalcolm@redhat.com>
713 * bounds-checking.cc (class out_of_bounds): Split out from...
714 (class concrete_out_of_bounds): New abstract subclass.
715 (class past_the_end): Rename to...
716 (class concrete_past_the_end): ...this, and make a subclass of
717 concrete_out_of_bounds.
718 (class buffer_overflow): Rename to...
719 (class concrete_buffer_overflow): ...this, and make a subclass of
720 concrete_past_the_end.
721 (class buffer_over_read): Rename to...
722 (class concrete_buffer_over_read): ...this, and make a subclass of
723 concrete_past_the_end.
724 (class buffer_underwrite): Rename to...
725 (class concrete_buffer_underwrite): ...this, and make a subclass
726 of concrete_out_of_bounds.
727 (class buffer_under_read): Rename to...
728 (class concrete_buffer_under_read): ...this, and make a subclass
729 of concrete_out_of_bounds.
730 (class symbolic_past_the_end): Convert to a subclass of
731 out_of_bounds.
732 (symbolic_buffer_overflow::get_kind): New.
733 (symbolic_buffer_over_read::get_kind): New.
734 (region_model::check_region_bounds): Update for renamings.
735 * engine.cc (impl_sm_context::set_next_state): Eliminate
736 "new_ctxt", passing NULL to get_rvalue instead.
737 (impl_sm_context::warn): Likewise.
739 2022-12-01 David Malcolm <dmalcolm@redhat.com>
741 PR analyzer/106626
742 * bounds-checking.cc (out_of_bounds::get_memory_space): New.
743 (buffer_overflow::emit): Use it.
744 (class buffer_overread): Rename to...
745 (class buffer_over_read): ...this.
746 (buffer_over_read::emit): Specify which memory space the read is
747 from, where known. Change "overread" to "over-read".
748 (class buffer_underflow): Rename to...
749 (class buffer_underwrite): ...this.
750 (buffer_underwrite::emit): Specify which memory space the write is
751 to, where known. Change "underflow" to "underwrite".
752 (class buffer_underread): Rename to...
753 (class buffer_under_read): Rename to...
754 (buffer_under_read::emit): Specify which memory space the read is
755 from, where known. Change "underread" to "under-read".
756 (symbolic_past_the_end::get_memory_space): New.
757 (symbolic_buffer_overflow::emit): Use it.
758 (class symbolic_buffer_overread): Rename to...
759 (class symbolic_buffer_over_read): ...this.
760 (symbolic_buffer_over_read::emit): Specify which memory space the
761 read is from, where known. Change "overread" to "over-read".
762 (region_model::check_symbolic_bounds): Update for class renaming.
763 (region_model::check_region_bounds): Likewise.
765 2022-12-01 David Malcolm <dmalcolm@redhat.com>
767 PR analyzer/106626
768 * bounds-checking.cc (out_of_bounds::maybe_describe_array_bounds):
769 New.
770 (buffer_overflow::emit): Call maybe_describe_array_bounds.
771 (buffer_overread::emit): Likewise.
772 (buffer_underflow::emit): Likewise.
773 (buffer_underread::emit): Likewise.
775 2022-12-01 David Malcolm <dmalcolm@redhat.com>
777 PR analyzer/106626
778 * bounds-checking.cc (buffer_overflow::emit): Use inform_n.
779 Update wording to clarify that we're talking about the size of
780 the bad access, rather than its position.
781 (buffer_overread::emit): Likewise.
783 2022-12-01 David Malcolm <dmalcolm@redhat.com>
785 * bounds-checking.cc: New file, taken from region-model.cc.
786 * region-model.cc (class out_of_bounds): Move to
787 bounds-checking.cc.
788 (class past_the_end): Likewise.
789 (class buffer_overflow): Likewise.
790 (class buffer_overread): Likewise.
791 (class buffer_underflow): Likewise.
792 (class buffer_underread): Likewise.
793 (class symbolic_past_the_end): Likewise.
794 (class symbolic_buffer_overflow): Likewise.
795 (class symbolic_buffer_overread): Likewise.
796 (region_model::check_symbolic_bounds): Likewise.
797 (maybe_get_integer_cst_tree): Likewise.
798 (region_model::check_region_bounds): Likewise.
799 * region-model.h: Add comment.
801 2022-12-01 David Malcolm <dmalcolm@redhat.com>
803 PR analyzer/107928
804 * sm-fd.cc (fd_state_machine::on_bind): Handle m_constant_fd in
805 the "success" outcome.
806 (fd_state_machine::on_connect): Likewise.
807 * sm-fd.dot: Add "constant_fd" state and its transitions.
809 2022-11-30 David Malcolm <dmalcolm@redhat.com>
811 * region-model-impl-calls.cc (class kf_fgets): Move to sm-file.cc.
812 (kf_fgets::impl_call_pre): Likewise.
813 (class kf_fread): Likewise.
814 (kf_fread::impl_call_pre): Likewise.
815 (class kf_getchar): Likewise.
816 (class kf_stdio_output_fn): Likewise.
817 (register_known_functions): Move registration of
818 BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
819 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
820 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
821 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
822 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
823 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF,
824 "getchar", "fgets", "fgets_unlocked", and "fread" to
825 register_known_file_functions.
826 * sm-file.cc (class kf_stdio_output_fn): Move here from
827 region-model-impl-calls.cc.
828 (class kf_fgets): Likewise.
829 (class kf_fread): Likewise.
830 (class kf_getchar): Likewise.
831 (register_known_file_functions): Move registration of
832 BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
833 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
834 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
835 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
836 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
837 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF,
838 "fgets", "fgets_unlocked", "fread", and "getchar" to here from
839 register_known_functions.
841 2022-11-30 David Malcolm <dmalcolm@redhat.com>
843 PR analyzer/103546
844 * analyzer.h (register_known_file_functions): New decl.
845 * program-state.cc (sm_state_map::replay_call_summary): Rejct
846 attempts to store sm-state for caller_sval that can't have
847 associated state.
848 * region-model-impl-calls.cc (register_known_functions): Call
849 register_known_file_functions.
850 * sm-fd.cc (class kf_isatty): New.
851 (register_known_fd_functions): Register it.
852 * sm-file.cc (class kf_ferror): New.
853 (class kf_fileno): New.
854 (class kf_getc): New.
855 (register_known_file_functions): New.
857 2022-11-30 David Malcolm <dmalcolm@redhat.com>
859 PR analyzer/105784
860 * region-model-manager.cc
861 (region_model_manager::maybe_fold_binop): For POINTER_PLUS_EXPR,
862 PLUS_EXPR and MINUS_EXPR, eliminate requirement that the final
863 type matches that of arg0 in favor of a cast.
865 2022-11-24 Martin Liska <mliska@suse.cz>
867 * varargs.cc: Fix Clang warnings.
869 2022-11-24 David Malcolm <dmalcolm@redhat.com>
871 PR analyzer/106473
872 * call-summary.cc
873 (call_summary_replay::convert_region_from_summary_1): Update for
874 change to creation of heap-allocated regions.
875 * program-state.cc (test_program_state_1): Likewise.
876 (test_program_state_merging): Likewise.
877 * region-model-impl-calls.cc (kf_calloc::impl_call_pre): Likewise.
878 (kf_malloc::impl_call_pre): Likewise.
879 (kf_operator_new::impl_call_pre): Likewise.
880 (kf_realloc::impl_call_postsuccess_with_move::update_model): Likewise.
881 * region-model-manager.cc
882 (region_model_manager::create_region_for_heap_alloc): Convert
883 to...
884 (region_model_manager::get_or_create_region_for_heap_alloc):
885 ...this, reusing an existing region if it's unreferenced in the
886 client state.
887 * region-model-manager.h (region_model_manager::get_num_regions): New.
888 (region_model_manager::create_region_for_heap_alloc): Convert to...
889 (region_model_manager::get_or_create_region_for_heap_alloc): ...this.
890 * region-model.cc (region_to_value_map::can_merge_with_p): Reject
891 merger when the values are different.
892 (region_model::create_region_for_heap_alloc): Convert to...
893 (region_model::get_or_create_region_for_heap_alloc): ...this.
894 (region_model::get_referenced_base_regions): New.
895 (selftest::test_state_merging): Update for change to creation of
896 heap-allocated regions.
897 (selftest::test_malloc_constraints): Likewise.
898 (selftest::test_malloc): Likewise.
899 * region-model.h: Include "sbitmap.h".
900 (region_model::create_region_for_heap_alloc): Convert to...
901 (region_model::get_or_create_region_for_heap_alloc): ...this.
902 (region_model::get_referenced_base_regions): New decl.
903 * store.cc (store::canonicalize): Don't purge a heap-allocated region
904 that's been marked as escaping.
906 2022-11-24 David Malcolm <dmalcolm@redhat.com>
908 * checker-path.cc (checker_path::inject_any_inlined_call_events):
909 Don't dump the address of the block when -fdump-noaddr.
911 2022-11-24 David Malcolm <dmalcolm@redhat.com>
913 * region-model.h (region_model::on_socket): Delete decl.
914 (region_model::on_bind): Likewise.
915 (region_model::on_listen): Likewise.
916 (region_model::on_accept): Likewise.
917 (region_model::on_connect): Likewise.
918 * sm-fd.cc (kf_socket::outcome_of_socket::update_model): Move body
919 of region_model::on_socket into here, ...
920 (region_model::on_socket): ...eliminating this function.
921 (kf_bind::outcome_of_bind::update_model): Likewise for on_bind...
922 (region_model::on_bind): ...eliminating this function.
923 (kf_listen::outcome_of_listen::update_model): Likewise fo
924 on_listen...
925 (region_model::on_listen): ...eliminating this function.
926 (kf_accept::outcome_of_accept::update_model): Likewise fo
927 on_accept...
928 (region_model::on_accept): ...eliminating this function.
929 (kf_connect::outcome_of_connect::update_model): Likewise fo
930 on_connect...
931 (region_model::on_connect): ...eliminating this function.
933 2022-11-24 David Malcolm <dmalcolm@redhat.com>
935 * analyzer.h (register_known_fd_functions): New decl.
936 * region-model-impl-calls.cc (class kf_accept): Move to sm-fd.cc.
937 (class kf_bind): Likewise.
938 (class kf_connect): Likewise.
939 (class kf_listen): Likewise.
940 (class kf_pipe): Likewise.
941 (class kf_socket): Likewise.
942 (register_known_functions): Remove registration of the above
943 functions, instead calling register_known_fd_functions.
944 * sm-fd.cc: Include "analyzer/call-info.h".
945 (class kf_socket): Move here from region-model-impl-calls.cc.
946 (class kf_bind): Likewise.
947 (class kf_listen): Likewise.
948 (class kf_accept): Likewise.
949 (class kf_connect): Likewise.
950 (class kf_pipe): Likewise.
951 (register_known_fd_functions): New.
953 2022-11-22 David Malcolm <dmalcolm@redhat.com>
955 PR analyzer/107788
956 * known-function-manager.cc (known_function_manager::get_match):
957 Don't look up fndecls by name when they're not in the root
958 namespace.
960 2022-11-22 David Malcolm <dmalcolm@redhat.com>
962 PR analyzer/107783
963 * sm-fd.cc (fd_state_machine::check_for_new_socket_fd): Don't
964 complain when old state is "fd-constant".
965 (fd_state_machine::on_listen): Likewise.
966 (fd_state_machine::on_accept): Likewise.
968 2022-11-22 David Malcolm <dmalcolm@redhat.com>
970 PR analyzer/107807
971 * region-model-impl-calls.cc (register_known_functions): Register
972 "___errno" and "__error" as synonyms for "__errno_location".
974 2022-11-22 David Malcolm <dmalcolm@redhat.com>
976 * analyzer.h (class internal_known_function): New.
977 (register_varargs_builtins): New decl.
978 * engine.cc (exploded_node::on_stmt_pre): Remove
979 "out_terminate_path" param from call to region_model::on_stmt_pre.
980 (feasibility_state::maybe_update_for_edge): Likewise.
981 * known-function-manager.cc: Include "basic-block.h", "gimple.h",
982 and "analyzer/region-model.h".
983 (known_function_manager::known_function_manager): Initialize
984 m_combined_fns_arr.
985 (known_function_manager::~known_function_manager): Clean up
986 m_combined_fns_arr.
987 (known_function_manager::get_by_identifier): Make const.
988 (known_function_manager::add): New overloaded definitions for
989 enum built_in_function and enum internal_fn.
990 (known_function_manager::get_by_fndecl): Delete.
991 (known_function_manager::get_match): New.
992 (known_function_manager::get_internal_fn): New.
993 (known_function_manager::get_normal_builtin): New.
994 * known-function-manager.h
995 (known_function_manager::get_by_identifier): Make private and
996 add const qualifier.
997 (known_function_manager::get_by_fndecl): Delete.
998 (known_function_manager::add): Add overloaded decls for
999 enum built_in_function name and enum internal_fn.
1000 (known_function_manager::get_match): New decl.
1001 (known_function_manager::get_internal_fn): New decl.
1002 (known_function_manager::get_normal_builtin): New decl.
1003 (known_function_manager::m_combined_fns_arr): New field.
1004 * region-model-impl-calls.cc (call_details::arg_is_size_p): New.
1005 (class kf_alloca): New.
1006 (region_model::impl_call_alloca): Convert to...
1007 (kf_alloca::impl_call_pre): ...this.
1008 (kf_analyzer_dump_capacity::matches_call_types_p): Rewrite check
1009 to use call_details::arg_is_pointer_p.
1010 (region_model::impl_call_builtin_expect): Convert to...
1011 (class kf_expect): ...this.
1012 (class kf_calloc): New, adding check that both arguments are
1013 size_t.
1014 (region_model::impl_call_calloc): Convert to...
1015 (kf_calloc::impl_call_pre): ...this.
1016 (kf_connect::matches_call_types_p): Rewrite check to use
1017 call_details::arg_is_pointer_p.
1018 (region_model::impl_call_error): Convert to...
1019 (class kf_error): ...this, and...
1020 (kf_error::impl_call_pre): ...this.
1021 (class kf_fgets): New, adding checks that args 0 and 2 are
1022 pointers.
1023 (region_model::impl_call_fgets): Convert to...
1024 (kf_fgets::impl_call_pre): ...this.
1025 (class kf_fread): New, adding checks on the argument types.
1026 (region_model::impl_call_fread): Convert to...
1027 (kf_fread::impl_call_pre): ...this.
1028 (class kf_free): New, adding check that the argument is a pointer.
1029 (region_model::impl_call_free): Convert to...
1030 (kf_free::impl_call_post): ...this.
1031 (class kf_getchar): New.
1032 (class kf_malloc): New, adding check that the argument is a
1033 size_t.
1034 (region_model::impl_call_malloc): Convert to...
1035 (kf_malloc::impl_call_pre): ...this.
1036 (class kf_memcpy): New, adding checks on arguments.
1037 (region_model::impl_call_memcpy): Convert to...
1038 (kf_memcpy::impl_call_pre): ...this.
1039 (class kf_memset): New.
1040 (region_model::impl_call_memset): Convert to...
1041 (kf_memset::impl_call_pre): ...this.
1042 (kf_pipe::matches_call_types_p): Rewrite check to use
1043 call_details::arg_is_pointer_p.
1044 (kf_putenv::matches_call_types_p): Likewise.
1045 (class kf_realloc): New, adding checks on the argument types.
1046 (region_model::impl_call_realloc): Convert to...
1047 (kf_realloc::impl_call_post): ...this.
1048 (class kf_strchr): New.
1049 (region_model::impl_call_strchr): Convert to...
1050 (kf_strchr::impl_call_post): ...this.
1051 (class kf_stack_restore): New.
1052 (class kf_stack_save): New.
1053 (class kf_stdio_output_fn): New.
1054 (class kf_strcpy): New,
1055 (region_model::impl_call_strcpy): Convert to...
1056 (kf_strcpy::impl_call_pre): ...this.
1057 (class kf_strlen): New.
1058 (region_model::impl_call_strlen): Convert to...
1059 (kf_strlen::impl_call_pre): ...this.
1060 (class kf_ubsan_bounds): New.
1061 (region_model::impl_deallocation_call): Reimplement to avoid call
1062 to impl_call_free.
1063 (register_known_functions): Add handlers for IFN_BUILTIN_EXPECT
1064 and IFN_UBSAN_BOUNDS. Add handlers for BUILT_IN_ALLOCA,
1065 BUILT_IN_ALLOCA_WITH_ALIGN, BUILT_IN_CALLOC, BUILT_IN_EXPECT,
1066 BUILT_IN_EXPECT_WITH_PROBABILITY, BUILT_IN_FPRINTF,
1067 BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
1068 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
1069 BUILT_IN_FREE, BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED,
1070 BUILT_IN_MALLOC, BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK,
1071 BUILT_IN_MEMSET, BUILT_IN_MEMSET_CHK, BUILT_IN_PRINTF,
1072 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
1073 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
1074 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_REALLOC, BUILT_IN_STACK_RESTORE,
1075 BUILT_IN_STACK_SAVE, BUILT_IN_STRCHR, BUILT_IN_STRCPY,
1076 BUILT_IN_STRCPY_CHK, BUILT_IN_STRLEN, BUILT_IN_VFPRINTF, and
1077 BUILT_IN_VPRINTF. Call register_varargs_builtins. Add handlers
1078 for "getchar", "memset", "fgets", "fgets_unlocked", "fread",
1079 "error", and "error_at_line".
1080 * region-model.cc (region_model::on_stmt_pre): Drop
1081 "out_terminate_path" param.
1082 (region_model::get_known_function): Reimplement by calling
1083 known_function_manager::get_match, passing new "cd" param.
1084 Add overload taking enum internal_fn.
1085 (region_model::on_call_pre): Drop "out_terminate_path" param.
1086 Remove special-case handling of internal fns IFN_BUILTIN_EXPECT,
1087 IFN_UBSAN_BOUNDS, and IFN_VA_ARG, of built-in fns BUILT_IN_ALLOCA,
1088 BUILT_IN_ALLOCA_WITH_ALIGN, BUILT_IN_CALLOC, BUILT_IN_EXPECT,
1089 BUILT_IN_EXPECT_WITH_PROBABILITY, BUILT_IN_FREE, BUILT_IN_MALLOC,
1090 BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_MEMSET,
1091 BUILT_IN_MEMSET_CHK, BUILT_IN_REALLOC, BUILT_IN_STRCHR,
1092 BUILT_IN_STRCPY, BUILT_IN_STRCPY_CHK, BUILT_IN_STRLEN,
1093 BUILT_IN_STACK_SAVE, BUILT_IN_STACK_RESTORE, BUILT_IN_FPRINTF,
1094 BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED,
1095 BUILT_IN_FPUTC, BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS,
1096 BUILT_IN_FPUTS_UNLOCKED, BUILT_IN_FWRITE,
1097 BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
1098 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR,
1099 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED,
1100 BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF, BUILT_IN_VA_START, and
1101 BUILT_IN_VA_COPY, and of named functions "malloc", "calloc",
1102 "alloca", "realloc", "error", "error_at_line", "fgets",
1103 "fgets_unlocked", "fread", "getchar", "memset", "strchr", and
1104 "strlen". Replace all this special-casing with calls to
1105 get_known_function for internal fns and for fn decls.
1106 (region_model::on_call_post): Remove special-casing handling for
1107 "free" and "strchr", and for BUILT_IN_REALLOC, BUILT_IN_STRCHR,
1108 and BUILT_IN_VA_END. Replace by consolidating on usage of
1109 get_known_function.
1110 * region-model.h (call_details::arg_is_size_p): New.
1111 (region_model::on_stmt_pre): Drop "out_terminate_path" param.
1112 (region_model::on_call_pre): Likewise.
1113 (region_model::impl_call_alloca): Delete.
1114 (region_model::impl_call_builtin_expect): Delete.
1115 (region_model::impl_call_calloc): Delete.
1116 (region_model::impl_call_error): Delete.
1117 (region_model::impl_call_fgets): Delete.
1118 (region_model::impl_call_fread): Delete.
1119 (region_model::impl_call_free): Delete.
1120 (region_model::impl_call_malloc): Delete.
1121 (region_model::impl_call_memcpy): Delete.
1122 (region_model::impl_call_memset): Delete.
1123 (region_model::impl_call_realloc): Delete.
1124 (region_model::impl_call_strchr): Delete.
1125 (region_model::impl_call_strcpy): Delete.
1126 (region_model::impl_call_strlen): Delete.
1127 (region_model::impl_call_va_start): Delete.
1128 (region_model::impl_call_va_copy): Delete.
1129 (region_model::impl_call_va_arg): Delete.
1130 (region_model::impl_call_va_end): Delete.
1131 (region_model::check_region_for_write): Public.
1132 (region_model::get_known_function): Add "cd" param. Add
1133 overloaded decl taking enum internal_fn.
1134 * sm-malloc.cc: Update comments.
1135 * varargs.cc (class kf_va_start): New.
1136 (region_model::impl_call_va_start): Convert to...
1137 (kf_va_start::impl_call_pre): ...this.
1138 (class kf_va_copy): New.
1139 (region_model::impl_call_va_copy): Convert to...
1140 (kf_va_copy::impl_call_pre): ...this.
1141 (class kf_va_arg): New.
1142 (region_model::impl_call_va_arg): Convert to...
1143 (kf_va_arg::impl_call_pre): ...this.
1144 (class kf_va_end): New.
1145 (region_model::impl_call_va_end): Delete.
1146 (register_varargs_builtins): New.
1148 2022-11-22 David Malcolm <dmalcolm@redhat.com>
1150 PR analyzer/107788
1151 * region-model.cc (region_model::update_for_int_cst_return):
1152 Require that the return type be an integer type.
1153 (region_model::update_for_nonzero_return): Likewise.
1155 2022-11-22 David Malcolm <dmalcolm@redhat.com>
1157 PR analyzer/107783
1158 * region-model-impl-calls.cc (kf_accept::matches_call_types_p):
1159 Require that args 1 and 2 be pointers.
1160 (kf_bind::matches_call_types_p): Require that arg 1 be a pointer.
1161 * region-model.h (call_details::arg_is_pointer_p): New
1163 2022-11-22 David Malcolm <dmalcolm@redhat.com>
1165 PR analyzer/107777
1166 * call-summary.cc
1167 (call_summary_replay::convert_region_from_summary_1): Handle
1168 RK_THREAD_LOCAL and RK_ERRNO in switch.
1169 * region-model.cc (region_model::get_representative_path_var_1):
1170 Likewise.
1172 2022-11-19 David Malcolm <dmalcolm@redhat.com>
1174 PR analyzer/107582
1175 * engine.cc (dynamic_call_info_t::update_model): Update the model
1176 by pushing or pop a frame, rather than by clobbering it with the
1177 model from the exploded_node's state.
1179 2022-11-18 David Malcolm <dmalcolm@redhat.com>
1181 * analyzer.cc (is_pipe_call_p): Delete.
1182 * analyzer.h (is_pipe_call_p): Delete.
1183 * region-model-impl-calls.cc (call_details::get_location): New.
1184 (class kf_analyzer_break): New, adapted from
1185 region_model::on_stmt_pre.
1186 (region_model::impl_call_analyzer_describe): Convert to...
1187 (class kf_analyzer_describe): ...this.
1188 (region_model::impl_call_analyzer_dump_capacity): Convert to...
1189 (class kf_analyzer_dump_capacity): ...this.
1190 (region_model::impl_call_analyzer_dump_escaped): Convert to...
1191 (class kf_analyzer_dump_escaped): ...this.
1192 (class kf_analyzer_dump_exploded_nodes): New.
1193 (region_model::impl_call_analyzer_dump_named_constant): Convert
1194 to...
1195 (class kf_analyzer_dump_named_constant): ...this.
1196 (class dump_path_diagnostic): Move here from region-model.cc.
1197 (class kf_analyzer_dump_path) New, adapted from
1198 region_model::on_stmt_pre.
1199 (class kf_analyzer_dump_region_model): Likewise.
1200 (region_model::impl_call_analyzer_eval): Convert to...
1201 (class kf_analyzer_eval): ...this.
1202 (region_model::impl_call_analyzer_get_unknown_ptr): Convert to...
1203 (class kf_analyzer_get_unknown_ptr): ...this.
1204 (class known_function_accept): Rename to...
1205 (class kf_accept): ...this.
1206 (class known_function_bind): Rename to...
1207 (class kf_bind): ...this.
1208 (class known_function_connect): Rename to...
1209 (class kf_connect): ...this.
1210 (region_model::impl_call_errno_location): Convert to...
1211 (class kf_errno_location): ...this.
1212 (class known_function_listen): Rename to...
1213 (class kf_listen): ...this.
1214 (region_model::impl_call_pipe): Convert to...
1215 (class kf_pipe): ...this.
1216 (region_model::impl_call_putenv): Convert to...
1217 (class kf_putenv): ...this.
1218 (region_model::impl_call_operator_new): Convert to...
1219 (class kf_operator_new): ...this.
1220 (region_model::impl_call_operator_delete): Convert to...
1221 (class kf_operator_delete): ...this.
1222 (class known_function_socket): Rename to...
1223 (class kf_socket): ...this.
1224 (register_known_functions): Rename param to KFM. Break out
1225 existing known functions into a "POSIX" section, and add "pipe",
1226 "pipe2", and "putenv". Add debugging functions
1227 "__analyzer_break", "__analyzer_describe",
1228 "__analyzer_dump_capacity", "__analyzer_dump_escaped",
1229 "__analyzer_dump_exploded_nodes",
1230 "__analyzer_dump_named_constant", "__analyzer_dump_path",
1231 "__analyzer_dump_region_model", "__analyzer_eval",
1232 "__analyzer_get_unknown_ptr". Add C++ support functions
1233 "operator new", "operator new []", "operator delete", and
1234 "operator delete []".
1235 * region-model.cc (class dump_path_diagnostic): Move to
1236 region-model-impl-calls.cc.
1237 (region_model::on_stmt_pre): Eliminate special-casing of
1238 "__analyzer_describe", "__analyzer_dump_capacity",
1239 "__analyzer_dump_escaped", "__analyzer_dump_named_constant",
1240 "__analyzer_dump_path", "__analyzer_dump_region_model",
1241 "__analyzer_eval", "__analyzer_break",
1242 "__analyzer_dump_exploded_nodes", "__analyzer_get_unknown_ptr",
1243 "__errno_location", "pipe", "pipe2", "putenv", "operator new",
1244 "operator new []", "operator delete", "operator delete []"
1245 "pipe" and "pipe2", handling them instead via the known_functions
1246 mechanism.
1247 * region-model.h (call_details::get_location): New decl.
1248 (region_model::impl_call_analyzer_describe): Delete decl.
1249 (region_model::impl_call_analyzer_dump_capacity): Delete decl.
1250 (region_model::impl_call_analyzer_dump_escaped): Delete decl.
1251 (region_model::impl_call_analyzer_dump_named_constant): Delete decl.
1252 (region_model::impl_call_analyzer_eval): Delete decl.
1253 (region_model::impl_call_analyzer_get_unknown_ptr): Delete decl.
1254 (region_model::impl_call_errno_location): Delete decl.
1255 (region_model::impl_call_pipe): Delete decl.
1256 (region_model::impl_call_putenv): Delete decl.
1257 (region_model::impl_call_operator_new): Delete decl.
1258 (region_model::impl_call_operator_delete): Delete decl.
1259 * sm-fd.cc: Update comments.
1261 2022-11-16 David Malcolm <dmalcolm@redhat.com>
1263 PR analyzer/107711
1264 * analyzer-language.cc: Include "diagnostic.h".
1265 (maybe_stash_named_constant): Add logger param and use it to log
1266 the name being looked up, and the result.
1267 (stash_named_constants): New, splitting out from...
1268 (on_finish_translation_unit): ...this function. Call
1269 get_or_create_logfile and use the result to create a logger
1270 instance, passing it to stash_named_constants.
1271 * analyzer.h (get_or_create_any_logfile): New decl.
1272 * engine.cc (dump_fout, owns_dump_fout): New globals, split out
1273 from run_checkers.
1274 (get_or_create_any_logfile): New function, split out from...
1275 (run_checkers): ...here, so that the logfile can be opened by
1276 on_finish_translation_unit. Clear the globals when closing the
1277 dump file.
1279 2022-11-16 David Malcolm <dmalcolm@redhat.com>
1281 * analyzer.h (known_function::matches_call_types_p): New vfunc.
1282 (known_function::impl_call_pre): Provide base implementation.
1283 (known_function::impl_call_post): New vfunc.
1284 (register_known_functions): New.
1285 * engine.cc (impl_run_checkers): Call register_known_functions.
1286 * region-model-impl-calls.cc (region_model::impl_call_accept):
1287 Convert to...
1288 (class known_function_accept): ...this.
1289 (region_model::impl_call_bind): Convert to...
1290 (class known_function_bind): ...this.
1291 (region_model::impl_call_connect): Convert to...
1292 (class known_function_connect): ...this.
1293 (region_model::impl_call_listen): Convert to...
1294 (class known_function_listen): ...this.
1295 (region_model::impl_call_socket): Convert to...
1296 (class known_function_socket): ...this.
1297 (register_known_functions): New.
1298 * region-model.cc (region_model::on_call_pre): Remove special
1299 case for "bind" in favor of the known_function-handling dispatch.
1300 Add call to known_function::matches_call_types_p to latter.
1301 (region_model::on_call_post): Remove special cases for "accept",
1302 "bind", "connect", "listen", and "socket" in favor of dispatch
1303 to known_function::impl_call_post.
1304 * region-model.h (region_model::impl_call_accept): Delete decl.
1305 (region_model::impl_call_bind): Delete decl.
1306 (region_model::impl_call_connect): Delete decl.
1307 (region_model::impl_call_listen): Delete decl.
1308 (region_model::impl_call_socket): Delete decl.
1309 * sm-fd.cc: Update comments.
1311 2022-11-16 David Malcolm <dmalcolm@redhat.com>
1313 * checker-event.cc: New file, split out from...
1314 * checker-path.cc: ...this file.
1316 2022-11-15 David Malcolm <dmalcolm@redhat.com>
1318 PR analyzer/106140
1319 * analyzer-language.cc (on_finish_translation_unit): Stash named
1320 constants "SOCK_STREAM" and "SOCK_DGRAM".
1321 * analyzer.opt (Wanalyzer-fd-phase-mismatch): New.
1322 (Wanalyzer-fd-type-mismatch): New.
1323 * engine.cc (impl_region_model_context::get_state_map_by_name):
1324 Add "out_sm_context" param. Allow out_sm_idx to be NULL.
1325 * exploded-graph.h
1326 (impl_region_model_context::get_state_map_by_name):
1327 Add "out_sm_context" param.
1328 * region-model-impl-calls.cc (region_model::impl_call_accept): New.
1329 (region_model::impl_call_bind): New.
1330 (region_model::impl_call_connect): New.
1331 (region_model::impl_call_listen): New.
1332 (region_model::impl_call_socket): New.
1333 * region-model.cc (region_model::on_call_pre): Special-case
1334 "bind".
1335 (region_model::on_call_post): Special-case "accept", "bind",
1336 "connect", "listen", and "socket".
1337 * region-model.h (region_model::impl_call_accept): New decl.
1338 (region_model::impl_call_bind): New decl.
1339 (region_model::impl_call_connect): New decl.
1340 (region_model::impl_call_listen): New decl.
1341 (region_model::impl_call_socket): New decl.
1342 (region_model::on_socket): New decl.
1343 (region_model::on_bind): New decl.
1344 (region_model::on_listen): New decl.
1345 (region_model::on_accept): New decl.
1346 (region_model::on_connect): New decl.
1347 (region_model::add_constraint): Make public.
1348 (region_model::check_for_poison): Make public.
1349 (region_model_context::get_state_map_by_name): Add out_sm_context param.
1350 (region_model_context::get_fd_map): Likewise.
1351 (region_model_context::get_malloc_map): Likewise.
1352 (region_model_context::get_taint_map): Likewise.
1353 (noop_region_model_context::get_state_map_by_name): Likewise.
1354 (region_model_context_decorator::get_state_map_by_name): Likewise.
1355 * sm-fd.cc: Include "analyzer/supergraph.h" and
1356 "analyzer/analyzer-language.h".
1357 (enum expected_phase): New enum.
1358 (fd_state_machine::m_new_datagram_socket): New.
1359 (fd_state_machine::m_new_stream_socket): New.
1360 (fd_state_machine::m_new_unknown_socket): New.
1361 (fd_state_machine::m_bound_datagram_socket): New.
1362 (fd_state_machine::m_bound_stream_socket): New.
1363 (fd_state_machine::m_bound_unknown_socket): New.
1364 (fd_state_machine::m_listening_stream_socket): New.
1365 (fd_state_machine::m_m_connected_stream_socket): New.
1366 (fd_state_machine::m_SOCK_STREAM): New.
1367 (fd_state_machine::m_SOCK_DGRAM): New.
1368 (fd_diagnostic::describe_state_change): Handle socket states.
1369 (fd_diagnostic::get_meaning_for_state_change): Likewise.
1370 (class fd_phase_mismatch): New.
1371 (enum expected_type): New enum.
1372 (class fd_type_mismatch): New.
1373 (fd_state_machine::fd_state_machine): Initialize new states and
1374 stashed named constants.
1375 (fd_state_machine::is_socket_fd_p): New.
1376 (fd_state_machine::is_datagram_socket_fd_p): New.
1377 (fd_state_machine::is_stream_socket_fd_p): New.
1378 (fd_state_machine::on_close): Handle the socket states.
1379 (fd_state_machine::check_for_open_fd): Complain about fncalls on
1380 sockets in the wrong phase. Support socket FDs.
1381 (add_constraint_ge_zero): New.
1382 (fd_state_machine::get_state_for_socket_type): New.
1383 (fd_state_machine::on_socket): New.
1384 (fd_state_machine::check_for_socket_fd): New.
1385 (fd_state_machine::check_for_new_socket_fd): New.
1386 (fd_state_machine::on_bind): New.
1387 (fd_state_machine::on_listen): New.
1388 (fd_state_machine::on_accept): New.
1389 (fd_state_machine::on_connect): New.
1390 (fd_state_machine::can_purge_p): Don't purge socket values.
1391 (get_fd_state): New.
1392 (region_model::mark_as_valid_fd): Use get_fd_state.
1393 (region_model::on_socket): New.
1394 (region_model::on_bind): New.
1395 (region_model::on_listen): New.
1396 (region_model::on_accept): New.
1397 (region_model::on_connect): New.
1398 * sm-fd.dot: Update to reflect sm-fd.cc changes.
1400 2022-11-15 David Malcolm <dmalcolm@redhat.com>
1402 PR analyzer/106302
1403 * analyzer-language.cc: New file.
1404 * analyzer-language.h: New file.
1405 * analyzer.h (get_stashed_constant_by_name): New decl.
1406 (log_stashed_constants): New decl.
1407 * engine.cc (impl_run_checkers): Call log_stashed_constants.
1408 * region-model-impl-calls.cc
1409 (region_model::impl_call_analyzer_dump_named_constant): New.
1410 * region-model.cc (region_model::on_stmt_pre): Handle
1411 __analyzer_dump_named_constant.
1412 * region-model.h
1413 (region_model::impl_call_analyzer_dump_named_constant): New decl.
1414 * sm-fd.cc (fd_state_machine::m_O_ACCMODE): New.
1415 (fd_state_machine::m_O_RDONLY): New.
1416 (fd_state_machine::m_O_WRONLY): New.
1417 (fd_state_machine::fd_state_machine): Initialize the new fields.
1418 (fd_state_machine::get_access_mode_from_flag): Use the new fields,
1419 rather than using the host values.
1421 2022-11-13 David Malcolm <dmalcolm@redhat.com>
1423 PR analyzer/106235
1424 * analyzer.opt (Wanalyzer-tainted-assertion): New.
1425 * checker-path.cc (checker_path::fixup_locations): Pass false to
1426 pending_diagnostic::fixup_location.
1427 * diagnostic-manager.cc (get_emission_location): Pass true to
1428 pending_diagnostic::fixup_location.
1429 * pending-diagnostic.cc (pending_diagnostic::fixup_location): Add
1430 bool param.
1431 * pending-diagnostic.h (pending_diagnostic::fixup_location): Add
1432 bool param to decl.
1433 * sm-taint.cc (taint_state_machine::m_tainted_control_flow): New.
1434 (taint_diagnostic::describe_state_change): Drop "final".
1435 (class tainted_assertion): New.
1436 (taint_state_machine::taint_state_machine): Initialize
1437 m_tainted_control_flow.
1438 (taint_state_machine::alt_get_inherited_state): Support
1439 comparisons being tainted, based on their arguments.
1440 (is_assertion_failure_handler_p): New.
1441 (taint_state_machine::on_stmt): Complain about calls to assertion
1442 failure handlers guarded by an attacker-controller conditional.
1443 Detect attacker-controlled gcond conditionals and gswitch index
1444 values.
1445 (taint_state_machine::check_control_flow_arg_for_taint): New.
1447 2022-11-11 David Malcolm <dmalcolm@redhat.com>
1449 * sm-fd.dot: Fix typo in comment.
1450 * sm-file.dot: New file.
1451 * varargs.cc: Fix typo in comment.
1452 * varargs.dot: New file.
1454 2022-11-11 David Malcolm <dmalcolm@redhat.com>
1456 * checker-path.h: Split out checker_event and its subclasses to...
1457 * checker-event.h: ...this new header.
1459 2022-11-11 David Malcolm <dmalcolm@redhat.com>
1461 PR analyzer/106147
1462 * analyzer.opt (Wanalyzer-infinite-recursion): New.
1463 * call-string.cc (call_string::count_occurrences_of_function):
1464 New.
1465 * call-string.h (call_string::count_occurrences_of_function): New
1466 decl.
1467 * checker-path.cc (function_entry_event::function_entry_event):
1468 New ctor.
1469 (checker_path::add_final_event): Delete.
1470 * checker-path.h (function_entry_event::function_entry_event): New
1471 ctor.
1472 (function_entry_event::get_desc): Drop "final".
1473 (checker_path::add_final_event): Delete.
1474 * diagnostic-manager.cc
1475 (diagnostic_manager::emit_saved_diagnostic): Create the final
1476 event via a new pending_diagnostic::add_final_event vfunc, rather
1477 than checker_path::add_final_event.
1478 (diagnostic_manager::add_events_for_eedge): Create function entry
1479 events via a new pending_diagnostic::add_function_entry_event
1480 vfunc.
1481 * engine.cc (exploded_graph::process_node): When creating a new
1482 PK_BEFORE_SUPERNODE node, call
1483 exploded_graph::detect_infinite_recursion on it after adding the
1484 in-edge.
1485 * exploded-graph.h (exploded_graph::detect_infinite_recursion):
1486 New decl.
1487 (exploded_graph::find_previous_entry_to): New decl.
1488 * infinite-recursion.cc: New file.
1489 * pending-diagnostic.cc
1490 (pending_diagnostic::add_function_entry_event): New.
1491 (pending_diagnostic::add_final_event): New.
1492 * pending-diagnostic.h
1493 (pending_diagnostic::add_function_entry_event): New vfunc.
1494 (pending_diagnostic::add_final_event): New vfunc.
1496 2022-11-10 David Malcolm <dmalcolm@redhat.com>
1498 PR analyzer/99671
1499 * analyzer.opt (Wanalyzer-deref-before-check): New warning.
1500 * diagnostic-manager.cc
1501 (null_assignment_sm_context::set_next_state): Only add state
1502 change events for transition to "null" state.
1503 (null_assignment_sm_context::is_transition_to_null): New.
1504 * engine.cc (impl_region_model_context::on_pop_frame): New.
1505 * exploded-graph.h (impl_region_model_context::on_pop_frame): New
1506 decl.
1507 * program-state.cc (sm_state_map::clear_any_state): New.
1508 (sm_state_map::can_merge_with_p): New.
1509 (program_state::can_merge_with_p): Replace requirement that
1510 sm-states be equal in favor of an attempt to merge them.
1511 * program-state.h (sm_state_map::clear_any_state): New decl.
1512 (sm_state_map::can_merge_with_p): New decl.
1513 * region-model.cc (region_model::eval_condition): Make const.
1514 (region_model::pop_frame): Call ctxt->on_pop_frame.
1515 * region-model.h (region_model::eval_condition): Make const.
1516 (region_model_context::on_pop_frame): New vfunc.
1517 (noop_region_model_context::on_pop_frame): New.
1518 (region_model_context_decorator::on_pop_frame): New.
1519 * sm-malloc.cc (enum resource_state): Add RS_ASSUMED_NON_NULL.
1520 (allocation_state::dump_to_pp): Drop "final".
1521 (struct assumed_non_null_state): New subclass.
1522 (malloc_state_machine::m_assumed_non_null): New.
1523 (assumed_non_null_p): New.
1524 (class deref_before_check): New.
1525 (assumed_non_null_state::dump_to_pp): New.
1526 (malloc_state_machine::get_or_create_assumed_non_null_state_for_frame):
1527 New.
1528 (malloc_state_machine::maybe_assume_non_null): New.
1529 (malloc_state_machine::on_stmt): Transition from start state to
1530 "assumed-non-null" state for pointers passed to
1531 __attribute__((nonnull)) arguments, and for pointers explicitly
1532 dereferenced. Call maybe_complain_about_deref_before_check for
1533 pointers explicitly compared against NULL.
1534 (malloc_state_machine::maybe_complain_about_deref_before_check):
1535 New.
1536 (malloc_state_machine::on_deallocator_call): Also transition
1537 "assumed-non-null" states to "freed".
1538 (malloc_state_machine::on_pop_frame): New.
1539 (malloc_state_machine::maybe_get_merged_states_nonequal): New.
1540 * sm-malloc.dot: Update for changes to sm-malloc.cc.
1541 * sm.h (state_machine::on_pop_frame): New.
1542 (state_machine::maybe_get_merged_state): New.
1543 (state_machine::maybe_get_merged_states_nonequal): New.
1545 2022-11-09 David Malcolm <dmalcolm@redhat.com>
1547 * checker-path.cc (checker_event::debug): New.
1548 (checker_path::add_event): Move here from checker-path.h. Add
1549 logging.
1550 * checker-path.h (checker_event::debug): New decl.
1551 (checker_path::checker_path): Add logger param.
1552 (checker_path::add_event): Move definition from here to
1553 checker-path.cc.
1554 (checker_path::m_logger): New field.
1555 * diagnostic-manager.cc
1556 (diagnostic_manager::emit_saved_diagnostic): Pass logger to
1557 checker_path ctor.
1558 (diagnostic_manager::add_events_for_eedge): Log scope when
1559 processing a run of stmts.
1561 2022-11-08 David Malcolm <dmalcolm@redhat.com>
1563 PR analyzer/101962
1564 * region-model-impl-calls.cc: Update comment.
1565 * region-model.cc (region_model::check_symbolic_bounds): Fix
1566 layout of "void" return. Replace usage of
1567 eval_condition_without_cm with eval_condition.
1568 (region_model::eval_condition): Take over body of...
1569 (region_model::eval_condition_without_cm): ...this subroutine,
1570 dropping the latter. Eliminating this distinction avoids issues
1571 where constraints were not considered when recursing.
1572 (region_model::compare_initial_and_pointer): Update comment.
1573 (region_model::symbolic_greater_than): Replace usage of
1574 eval_condition_without_cm with eval_condition.
1575 * region-model.h
1576 (region_model::eval_condition_without_cm): Delete decl.
1578 2022-11-08 David Malcolm <dmalcolm@redhat.com>
1580 * region-model-impl-calls.cc
1581 (region_model::impl_call_errno_location): New.
1582 * region-model-manager.cc
1583 (region_model_manager::region_model_manager): Initialize
1584 m_thread_local_region and m_errno_region.
1585 * region-model-manager.h (region_model_manager::get_errno_region):
1586 New accessor.
1587 (region_model_manager::m_thread_local_region): New.
1588 (region_model_manager::m_errno_region): New.
1589 * region-model.cc (region_model::on_call_pre): Special-case
1590 "__errno_location".
1591 (region_model::set_errno): New.
1592 * region-model.h (impl_call_errno_location): New decl.
1593 (region_model::set_errno): New decl.
1594 * region.cc (thread_local_region::dump_to_pp): New.
1595 (errno_region::dump_to_pp): New.
1596 * region.h (enum memory_space): Add MEMSPACE_THREAD_LOCAL.
1597 (enum region_kind): Add RK_THREAD_LOCAL and RK_ERRNO.
1598 (class thread_local_region): New.
1599 (is_a_helper <const thread_local_region *>::test): New.
1600 (class errno_region): New.
1601 (is_a_helper <const errno_region *>::test): New.
1602 * store.cc (binding_cluster::escaped_p): New.
1603 (store::escaped_p): Treat errno as always having escaped.
1604 (store::replay_call_summary_cluster): Handle RK_THREAD_LOCAL and
1605 RK_ERRNO.
1606 * store.h (binding_cluster::escaped_p): Remove definition.
1608 2022-11-08 David Malcolm <dmalcolm@redhat.com>
1610 * call-info.cc (success_call_info::get_desc): Delete.
1611 (failed_call_info::get_desc): Likewise.
1612 (succeed_or_fail_call_info::get_desc): New.
1613 * call-info.h (class succeed_or_fail_call_info): New.
1614 (class success_call_info): Convert to a subclass of
1615 succeed_or_fail_call_info.
1616 (class failed_call_info): Likewise.
1618 2022-11-08 David Malcolm <dmalcolm@redhat.com>
1620 * region-model-impl-calls.cc (region_model::impl_call_strchr):
1621 Move to on_call_post. Handle both outcomes using bifurcation,
1622 rather than just the "not found" case.
1623 * region-model.cc (region_model::on_call_pre): Move
1624 BUILT_IN_STRCHR and "strchr" to...
1625 (region_model::on_call_post): ...here.
1627 2022-11-03 David Malcolm <dmalcolm@redhat.com>
1629 * analyzer.h: Use std::unique_ptr for state machines from plugins.
1630 * engine.cc: Likewise.
1632 2022-11-03 David Malcolm <dmalcolm@redhat.com>
1634 * analyzer.h: Use std::unique_ptr for known functions.
1635 * engine.cc: Likewise.
1636 * known-function-manager.cc: Likewise.
1637 * known-function-manager.h: Likewise.
1639 2022-11-03 David Malcolm <dmalcolm@redhat.com>
1641 * analysis-plan.cc: Define INCLUDE_MEMORY before including
1642 system.h.
1643 * analyzer-pass.cc: Likewise.
1644 * analyzer-selftests.cc: Likewise.
1645 * analyzer.cc: Likewise.
1646 * analyzer.h: Use std::unique_ptr in bifurcation code.
1647 * call-string.cc: Define INCLUDE_MEMORY before including system.h.
1648 * complexity.cc: Likewise.
1649 * engine.cc: Use std::unique_ptr in bifurcation code.
1650 * exploded-graph.h: Likewise.
1651 * known-function-manager.cc: Define INCLUDE_MEMORY before
1652 including system.h.
1653 * region-model-impl-calls.cc: Use std::unique_ptr in bifurcation
1654 code.
1655 * region-model.cc: Likewise.
1656 * region-model.h: Likewise.
1657 * supergraph.cc: Define INCLUDE_MEMORY before including system.h.
1659 2022-11-03 David Malcolm <dmalcolm@redhat.com>
1661 * call-info.cc: Use std::unique_ptr for checker_event.
1662 * checker-path.cc: Likewise.
1663 * checker-path.h: Likewise.
1664 * diagnostic-manager.cc: Likewise.
1665 * engine.cc: Likewise.
1666 * pending-diagnostic.cc: Likewise.
1667 * sm-signal.cc: Likewise.
1668 * varargs.cc: Likewise.
1670 2022-11-03 David Malcolm <dmalcolm@redhat.com>
1672 * diagnostic-manager.cc: Include "make-unique.h".
1673 Use std::unique_ptr for feasibility_problems and exploded_path.
1674 Delete explicit saved_diagnostic dtor.
1675 * diagnostic-manager.h: Likewise.
1676 * engine.cc: Likewise.
1677 * exploded-graph.h: Likewise.
1678 * feasible-graph.cc: Likewise.
1679 * feasible-graph.h: Likewise.
1681 2022-11-03 David Malcolm <dmalcolm@redhat.com>
1683 * checker-path.cc (rewind_event::rewind_event): Update for usage of
1684 std::unique_ptr on custom_edge_info.
1685 * engine.cc (exploded_node::on_longjmp): Likewise.
1686 (exploded_edge::exploded_edge): Likewise.
1687 (exploded_edge::~exploded_edge): Delete.
1688 (exploded_graph::add_function_entry): Update for usage of
1689 std::unique_ptr on custom_edge_info.
1690 (exploded_graph::add_edge): Likewise.
1691 (add_tainted_args_callback): Likewise.
1692 (exploded_graph::maybe_create_dynamic_call): Likewise.
1693 (exploded_graph::process_node): Likewise.
1694 * exploded-graph.h (exploded_edge::~exploded_edge): Delete.
1695 (exploded_edge::m_custom_info): Use std::unique_ptr.
1696 (exploded_edge::add_edge): Likewise.
1697 * sm-signal.cc (register_signal_handler::impl_transition): Use
1698 make_unique.
1700 2022-11-03 David Malcolm <dmalcolm@redhat.com>
1702 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic): Make
1703 stmt_finder const.
1704 (saved_diagnostic::~saved_diagnostic): Remove explicit delete of
1705 m_stmt_finder.
1706 (diagnostic_manager::add_diagnostic): Make stmt_finder const.
1707 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic):
1708 Likewise.
1709 (saved_diagnostic::m_stmt_finder): Convert to std::unique_ptr.
1710 (diagnostic_manager::add_diagnostic): Make stmt_finder const.
1711 * engine.cc (impl_sm_context::impl_sm_context): Likewise.
1712 (impl_sm_context::m_stmt_finder): Likewise.
1713 (leak_stmt_finder::clone): Convert return type to std::unique_ptr.
1714 * exploded-graph.h (stmt_finder::clone): Likewise.
1716 2022-11-03 David Malcolm <dmalcolm@redhat.com>
1718 * call-info.cc: Add define of INCLUDE_MEMORY.
1719 * call-summary.cc: Likewise.
1720 * checker-path.cc: Likewise.
1721 * constraint-manager.cc: Likewise.
1722 * diagnostic-manager.cc: Likewise.
1723 (saved_diagnostic::saved_diagnostic): Use std::unique_ptr for
1724 param d and field m_d.
1725 (saved_diagnostic::~saved_diagnostic): Remove explicit delete of m_d.
1726 (saved_diagnostic::add_note): Use std::unique_ptr for
1727 param pn.
1728 (saved_diagnostic::get_pending_diagnostic): Update for conversion
1729 of m_sd.m_d to unique_ptr.
1730 (diagnostic_manager::add_diagnostic): Use std::unique_ptr for
1731 param d. Remove explicit deletion.
1732 (diagnostic_manager::add_note): Use std::unique_ptr for param pn.
1733 (diagnostic_manager::emit_saved_diagnostic): Update for conversion
1734 of m_sd.m_d to unique_ptr.
1735 (null_assignment_sm_context::warn): Use std::unique_ptr for
1736 param d. Remove explicit deletion.
1737 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Use
1738 std::unique_ptr for param d.
1739 (saved_diagnostic::add_note): Likewise for param pn.
1740 (saved_diagnostic::m_d): Likewise.
1741 (diagnostic_manager::add_diagnostic): Use std::unique_ptr for
1742 param d.
1743 (diagnostic_manager::add_note): Use std::unique_ptr for param pn.
1744 * engine.cc: Include "make-unique.h".
1745 (impl_region_model_context::warn): Update to use std::unique_ptr
1746 for param, removing explicit deletion.
1747 (impl_region_model_context::add_note): Likewise.
1748 (impl_sm_context::warn): Update to use std::unique_ptr
1749 for param.
1750 (impl_region_model_context::on_state_leak): Likewise for result of
1751 on_leak.
1752 (exploded_node::on_longjmp): Use make_unique when creating
1753 pending_diagnostic.
1754 (exploded_graph::process_node): Likewise.
1755 * exploded-graph.h (impl_region_model_context::warn): Update to
1756 use std::unique_ptr for param.
1757 (impl_region_model_context::add_note): Likewise.
1758 * feasible-graph.cc: Add define of INCLUDE_MEMORY.
1759 * pending-diagnostic.cc: Likewise.
1760 * pending-diagnostic.h: Include analyzer.sm.h"
1761 * program-point.cc: Add define of INCLUDE_MEMORY.
1762 * program-state.cc: Likewise.
1763 * region-model-asm.cc: Likewise.
1764 * region-model-impl-calls.cc: Likewise. Include "make-unique.h".
1765 (region_model::impl_call_putenv): Use make_unique when creating
1766 pending_diagnostic.
1767 * region-model-manager.cc: Add define of INCLUDE_MEMORY.
1768 * region-model-reachability.cc: Likewise.
1769 * region-model.cc: Likewise. Include "make-unique.h".
1770 (region_model::get_gassign_result): Use make_unique when creating
1771 pending_diagnostic.
1772 (region_model::check_for_poison): Likewise.
1773 (region_model::on_stmt_pre): Likewise.
1774 (region_model::check_symbolic_bounds): Likewise.
1775 (region_model::check_region_bounds): Likewise.
1776 (annotating_ctxt: make_note): Use std::unique_ptr for result.
1777 (region_model::deref_rvalue): Use make_unique when creating
1778 pending_diagnostic.
1779 (region_model::check_for_writable_region): Likewise.
1780 (region_model::check_region_size): Likewise.
1781 (region_model::check_dynamic_size_for_floats): Likewise.
1782 (region_model::maybe_complain_about_infoleak): Likewise.
1783 (noop_region_model_context::add_note): Use std::unique_ptr for
1784 param. Remove explicit deletion.
1785 * region-model.h: Include "analyzer/pending-diagnostic.h".
1786 (region_model_context::warn): Convert param to std::unique_ptr.
1787 (region_model_context::add_note): Likewise.
1788 (noop_region_model_context::warn): Likewise.
1789 (noop_region_model_context::add_note): Likewise.
1790 (region_model_context_decorator::warn): Likewise.
1791 (region_model_context_decorator::add_note): Likewise.
1792 (note_adding_context::warn): Likewise.
1793 (note_adding_context::make_note): Likewise for return type.
1794 (test_region_model_context::warn): Convert param to
1795 std::unique_ptr.
1796 * region.cc: Add define of INCLUDE_MEMORY.
1797 * sm-fd.cc: Likewise. Include "make-unique.h".
1798 (fd_state_machine::check_for_fd_attrs): Use make_unique when
1799 creating pending_diagnostics.
1800 (fd_state_machine::on_open): Likewise.
1801 (fd_state_machine::on_creat): Likewise.
1802 (fd_state_machine::check_for_dup): Likewise.
1803 (fd_state_machine::on_close): Likewise.
1804 (fd_state_machine::check_for_open_fd): Likewise.
1805 (fd_state_machine::on_leak): Likewise, converting return type to
1806 std::unique_ptr.
1807 * sm-file.cc: Add define of INCLUDE_MEMORY. Include
1808 "make-unique.h".
1809 (fileptr_state_machine::on_stmt): Use make_unique when creating
1810 pending_diagnostic.
1811 (fileptr_state_machine::on_leak): Likewise, converting return type
1812 to std::unique_ptr.
1813 * sm-malloc.cc: Add define of INCLUDE_MEMORY. Include
1814 "make-unique.h".
1815 (malloc_state_machine::on_stmt): Use make_unique when creating
1816 pending_diagnostic.
1817 (malloc_state_machine::handle_free_of_non_heap): Likewise.
1818 (malloc_state_machine::on_deallocator_call): Likewise.
1819 (malloc_state_machine::on_realloc_call): Likewise.
1820 (malloc_state_machine::on_leak): Likewise, converting return type
1821 to std::unique_ptr.
1822 * sm-pattern-test.cc: Add define of INCLUDE_MEMORY. Include
1823 "make-unique.h".
1824 (pattern_test_state_machine::on_condition): Use make_unique when
1825 creating pending_diagnostic.
1826 * sm-sensitive.cc: Add define of INCLUDE_MEMORY. Include
1827 "make-unique.h".
1828 (sensitive_state_machine::warn_for_any_exposure): Use make_unique
1829 when creating pending_diagnostic.
1830 * sm-signal.cc: Add define of INCLUDE_MEMORY. Include
1831 "make-unique.h".
1832 (signal_state_machine::on_stmt): Use make_unique when creating
1833 pending_diagnostic.
1834 * sm-taint.cc: Add define of INCLUDE_MEMORY. Include
1835 "make-unique.h".
1836 (taint_state_machine::check_for_tainted_size_arg): Use make_unique
1837 when creating pending_diagnostic.
1838 (taint_state_machine::check_for_tainted_divisor): Likewise.
1839 (region_model::check_region_for_taint): Likewise.
1840 (region_model::check_dynamic_size_for_taint): Likewise.
1841 * sm.cc: Add define of INCLUDE_MEMORY. Include
1842 "analyzer/pending-diagnostic.h".
1843 (state_machine::on_leak): Move here from sm.h, changing return
1844 type to std::unique_ptr.
1845 * sm.h (state_machine::on_leak): Change return type to
1846 std::unique_ptr. Move defn of base impl to sm.cc
1847 (sm_context::warn): Convert param d to std_unique_ptr.
1848 * state-purge.cc: Add define of INCLUDE_MEMORY.
1849 * store.cc: Likewise.
1850 * svalue.cc: Likewise.
1851 * trimmed-graph.cc: Likewise.
1852 * varargs.cc: Likewise. Include "make-unique.h".
1853 (va_list_state_machine::check_for_ended_va_list): Use make_unique
1854 when creating pending_diagnostic.
1855 (va_list_state_machine::on_leak): Likewise, converting return type
1856 to std::unique_ptr.
1857 (region_model::impl_call_va_arg): Use make_unique when creating
1858 pending_diagnostic.
1860 2022-11-03 David Malcolm <dmalcolm@redhat.com>
1862 PR analyzer/107486
1863 * analyzer.cc (is_pipe_call_p): New.
1864 * analyzer.h (is_pipe_call_p): New decl.
1865 * region-model.cc (region_model::on_call_pre): Use it.
1866 (region_model::on_call_post): Likewise.
1868 2022-10-26 David Malcolm <dmalcolm@redhat.com>
1870 * sm-fd.cc (fd_state_machine::on_open): Transition to "unchecked"
1871 when the mode is symbolic, rather than just on integer constants.
1872 (fd_state_machine::check_for_open_fd): Don't complain about
1873 unchecked values in the start state.
1875 2022-10-26 David Malcolm <dmalcolm@redhat.com>
1877 * sm-fd.dot: New file.
1879 2022-10-24 David Malcolm <dmalcolm@redhat.com>
1881 PR analyzer/107349
1882 * varargs.cc (get_va_copy_arg): Fix the non-pointer case.
1884 2022-10-24 David Malcolm <dmalcolm@redhat.com>
1886 PR analyzer/107345
1887 * region-model.cc (region_model::eval_condition_without_cm):
1888 Ensure that constants are on the right-hand side before checking
1889 for them.
1891 2022-10-24 David Malcolm <dmalcolm@redhat.com>
1893 * engine.cc (impl_region_model_context::get_malloc_map): Replace
1894 with...
1895 (impl_region_model_context::get_state_map_by_name): ...this.
1896 (impl_region_model_context::get_fd_map): Delete.
1897 (impl_region_model_context::get_taint_map): Delete.
1898 * exploded-graph.h (impl_region_model_context::get_fd_map):
1899 Delete.
1900 (impl_region_model_context::get_malloc_map): Delete.
1901 (impl_region_model_context::get_taint_map): Delete.
1902 (impl_region_model_context::get_state_map_by_name): New.
1903 * region-model.h (region_model_context::get_state_map_by_name):
1904 New vfunc.
1905 (region_model_context::get_fd_map): Convert from vfunc to
1906 function.
1907 (region_model_context::get_malloc_map): Likewise.
1908 (region_model_context::get_taint_map): Likewise.
1909 (noop_region_model_context::get_state_map_by_name): New.
1910 (noop_region_model_context::get_fd_map): Delete.
1911 (noop_region_model_context::get_malloc_map): Delete.
1912 (noop_region_model_context::get_taint_map): Delete.
1913 (region_model_context_decorator::get_state_map_by_name): New.
1914 (region_model_context_decorator::get_fd_map): Delete.
1915 (region_model_context_decorator::get_malloc_map): Delete.
1916 (region_model_context_decorator::get_taint_map): Delete.
1918 2022-10-24 David Malcolm <dmalcolm@redhat.com>
1920 PR analyzer/106300
1921 * engine.cc (impl_region_model_context::get_fd_map): New.
1922 * exploded-graph.h (impl_region_model_context::get_fd_map): New
1923 decl.
1924 * region-model-impl-calls.cc (region_model::impl_call_pipe): New.
1925 * region-model.cc (region_model::update_for_int_cst_return): New,
1926 based on...
1927 (region_model::update_for_zero_return): ...this. Reimplement in
1928 terms of the former.
1929 (region_model::on_call_pre): Handle "pipe" and "pipe2".
1930 (region_model::on_call_post): Likewise.
1931 * region-model.h (region_model::impl_call_pipe): New decl.
1932 (region_model::update_for_int_cst_return): New decl.
1933 (region_model::mark_as_valid_fd): New decl.
1934 (region_model_context::get_fd_map): New pure virtual fn.
1935 (noop_region_model_context::get_fd_map): New.
1936 (region_model_context_decorator::get_fd_map): New.
1937 * sm-fd.cc: Include "analyzer/program-state.h".
1938 (fd_state_machine::describe_state_change): Handle transitions from
1939 start state to valid states.
1940 (fd_state_machine::mark_as_valid_fd): New.
1941 (fd_state_machine::on_stmt): Add missing return for "creat".
1942 (region_model::mark_as_valid_fd): New.
1944 2022-10-19 David Malcolm <dmalcolm@redhat.com>
1946 PR analyzer/105765
1947 * varargs.cc (get_BT_VALIST_ARG): Rename to...
1948 (get_va_copy_arg): ...this, and update logic for determining level
1949 of indirection of va_copy's argument to use type of argument,
1950 rather than looking at va_list_type_node, to correctly handle
1951 __builtin_ms_va_copy.
1952 (get_stateful_BT_VALIST_ARG): Rename to...
1953 (get_stateful_va_copy_arg): ...this.
1954 (va_list_state_machine::on_va_copy): Update for renaming.
1955 (region_model::impl_call_va_copy): Likewise.
1957 2022-10-13 David Malcolm <dmalcolm@redhat.com>
1959 PR analyzer/107210
1960 * svalue.cc (constant_svalue::maybe_fold_bits_within): Only
1961 attempt to extract individual bits when tree_fits_uhwi_p.
1963 2022-10-07 David Malcolm <dmalcolm@redhat.com>
1965 PR analyzer/105783
1966 * region-model.cc (selftest::get_bit): New function.
1967 (selftest::test_bits_within_svalue_folding): New.
1968 (selfftest::analyzer_region_model_cc_tests): Call it.
1969 * svalue.cc (constant_svalue::maybe_fold_bits_within): Handle the
1970 case of extracting a single bit.
1972 2022-10-06 David Malcolm <dmalcolm@redhat.com>
1974 PR analyzer/107158
1975 * store.cc (store::replay_call_summary_cluster): Eliminate
1976 special-casing of RK_HEAP_ALLOCATED in favor of sharing code with
1977 RK_DECL, avoiding an ICE due to attempting to bind a
1978 compound_svalue into a binding_cluster when an svalue in the
1979 summary cluster converts to a compound_svalue in the caller.
1981 2022-10-06 David Malcolm <dmalcolm@redhat.com>
1983 * call-summary.cc (call_summary_replay::dump_to_pp): Bulletproof
1984 against NULL caller regions/svalues.
1986 2022-10-05 David Malcolm <dmalcolm@redhat.com>
1988 * analysis-plan.cc: Simplify includes.
1989 * analyzer-pass.cc: Likewise.
1990 * analyzer-selftests.cc: Likewise.
1991 * analyzer.cc: Likewise.
1992 * analyzer.h: Add includes of "json.h" and "tristate.h".
1993 * call-info.cc: Simplify includes.
1994 * call-string.cc: Likewise.
1995 * call-summary.cc: Likewise.
1996 * checker-path.cc: Likewise.
1997 * complexity.cc: Likewise.
1998 * constraint-manager.cc: Likewise.
1999 * diagnostic-manager.cc: Likewise.
2000 * engine.cc: Likewise.
2001 * feasible-graph.cc: Likewise.
2002 * known-function-manager.cc: Likewise.
2003 * pending-diagnostic.cc: Likewise.
2004 * program-point.cc: Likewise.
2005 * program-state.cc: Likewise.
2006 * region-model-asm.cc: Likewise.
2007 * region-model-impl-calls.cc: Likewise.
2008 * region-model-manager.cc: Likewise.
2009 * region-model-reachability.cc: Likewise.
2010 * region-model.cc: Likewise.
2011 * region-model.h: Include "selftest.h".
2012 * region.cc: Simplify includes.
2013 * sm-fd.cc: Likewise.
2014 * sm-file.cc: Likewise.
2015 * sm-malloc.cc: Likewise.
2016 * sm-pattern-test.cc: Likewise.
2017 * sm-sensitive.cc: Likewise.
2018 * sm-signal.cc: Likewise.
2019 * sm-taint.cc: Likewise.
2020 * sm.cc: Likewise.
2021 * state-purge.cc: Likewise.
2022 * store.cc: Likewise.
2023 * store.h: Likewise.
2024 * supergraph.cc: Likewise.
2025 * svalue.cc: Likewise.
2026 * svalue.h: Likewise.
2027 * trimmed-graph.cc: Likewise.
2028 * varargs.cc: Likewise.
2030 2022-10-05 David Malcolm <dmalcolm@redhat.com>
2032 PR analyzer/107060
2033 * call-summary.cc
2034 (call_summary_replay::convert_svalue_from_summary_1): Handle NULL
2035 results from convert_svalue_from_summary in SK_UNARY_OP and
2036 SK_BIN_OP.
2037 * engine.cc (impl_region_model_context::on_unknown_change): Bail
2038 out on svalues that can't have associated state.
2039 * region-model-impl-calls.cc
2040 (region_model::impl_call_analyzer_get_unknown_ptr): New.
2041 * region-model.cc (region_model::on_stmt_pre): Handle
2042 "__analyzer_get_unknown_ptr".
2043 * region-model.h
2044 (region_model::impl_call_analyzer_get_unknown_ptr): New decl.
2045 * store.cc (store::replay_call_summary_cluster): Avoid trying to
2046 create binding clusters for base regions that shouldn't have them.
2048 2022-10-05 Martin Liska <mliska@suse.cz>
2050 * call-summary.cc (call_summary_replay::call_summary_replay):
2051 Remove unused variable and arguments.
2052 * call-summary.h: Likewise.
2053 * engine.cc (exploded_node::on_stmt): Likewise.
2054 (exploded_node::replay_call_summaries): Likewise.
2055 (exploded_node::replay_call_summary): Likewise.
2056 * exploded-graph.h (class exploded_node): Likewise.
2058 2022-10-05 David Malcolm <dmalcolm@redhat.com>
2060 PR analyzer/107072
2061 * analyzer-logging.h: Include "diagnostic-core.h".
2062 * analyzer.h: Include "function.h".
2063 (class call_summary): New forward decl.
2064 (class call_summary_replay): New forward decl.
2065 (struct per_function_data): New forward decl.
2066 (struct interesting_t): New forward decl.
2067 (custom_edge_info::update_state): New vfunc.
2068 * call-info.cc (custom_edge_info::update_state): New.
2069 * call-summary.cc: New file.
2070 * call-summary.h: New file.
2071 * constraint-manager.cc: Include "analyzer/call-summary.h".
2072 (class replay_fact_visitor): New.
2073 (constraint_manager::replay_call_summary): New.
2074 * constraint-manager.h (constraint_manager::replay_call_summary):
2075 New.
2076 * engine.cc: Include "analyzer/call-summary.h".
2077 (exploded_node::on_stmt): Handle call summaries.
2078 (class call_summary_edge_info): New.
2079 (exploded_node::replay_call_summaries): New.
2080 (exploded_node::replay_call_summary): New.
2081 (per_function_data::~per_function_data): New.
2082 (per_function_data::add_call_summary): Move here from header and
2083 reimplement.
2084 (exploded_graph::process_node): Call update_state rather than
2085 update_model when handling bifurcation
2086 (viz_callgraph_node::dump_dot): Use a regular label rather
2087 than an HTML table; add summaries to dump.
2088 * exploded-graph.h: Include "alloc-pool.h", "fibonacci_heap.h",
2089 "supergraph.h", "sbitmap.h", "shortest-paths.h", "analyzer/sm.h",
2090 "analyzer/program-state.h", and "analyzer/diagnostic-manager.h".
2091 (exploded_node::replay_call_summaries): New decl.
2092 (exploded_node::replay_call_summary): New decl.
2093 (per_function_data::~per_function_data): New decl.
2094 (per_function_data::add_call_summary): Move implemention from
2095 header.
2096 (per_function_data::m_summaries): Update type of element.
2097 * known-function-manager.h: Include "analyzer/analyzer-logging.h".
2098 * program-point.h: Include "pretty-print.h" and
2099 "analyzer/call-string.h".
2100 * program-state.cc: Include "analyzer/call-summary.h".
2101 (sm_state_map::replay_call_summary): New.
2102 (program_state::replay_call_summary): New.
2103 * program-state.h (sm_state_map::replay_call_summary): New decl.
2104 (program_state::replay_call_summary): New decl.
2105 * region-model-manager.cc
2106 (region_model_manager::get_or_create_asm_output_svalue): New
2107 overload.
2108 * region-model-manager.h
2109 (region_model_manager::get_or_create_asm_output_svalue): New
2110 overload decl.
2111 * region-model.cc: Include "analyzer/call-summary.h".
2112 (region_model::maybe_update_for_edge): Remove call to
2113 region_model::update_for_call_summary on
2114 SUPEREDGE_INTRAPROCEDURAL_CALL.
2115 (region_model::update_for_call_summary): Delete.
2116 (region_model::replay_call_summary): New.
2117 * region-model.h (region_model::replay_call_summary): New decl.
2118 (region_model::update_for_call_summary): Delete decl.
2119 * store.cc: Include "analyzer/call-summary.h".
2120 (store::replay_call_summary): New.
2121 (store::replay_call_summary_cluster): New.
2122 * store.h: Include "tristate.h".
2123 (is_a_helper <const ana::concrete_binding *>::test): New.
2124 (store::replay_call_summary): New decl.
2125 (store::replay_call_summary_cluster): New decl.
2126 * supergraph.cc (get_ultimate_function_for_cgraph_edge): Remove
2127 "static" from decl.
2128 (supergraph_call_edge): Make stmt param const.
2129 * supergraph.h: Include "ordered-hash-map.h", "cfg.h",
2130 "basic-block.h", "gimple.h", "gimple-iterator.h", and "digraph.h".
2131 (supergraph_call_edge): Make stmt param const.
2132 (get_ultimate_function_for_cgraph_edge): New decl.
2133 * svalue.cc (compound_svalue::compound_svalue): Assert that we're
2134 not nesting compound_svalues.
2135 * svalue.h: Include "json.h", "analyzer/store.h", and
2136 "analyzer/program-point.h".
2137 (asm_output_svalue::get_num_outputs): New accessor.
2139 2022-10-05 David Malcolm <dmalcolm@redhat.com>
2141 * region-model.h: Include "analyzer/region-model-manager.h"
2142 (class region_model_manager): Move decl to...
2143 * region-model-manager.h: ...this new file.
2145 2022-10-05 David Malcolm <dmalcolm@redhat.com>
2147 * region-model-manager.cc
2148 (region_model_manager::maybe_fold_unaryop): Fold -(-(VAL)) to VAL.
2150 2022-10-05 David Malcolm <dmalcolm@redhat.com>
2152 * region-model-manager.cc
2153 (region_model_manager::get_or_create_widening_svalue): Use a
2154 function_point rather than a program_point.
2155 * region-model.cc (selftest::test_widening_constraints): Likewise.
2156 * region-model.h
2157 (region_model_manager::get_or_create_widening_svalue): Likewise.
2158 (model_merger::get_function_point): New.
2159 * svalue.cc (svalue::can_merge_p): Use a function_point rather
2160 than a program_point.
2161 (svalue::can_merge_p): Likewise.
2162 * svalue.h (widening_svalue::key_t): Likewise.
2163 (widening_svalue::widening_svalue): Likewise.
2165 2022-09-12 Martin Liska <mliska@suse.cz>
2167 * region-model.cc (region_model::maybe_complain_about_infoleak):
2168 Remove unused fields.
2170 2022-09-11 Tim Lange <mail@tim-lange.me>
2172 PR analyzer/106845
2173 * region-model.cc (region_model::check_region_bounds):
2174 Bail out if 0 bytes were accessed.
2175 * store.cc (byte_range::dump_to_pp):
2176 Add special case for empty ranges.
2177 (byte_range::exceeds_p): Restrict to non-empty ranges.
2178 (byte_range::falls_short_of_p): Restrict to non-empty ranges.
2179 * store.h (bit_range::empty_p): New function.
2180 (bit_range::get_last_byte_offset): Restrict to non-empty ranges.
2181 (byte_range::empty_p): New function.
2182 (byte_range::get_last_byte_offset): Restrict to non-empty ranges.
2184 2022-09-09 David Malcolm <dmalcolm@redhat.com>
2186 * analyzer.opt (Wanalyzer-exposure-through-uninit-copy): New.
2187 * checker-path.cc (region_creation_event::region_creation_event):
2188 Add "capacity" and "kind" params.
2189 (region_creation_event::get_desc): Generalize to different kinds
2190 of event.
2191 (checker_path::add_region_creation_event): Convert to...
2192 (checker_path::add_region_creation_events): ...this.
2193 * checker-path.h (enum rce_kind): New.
2194 (region_creation_event::region_creation_event): Add "capacity" and
2195 "kind" params.
2196 (region_creation_event::m_capacity): New field.
2197 (region_creation_event::m_rce_kind): New field.
2198 (checker_path::add_region_creation_event): Convert to...
2199 (checker_path::add_region_creation_events): ...this.
2200 * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
2201 Update for multiple region creation events.
2202 (diagnostic_manager::add_event_on_final_node): Likewise.
2203 (diagnostic_manager::add_events_for_eedge): Likewise.
2204 * region-model-impl-calls.cc (call_details::get_logger): New.
2205 * region-model.cc: Define INCLUDE_MEMORY before including
2206 "system.h". Include "gcc-rich-location.h".
2207 (class record_layout): New.
2208 (class exposure_through_uninit_copy): New.
2209 (contains_uninit_p): New.
2210 (region_model::maybe_complain_about_infoleak): New.
2211 * region-model.h (call_details::get_logger): New decl.
2212 (region_model::maybe_complain_about_infoleak): New decl.
2213 (region_model::mark_as_tainted): New decl.
2214 * sm-taint.cc (region_model::mark_as_tainted): New.
2216 2022-09-09 David Malcolm <dmalcolm@redhat.com>
2218 * analyzer.h (class known_function_manager): New forward decl.
2219 (class known_function): New.
2220 (plugin_analyzer_init_iface::register_known_function): New.
2221 * engine.cc: Include "analyzer/known-function-manager.h".
2222 (plugin_analyzer_init_impl::plugin_analyzer_init_impl): Add
2223 known_fn_mgr param.
2224 (plugin_analyzer_init_impl::register_state_machine): Add
2225 LOC_SCOPE.
2226 (plugin_analyzer_init_impl::register_known_function): New.
2227 (plugin_analyzer_init_impl::m_known_fn_mgr): New.
2228 (impl_run_checkers): Update plugin callback invocation to use
2229 eng's known_function_manager.
2230 * known-function-manager.cc: New file.
2231 * known-function-manager.h: New file.
2232 * region-model-manager.cc
2233 (region_model_manager::region_model_manager): Pass logger to
2234 m_known_fn_mgr's ctor.
2235 * region-model.cc (region_model::update_for_zero_return): New.
2236 (region_model::update_for_nonzero_return): New.
2237 (maybe_simplify_upper_bound): New.
2238 (region_model::maybe_get_copy_bounds): New.
2239 (region_model::get_known_function): New.
2240 (region_model::on_call_pre): Handle plugin-supplied known
2241 functions.
2242 * region-model.h: Include "analyzer/known-function-manager.h".
2243 (region_model_manager::get_known_function_manager): New.
2244 (region_model_manager::m_known_fn_mgr): New.
2245 (call_details::get_model): New accessor.
2246 (region_model::maybe_get_copy_bounds): New decl.
2247 (region_model::update_for_zero_return): New decl.
2248 (region_model::update_for_nonzero_return): New decl.
2249 (region_model::get_known_function): New decl.
2250 (region_model::get_known_function_manager): New.
2252 2022-09-08 Tim Lange <mail@tim-lange.me>
2254 PR analyzer/106625
2255 * analyzer.h (region_offset): Eliminate m_is_symbolic member.
2256 * region-model-impl-calls.cc (region_model::impl_call_realloc):
2257 Refine implementation to be more precise.
2258 * region-model.cc (class symbolic_past_the_end):
2259 Abstract diagnostic class to complain about accesses past the end
2260 with symbolic values.
2261 (class symbolic_buffer_overflow):
2262 Concrete diagnostic class to complain about buffer overflows with
2263 symbolic values.
2264 (class symbolic_buffer_overread):
2265 Concrete diagnostic class to complain about buffer overreads with
2266 symbolic values.
2267 (region_model::check_symbolic_bounds): New function.
2268 (maybe_get_integer_cst_tree): New helper function.
2269 (region_model::check_region_bounds):
2270 Add call to check_symbolic_bounds if offset is not concrete.
2271 (region_model::eval_condition_without_cm):
2272 Add support for EQ_EXPR and GT_EXPR with binaryop_svalues.
2273 (is_positive_svalue): New hleper function.
2274 (region_model::symbolic_greater_than):
2275 New function to handle GT_EXPR comparisons with symbolic values.
2276 (region_model::structural_equality): New function to compare
2277 whether two svalues are structured the same, i.e. evaluate to
2278 the same value.
2279 (test_struct): Reflect changes to region::calc_offset.
2280 (test_var): Likewise.
2281 (test_array_2): Likewise and add selftest with symbolic i.
2282 * region-model.h (class region_model): Add check_symbolic_bounds,
2283 symbolic_greater_than and structural_equality.
2284 * region.cc (region::get_offset):
2285 Reflect changes to region::calc_offset.
2286 (region::calc_offset):
2287 Compute the symbolic offset if the offset is not concrete.
2288 (region::get_relative_symbolic_offset): New function to return the
2289 symbolic offset in bytes relative to its parent.
2290 (field_region::get_relative_symbolic_offset): Likewise.
2291 (element_region::get_relative_symbolic_offset): Likewise.
2292 (offset_region::get_relative_symbolic_offset): Likewise.
2293 (bit_range_region::get_relative_symbolic_offset): Likewise.
2294 * region.h: Add get_relative_symbolic_offset.
2295 * store.cc (binding_key::make):
2296 Reflect changes to region::calc_offset.
2297 (binding_map::apply_ctor_val_to_range): Likewise.
2298 (binding_map::apply_ctor_pair_to_child_region): Likewise.
2299 (binding_cluster::bind_compound_sval): Likewise.
2300 (binding_cluster::get_any_binding): Likewise.
2301 (binding_cluster::maybe_get_compound_binding): Likewise.
2303 2022-09-05 Tim Lange <mail@tim-lange.me>
2305 * region-model-impl-calls.cc (region_model::impl_call_strcpy):
2306 Handle the constant string case.
2307 * region-model.cc (region_model::get_string_size):
2308 New function to get the string size from a region or svalue.
2309 * region-model.h (class region_model): Add get_string_size.
2311 2022-09-05 Tim Lange <mail@tim-lange.me>
2313 * region.cc (cast_region::get_relative_concrete_offset):
2314 New overloaded method.
2315 * region.h: Add cast_region::get_relative_concrete_offset.
2317 2022-08-22 Martin Liska <mliska@suse.cz>
2319 * region-model.cc: Add missing final keyword.
2321 2022-08-18 Tim Lange <mail@tim-lange.me>
2323 PR analyzer/106181
2324 * analyzer.opt: Add Wanalyzer-imprecise-floating-point-arithmetic.
2325 * region-model.cc (is_any_cast_p): Formatting.
2326 (region_model::check_region_size): Ensure precondition.
2327 (class imprecise_floating_point_arithmetic): New abstract
2328 diagnostic class for all floating-point related warnings.
2329 (class float_as_size_arg): Concrete diagnostic class to complain
2330 about floating-point operands inside the size argument.
2331 (class contains_floating_point_visitor):
2332 New visitor to find floating-point operands inside svalues.
2333 (region_model::check_dynamic_size_for_floats): New function.
2334 (region_model::set_dynamic_extents):
2335 Call to check_dynamic_size_for_floats.
2336 * region-model.h (class region_model):
2337 Add region_model::check_dynamic_size_for_floats.
2339 2022-08-16 Martin Liska <mliska@suse.cz>
2341 * region-model.cc: Fix -Winconsistent-missing-override clang
2342 warning.
2343 * region.h: Likewise.
2345 2022-08-15 David Malcolm <dmalcolm@redhat.com>
2347 PR analyzer/106626
2348 * region-model.cc (buffer_overread::emit): Fix copy&paste error in
2349 direction of the access in the note.
2351 2022-08-15 David Malcolm <dmalcolm@redhat.com>
2353 PR analyzer/106573
2354 * region-model.cc (region_model::on_call_pre): Use check_call_args
2355 when ensuring that we call get_arg_svalue on all args. Remove
2356 redundant call from handling for stdio builtins.
2358 2022-08-15 Immad Mir <mirimmad@outlook.com>
2360 PR analyzer/106551
2361 * sm-fd.cc (check_for_dup): exit early if first
2362 argument is invalid for all dup functions.
2364 2022-08-12 Tim Lange <mail@tim-lange.me>
2366 PR analyzer/106000
2367 * analyzer.opt: Add Wanalyzer-out-of-bounds.
2368 * region-model.cc (class out_of_bounds): Diagnostics base class
2369 for all out-of-bounds diagnostics.
2370 (class past_the_end): Base class derived from out_of_bounds for
2371 the buffer_overflow and buffer_overread diagnostics.
2372 (class buffer_overflow): Buffer overflow diagnostics.
2373 (class buffer_overread): Buffer overread diagnostics.
2374 (class buffer_underflow): Buffer underflow diagnostics.
2375 (class buffer_underread): Buffer overread diagnostics.
2376 (region_model::check_region_bounds): New function to check region
2377 bounds for out-of-bounds accesses.
2378 (region_model::check_region_access):
2379 Add call to check_region_bounds.
2380 (region_model::get_representative_tree): New function that accepts
2381 a region instead of an svalue.
2382 * region-model.h (class region_model):
2383 Add region_model::check_region_bounds.
2384 * region.cc (region::symbolic_p): New predicate.
2385 (offset_region::get_byte_size_sval): Only return the remaining
2386 byte size on offset_regions.
2387 * region.h: Add region::symbolic_p.
2388 * store.cc (byte_range::intersects_p):
2389 Add new function equivalent to bit_range::intersects_p.
2390 (byte_range::exceeds_p): New function.
2391 (byte_range::falls_short_of_p): New function.
2392 * store.h (struct byte_range): Add byte_range::intersects_p,
2393 byte_range::exceeds_p and byte_range::falls_short_of_p.
2395 2022-08-12 Tim Lange <mail@tim-lange.me>
2397 PR analyzer/106539
2398 * region-model-impl-calls.cc (region_model::impl_call_realloc):
2399 Use the result of get_copied_size as the size for the
2400 sized_regions in realloc.
2401 (success_with_move::get_copied_size): New function.
2403 2022-08-11 Immad Mir <mirimmad@outlook.com>
2405 PR analyzer/106551
2406 * sm-fd.cc (check_for_dup): handle the m_start
2407 state when transitioning the state of LHS
2408 of dup, dup2 and dup3 call.
2410 2022-08-09 David Malcolm <dmalcolm@redhat.com>
2412 PR analyzer/106573
2413 * region-model.cc (region_model::on_call_pre): Ensure that we call
2414 get_arg_svalue on all arguments.
2416 2022-08-05 David Malcolm <dmalcolm@redhat.com>
2418 PR analyzer/105947
2419 * analyzer.opt (Wanalyzer-jump-through-null): New option.
2420 * engine.cc (class jump_through_null): New.
2421 (exploded_graph::process_node): Complain about jumps through NULL
2422 function pointers.
2424 2022-08-02 Immad Mir <mirimmad@outlook.com>
2426 PR analyzer/106298
2427 * sm-fd.cc (fd_state_machine::on_open): Add
2428 creat, dup, dup2 and dup3 functions.
2429 (enum dup): New.
2430 (fd_state_machine::valid_to_unchecked_state): New.
2431 (fd_state_machine::on_creat): New.
2432 (fd_state_machine::on_dup): New.
2434 2022-07-28 David Malcolm <dmalcolm@redhat.com>
2436 PR analyzer/105893
2437 * analyzer.opt (Wanalyzer-putenv-of-auto-var): New.
2438 * region-model-impl-calls.cc (class putenv_of_auto_var): New.
2439 (region_model::impl_call_putenv): New.
2440 * region-model.cc (region_model::on_call_pre): Handle putenv.
2441 * region-model.h (region_model::impl_call_putenv): New decl.
2443 2022-07-28 David Malcolm <dmalcolm@redhat.com>
2445 * sm-malloc.cc (free_of_non_heap::emit): Add comment about CWE.
2446 * sm-taint.cc (tainted_size::emit): Likewise.
2448 2022-07-28 David Malcolm <dmalcolm@redhat.com>
2450 * region.h: Add notes to the comment describing the region
2451 class hierarchy.
2453 2022-07-27 Immad Mir <mirimmad@outlook.com>
2455 PR analyzer/106286
2456 * sm-fd.cc:
2457 (fd_diagnostic::get_meaning_for_state_change): New.
2459 2022-07-26 David Malcolm <dmalcolm@redhat.com>
2461 PR analyzer/106319
2462 * store.cc (store::set_value): Don't strip away casts if the
2463 region has NULL type.
2465 2022-07-26 David Malcolm <dmalcolm@redhat.com>
2467 * region.h (code_region::get_element): Remove stray decl.
2468 (function_region::get_element): Likewise.
2470 2022-07-25 Martin Liska <mliska@suse.cz>
2472 * sm-fd.cc: Run dos2unix and fix coding style issues.
2474 2022-07-23 Immad Mir <mirimmad@outlook.com>
2476 * sm-fd.cc (fd_param_diagnostic): New diagnostic class.
2477 (fd_access_mode_mismatch): Change inheritance from fd_diagnostic
2478 to fd_param_diagnostic. Add new overloaded constructor.
2479 (fd_use_after_close): Likewise.
2480 (unchecked_use_of_fd): Likewise and also change name to fd_use_without_check.
2481 (double_close): Change name to fd_double_close.
2482 (enum access_directions): New.
2483 (fd_state_machine::on_stmt): Handle calls to function with the
2484 new three function attributes.
2485 (fd_state_machine::check_for_fd_attrs): New.
2486 (fd_state_machine::on_open): Use the new overloaded constructors
2487 of diagnostic classes.
2489 2022-07-22 David Malcolm <dmalcolm@redhat.com>
2491 PR analyzer/106413
2492 * varargs.cc (region_model::impl_call_va_start): Avoid iterating
2493 through non-existant variadic arguments by initializing the
2494 impl_region to "UNKNOWN" if the va_start occurs in the top-level
2495 function to the analysis.
2497 2022-07-22 David Malcolm <dmalcolm@redhat.com>
2499 PR analyzer/106401
2500 * store.cc (binding_cluster::binding_cluster): Remove overzealous
2501 assertion; we're checking for tracked_p in
2502 store::get_or_create_cluster.
2504 2022-07-22 Tim Lange <mail@tim-lange.me>
2506 PR analyzer/106394
2507 * region-model.cc (capacity_compatible_with_type): Always return true
2508 if alloc_size is zero.
2510 2022-07-21 David Malcolm <dmalcolm@redhat.com>
2512 PR analyzer/106383
2513 * varargs.cc (region_model::impl_call_va_arg): When determining if
2514 we're doing interprocedural analysis, use the stack depth of the
2515 frame in which va_start was called, rather than the current stack
2516 depth.
2518 2022-07-21 David Malcolm <dmalcolm@redhat.com>
2520 * sm-taint.cc (tainted_array_index::emit): Bulletproof against
2521 NULL m_arg.
2522 (tainted_array_index::describe_final_event): Likewise.
2523 (tainted_size::emit): Likewise.
2524 (tainted_size::describe_final_event): Likewise.
2526 2022-07-21 David Malcolm <dmalcolm@redhat.com>
2528 PR analyzer/106374
2529 * region.cc (decl_region::get_svalue_for_initializer): Bail out on
2530 untracked regions.
2532 2022-07-20 David Malcolm <dmalcolm@redhat.com>
2534 PR analyzer/106373
2535 * sm-taint.cc (taint_state_machine::on_condition): Potentially
2536 update the state of the RHS as well as the LHS.
2538 2022-07-20 David Malcolm <dmalcolm@redhat.com>
2540 PR analyzer/106359
2541 * region.h (string_region::tracked_p): New.
2542 * store.cc (binding_cluster::binding_cluster): Move here from
2543 store.h. Add assertion that base_region is tracked_p.
2544 * store.h (binding_cluster::binding_cluster): Move to store.cc.
2546 2022-07-19 David Malcolm <dmalcolm@redhat.com>
2548 PR analyzer/106321
2549 * constraint-manager.h (bounded_ranges::get_count): New.
2550 (bounded_ranges::get_range): New.
2551 * engine.cc (impl_region_model_context::on_bounded_ranges): New.
2552 * exploded-graph.h (impl_region_model_context::on_bounded_ranges):
2553 New decl.
2554 * region-model.cc (region_model::apply_constraints_for_gswitch):
2555 Potentially call ctxt->on_bounded_ranges.
2556 * region-model.h (region_model_context::on_bounded_ranges): New
2557 vfunc.
2558 (noop_region_model_context::on_bounded_ranges): New.
2559 (region_model_context_decorator::on_bounded_ranges): New.
2560 * sm-taint.cc: Include "analyzer/constraint-manager.h".
2561 (taint_state_machine::on_bounded_ranges): New.
2562 * sm.h (state_machine::on_bounded_ranges): New.
2564 2022-07-19 David Malcolm <dmalcolm@redhat.com>
2566 * engine.cc (exploded_graph::process_node): Show any description
2567 of the out-edge when logging it for consideration.
2569 2022-07-15 David Malcolm <dmalcolm@redhat.com>
2571 PR analyzer/106284
2572 * sm-taint.cc (taint_state_machine::on_condition): Handle range
2573 checks optimized by build_range_check.
2575 2022-07-15 Jonathan Wakely <jwakely@redhat.com>
2577 * call-info.cc (call_info::print): Adjust to new label_text API.
2578 * checker-path.cc (checker_event::dump): Likewise.
2579 (region_creation_event::get_desc): Likewise.
2580 (state_change_event::get_desc): Likewise.
2581 (superedge_event::should_filter_p): Likewise.
2582 (start_cfg_edge_event::get_desc): Likewise.
2583 (call_event::get_desc): Likewise.
2584 (return_event::get_desc): Likewise.
2585 (warning_event::get_desc): Likewise.
2586 (checker_path::dump): Likewise.
2587 (checker_path::debug): Likewise.
2588 * diagnostic-manager.cc (diagnostic_manager::prune_for_sm_diagnostic):
2589 Likewise.
2590 (diagnostic_manager::prune_interproc_events): Likewise.
2591 * engine.cc (feasibility_state::maybe_update_for_edge):
2592 Likewise.
2593 * program-state.cc (sm_state_map::to_json): Likewise.
2594 * region-model-impl-calls.cc (region_model::impl_call_analyzer_describe): Likewise.
2595 (region_model::impl_call_analyzer_dump_capacity): Likewise.
2596 * region.cc (region::to_json): Likewise.
2597 * sm-malloc.cc (inform_nonnull_attribute): Likewise.
2598 * store.cc (binding_map::to_json): Likewise.
2599 (store::to_json): Likewise.
2600 * supergraph.cc (superedge::dump): Likewise.
2601 * svalue.cc (svalue::to_json): Likewise.
2603 2022-07-07 David Malcolm <dmalcolm@redhat.com>
2605 * checker-path.cc (start_cfg_edge_event::get_desc): Update for
2606 superedge::get_description returning a label_text.
2607 * engine.cc (feasibility_state::maybe_update_for_edge): Likewise.
2608 * supergraph.cc (superedge::dump): Likewise.
2609 (superedge::get_description): Convert return type from char * to
2610 label_text.
2611 * supergraph.h (superedge::get_description): Likewise.
2613 2022-07-07 David Malcolm <dmalcolm@redhat.com>
2615 * call-info.cc (call_info::print): Update for removal of
2616 label_text::maybe_free in favor of automatic memory management.
2617 * checker-path.cc (checker_event::dump): Likewise.
2618 (checker_event::prepare_for_emission): Likewise.
2619 (state_change_event::get_desc): Likewise.
2620 (superedge_event::should_filter_p): Likewise.
2621 (start_cfg_edge_event::get_desc): Likewise.
2622 (warning_event::get_desc): Likewise.
2623 (checker_path::dump): Likewise.
2624 (checker_path::debug): Likewise.
2625 * diagnostic-manager.cc
2626 (diagnostic_manager::prune_for_sm_diagnostic): Likewise.
2627 (diagnostic_manager::prune_interproc_events): Likewise.
2628 * program-state.cc (sm_state_map::to_json): Likewise.
2629 * region.cc (region::to_json): Likewise.
2630 * sm-malloc.cc (inform_nonnull_attribute): Likewise.
2631 * store.cc (binding_map::to_json): Likewise.
2632 (store::to_json): Likewise.
2633 * svalue.cc (svalue::to_json): Likewise.
2635 2022-07-07 David Malcolm <dmalcolm@redhat.com>
2637 PR analyzer/106225
2638 * sm-taint.cc (taint_state_machine::on_stmt): Move handling of
2639 assignments from division to...
2640 (taint_state_machine::check_for_tainted_divisor): ...this new
2641 function. Reject warning when the divisor is known to be non-zero.
2642 * sm.cc: Include "analyzer/program-state.h".
2643 (sm_context::get_old_region_model): New.
2644 * sm.h (sm_context::get_old_region_model): New decl.
2646 2022-07-06 Immad Mir <mirimmad@outlook.com>
2648 PR analyzer/106184
2649 * sm-fd.cc (fd_state_machine): Change ordering of initialization
2650 of state m_invalid so that the order of initializers is same as
2651 the ordering of the fields in the class decl.
2653 2022-07-06 Immad Mir <mirimmad@outlook.com>
2655 * sm-fd.cc (use_after_close): save the "close" event and
2656 show it where possible.
2658 2022-07-06 David Malcolm <dmalcolm@redhat.com>
2660 PR analyzer/106204
2661 * region-model.cc (within_short_circuited_stmt_p): Move extraction
2662 of assign_stmt to caller.
2663 (due_to_ifn_deferred_init_p): New.
2664 (region_model::check_for_poison): Move extraction of assign_stmt
2665 from within_short_circuited_stmt_p to here. Share logic with
2666 call to due_to_ifn_deferred_init_p.
2668 2022-07-02 Tim Lange <mail@tim-lange.me>
2670 PR analyzer/105900
2671 * analyzer.opt: Added Wanalyzer-allocation-size.
2672 * checker-path.cc (region_creation_event::get_desc): Added call to new
2673 virtual function pending_diagnostic::describe_region_creation_event.
2674 * checker-path.h: Added region_creation_event::get_desc.
2675 * diagnostic-manager.cc (diagnostic_manager::add_event_on_final_node):
2676 New function.
2677 * diagnostic-manager.h:
2678 Added diagnostic_manager::add_event_on_final_node.
2679 * pending-diagnostic.h (struct region_creation): New event_desc struct.
2680 (pending_diagnostic::describe_region_creation_event): Added virtual
2681 function to overwrite description of a region creation.
2682 * region-model.cc (class dubious_allocation_size): New class.
2683 (capacity_compatible_with_type): New helper function.
2684 (class size_visitor): New class.
2685 (struct_or_union_with_inheritance_p): New helper function.
2686 (is_any_cast_p): New helper function.
2687 (region_model::check_region_size): New function.
2688 (region_model::set_value): Added call to
2689 region_model::check_region_size.
2690 * region-model.h (class region_model): New function check_region_size.
2691 * svalue.cc (region_svalue::accept): Changed to post-order traversal.
2692 (initial_svalue::accept): Likewise.
2693 (unaryop_svalue::accept): Likewise.
2694 (binop_svalue::accept): Likewise.
2695 (sub_svalue::accept): Likewise.
2696 (repeated_svalue::accept): Likewise.
2697 (bits_within_svalue::accept): Likewise.
2698 (widening_svalue::accept): Likewise.
2699 (unmergeable_svalue::accept): Likewise.
2700 (compound_svalue::accept): Likewise.
2701 (conjured_svalue::accept): Likewise.
2702 (asm_output_svalue::accept): Likewise.
2703 (const_fn_result_svalue::accept): Likewise.
2705 2022-07-02 Immad Mir <mirimmad17@gmail.com>
2707 PR analyzer/106003
2708 * analyzer.opt (Wanalyzer-fd-leak): New option.
2709 (Wanalyzer-fd-access-mode-mismatch): New option.
2710 (Wanalyzer-fd-use-without-check): New option.
2711 (Wanalyzer-fd-double-close): New option.
2712 (Wanalyzer-fd-use-after-close): New option.
2713 * sm.h (make_fd_state_machine): New decl.
2714 * sm.cc (make_checkers): Call make_fd_state_machine.
2715 * sm-fd.cc: New file.
2717 2022-06-24 David Malcolm <dmalcolm@redhat.com>
2719 * call-string.cc: Add includes of "analyzer/analyzer.h"
2720 and "analyzer/analyzer-logging.h".
2721 (call_string::call_string): Delete copy ctor.
2722 (call_string::operator=): Delete.
2723 (call_string::operator==): Delete.
2724 (call_string::hash): Delete.
2725 (call_string::push_call): Make const, returning the resulting
2726 call_string.
2727 (call_string::pop): Delete.
2728 (call_string::cmp_ptr_ptr): New.
2729 (call_string::validate): Assert that m_parent is non-NULL, or
2730 m_elements is empty.
2731 (call_string::call_string): Move default ctor here from
2732 call-string.h and reimplement. Add ctor taking a parent
2733 and an element.
2734 (call_string::~call_string): New.
2735 (call_string::recursive_log): New.
2736 * call-string.h (call_string::call_string): Move default ctor's
2737 defn to call-string.cc. Delete copy ctor. Add ctor taking a
2738 parent and an element.
2739 (call_string::operator=): Delete.
2740 (call_string::operator==): Delete.
2741 (call_string::hash): Delete.
2742 (call_string::push_call): Make const, returning the resulting
2743 call_string.
2744 (call_string::pop): Delete decl.
2745 (call_string::get_parent): New.
2746 (call_string::cmp_ptr_ptr): New decl.
2747 (call_string::get_top_of_stack): New.
2748 (struct call_string::hashmap_traits_t): New.
2749 (class call_string): Add friend class region_model_manager. Add
2750 DISABLE_COPY_AND_ASSIGN.
2751 (call_string::~call_string): New decl.
2752 (call_string::recursive_log): New decl.
2753 (call_string::m_parent): New field.
2754 (call_string::m_children): New field.
2755 * constraint-manager.cc (selftest::test_many_constants): Pass
2756 model manager to program_point::origin.
2757 * engine.cc (exploded_graph::exploded_graph): Likewise.
2758 (exploded_graph::add_function_entry): Likewise for
2759 program_point::from_function_entry.
2760 (add_tainted_args_callback): Likewise.
2761 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
2762 Update for change to program_point.get_call_string.
2763 (exploded_graph::process_node): Likewise.
2764 (class function_call_string_cluster): Convert m_cs from a
2765 call_string to a const call_string &.
2766 (struct function_call_string): Likewise.
2767 (pod_hash_traits<function_call_string>::hash): Use pointer_hash
2768 for m_cs.
2769 (pod_hash_traits<function_call_string>::equal): Update for change
2770 to m_cs.
2771 (root_cluster::add_node): Update for change to
2772 function_call_string.
2773 (viz_callgraph_node::dump_dot): Update for change to call_string.
2774 * exploded-graph.h (per_call_string_data::m_key): Convert to a
2775 reference.
2776 (struct eg_call_string_hash_map_traits): Delete.
2777 (exploded_graph::call_string_data_map_t): Remove traits class.
2778 * program-point.cc: Move include of "analyzer/call-string.h" to
2779 after "analyzer/analyzer-logging.h".
2780 (program_point::print): Update for conversion of m_call_string to
2781 a pointer.
2782 (program_point::to_json): Likewise.
2783 (program_point::push_to_call_stack): Update for immutability of
2784 call strings.
2785 (program_point::pop_from_call_stack): Likewise.
2786 (program_point::hash): Use pointer hashing for m_call_string.
2787 (program_point::get_function_at_depth): Update for change to
2788 m_call_string.
2789 (program_point::validate): Update for changes to call_string.
2790 (program_point::on_edge): Likewise.
2791 (program_point::origin): Move here from call-string.h. Add
2792 region_model_manager param and use it to get empty call string.
2793 (program_point::from_function_entry): Likewise.
2794 (selftest::test_function_point_ordering): Likewise.
2795 (selftest::test_function_point_ordering): Likewise.
2796 * program-point.h (program_point::program_point): Update for
2797 change to m_call_string.
2798 (program_point::get_call_string): Likewise.
2799 (program_point::get_stack_depth): Likewise.
2800 (program_point::origin): Add region_model_manager param, and move
2801 defn to call-string.cc.
2802 (program_point::from_function_entry): Likewise.
2803 (program_point::empty): Drop call_string.
2804 (program_point::deleted): Likewise.
2805 (program_point::program_point): New private ctor.
2806 (program_point::m_call_string): Convert from call_string to const
2807 call_string *.
2808 * program-state.cc (selftest::test_program_state_merging): Update
2809 for call_string changes.
2810 (selftest::test_program_state_merging_2): Likewise.
2811 * region-model-manager.cc
2812 (region_model_manager::region_model_manager): Construct
2813 m_empty_call_string.
2814 (region_model_manager::log_stats): Log the call strings.
2815 * region-model.cc (assert_region_models_merge): Pass the
2816 region_model_manager when creating program_point instances.
2817 (selftest::test_state_merging): Likewise.
2818 (selftest::test_constraint_merging): Likewise.
2819 (selftest::test_widening_constraints): Likewise.
2820 (selftest::test_iteration_1): Likewise.
2821 * region-model.h (region_model_manager::get_empty_call_string):
2822 New.
2823 (region_model_manager::m_empty_call_string): New.
2824 * sm-signal.cc (register_signal_handler::impl_transition): Update
2825 for changes to call_string.
2827 2022-06-24 David Malcolm <dmalcolm@redhat.com>
2829 * call-string.cc (call_string::calc_recursion_depth): Whitespace
2830 cleanups.
2831 (call_string::cmp): Likewise.
2832 (call_string::get_caller_node): Likewise.
2833 (call_string::validate): Likewise.
2834 * engine.cc (dynamic_call_info_t::add_events_to_path): Likewise.
2835 (exploded_graph::get_per_function_data): Likewise.
2836 (exploded_graph::maybe_create_dynamic_call): Likewise.
2837 (exploded_graph::maybe_create_dynamic_call): Likewise.
2838 (exploded_graph::process_node): Likewise.
2840 2022-06-16 David Malcolm <dmalcolm@redhat.com>
2842 * varargs.cc (va_arg_type_mismatch::emit): Associate the warning
2843 with CWE-686 ("Function Call With Incorrect Argument Type").
2845 2022-06-16 David Malcolm <dmalcolm@redhat.com>
2847 * varargs.cc: Include "diagnostic-metadata.h".
2848 (va_list_exhausted::emit): Associate the warning with
2849 CWE-685 ("Function Call With Incorrect Number of Arguments").
2851 2022-06-16 David Malcolm <dmalcolm@redhat.com>
2853 * sm-file.cc (double_fclose::emit): Associate the warning with
2854 CWE-1341 ("Multiple Releases of Same Resource or Handle").
2856 2022-06-15 David Malcolm <dmalcolm@redhat.com>
2858 PR analyzer/105962
2859 * analyzer.opt (fanalyzer-undo-inlining): New option.
2860 * checker-path.cc: Include "diagnostic-core.h" and
2861 "inlining-iterator.h".
2862 (event_kind_to_string): Handle EK_INLINED_CALL.
2863 (class inlining_info): New class.
2864 (checker_event::checker_event): Move here from checker-path.h.
2865 Store original fndecl and depth, and calculate effective fndecl
2866 and depth based on inlining information.
2867 (checker_event::dump): Emit original depth as well as effective
2868 depth when they differ; likewise for fndecl.
2869 (region_creation_event::get_desc): Use m_effective_fndecl.
2870 (inlined_call_event::get_desc): New.
2871 (inlined_call_event::get_meaning): New.
2872 (checker_path::inject_any_inlined_call_events): New.
2873 * checker-path.h (enum event_kind): Add EK_INLINED_CALL.
2874 (checker_event::checker_event): Make protected, and move
2875 definition to checker-path.cc.
2876 (checker_event::get_fndecl): Use effective fndecl.
2877 (checker_event::get_stack_depth): Use effective stack depth.
2878 (checker_event::get_logical_location): Use effective stack depth.
2879 (checker_event::get_original_stack_depth): New.
2880 (checker_event::m_fndecl): Rename to...
2881 (checker_event::m_original_fndecl): ...this.
2882 (checker_event::m_depth): Rename to...
2883 (checker_event::m_original_depth): ...this.
2884 (checker_event::m_effective_fndecl): New field.
2885 (checker_event::m_effective_depth): New field.
2886 (class inlined_call_event): New checker_event subclass.
2887 (checker_path::inject_any_inlined_call_events): New decl.
2888 * diagnostic-manager.cc: Include "inlining-iterator.h".
2889 (diagnostic_manager::emit_saved_diagnostic): Call
2890 checker_path::inject_any_inlined_call_events.
2891 (diagnostic_manager::prune_for_sm_diagnostic): Handle
2892 EK_INLINED_CALL.
2893 * engine.cc (tainted_args_function_custom_event::get_desc): Use
2894 effective fndecl.
2895 * inlining-iterator.h: New file.
2897 2022-06-15 David Malcolm <dmalcolm@redhat.com>
2899 * diagnostic-manager.cc (saved_diagnostic::dump_dot_id): New.
2900 (saved_diagnostic::dump_as_dot_node): New.
2901 * diagnostic-manager.h (saved_diagnostic::dump_dot_id): New decl.
2902 (saved_diagnostic::dump_as_dot_node): New decl.
2903 * engine.cc (exploded_node::dump_dot): Add nodes for saved
2904 diagnostics.
2906 2022-06-02 David Malcolm <dmalcolm@redhat.com>
2908 * checker-path.cc (checker_event::get_meaning): New.
2909 (function_entry_event::get_meaning): New.
2910 (state_change_event::get_desc): Add dump of meaning of the event
2911 to the -fanalyzer-verbose-state-changes output.
2912 (state_change_event::get_meaning): New.
2913 (cfg_edge_event::get_meaning): New.
2914 (call_event::get_meaning): New.
2915 (return_event::get_meaning): New.
2916 (start_consolidated_cfg_edges_event::get_meaning): New.
2917 (warning_event::get_meaning): New.
2918 * checker-path.h: Include "tree-logical-location.h".
2919 (checker_event::checker_event): Construct m_logical_loc.
2920 (checker_event::get_logical_location): New.
2921 (checker_event::get_meaning): New decl.
2922 (checker_event::m_logical_loc): New.
2923 (function_entry_event::get_meaning): New decl.
2924 (state_change_event::get_meaning): New decl.
2925 (cfg_edge_event::get_meaning): New decl.
2926 (call_event::get_meaning): New decl.
2927 (return_event::get_meaning): New decl.
2928 (start_consolidated_cfg_edges_event::get_meaning): New.
2929 (warning_event::get_meaning): New decl.
2930 * pending-diagnostic.h: Include "diagnostic-path.h".
2931 (pending_diagnostic::get_meaning_for_state_change): New vfunc.
2932 * sm-file.cc (file_diagnostic::get_meaning_for_state_change): New
2933 vfunc impl.
2934 * sm-malloc.cc (malloc_diagnostic::get_meaning_for_state_change):
2935 Likewise.
2936 * sm-sensitive.cc
2937 (exposure_through_output_file::get_meaning_for_state_change):
2938 Likewise.
2939 * sm-taint.cc (taint_diagnostic::get_meaning_for_state_change):
2940 Likewise.
2941 * varargs.cc
2942 (va_list_sm_diagnostic::get_meaning_for_state_change): Likewise.
2944 2022-05-23 David Malcolm <dmalcolm@redhat.com>
2946 * call-info.cc: Add "final" and "override" to all vfunc
2947 implementations that were missing them, as appropriate.
2948 * engine.cc: Likewise.
2949 * region-model.cc: Likewise.
2950 * sm-malloc.cc: Likewise.
2951 * supergraph.h: Likewise.
2952 * svalue.cc: Likewise.
2953 * varargs.cc: Likewise.
2955 2022-05-20 David Malcolm <dmalcolm@redhat.com>
2957 * analyzer-pass.cc: Replace uses of "FINAL" and "OVERRIDE" with
2958 "final" and "override".
2959 * call-info.h: Likewise.
2960 * checker-path.h: Likewise.
2961 * constraint-manager.cc: Likewise.
2962 * diagnostic-manager.cc: Likewise.
2963 * engine.cc: Likewise.
2964 * exploded-graph.h: Likewise.
2965 * feasible-graph.h: Likewise.
2966 * pending-diagnostic.h: Likewise.
2967 * region-model-impl-calls.cc: Likewise.
2968 * region-model.cc: Likewise.
2969 * region-model.h: Likewise.
2970 * region.h: Likewise.
2971 * sm-file.cc: Likewise.
2972 * sm-malloc.cc: Likewise.
2973 * sm-pattern-test.cc: Likewise.
2974 * sm-sensitive.cc: Likewise.
2975 * sm-signal.cc: Likewise.
2976 * sm-taint.cc: Likewise.
2977 * state-purge.h: Likewise.
2978 * store.cc: Likewise.
2979 * store.h: Likewise.
2980 * supergraph.h: Likewise.
2981 * svalue.h: Likewise.
2982 * trimmed-graph.h: Likewise.
2983 * varargs.cc: Likewise.
2985 2022-05-16 David Malcolm <dmalcolm@redhat.com>
2987 PR analyzer/105103
2988 * analyzer.cc (make_label_text_n): New.
2989 * analyzer.h (class var_arg_region): New forward decl.
2990 (make_label_text_n): New decl.
2991 * analyzer.opt (Wanalyzer-va-arg-type-mismatch): New option.
2992 (Wanalyzer-va-list-exhausted): New option.
2993 (Wanalyzer-va-list-leak): New option.
2994 (Wanalyzer-va-list-use-after-va-end): New option.
2995 * checker-path.cc (call_event::get_desc): Split out decl access
2996 into..
2997 (call_event::get_caller_fndecl): ...this new function and...
2998 (call_event::get_callee_fndecl): ...this new function.
2999 * checker-path.h (call_event::get_desc): Drop "FINAL".
3000 (call_event::get_caller_fndecl): New decl.
3001 (call_event::get_callee_fndecl): New decl.
3002 (class call_event): Make fields protected.
3003 * diagnostic-manager.cc (null_assignment_sm_context::warn): New
3004 overload.
3005 (null_assignment_sm_context::get_new_program_state): New.
3006 (diagnostic_manager::add_events_for_superedge): Move case
3007 SUPEREDGE_CALL to a new pending_diagnostic::add_call_event vfunc.
3008 * engine.cc (impl_sm_context::warn): Implement new override.
3009 (impl_sm_context::get_new_program_state): New.
3010 * pending-diagnostic.cc: Include "analyzer/diagnostic-manager.h",
3011 "cpplib.h", "digraph.h", "ordered-hash-map.h", "cfg.h",
3012 "basic-block.h", "gimple.h", "gimple-iterator.h", "cgraph.h"
3013 "analyzer/supergraph.h", "analyzer/program-state.h",
3014 "alloc-pool.h", "fibonacci_heap.h", "shortest-paths.h",
3015 "sbitmap.h", "analyzer/exploded-graph.h", "diagnostic-path.h",
3016 and "analyzer/checker-path.h".
3017 (ht_ident_eq): New.
3018 (fixup_location_in_macro_p): New.
3019 (pending_diagnostic::fixup_location): New.
3020 (pending_diagnostic::add_call_event): New.
3021 * pending-diagnostic.h (pending_diagnostic::fixup_location): Drop
3022 no-op inline implementation in favor of the more complex
3023 implementation above.
3024 (pending_diagnostic::add_call_event): New vfunc.
3025 * region-model-impl-calls.cc: Include "analyzer/sm.h",
3026 "diagnostic-path.h", and "analyzer/pending-diagnostic.h".
3027 * region-model-manager.cc
3028 (region_model_manager::get_var_arg_region): New.
3029 (region_model_manager::log_stats): Log m_var_arg_regions.
3030 * region-model.cc (region_model::on_call_pre): Handle IFN_VA_ARG,
3031 BUILT_IN_VA_START, and BUILT_IN_VA_COPY.
3032 (region_model::on_call_post): Handle BUILT_IN_VA_END.
3033 (region_model::get_representative_path_var_1): Handle RK_VAR_ARG.
3034 (region_model::push_frame): Push variadic arguments.
3035 * region-model.h (region_model_manager::get_var_arg_region): New
3036 decl.
3037 (region_model_manager::m_var_arg_regions): New field.
3038 (region_model::impl_call_va_start): New decl.
3039 (region_model::impl_call_va_copy): New decl.
3040 (region_model::impl_call_va_arg): New decl.
3041 (region_model::impl_call_va_end): New decl.
3042 * region.cc (alloca_region::dump_to_pp): Dump the id.
3043 (var_arg_region::dump_to_pp): New.
3044 (var_arg_region::get_frame_region): New.
3045 * region.h (enum region_kind): Add RK_VAR_ARG.
3046 (region::dyn_cast_var_arg_region): New.
3047 (class var_arg_region): New.
3048 (is_a_helper <const var_arg_region *>::test): New.
3049 (struct default_hash_traits<var_arg_region::key_t>): New.
3050 * sm.cc (make_checkers): Call make_va_list_state_machine.
3051 * sm.h (sm_context::warn): New vfunc.
3052 (sm_context::get_old_svalue): Drop unused decl.
3053 (sm_context::get_new_program_state): New vfunc.
3054 (make_va_list_state_machine): New decl.
3055 * varargs.cc: New file.
3057 2022-05-16 Martin Liska <mliska@suse.cz>
3059 * engine.cc (exploded_node::get_dot_fillcolor): Use ARRAY_SIZE.
3060 * function-set.cc (test_stdio_example): Likewise.
3061 * sm-file.cc (get_file_using_fns): Likewise.
3062 * sm-malloc.cc (malloc_state_machine::unaffected_by_call_p): Likewise.
3063 * sm-signal.cc (get_async_signal_unsafe_fns): Likewise.
3065 2022-05-13 Richard Biener <rguenther@suse.de>
3067 * supergraph.cc: Re-order gimple-fold.h include.
3069 2022-05-11 David Malcolm <dmalcolm@redhat.com>
3071 * checker-path.cc (state_change_event::get_desc): Call maybe_free
3072 on label_text temporaries.
3073 * diagnostic-manager.cc
3074 (diagnostic_manager::prune_for_sm_diagnostic): Likewise.
3075 * engine.cc (exploded_graph::~exploded_graph): Fix leak of
3076 m_per_point_data and m_per_call_string_data values. Simplify
3077 cleanup of m_per_function_stats and m_per_point_data values.
3078 (feasibility_state::maybe_update_for_edge): Fix leak of result of
3079 superedge::get_description.
3080 * region-model-manager.cc
3081 (region_model_manager::~region_model_manager): Move cleanup of
3082 m_setjmp_values to match the ordering of the fields within
3083 region_model_manager. Fix leak of values within
3084 m_repeated_values_map, m_bits_within_values_map,
3085 m_asm_output_values_map, and m_const_fn_result_values_map.
3087 2022-04-28 David Malcolm <dmalcolm@redhat.com>
3089 PR analyzer/105285
3090 * store.cc (binding_cluster::get_any_binding): Handle accessing
3091 sub_svalues of clusters where the base region has a symbolic
3092 binding.
3094 2022-04-28 David Malcolm <dmalcolm@redhat.com>
3096 * diagnostic-manager.cc (epath_finder::process_worklist_item):
3097 Call dump_feasible_path when a path that reaches the the target
3098 enode is found.
3099 (epath_finder::dump_feasible_path): New.
3100 * engine.cc (feasibility_state::dump_to_pp): New.
3101 * exploded-graph.h (feasibility_state::dump_to_pp): New decl.
3102 * feasible-graph.cc (feasible_graph::dump_feasible_path): New.
3103 * feasible-graph.h (feasible_graph::dump_feasible_path): New
3104 decls.
3105 * program-point.cc (function_point::print): Fix missing trailing
3106 newlines.
3107 * program-point.h (program_point::print_source_line): Remove
3108 unimplemented decl.
3110 2022-04-25 David Malcolm <dmalcolm@redhat.com>
3112 PR analyzer/105365
3113 PR analyzer/105366
3114 * svalue.cc
3115 (cmp_cst): Rename to...
3116 (cmp_csts_same_type): ...this. Convert all recursive calls to
3117 calls to...
3118 (cmp_csts_and_types): ....this new function.
3119 (svalue::cmp_ptr): Update for renaming of cmp_cst
3121 2022-04-14 David Malcolm <dmalcolm@redhat.com>
3123 PR analyzer/105264
3124 * region-model-reachability.cc (reachable_regions::handle_parm):
3125 Use maybe_get_deref_base_region rather than just region_svalue, to
3126 handle pointer arithmetic also.
3127 * svalue.cc (svalue::maybe_get_deref_base_region): New.
3128 * svalue.h (svalue::maybe_get_deref_base_region): New decl.
3130 2022-04-14 David Malcolm <dmalcolm@redhat.com>
3132 PR analyzer/105252
3133 * svalue.cc (cmp_cst): When comparing VECTOR_CSTs, compare the
3134 types of the encoded elements before calling cmp_cst on them.
3136 2022-04-09 David Malcolm <dmalcolm@redhat.com>
3138 PR analyzer/103892
3139 * region-model-manager.cc
3140 (region_model_manager::get_unknown_symbolic_region): New,
3141 extracted from...
3142 (region_model_manager::get_field_region): ...here.
3143 (region_model_manager::get_element_region): Use it here.
3144 (region_model_manager::get_offset_region): Likewise.
3145 (region_model_manager::get_sized_region): Likewise.
3146 (region_model_manager::get_cast_region): Likewise.
3147 (region_model_manager::get_bit_range): Likewise.
3148 * region-model.h
3149 (region_model_manager::get_unknown_symbolic_region): New decl.
3150 * region.cc (symbolic_region::symbolic_region): Handle sval_ptr
3151 having NULL type.
3152 (symbolic_region::dump_to_pp): Handle having NULL type.
3154 2022-04-07 David Malcolm <dmalcolm@redhat.com>
3156 PR analyzer/102208
3157 * store.cc (binding_map::remove_overlapping_bindings): Add
3158 "always_overlap" param, using it to generalize to the case where
3159 we want to remove all bindings. Update "uncertainty" logic to
3160 only record maybe-bound values for cases where there is a symbolic
3161 write involved.
3162 (binding_cluster::mark_region_as_unknown): Split param "reg" into
3163 "reg_to_bind" and "reg_for_overlap".
3164 (binding_cluster::maybe_get_compound_binding): Pass "false" to
3165 binding_map::remove_overlapping_bindings new "always_overlap" param.
3166 (binding_cluster::remove_overlapping_bindings): Determine
3167 "always_overlap" and pass it to
3168 binding_map::remove_overlapping_bindings.
3169 (store::set_value): Pass uncertainty to remove_overlapping_bindings
3170 call. Update for new param of
3171 binding_cluster::mark_region_as_unknown, passing both the base
3172 region of the iter_cluster, and the lhs_reg.
3173 (store::mark_region_as_unknown): Update for new param of
3174 binding_cluster::mark_region_as_unknown, passing "reg" for both.
3175 (store::remove_overlapping_bindings): Add param "uncertainty", and
3176 pass it on to call to
3177 binding_cluster::remove_overlapping_bindings.
3178 * store.h (binding_map::remove_overlapping_bindings): Add
3179 "always_overlap" param.
3180 (binding_cluster::mark_region_as_unknown): Split param "reg" into
3181 "reg_to_bind" and "reg_for_overlap".
3182 (store::remove_overlapping_bindings): Add param "uncertainty".
3184 2022-03-29 David Malcolm <dmalcolm@redhat.com>
3186 PR testsuite/105085
3187 * region-model-manager.cc (dump_untracked_region): Skip decls in
3188 the constant pool.
3190 2022-03-29 David Malcolm <dmalcolm@redhat.com>
3192 PR analyzer/105087
3193 * analyzer.h (class conjured_purge): New forward decl.
3194 * region-model-asm.cc (region_model::on_asm_stmt): Add
3195 conjured_purge param to calls binding_cluster::on_asm and
3196 region_model_manager::get_or_create_conjured_svalue.
3197 * region-model-impl-calls.cc
3198 (call_details::get_or_create_conjured_svalue): Likewise for call
3199 to region_model_manager::get_or_create_conjured_svalue.
3200 (region_model::impl_call_fgets): Remove call to
3201 region_model::purge_state_involving, as this is now done
3202 implicitly by call_details::get_or_create_conjured_svalue.
3203 (region_model::impl_call_fread): Likewise.
3204 (region_model::impl_call_strchr): Pass conjured_purge param to
3205 call to region_model_manager::get_or_create_conjured_svalue.
3206 * region-model-manager.cc (conjured_purge::purge): New.
3207 (region_model_manager::get_or_create_conjured_svalue): Add
3208 param "p". Use it to purge state when reusing an existing
3209 conjured_svalue.
3210 * region-model.cc (region_model::on_call_pre): Replace call to
3211 region_model::purge_state_involving with passing conjured_purge
3212 to region_model_manager::get_or_create_conjured_svalue.
3213 (region_model::handle_unrecognized_call): Pass conjured_purge to
3214 store::on_unknown_fncall.
3215 * region-model.h
3216 (region_model_manager::get_or_create_conjured_svalue): Add param
3217 "p".
3218 * store.cc (binding_cluster::on_unknown_fncall): Likewise. Pass
3219 it on to region_model_manager::get_or_create_conjured_svalue.
3220 (binding_cluster::on_asm): Likewise.
3221 (store::on_unknown_fncall): Add param "p" and pass it on to
3222 binding_cluster::on_unknown_fncall.
3223 * store.h (binding_cluster::on_unknown_fncall): Add param p.
3224 (binding_cluster::on_asm): Likewise.
3225 (store::on_unknown_fncall): Likewise.
3226 * svalue.h (class conjured_purge): New.
3228 2022-03-29 David Malcolm <dmalcolm@redhat.com>
3230 PR analyzer/105074
3231 * region.cc (ipa_ref_requires_tracking): Drop "context_fndecl",
3232 instead using the ref->referring to get the cgraph node of the
3233 caller.
3234 (symnode_requires_tracking_p): Likewise.
3236 2022-03-26 David Malcolm <dmalcolm@redhat.com>
3238 PR analyzer/105057
3239 * store.cc (binding_cluster::make_unknown_relative_to): Reject
3240 attempts to create a cluster for untracked base regions.
3241 (store::set_value): Likewise.
3242 (store::fill_region): Likewise.
3243 (store::mark_region_as_unknown): Likewise.
3245 2022-03-25 David Malcolm <dmalcolm@redhat.com>
3247 PR analyzer/104954
3248 * analyzer.opt (-fdump-analyzer-untracked): New option.
3249 * engine.cc (impl_run_checkers): Handle it.
3250 * region-model-asm.cc (region_model::on_asm_stmt): Don't attempt
3251 to clobber regions with !tracked_p ().
3252 * region-model-manager.cc (dump_untracked_region): New.
3253 (region_model_manager::dump_untracked_regions): New.
3254 (frame_region::dump_untracked_regions): New.
3255 * region-model.h (region_model_manager::dump_untracked_regions):
3256 New decl.
3257 * region.cc (ipa_ref_requires_tracking): New.
3258 (symnode_requires_tracking_p): New.
3259 (decl_region::calc_tracked_p): New.
3260 * region.h (region::tracked_p): New vfunc.
3261 (frame_region::dump_untracked_regions): New decl.
3262 (class decl_region): Note that this is also used fo SSA names.
3263 (decl_region::decl_region): Initialize m_tracked.
3264 (decl_region::tracked_p): New.
3265 (decl_region::calc_tracked_p): New decl.
3266 (decl_region::m_tracked): New.
3267 * store.cc (store::get_or_create_cluster): Assert that we
3268 don't try to create clusters for base regions that aren't
3269 trackable.
3270 (store::mark_as_escaped): Don't mark base regions that we're not
3271 tracking.
3273 2022-03-23 David Malcolm <dmalcolm@redhat.com>
3275 PR analyzer/104979
3276 * engine.cc (impl_run_checkers): Create the engine after the
3277 supergraph, and pass the supergraph to the engine.
3278 * region-model.cc (region_model::get_lvalue_1): Pass ctxt to
3279 frame_region::get_region_for_local.
3280 (region_model::update_for_return_gcall): Pass the lvalue for the
3281 result to pop_frame as a tree, rather than as a region.
3282 (region_model::pop_frame): Update for above change, determining
3283 the destination region after the frame is popped and thus with
3284 respect to the caller frame rather than the called frame.
3285 Likewise, set the value of the region to the return value after
3286 the frame is popped.
3287 (engine::engine): Add supergraph pointer.
3288 (selftest::test_stack_frames): Set the DECL_CONTECT of PARM_DECLs.
3289 (selftest::test_get_representative_path_var): Likewise.
3290 (selftest::test_state_merging): Likewise.
3291 * region-model.h (region_model::pop_frame): Convert first param
3292 from a const region * to a tree.
3293 (engine::engine): Add param "sg".
3294 (engine::m_sg): New field.
3295 * region.cc: Include "analyzer/sm.h" and
3296 "analyzer/program-state.h".
3297 (frame_region::get_region_for_local): Add "ctxt" param.
3298 Add assertions that VAR_DECLs are locals, and that expr is for the
3299 correct function.
3300 * region.h (frame_region::get_region_for_local): Add "ctxt" param.
3302 2022-03-23 David Malcolm <dmalcolm@redhat.com>
3304 PR analyzer/105017
3305 * sm-taint.cc (taint_diagnostic::subclass_equal_p): Check
3306 m_has_bounds as well as m_arg.
3307 (tainted_allocation_size::subclass_equal_p): Chain up to base
3308 class implementation. Also check m_mem_space.
3309 (tainted_allocation_size::emit): Add note showing stack-based vs
3310 heap-based allocations.
3312 2022-03-23 David Malcolm <dmalcolm@redhat.com>
3314 PR analyzer/104997
3315 * diagnostic-manager.cc (diagnostic_manager::add_diagnostic):
3316 Convert return type from "void" to "bool", reporting success vs
3317 failure to caller, for both overloads.
3318 * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
3319 Likewise.
3320 * engine.cc (impl_region_model_context::warn): Propagate return
3321 value from diagnostic_manager::add_diagnostic.
3323 2022-03-18 David Malcolm <dmalcolm@redhat.com>
3325 PR analyzer/104943
3326 PR analyzer/104954
3327 PR analyzer/103533
3328 * analyzer.h (class state_purge_per_decl): New forward decl.
3329 * engine.cc (impl_run_checkers): Pass region_model_manager to
3330 state_purge_map ctor.
3331 * program-point.cc (function_point::final_stmt_p): New.
3332 (function_point::get_next): New.
3333 * program-point.h (function_point::final_stmt_p): New decl.
3334 (function_point::get_next): New decl.
3335 * program-state.cc (program_state::prune_for_point): Generalize to
3336 purge local decls as well as SSA names.
3337 (program_state::can_purge_base_region_p): New.
3338 * program-state.h (program_state::can_purge_base_region_p): New
3339 decl.
3340 * region-model.cc (struct append_ssa_names_cb_data): Rename to...
3341 (struct append_regions_cb_data): ...this.
3342 (region_model::get_ssa_name_regions_for_current_frame): Rename
3343 to...
3344 (region_model::get_regions_for_current_frame): ...this, updating
3345 for other renamings.
3346 (region_model::append_ssa_names_cb): Rename to...
3347 (region_model::append_regions_cb): ...this, and drop the requirement
3348 that the subregion be a SSA name.
3349 * region-model.h (struct append_ssa_names_cb_data): Rename decl
3350 to...
3351 (struct append_regions_cb_data): ...this.
3352 (region_model::get_ssa_name_regions_for_current_frame): Rename
3353 decl to...
3354 (region_model::get_regions_for_current_frame): ...this.
3355 (region_model::append_ssa_names_cb): Rename decl to...
3356 (region_model::append_regions_cb): ...this.
3357 * state-purge.cc: Include "tristate.h", "selftest.h",
3358 "analyzer/store.h", "analyzer/region-model.h", and
3359 "gimple-walk.h".
3360 (get_candidate_for_purging): New.
3361 (class gimple_op_visitor): New.
3362 (my_load_cb): New.
3363 (my_store_cb): New.
3364 (my_addr_cb): New.
3365 (state_purge_map::state_purge_map): Add "mgr" param. Update for
3366 renamings. Find uses of local variables.
3367 (state_purge_map::~state_purge_map): Update for renaming of m_map
3368 to m_ssa_map. Clean up m_decl_map.
3369 (state_purge_map::get_or_create_data_for_decl): New.
3370 (state_purge_per_ssa_name::state_purge_per_ssa_name): Update for
3371 inheriting from state_purge_per_tree.
3372 (state_purge_per_ssa_name::add_to_worklist): Likewise.
3373 (state_purge_per_decl::state_purge_per_decl): New.
3374 (state_purge_per_decl::add_needed_at): New.
3375 (state_purge_per_decl::add_pointed_to_at): New.
3376 (state_purge_per_decl::process_worklists): New.
3377 (state_purge_per_decl::add_to_worklist): New.
3378 (same_binding_p): New.
3379 (fully_overwrites_p): New.
3380 (state_purge_per_decl::process_point_backwards): New.
3381 (state_purge_per_decl::process_point_forwards): New.
3382 (state_purge_per_decl::needed_at_point_p): New.
3383 (state_purge_annotator::print_needed): Generalize to print local
3384 decls as well as SSA names.
3385 * state-purge.h (class state_purge_map): Update leading comment.
3386 (state_purge_map::map_t): Rename to...
3387 (state_purge_map::ssa_map_t): ...this.
3388 (state_purge_map::iterator): Rename to...
3389 (state_purge_map::ssa_iterator): ...this.
3390 (state_purge_map::decl_map_t): New typedef.
3391 (state_purge_map::decl_iterator): New typedef.
3392 (state_purge_map::state_purge_map): Add "mgr" param.
3393 (state_purge_map::get_data_for_ssa_name): Update for renaming.
3394 (state_purge_map::get_any_data_for_decl): New.
3395 (state_purge_map::get_or_create_data_for_decl): New decl.
3396 (state_purge_map::begin): Rename to...
3397 (state_purge_map::begin_ssas): ...this.
3398 (state_purge_map::end): Rename to...
3399 (state_purge_map::end_ssa): ...this.
3400 (state_purge_map::begin_decls): New.
3401 (state_purge_map::end_decls): New.
3402 (state_purge_map::m_map): Rename to...
3403 (state_purge_map::m_ssa_map): ...this.
3404 (state_purge_map::m_decl_map): New field.
3405 (class state_purge_per_tree): New class.
3406 (class state_purge_per_ssa_name): Inherit from state_purge_per_tree.
3407 (state_purge_per_ssa_name::get_function): Move to base class.
3408 (state_purge_per_ssa_name::point_set_t): Likewise.
3409 (state_purge_per_ssa_name::m_fun): Likewise.
3410 (class state_purge_per_decl): New.
3412 2022-03-17 David Malcolm <dmalcolm@redhat.com>
3414 * state-purge.cc (state_purge_annotator::add_node_annotations):
3415 Avoid duplicate before-supernode annotations when returning from
3416 an interprocedural call. Show after-supernode annotations.
3418 2022-03-17 David Malcolm <dmalcolm@redhat.com>
3420 * program-point.cc (program_point::get_next): Fix missing
3421 increment of index.
3423 2022-03-16 David Malcolm <dmalcolm@redhat.com>
3425 PR analyzer/104955
3426 * diagnostic-manager.cc (get_emission_location): New.
3427 (diagnostic_manager::diagnostic_manager): Initialize
3428 m_num_disabled_diagnostics.
3429 (diagnostic_manager::add_diagnostic): Reject diagnostics that
3430 will eventually be rejected due to being disabled.
3431 (diagnostic_manager::emit_saved_diagnostics): Log the number
3432 of disabled diagnostics.
3433 (diagnostic_manager::emit_saved_diagnostic): Split out logic for
3434 determining emission location to get_emission_location.
3435 * diagnostic-manager.h
3436 (diagnostic_manager::m_num_disabled_diagnostics): New field.
3437 * engine.cc (stale_jmp_buf::get_controlling_option): New.
3438 (stale_jmp_buf::emit): Use it.
3439 * pending-diagnostic.h
3440 (pending_diagnostic::get_controlling_option): New vfunc.
3441 * region-model.cc
3442 (poisoned_value_diagnostic::get_controlling_option): New.
3443 (poisoned_value_diagnostic::emit): Use it.
3444 (shift_count_negative_diagnostic::get_controlling_option): New.
3445 (shift_count_negative_diagnostic::emit): Use it.
3446 (shift_count_overflow_diagnostic::get_controlling_option): New.
3447 (shift_count_overflow_diagnostic::emit): Use it.
3448 (dump_path_diagnostic::get_controlling_option): New.
3449 (dump_path_diagnostic::emit): Use it.
3450 (write_to_const_diagnostic::get_controlling_option): New.
3451 (write_to_const_diagnostic::emit): Use it.
3452 (write_to_string_literal_diagnostic::get_controlling_option): New.
3453 (write_to_string_literal_diagnostic::emit): Use it.
3454 * sm-file.cc (double_fclose::get_controlling_option): New.
3455 (double_fclose::emit): Use it.
3456 (file_leak::get_controlling_option): New.
3457 (file_leak::emit): Use it.
3458 * sm-malloc.cc (mismatching_deallocation::get_controlling_option):
3459 New.
3460 (mismatching_deallocation::emit): Use it.
3461 (double_free::get_controlling_option): New.
3462 (double_free::emit): Use it.
3463 (possible_null_deref::get_controlling_option): New.
3464 (possible_null_deref::emit): Use it.
3465 (possible_null_arg::get_controlling_option): New.
3466 (possible_null_arg::emit): Use it.
3467 (null_deref::get_controlling_option): New.
3468 (null_deref::emit): Use it.
3469 (null_arg::get_controlling_option): New.
3470 (null_arg::emit): Use it.
3471 (use_after_free::get_controlling_option): New.
3472 (use_after_free::emit): Use it.
3473 (malloc_leak::get_controlling_option): New.
3474 (malloc_leak::emit): Use it.
3475 (free_of_non_heap::get_controlling_option): New.
3476 (free_of_non_heap::emit): Use it.
3477 * sm-pattern-test.cc (pattern_match::get_controlling_option): New.
3478 (pattern_match::emit): Use it.
3479 * sm-sensitive.cc
3480 (exposure_through_output_file::get_controlling_option): New.
3481 (exposure_through_output_file::emit): Use it.
3482 * sm-signal.cc (signal_unsafe_call::get_controlling_option): New.
3483 (signal_unsafe_call::emit): Use it.
3484 * sm-taint.cc (tainted_array_index::get_controlling_option): New.
3485 (tainted_array_index::emit): Use it.
3486 (tainted_offset::get_controlling_option): New.
3487 (tainted_offset::emit): Use it.
3488 (tainted_size::get_controlling_option): New.
3489 (tainted_size::emit): Use it.
3490 (tainted_divisor::get_controlling_option): New.
3491 (tainted_divisor::emit): Use it.
3492 (tainted_allocation_size::get_controlling_option): New.
3493 (tainted_allocation_size::emit): Use it.
3495 2022-03-15 David Malcolm <dmalcolm@redhat.com>
3497 * store.cc (store::store): Presize m_cluster_map.
3499 2022-03-10 David Malcolm <dmalcolm@redhat.com>
3501 PR analyzer/104863
3502 * constraint-manager.cc (constraint_manager::add_constraint):
3503 Refresh the EC IDs when adding constraints implied by offsets.
3505 2022-03-10 David Malcolm <dmalcolm@redhat.com>
3507 PR analyzer/104793
3508 * analyzer.h (class pending_note): New forward decl.
3509 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
3510 Initialize m_notes.
3511 (saved_diagnostic::operator==): Compare m_notes.
3512 (saved_diagnostic::add_note): New.
3513 (saved_diagnostic::emit_any_notes): New.
3514 (diagnostic_manager::add_note): New.
3515 (diagnostic_manager::emit_saved_diagnostic): Call emit_any_notes
3516 after emitting the warning.
3517 * diagnostic-manager.h (saved_diagnostic::add_note): New decl.
3518 (saved_diagnostic::emit_any_notes): New decl.
3519 (saved_diagnostic::m_notes): New field.
3520 (diagnostic_manager::add_note): New decl.
3521 * engine.cc (impl_region_model_context::add_note): New.
3522 * exploded-graph.h (impl_region_model_context::add_note): New
3523 decl.
3524 * pending-diagnostic.h (class pending_note): New.
3525 (class pending_note_subclass): New template.
3526 * region-model.cc (class reason_attr_access): New.
3527 (check_external_function_for_access_attr): Add class
3528 annotating_ctxt and use it when checking region.
3529 (noop_region_model_context::add_note): New.
3530 * region-model.h (region_model_context::add_note): New vfunc.
3531 (noop_region_model_context::add_note): New decl.
3532 (class region_model_context_decorator): New.
3533 (class note_adding_context): New.
3535 2022-03-10 David Malcolm <dmalcolm@redhat.com>
3537 PR analyzer/104793
3538 * region-model.cc
3539 (region_model::check_external_function_for_access_attr): New.
3540 (region_model::handle_unrecognized_call): Call it.
3541 * region-model.h
3542 (region_model::check_external_function_for_access_attr): New decl.
3543 (region_model::handle_unrecognized_call): New decl.
3545 2022-03-10 David Malcolm <dmalcolm@redhat.com>
3547 * sm-taint.cc (taint_state_machine::check_for_tainted_size_arg):
3548 Avoid generating duplicate saved_diagnostics by only handling the
3549 rdwr_map entry for the ptrarg, not the duplicate entry for the
3550 sizarg.
3552 2022-03-07 David Malcolm <dmalcolm@redhat.com>
3554 PR analyzer/101983
3555 * engine.cc (returning_from_function_p): New.
3556 (impl_region_model_context::on_state_leak): Use it when rejecting
3557 leaks at the return from "main".
3559 2022-03-07 Jakub Jelinek <jakub@redhat.com>
3561 * store.cc: Fix up duplicated word issue in a comment.
3562 * analyzer.cc: Likewise.
3563 * engine.cc: Likewise.
3564 * sm-taint.cc: Likewise.
3566 2022-03-04 David Malcolm <dmalcolm@redhat.com>
3568 PR analyzer/103521
3569 * analyzer.opt (-param=analyzer-max-svalue-depth=): Reduce from 13
3570 to 12.
3572 2022-02-23 David Malcolm <dmalcolm@redhat.com>
3574 PR analyzer/104434
3575 * analyzer.h (class const_fn_result_svalue): New decl.
3576 * region-model-impl-calls.cc (call_details::get_manager): New.
3577 * region-model-manager.cc
3578 (region_model_manager::get_or_create_const_fn_result_svalue): New.
3579 (region_model_manager::log_stats): Log
3580 m_const_fn_result_values_map.
3581 * region-model.cc (const_fn_p): New.
3582 (maybe_get_const_fn_result): New.
3583 (region_model::on_call_pre): Handle fndecls with
3584 __attribute__((const)) by calling the above rather than making
3585 a conjured_svalue.
3586 * region-model.h (visitor::visit_const_fn_result_svalue): New.
3587 (region_model_manager::get_or_create_const_fn_result_svalue): New
3588 decl.
3589 (region_model_manager::const_fn_result_values_map_t): New typedef.
3590 (region_model_manager::m_const_fn_result_values_map): New field.
3591 (call_details::get_manager): New decl.
3592 * svalue.cc (svalue::cmp_ptr): Handle SK_CONST_FN_RESULT.
3593 (const_fn_result_svalue::dump_to_pp): New.
3594 (const_fn_result_svalue::dump_input): New.
3595 (const_fn_result_svalue::accept): New.
3596 * svalue.h (enum svalue_kind): Add SK_CONST_FN_RESULT.
3597 (svalue::dyn_cast_const_fn_result_svalue): New.
3598 (class const_fn_result_svalue): New.
3599 (is_a_helper <const const_fn_result_svalue *>::test): New.
3600 (template <> struct default_hash_traits<const_fn_result_svalue::key_t>):
3601 New.
3603 2022-02-17 David Malcolm <dmalcolm@redhat.com>
3605 PR analyzer/104576
3606 * region-model.cc: Include "calls.h".
3607 (region_model::on_call_pre): Use flags_from_decl_or_type to
3608 generalize check for DECL_PURE_P to also check for ECF_CONST.
3610 2022-02-16 David Malcolm <dmalcolm@redhat.com>
3612 PR analyzer/104560
3613 * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
3614 Add region creation events for globals of interest.
3615 (null_assignment_sm_context::get_old_program_state): New.
3616 (diagnostic_manager::add_events_for_eedge): Move check for
3617 changing dynamic extents from PK_BEFORE_STMT case to after the
3618 switch on the dst_point's kind so that we can emit them for the
3619 final stmt in a basic block.
3620 * engine.cc (impl_sm_context::get_old_program_state): New.
3621 * sm-malloc.cc (malloc_state_machine::get_default_state): Rewrite
3622 detection of m_non_heap to use get_memory_space.
3623 (free_of_non_heap::free_of_non_heap): Add freed_reg param.
3624 (free_of_non_heap::subclass_equal_p): Update for changes to
3625 fields.
3626 (free_of_non_heap::emit): Drop m_kind in favor of
3627 get_memory_space.
3628 (free_of_non_heap::describe_state_change): Remove logic for
3629 detecting alloca.
3630 (free_of_non_heap::mark_interesting_stuff): Add region-creation of
3631 m_freed_reg.
3632 (free_of_non_heap::get_memory_space): New.
3633 (free_of_non_heap::kind): Drop enum.
3634 (free_of_non_heap::m_freed_reg): New field.
3635 (free_of_non_heap::m_kind): Drop field.
3636 (malloc_state_machine::on_stmt): Drop transition to m_non_heap.
3637 (malloc_state_machine::handle_free_of_non_heap): New function,
3638 split out from on_deallocator_call and on_realloc_call, adding
3639 detection of the freed region.
3640 (malloc_state_machine::on_deallocator_call): Use it.
3641 (malloc_state_machine::on_realloc_call): Likewise.
3642 * sm.h (sm_context::get_old_program_state): New vfunc.
3644 2022-02-15 David Malcolm <dmalcolm@redhat.com>
3646 PR analyzer/104524
3647 * region-model-manager.cc
3648 (region_model_manager::maybe_fold_sub_svalue): Only call
3649 get_or_create_cast if type is non-NULL.
3651 2022-02-15 David Malcolm <dmalcolm@redhat.com>
3653 PR analyzer/102692
3654 * exploded-graph.h (impl_region_model_context::get_stmt): New.
3655 * region-model.cc: Include "gimple-ssa.h", "tree-phinodes.h",
3656 "tree-ssa-operands.h", and "ssa-iterators.h".
3657 (within_short_circuited_stmt_p): New.
3658 (region_model::check_for_poison): Don't warn about uninit values
3659 if within_short_circuited_stmt_p.
3660 * region-model.h (region_model_context::get_stmt): New vfunc.
3661 (noop_region_model_context::get_stmt): New.
3663 2022-02-11 David Malcolm <dmalcolm@redhat.com>
3665 PR analyzer/104274
3666 * region-model.cc (region_model::check_for_poison): Ignore
3667 uninitialized uses of empty types.
3669 2022-02-10 David Malcolm <dmalcolm@redhat.com>
3671 PR analyzer/98797
3672 * region-model-manager.cc
3673 (region_model_manager::maybe_fold_sub_svalue): Generalize getting
3674 individual chars of a STRING_CST from element_region to any
3675 subregion which is a concrete access of a single byte from its
3676 parent region.
3677 * region.cc (region::get_relative_concrete_byte_range): New.
3678 * region.h (region::get_relative_concrete_byte_range): New decl.
3680 2022-02-09 David Malcolm <dmalcolm@redhat.com>
3682 PR analyzer/104452
3683 * region-model.cc (selftest::test_bit_range_regions): New.
3684 (selftest::analyzer_region_model_cc_tests): Call it.
3685 * region.h (bit_range_region::key_t::hash): Fix hashing of m_bits
3686 to avoid using uninitialized data.
3688 2022-02-07 David Malcolm <dmalcolm@redhat.com>
3690 PR analyzer/104417
3691 * sm-taint.cc (tainted_allocation_size::tainted_allocation_size):
3692 Remove overzealous assertion.
3693 (tainted_allocation_size::emit): Likewise.
3694 (region_model::check_dynamic_size_for_taint): Likewise.
3696 2022-02-07 David Malcolm <dmalcolm@redhat.com>
3698 PR analyzer/103872
3699 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
3700 Reimplement in terms of a get_store_value followed by a set_value.
3702 2022-02-03 David Malcolm <dmalcolm@redhat.com>
3704 PR analyzer/104369
3705 * engine.cc (exploded_graph::process_node): Use the node for any
3706 diagnostics, avoiding ICE if a bifurcation update adds a
3707 saved_diagnostic, such as for a tainted realloc size.
3708 * region-model-impl-calls.cc
3709 (region_model::impl_call_realloc::success_no_move::update_model):
3710 Require the old pointer to be non-NULL to be able successfully
3711 grow in place. Use model->deref_rvalue rather than maybe_get_region
3712 to support the old pointer being symbolic.
3713 (region_model::impl_call_realloc::success_with_move::update_model):
3714 Likewise. Add a constraint that the new pointer != the old pointer.
3715 Use a sized_region when setting the value of the new region.
3716 Handle the case where we don't know the dynamic size of the old
3717 region by marking the new region as unknown.
3718 * sm-taint.cc (tainted_allocation_size::tainted_allocation_size):
3719 Update assertion to also allow for MEMSPACE_UNKNOWN.
3720 (tainted_allocation_size::emit): Likewise.
3721 (region_model::check_dynamic_size_for_taint): Likewise.
3723 2022-02-03 David Malcolm <dmalcolm@redhat.com>
3725 * region-model-impl-calls.cc (region_model::impl_call_calloc): Use
3726 a sized_region when calling zero_fill_region.
3728 2022-02-02 David Malcolm <dmalcolm@redhat.com>
3730 * region-model.cc (region_model::on_return): Replace usage of
3731 copy_region with get_rvalue/set_value pair.
3732 (region_model::pop_frame): Likewise.
3733 (selftest::test_compound_assignment): Likewise.
3734 * region-model.h (region_model::copy_region): Delete decl.
3735 * region.cc (region_model::copy_region): Delete.
3737 2022-02-02 David Malcolm <dmalcolm@redhat.com>
3739 * region.cc (region::calc_offset): Consolidate effectively
3740 identical cases.
3742 2022-02-02 David Malcolm <dmalcolm@redhat.com>
3744 * analyzer.h (class bit_range_region): New forward decl.
3745 * region-model-manager.cc (region_model_manager::get_bit_range):
3746 New.
3747 (region_model_manager::log_stats): Handle m_bit_range_regions.
3748 * region-model.cc (region_model::get_lvalue_1): Handle
3749 BIT_FIELD_REF.
3750 * region-model.h (region_model_manager::get_bit_range): New decl.
3751 (region_model_manager::m_bit_range_regions): New field.
3752 * region.cc (region::get_base_region): Handle RK_BIT_RANGE.
3753 (region::base_region_p): Likewise.
3754 (region::calc_offset): Likewise.
3755 (bit_range_region::dump_to_pp): New.
3756 (bit_range_region::get_byte_size): New.
3757 (bit_range_region::get_bit_size): New.
3758 (bit_range_region::get_byte_size_sval): New.
3759 (bit_range_region::get_relative_concrete_offset): New.
3760 * region.h (enum region_kind): Add RK_BIT_RANGE.
3761 (region::dyn_cast_bit_range_region): New vfunc.
3762 (class bit_range_region): New.
3763 (is_a_helper <const bit_range_region *>::test): New.
3764 (default_hash_traits<bit_range_region::key_t>): New.
3766 2022-02-02 David Malcolm <dmalcolm@redhat.com>
3768 PR analyzer/104270
3769 * region-model.cc (region_model::on_call_pre): Handle
3770 IFN_DEFERRED_INIT.
3772 2022-01-27 David Malcolm <dmalcolm@redhat.com>
3774 * checker-path.cc (event_kind_to_string): Handle
3775 EK_REGION_CREATION.
3776 (region_creation_event::region_creation_event): New.
3777 (region_creation_event::get_desc): New.
3778 (checker_path::add_region_creation_event): New.
3779 * checker-path.h (enum event_kind): Add EK_REGION_CREATION.
3780 (class region_creation_event): New subclass.
3781 (checker_path::add_region_creation_event): New decl.
3782 * diagnostic-manager.cc
3783 (diagnostic_manager::emit_saved_diagnostic): Pass NULL for new
3784 param to add_events_for_eedge when handling trailing eedge.
3785 (diagnostic_manager::build_emission_path): Create an interesting_t
3786 instance, allow the pending diagnostic to populate it, and pass it
3787 to the calls to add_events_for_eedge.
3788 (diagnostic_manager::add_events_for_eedge): Add "interest" param.
3789 Use it to add region_creation_events for on-stack regions created
3790 within at function entry, and when pertinent dynamically-sized
3791 regions are created.
3792 (diagnostic_manager::prune_for_sm_diagnostic): Add case for
3793 EK_REGION_CREATION.
3794 * diagnostic-manager.h (diagnostic_manager::add_events_for_eedge):
3795 Add "interest" param.
3796 * pending-diagnostic.cc: Include "selftest.h", "tristate.h",
3797 "analyzer/call-string.h", "analyzer/program-point.h",
3798 "analyzer/store.h", and "analyzer/region-model.h".
3799 (interesting_t::add_region_creation): New.
3800 (interesting_t::dump_to_pp): New.
3801 * pending-diagnostic.h (struct interesting_t): New.
3802 (pending_diagnostic::mark_interesting_stuff): New vfunc.
3803 * region-model.cc
3804 (poisoned_value_diagnostic::poisoned_value_diagnostic): Add
3805 (poisoned_value_diagnostic::operator==): Compare m_pkind and
3806 m_src_region fields.
3807 (poisoned_value_diagnostic::mark_interesting_stuff): New.
3808 (poisoned_value_diagnostic::m_src_region): New.
3809 (region_model::check_for_poison): Call
3810 get_region_for_poisoned_expr for uninit values and pass the resul
3811 to the diagnostic.
3812 (region_model::get_region_for_poisoned_expr): New.
3813 (region_model::deref_rvalue): Pass NULL for
3814 poisoned_value_diagnostic's src_region.
3815 * region-model.h (region_model::get_region_for_poisoned_expr): New
3816 decl.
3817 * region.h (frame_region::get_fndecl): New.
3819 2022-01-27 Martin Liska <mliska@suse.cz>
3821 PR analyzer/104247
3822 * constraint-manager.cc (bounded_ranges_manager::log_stats):
3823 Cast to long for format purpose.
3824 * region-model-manager.cc (log_uniq_map): Likewise.
3826 2022-01-26 David Malcolm <dmalcolm@redhat.com>
3828 PR analyzer/104224
3829 * region-model.cc (region_model::check_call_args): New.
3830 (region_model::on_call_pre): Call it when ignoring stdio builtins.
3831 * region-model.h (region_model::check_call_args): New decl
3833 2022-01-26 David Malcolm <dmalcolm@redhat.com>
3835 PR analyzer/94362
3836 * constraint-manager.cc (range::add_bound): Fix tests for
3837 discarding redundant constraints. Perform test for rejecting
3838 unsatisfiable constraints earlier so that they don't update
3839 the object on failure.
3840 (selftest::test_range): New.
3841 (selftest::test_constant_comparisons): Add test coverage for
3842 existing constraints becoming narrower until they are
3843 unsatisfiable.
3844 (selftest::run_constraint_manager_tests): Call test_range.
3846 2022-01-22 David Malcolm <dmalcolm@redhat.com>
3848 PR analyzer/104159
3849 * region-model-manager.cc
3850 (region_model_manager::get_or_create_cast): Bail out if the types
3851 are the same. Don't attempt to handle casts involving vector
3852 types.
3854 2022-01-20 David Malcolm <dmalcolm@redhat.com>
3856 PR analyzer/94362
3857 * constraint-manager.cc (bound::ensure_closed): Convert param to
3858 enum bound_kind.
3859 (range::constrained_to_single_element): Likewise.
3860 (range::add_bound): New.
3861 (constraint_manager::add_constraint): Handle SVAL + OFFSET
3862 compared to a constant.
3863 (constraint_manager::get_ec_bounds): Rewrite in terms of
3864 range::add_bound.
3865 (constraint_manager::eval_condition): Reject if range::add_bound
3866 fails.
3867 (selftest::test_constant_comparisons): Add test coverage for
3868 various impossible combinations of integer comparisons.
3869 * constraint-manager.h (enum bound_kind): New.
3870 (struct bound): Likewise.
3871 (bound::ensure_closed): Convert to param to enum bound_kind.
3872 (struct range): Convert to...
3873 (class range): ...this, making fields private.
3874 (range::add_bound): New decls.
3875 * region-model.cc (region_model::add_constraint): Fail if
3876 constraint_manager::add_constraint fails.
3878 2022-01-18 David Malcolm <dmalcolm@redhat.com>
3880 PR analyzer/104089
3881 * region-model-manager.cc
3882 (region_model_manager::get_or_create_constant_svalue): Assert that
3883 we have a CONSTANT_CLASS_P.
3884 (region_model_manager::maybe_fold_unaryop): Only fold a constant
3885 when fold_unary's result is a constant or a cast of a constant.
3887 2022-01-18 David Malcolm <dmalcolm@redhat.com>
3889 PR analyzer/104062
3890 * region-model-manager.cc
3891 (region_model_manager::maybe_fold_sub_svalue): Avoid casting to
3892 NULL type when folding access to repeated svalue.
3894 2022-01-17 Martin Liska <mliska@suse.cz>
3896 * analyzer.cc (is_special_named_call_p): Rename .c names to .cc.
3897 (is_named_call_p): Likewise.
3898 * region-model-asm.cc (deterministic_p): Likewise.
3899 * region.cc (field_region::get_relative_concrete_offset): Likewise.
3900 * sm-malloc.cc (method_p): Likewise.
3901 * supergraph.cc (superedge::dump_dot): Likewise.
3903 2022-01-14 David Malcolm <dmalcolm@redhat.com>
3905 * sm-taint.cc (taint_state_machine::combine_states): Handle combination
3906 of has_ub and has_lb.
3908 2022-01-14 David Malcolm <dmalcolm@redhat.com>
3910 PR analyzer/104029
3911 * sm-taint.cc (taint_state_machine::alt_get_inherited_state):
3912 Remove gcc_unreachable from default case for unary ops.
3914 2022-01-14 David Malcolm <dmalcolm@redhat.com>
3916 * engine.cc: Include "stringpool.h", "attribs.h", and
3917 "tree-dfa.h".
3918 (mark_params_as_tainted): New.
3919 (class tainted_args_function_custom_event): New.
3920 (class tainted_args_function_info): New.
3921 (exploded_graph::add_function_entry): Handle functions with
3922 "tainted_args" attribute.
3923 (class tainted_args_field_custom_event): New.
3924 (class tainted_args_callback_custom_event): New.
3925 (class tainted_args_call_info): New.
3926 (add_tainted_args_callback): New.
3927 (add_any_callbacks): New.
3928 (exploded_graph::build_initial_worklist): Likewise.
3929 (exploded_graph::build_initial_worklist): Find callbacks that are
3930 reachable from global initializers, calling add_any_callbacks on
3931 them.
3933 2022-01-12 David Malcolm <dmalcolm@redhat.com>
3935 PR analyzer/103940
3936 * engine.cc (impl_sm_context::impl_sm_context): Add
3937 "unknown_side_effects" param and use it to initialize
3938 new m_unknown_side_effects field.
3939 (impl_sm_context::unknown_side_effects_p): New.
3940 (impl_sm_context::m_unknown_side_effects): New.
3941 (exploded_node::on_stmt): Pass unknown_side_effects to sm_ctxt
3942 ctor.
3943 * sm-taint.cc: Include "stringpool.h" and "attribs.h".
3944 (tainted_size::tainted_size): Drop "dir" param.
3945 (tainted_size::get_kind): Drop "FINAL".
3946 (tainted_size::emit): Likewise.
3947 (tainted_size::m_dir): Drop unused field.
3948 (class tainted_access_attrib_size): New subclass.
3949 (taint_state_machine::on_stmt): Call check_for_tainted_size_arg on
3950 external functions with unknown side effects.
3951 (taint_state_machine::check_for_tainted_size_arg): New.
3952 (region_model::check_region_for_taint): Drop "dir" param from
3953 tainted_size ctor.
3954 * sm.h (sm_context::unknown_side_effects_p): New.
3956 2022-01-11 David Malcolm <dmalcolm@redhat.com>
3958 PR analyzer/102692
3959 * diagnostic-manager.cc
3960 (class auto_disable_complexity_checks): Rename to...
3961 (class auto_checking_feasibility): ...this, updating
3962 the calls accordingly.
3963 (epath_finder::explore_feasible_paths): Update for renaming.
3964 * region-model-manager.cc
3965 (region_model_manager::region_model_manager): Update for change from
3966 m_check_complexity to m_checking_feasibility.
3967 (region_model_manager::reject_if_too_complex): Likewise.
3968 (region_model_manager::get_or_create_unknown_svalue): Handle
3969 m_checking_feasibility.
3970 (region_model_manager::create_unique_svalue): New.
3971 (region_model_manager::maybe_fold_binop): Handle BIT_AND_EXPR and
3972 BIT_IOR_EXPRs on booleans where we know the result.
3973 * region-model.cc (test_binop_svalue_folding): Add test coverage
3974 for the above.
3975 * region-model.h (region_model_manager::create_unique_svalue): New
3976 decl.
3977 (region_model_manager::enable_complexity_check): Replace with...
3978 (region_model_manager::begin_checking_feasibility): ...this.
3979 (region_model_manager::disable_complexity_check): Replace with...
3980 (region_model_manager::end_checking_feasibility): ...this.
3981 (region_model_manager::m_check_complexity): Replace with...
3982 (region_model_manager::m_checking_feasibility): ...this.
3983 (region_model_manager::m_managed_dynamic_svalues): New field.
3985 2022-01-08 David Malcolm <dmalcolm@redhat.com>
3987 * engine.cc (impl_run_checkers): Pass logger to engine ctor.
3988 * region-model-manager.cc
3989 (region_model_manager::region_model_manager): Add logger param and
3990 use it to initialize m_logger.
3991 * region-model.cc (engine::engine): New.
3992 * region-model.h (region_model_manager::region_model_manager):
3993 Add logger param.
3994 (region_model_manager::get_logger): New.
3995 (region_model_manager::m_logger): New field.
3996 (engine::engine): New.
3997 * store.cc (store_manager::get_logger): New.
3998 (store::set_value): Log scope. Log when marking a cluster as
3999 unknown due to possible aliasing.
4000 * store.h (store_manager::get_logger): New decl.
4002 2022-01-08 David Malcolm <dmalcolm@redhat.com>
4004 * region-model-impl-calls.cc (cmp_decls): New.
4005 (cmp_decls_ptr_ptr): New.
4006 (region_model::impl_call_analyzer_dump_escaped): New.
4007 * region-model.cc (region_model::on_stmt_pre): Handle
4008 __analyzer_dump_escaped.
4009 * region-model.h (region_model::impl_call_analyzer_dump_escaped):
4010 New decl.
4011 * store.h (binding_cluster::get_base_region): New accessor.
4013 2022-01-08 David Malcolm <dmalcolm@redhat.com>
4015 * region.cc (region::is_named_decl_p): New.
4016 * region.h (region::is_named_decl_p): New decl.
4018 2022-01-06 David Malcolm <dmalcolm@redhat.com>
4020 PR analyzer/103546
4021 * store.cc (store::eval_alias_1): Refactor handling of decl
4022 regions, adding a test for may_be_aliased, rejecting those for
4023 which it returns false.
4025 2021-12-12 Jonathan Wakely <jwakely@redhat.com>
4027 * engine.cc: Define INCLUDE_MEMORY instead of INCLUDE_UNIQUE_PTR.
4029 2021-12-06 David Malcolm <dmalcolm@redhat.com>
4031 PR analyzer/103533
4032 * constraint-manager.cc (equiv_class::contains_non_constant_p):
4033 New.
4034 (constraint_manager::canonicalize): Call it when determining
4035 redundant ECs.
4036 (selftest::test_purging): New selftest.
4037 (selftest::run_constraint_manager_tests): Likewise.
4038 * constraint-manager.h (equiv_class::contains_non_constant_p):
4039 New decl.
4041 2021-12-01 David Malcolm <dmalcolm@redhat.com>
4043 PR analyzer/102471
4044 * region-model-reachability.cc (reachable_regions::handle_parm):
4045 Treat all svalues within a compound parm has reachable, and those
4046 wrapped in a cast.
4048 2021-11-29 David Malcolm <dmalcolm@redhat.com>
4050 PR analyzer/103217
4051 * store.cc (binding_cluster::can_merge_p): For the "key is bound"
4052 vs "key is not bound" merger case, check that the bound svalue
4053 is mergeable before merging it to "unknown", rejecting the merger
4054 otherwise.
4056 2021-11-19 David Malcolm <dmalcolm@redhat.com>
4058 PR analyzer/103217
4059 * engine.cc (exploded_graph::get_or_create_node): Pass in
4060 m_ext_state to program_state::can_merge_with_p.
4061 (exploded_graph::process_worklist): Likewise.
4062 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
4063 Likewise.
4064 (exploded_graph::process_node): Add missing call to detect_leaks
4065 when handling phi nodes.
4066 * program-state.cc (program_state::can_merge_with_p): Add
4067 "ext_state" param. Pass it and state ptrs to
4068 region_model::can_merge_with_p.
4069 (selftest::test_program_state_merging): Update for new ext_state
4070 param of program_state::can_merge_with_p.
4071 (selftest::test_program_state_merging_2): Likewise.
4072 * program-state.h (program_state::can_purge_p): Make const.
4073 (program_state::can_merge_with_p): Add "ext_state" param.
4074 * region-model.cc: Include "analyzer/program-state.h".
4075 (region_model::can_merge_with_p): Add params "ext_state",
4076 "state_a", and "state_b", use them when creating model_merger
4077 object.
4078 (model_merger::mergeable_svalue_p): New.
4079 * region-model.h (region_model::can_merge_with_p): Add params
4080 "ext_state", "state_a", and "state_b".
4081 (model_merger::model_merger) Likewise, initializing new fields.
4082 (model_merger::mergeable_svalue_p): New decl.
4083 (model_merger::m_ext_state): New field.
4084 (model_merger::m_state_a): New field.
4085 (model_merger::m_state_b): New field.
4086 * svalue.cc (svalue::can_merge_p): Call
4087 model_merger::mergeable_svalue_p on both states and reject the
4088 merger accordingly.
4090 2021-11-17 David Malcolm <dmalcolm@redhat.com>
4092 PR analyzer/102695
4093 * region-model-impl-calls.cc (region_model::impl_call_strchr): New.
4094 * region-model-manager.cc
4095 (region_model_manager::maybe_fold_unaryop): Simplify cast to
4096 pointer type of an existing pointer to a region.
4097 * region-model.cc (region_model::on_call_pre): Handle
4098 BUILT_IN_STRCHR and "strchr".
4099 (write_to_const_diagnostic::emit): Add auto_diagnostic_group. Add
4100 alternate wordings for functions and labels.
4101 (write_to_const_diagnostic::describe_final_event): Add alternate
4102 wordings for functions and labels.
4103 (region_model::check_for_writable_region): Handle RK_FUNCTION and
4104 RK_LABEL.
4105 * region-model.h (region_model::impl_call_strchr): New decl.
4107 2021-11-16 David Malcolm <dmalcolm@redhat.com>
4109 PR analyzer/102662
4110 * constraint-manager.cc (bounded_range::operator==): Require the
4111 types to be the same for equality.
4113 2021-11-13 David Malcolm <dmalcolm@redhat.com>
4115 * analyzer.opt (Wanalyzer-tainted-allocation-size): New.
4116 (Wanalyzer-tainted-divisor): New.
4117 (Wanalyzer-tainted-offset): New.
4118 (Wanalyzer-tainted-size): New.
4119 * engine.cc (impl_region_model_context::get_taint_map): New.
4120 * exploded-graph.h (impl_region_model_context::get_taint_map):
4121 New decl.
4122 * program-state.cc (sm_state_map::get_state): Call
4123 alt_get_inherited_state.
4124 (sm_state_map::impl_set_state): Modify states within
4125 compound svalues.
4126 (program_state::impl_call_analyzer_dump_state): Undo casts.
4127 (selftest::test_program_state_1): Update for new context param of
4128 create_region_for_heap_alloc.
4129 (selftest::test_program_state_merging): Likewise.
4130 * region-model-impl-calls.cc (region_model::impl_call_alloca):
4131 Likewise.
4132 (region_model::impl_call_calloc): Likewise.
4133 (region_model::impl_call_malloc): Likewise.
4134 (region_model::impl_call_operator_new): Likewise.
4135 (region_model::impl_call_realloc): Likewise.
4136 * region-model.cc (region_model::check_region_access): Call
4137 check_region_for_taint.
4138 (region_model::get_representative_path_var_1): Handle binops.
4139 (region_model::create_region_for_heap_alloc): Add "ctxt" param and
4140 pass it to set_dynamic_extents.
4141 (region_model::create_region_for_alloca): Likewise.
4142 (region_model::set_dynamic_extents): Add "ctxt" param and use it
4143 to call check_dynamic_size_for_taint.
4144 (selftest::test_state_merging): Update for new context param of
4145 create_region_for_heap_alloc.
4146 (selftest::test_malloc_constraints): Likewise.
4147 (selftest::test_malloc): Likewise.
4148 (selftest::test_alloca): Likewise for create_region_for_alloca.
4149 * region-model.h (region_model::create_region_for_heap_alloc): Add
4150 "ctxt" param.
4151 (region_model::create_region_for_alloca): Likewise.
4152 (region_model::set_dynamic_extents): Likewise.
4153 (region_model::check_dynamic_size_for_taint): New decl.
4154 (region_model::check_region_for_taint): New decl.
4155 (region_model_context::get_taint_map): New vfunc.
4156 (noop_region_model_context::get_taint_map): New.
4157 * sm-taint.cc: Remove include of "diagnostic-event-id.h"; add
4158 includes of "gimple-iterator.h", "tristate.h", "selftest.h",
4159 "ordered-hash-map.h", "cgraph.h", "cfg.h", "digraph.h",
4160 "analyzer/supergraph.h", "analyzer/call-string.h",
4161 "analyzer/program-point.h", "analyzer/store.h",
4162 "analyzer/region-model.h", and "analyzer/program-state.h".
4163 (enum bounds): Move to top of file.
4164 (class taint_diagnostic): New.
4165 (class tainted_array_index): Convert to subclass of taint_diagnostic.
4166 (tainted_array_index::emit): Add CWE-129. Reword warning to use
4167 "attacker-controlled" rather than "tainted".
4168 (tainted_array_index::describe_state_change): Move to
4169 taint_diagnostic::describe_state_change.
4170 (tainted_array_index::describe_final_event): Reword to use
4171 "attacker-controlled" rather than "tainted".
4172 (class tainted_offset): New.
4173 (class tainted_size): New.
4174 (class tainted_divisor): New.
4175 (class tainted_allocation_size): New.
4176 (taint_state_machine::alt_get_inherited_state): New.
4177 (taint_state_machine::on_stmt): In assignment handling, remove
4178 ARRAY_REF handling in favor of check_region_for_taint. Add
4179 detection of tainted divisors.
4180 (taint_state_machine::get_taint): New.
4181 (taint_state_machine::combine_states): New.
4182 (region_model::check_region_for_taint): New.
4183 (region_model::check_dynamic_size_for_taint): New.
4184 * sm.h (state_machine::alt_get_inherited_state): New.
4186 2021-11-12 David Malcolm <dmalcolm@redhat.com>
4188 * engine.cc (exploded_node::on_stmt_pre): Return when handling
4189 "__analyzer_dump_state".
4191 2021-11-11 Richard Biener <rguenther@suse.de>
4193 * supergraph.cc: Include bitmap.h.
4195 2021-11-04 David Malcolm <dmalcolm@redhat.com>
4197 * program-state.cc (sm_state_map::dump): Use default_tree_printer
4198 as format decoder.
4200 2021-09-16 Maxim Blinov <maxim.blinov@embecosm.com>
4202 PR bootstrap/102242
4203 * engine.cc (INCLUDE_UNIQUE_PTR): Define.
4205 2021-09-08 David Malcolm <dmalcolm@redhat.com>
4207 PR analyzer/102225
4208 * analyzer.h (compat_types_p): New decl.
4209 * constraint-manager.cc
4210 (constraint_manager::get_or_add_equiv_class): Guard against NULL
4211 type when checking for pointer types.
4212 * region-model-impl-calls.cc (region_model::impl_call_realloc):
4213 Guard against NULL lhs type/region. Guard against the size value
4214 not being of a compatible type for dynamic extents.
4215 * region-model.cc (compat_types_p): Make non-static.
4217 2021-08-30 David Malcolm <dmalcolm@redhat.com>
4219 PR analyzer/99260
4220 * analyzer.h (class custom_edge_info): New class, adapted from
4221 exploded_edge::custom_info_t. Make member functions const.
4222 Make update_model return bool, converting edge param from
4223 reference to a pointer, and adding a ctxt param.
4224 (class path_context): New class.
4225 * call-info.cc: New file.
4226 * call-info.h: New file.
4227 * engine.cc: Include "analyzer/call-info.h" and <memory>.
4228 (impl_region_model_context::impl_region_model_context): Update for
4229 new m_path_ctxt field.
4230 (impl_region_model_context::bifurcate): New.
4231 (impl_region_model_context::terminate_path): New.
4232 (impl_region_model_context::get_malloc_map): New.
4233 (impl_sm_context::impl_sm_context): Update for new m_path_ctxt
4234 field.
4235 (impl_sm_context::get_fndecl_for_call): Likewise.
4236 (impl_sm_context::set_next_state): Likewise.
4237 (impl_sm_context::warn): Likewise.
4238 (impl_sm_context::is_zero_assignment): Likewise.
4239 (impl_sm_context::get_path_context): New.
4240 (impl_sm_context::m_path_ctxt): New.
4241 (impl_region_model_context::on_condition): Update for new
4242 path_ctxt param. Handle m_enode_for_diag being NULL.
4243 (impl_region_model_context::on_phi): Update for new path_ctxt
4244 param.
4245 (exploded_node::on_stmt): Add path_ctxt param, updating ctor calls
4246 to use it as necessary. Use it to bail out after sm-handling,
4247 if needed.
4248 (exploded_node::detect_leaks): Update for new path_ctxt param.
4249 (dynamic_call_info_t::update_model): Update for conversion of
4250 exploded_edge::custom_info_t to custom_edge_info.
4251 (dynamic_call_info_t::add_events_to_path): Likewise.
4252 (rewind_info_t::update_model): Likewise.
4253 (rewind_info_t::add_events_to_path): Likewise.
4254 (exploded_edge::exploded_edge): Likewise.
4255 (exploded_graph::add_edge): Likewise.
4256 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
4257 Update for new path_ctxt param.
4258 (class impl_path_context): New.
4259 (exploded_graph::process_node): Update for new path_ctxt param.
4260 Create an impl_path_context and pass it to exploded_node::on_stmt.
4261 Use it to terminate iterating stmts if terminate_path is called
4262 on it. After processing a run of stmts, query path_ctxt to
4263 potentially terminate the analysis path, and/or to "bifurcate" the
4264 analysis into multiple additional paths.
4265 (feasibility_state::maybe_update_for_edge): Update for new
4266 update_model ctxt param.
4267 * exploded-graph.h
4268 (impl_region_model_context::impl_region_model_context): Add
4269 path_ctxt param.
4270 (impl_region_model_context::bifurcate): New.
4271 (impl_region_model_context::terminate_path): New
4272 (impl_region_model_context::get_ext_state): New.
4273 (impl_region_model_context::get_malloc_map): New.
4274 (impl_region_model_context::m_path_ctxt): New field.
4275 (exploded_node::on_stmt): Add path_ctxt param.
4276 (class exploded_edge::custom_info_t): Move to analyzer.h, renaming
4277 to custom_edge_info, and making the changes as noted in analyzer.h
4278 above.
4279 (exploded_edge::exploded_edge): Update for these changes to
4280 exploded_edge::custom_info_t.
4281 (exploded_edge::m_custom_info): Likewise.
4282 (class dynamic_call_info_t): Likewise.
4283 (class rewind_info_t): Likewise.
4284 (exploded_graph::add_edge): Likewise.
4285 * program-state.cc (program_state::on_edge): Update for new
4286 path_ctxt param.
4287 (program_state::push_call): Likewise.
4288 (program_state::returning_call): Likewise.
4289 (program_state::prune_for_point): Likewise.
4290 * region-model-impl-calls.cc: Include "analyzer/call-info.h".
4291 (call_details::get_fndecl_for_call): New.
4292 (region_model::impl_call_realloc): Reimplement.
4293 * region-model.cc (region_model::on_call_pre): Move call to
4294 impl_call_realloc to...
4295 (region_model::on_call_post): ...here. Consolidate creation
4296 of call_details instance.
4297 (noop_region_model_context::bifurcate): New.
4298 (noop_region_model_context::terminate_path): New.
4299 * region-model.h (call_details::get_call_stmt): New.
4300 (call_details::get_fndecl_for_call): New.
4301 (region_model::on_realloc_with_move): New.
4302 (region_model_context::bifurcate): New.
4303 (region_model_context::terminate_path): New.
4304 (region_model_context::get_ext_state): New.
4305 (region_model_context::get_malloc_map): New.
4306 (noop_region_model_context::bifurcate): New.
4307 (noop_region_model_context::terminate_path): New.
4308 (noop_region_model_context::get_ext_state): New.
4309 (noop_region_model_context::get_malloc_map): New.
4310 * sm-malloc.cc: Include "analyzer/program-state.h".
4311 (malloc_state_machine::on_realloc_call): Reimplement.
4312 (malloc_state_machine::on_realloc_with_move): New.
4313 (region_model::on_realloc_with_move): New.
4314 * sm-signal.cc (class signal_delivery_edge_info_t): Update for
4315 conversion from exploded_edge::custom_info_t to custom_edge_info.
4316 * sm.h (sm_context::get_path_context): New.
4317 * svalue.cc (svalue::maybe_get_constant): Call
4318 unwrap_any_unmergeable.
4320 2021-08-25 Ankur Saini <arsenic@sourceware.org>
4322 PR analyzer/101980
4323 * engine.cc (exploded_graph::maybe_create_dynamic_call): Don't create
4324 calls if max recursion limit is reached.
4326 2021-08-23 David Malcolm <dmalcolm@redhat.com>
4328 * analyzer.h (struct rejected_constraint): Convert to...
4329 (class rejected_constraint): ...this.
4330 (class bounded_ranges): New forward decl.
4331 (class bounded_ranges_manager): New forward decl.
4332 * constraint-manager.cc: Include "analyzer/analyzer-logging.h" and
4333 "tree-pretty-print.h".
4334 (can_plus_one_p): New.
4335 (plus_one): New.
4336 (can_minus_one_p): New.
4337 (minus_one): New.
4338 (bounded_range::bounded_range): New.
4339 (dump_cst): New.
4340 (bounded_range::dump_to_pp): New.
4341 (bounded_range::dump): New.
4342 (bounded_range::to_json): New.
4343 (bounded_range::set_json_attr): New.
4344 (bounded_range::contains_p): New.
4345 (bounded_range::intersects_p): New.
4346 (bounded_range::operator==): New.
4347 (bounded_range::cmp): New.
4348 (bounded_ranges::bounded_ranges): New.
4349 (bounded_ranges::bounded_ranges): New.
4350 (bounded_ranges::bounded_ranges): New.
4351 (bounded_ranges::canonicalize): New.
4352 (bounded_ranges::validate): New.
4353 (bounded_ranges::operator==): New.
4354 (bounded_ranges::dump_to_pp): New.
4355 (bounded_ranges::dump): New.
4356 (bounded_ranges::to_json): New.
4357 (bounded_ranges::eval_condition): New.
4358 (bounded_ranges::contain_p): New.
4359 (bounded_ranges::cmp): New.
4360 (bounded_ranges_manager::~bounded_ranges_manager): New.
4361 (bounded_ranges_manager::get_or_create_empty): New.
4362 (bounded_ranges_manager::get_or_create_point): New.
4363 (bounded_ranges_manager::get_or_create_range): New.
4364 (bounded_ranges_manager::get_or_create_union): New.
4365 (bounded_ranges_manager::get_or_create_intersection): New.
4366 (bounded_ranges_manager::get_or_create_inverse): New.
4367 (bounded_ranges_manager::consolidate): New.
4368 (bounded_ranges_manager::get_or_create_ranges_for_switch): New.
4369 (bounded_ranges_manager::create_ranges_for_switch): New.
4370 (bounded_ranges_manager::make_case_label_ranges): New.
4371 (bounded_ranges_manager::log_stats): New.
4372 (bounded_ranges_constraint::print): New.
4373 (bounded_ranges_constraint::to_json): New.
4374 (bounded_ranges_constraint::operator==): New.
4375 (bounded_ranges_constraint::add_to_hash): New.
4376 (constraint_manager::constraint_manager): Update for new field
4377 m_bounded_ranges_constraints.
4378 (constraint_manager::operator=): Likewise.
4379 (constraint_manager::hash): Likewise.
4380 (constraint_manager::operator==): Likewise.
4381 (constraint_manager::print): Likewise.
4382 (constraint_manager::dump_to_pp): Likewise.
4383 (constraint_manager::to_json): Likewise.
4384 (constraint_manager::add_unknown_constraint): Update the lhs_ec_id
4385 if necessary in existing constraints when combining equivalence
4386 classes. Add similar code for handling
4387 m_bounded_ranges_constraints.
4388 (constraint_manager::add_constraint_internal): Add comment.
4389 (constraint_manager::add_bounded_ranges): New.
4390 (constraint_manager::eval_condition): Use new field
4391 m_bounded_ranges_constraints.
4392 (constraint_manager::purge): Update bounded_ranges_constraint
4393 instances.
4394 (constraint_manager::canonicalize): Update for new field.
4395 (merger_fact_visitor::on_ranges): New.
4396 (constraint_manager::for_each_fact): Use new field
4397 m_bounded_ranges_constraints.
4398 (constraint_manager::validate): Fix off-by-one error needed due
4399 to bug fixed above in add_unknown_constraint. Validate the EC IDs
4400 in m_bounded_ranges_constraints.
4401 (constraint_manager::get_range_manager): New.
4402 (selftest::assert_dump_bounded_range_eq): New.
4403 (ASSERT_DUMP_BOUNDED_RANGE_EQ): New.
4404 (selftest::test_bounded_range): New.
4405 (selftest::assert_dump_bounded_ranges_eq): New.
4406 (ASSERT_DUMP_BOUNDED_RANGES_EQ): New.
4407 (selftest::test_bounded_ranges): New.
4408 (selftest::run_constraint_manager_tests): Call the new selftests.
4409 * constraint-manager.h (struct bounded_range): New.
4410 (struct bounded_ranges): New.
4411 (template <> struct default_hash_traits<bounded_ranges::key_t>): New.
4412 (class bounded_ranges_manager): New.
4413 (fact_visitor::on_ranges): New pure virtual function.
4414 (class bounded_ranges_constraint): New.
4415 (constraint_manager::add_bounded_ranges): New decl.
4416 (constraint_manager::get_range_manager): New decl.
4417 (constraint_manager::m_bounded_ranges_constraints): New field.
4418 * diagnostic-manager.cc (epath_finder::process_worklist_item):
4419 Transfer ownership of rc to add_feasibility_problem.
4420 * engine.cc (feasibility_problem::dump_to_pp): Use get_model.
4421 * feasible-graph.cc (infeasible_node::dump_dot): Update for
4422 conversion of m_rc to a pointer.
4423 (feasible_graph::add_feasibility_problem): Pass RC by pointer and
4424 take ownership.
4425 * feasible-graph.h (infeasible_node::infeasible_node): Pass RC by
4426 pointer and take ownership.
4427 (infeasible_node::~infeasible_node): New.
4428 (infeasible_node::m_rc): Convert to a pointer.
4429 (feasible_graph::add_feasibility_problem): Pass RC by pointer and
4430 take ownership.
4431 * region-model-manager.cc: Include
4432 "analyzer/constraint-manager.h".
4433 (region_model_manager::region_model_manager): Initializer new
4434 field m_range_mgr.
4435 (region_model_manager::~region_model_manager): Delete it.
4436 (region_model_manager::log_stats): Call log_stats on it.
4437 * region-model.cc (region_model::add_constraint): Use new subclass
4438 rejected_op_constraint.
4439 (region_model::apply_constraints_for_gswitch): Reimplement using
4440 bounded_ranges_manager.
4441 (rejected_constraint::dump_to_pp): Convert to...
4442 (rejected_op_constraint::dump_to_pp): ...this.
4443 (rejected_ranges_constraint::dump_to_pp): New.
4444 * region-model.h (struct purge_stats): Add field
4445 m_num_bounded_ranges_constraints.
4446 (region_model_manager::get_range_manager): New.
4447 (region_model_manager::m_range_mgr): New.
4448 (region_model::get_range_manager): New.
4449 (struct rejected_constraint): Split into...
4450 (class rejected_constraint):...this new abstract base class,
4451 and...
4452 (class rejected_op_constraint): ...this new concrete subclass.
4453 (class rejected_ranges_constraint): New.
4454 * supergraph.cc: Include "tree-cfg.h".
4455 (supergraph::supergraph): Drop idx param from add_cfg_edge.
4456 (supergraph::add_cfg_edge): Drop idx param.
4457 (switch_cfg_superedge::switch_cfg_superedge): Move here from
4458 header. Populate m_case_labels with all cases which go to DST.
4459 (switch_cfg_superedge::dump_label_to_pp): Reimplement to use
4460 m_case_labels.
4461 (switch_cfg_superedge::get_case_label): Delete.
4462 * supergraph.h (supergraphadd_cfg_edge): Drop "idx" param.
4463 (switch_cfg_superedge::switch_cfg_superedge): Drop idx param and
4464 move implementation to supergraph.cc.
4465 (switch_cfg_superedge::get_case_label): Delete.
4466 (switch_cfg_superedge::get_case_labels): New.
4467 (switch_cfg_superedge::m_idx): Delete.
4468 (switch_cfg_superedge::m_case_labels): New field.
4470 2021-08-23 David Malcolm <dmalcolm@redhat.com>
4472 PR analyzer/101875
4473 * sm-file.cc (file_diagnostic::describe_state_change): Handle
4474 change.m_expr being NULL.
4476 2021-08-23 David Malcolm <dmalcolm@redhat.com>
4478 PR analyzer/101837
4479 * analyzer.cc (maybe_reconstruct_from_def_stmt): Bail if fn is
4480 NULL, and assert that it's non-NULL before passing it to
4481 build_call_array_loc.
4483 2021-08-23 David Malcolm <dmalcolm@redhat.com>
4485 PR analyzer/101962
4486 * region-model.cc (region_model::eval_condition_without_cm):
4487 Refactor comparison against zero, adding a check for
4488 POINTER_PLUS_EXPR of non-NULL.
4490 2021-08-23 David Malcolm <dmalcolm@redhat.com>
4492 * store.cc (bit_range::intersects_p): New overload.
4493 (bit_range::operator-): New.
4494 (binding_cluster::maybe_get_compound_binding): Handle the partial
4495 overlap case.
4496 (selftest::test_bit_range_intersects_p): Add test coverage for
4497 new overload of bit_range::intersects_p.
4498 * store.h (bit_range::intersects_p): New overload.
4499 (bit_range::operator-): New.
4501 2021-08-23 Ankur Saini <arsenic@sourceware.org>
4503 PR analyzer/102020
4504 * diagnostic-manager.cc
4505 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Fix typo.
4507 2021-08-21 Ankur Saini <arsenic@sourceware.org>
4509 PR analyzer/101980
4510 * diagnostic-manager.cc
4511 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Use
4512 caller_model only when the supergraph_edge doesn't exixt.
4513 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
4514 Likewise.
4515 * engine.cc (exploded_graph::create_dynamic_call): Rename to...
4516 (exploded_graph::maybe_create_dynamic_call): ...this, return call
4517 creation status.
4518 (exploded_graph::process_node): Handle calls which were not dynamically
4519 discovered.
4520 * exploded-graph.h (exploded_graph::create_dynamic_call): Rename to...
4521 (exploded_graph::maybe_create_dynamic_call): ...this.
4522 * region-model.cc (region_model::update_for_gcall): New param, use it
4523 to push call to frame.
4524 (region_model::update_for_call_superedge): Pass callee function to
4525 update_for_gcall.
4526 * region-model.h (region_model::update_for_gcall): New param.
4528 2021-08-18 Ankur Saini <arsenic@sourceware.org>
4530 PR analyzer/97114
4531 * region-model.cc (region_model::get_rvalue_1): Add case for
4532 OBJ_TYPE_REF.
4534 2021-08-18 Ankur Saini <arsenic@sourceware.org>
4536 PR analyzer/100546
4537 * analysis-plan.cc (analysis_plan::use_summary_p): Don't use call
4538 summaries if there is no callgraph edge
4539 * checker-path.cc (call_event::call_event): Handle calls events that
4540 are not represented by a supergraph call edge
4541 (return_event::return_event): Likewise.
4542 (call_event::get_desc): Work with new call_event structure.
4543 (return_event::get_desc): Likeise.
4544 * checker-path.h (call_event::m_src_snode): New field.
4545 (call_event::m_dest_snode): New field.
4546 (return_event::m_src_snode): New field.
4547 (return_event::m_dest_snode): New field.
4548 * diagnostic-manager.cc
4549 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>:
4550 Refactor to work with edges without callgraph edge.
4551 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
4552 Likewise.
4553 * engine.cc (dynamic_call_info_t::update_model): New function.
4554 (dynamic_call_info_t::add_events_to_path): New function.
4555 (exploded_graph::create_dynamic_call): New function.
4556 (exploded_graph::process_node): Work with dynamically discovered calls.
4557 * exploded-graph.h (class dynamic_call_info_t): New class.
4558 (exploded_graph::create_dynamic_call): New decl.
4559 * program-point.cc (program_point::push_to_call_stack): New function.
4560 (program_point::pop_from_call_stack): New function.
4561 * program-point.h (program_point::push_to_call_stack): New decl.
4562 (program_point::pop_from_call_stack): New decl.
4563 * program-state.cc (program_state::push_call): New function.
4564 (program_state::returning_call): New function.
4565 * program-state.h (program_state::push_call): New decl.
4566 (program_state::returning_call): New decl.
4567 * region-model.cc (region_model::update_for_gcall) New function.
4568 (region_model::update_for_return_gcall): New function.
4569 (egion_model::update_for_call_superedge): Get the underlying gcall and
4570 update for gcall.
4571 (region_model::update_for_return_superedge): Likewise.
4572 * region-model.h (region_model::update_for_gcall): New decl.
4573 (region_model::update_for_return_gcall): New decl.
4574 * state-purge.cc (state_purge_per_ssa_name::process_point): Update to
4575 work with calls without underlying cgraph edge.
4576 * supergraph.cc (supergraph::supergraph) Split snodes at every callsite.
4577 * supergraph.h (supernode::get_returning_call) New accessor.
4579 2021-08-04 David Malcolm <dmalcolm@redhat.com>
4581 PR analyzer/101570
4582 * analyzer.cc (maybe_reconstruct_from_def_stmt): Add GIMPLE_ASM
4583 case.
4584 * analyzer.h (class asm_output_svalue): New forward decl.
4585 (class reachable_regions): New forward decl.
4586 * complexity.cc (complexity::from_vec_svalue): New.
4587 * complexity.h (complexity::from_vec_svalue): New decl.
4588 * engine.cc (feasibility_state::maybe_update_for_edge): Handle
4589 asm stmts by calling on_asm_stmt.
4590 * region-model-asm.cc: New file.
4591 * region-model-manager.cc
4592 (region_model_manager::maybe_fold_asm_output_svalue): New.
4593 (region_model_manager::get_or_create_asm_output_svalue): New.
4594 (region_model_manager::log_stats): Log m_asm_output_values_map.
4595 * region-model.cc (region_model::on_stmt_pre): Handle GIMPLE_ASM.
4596 * region-model.h (visitor::visit_asm_output_svalue): New.
4597 (region_model_manager::get_or_create_asm_output_svalue): New decl.
4598 (region_model_manager::maybe_fold_asm_output_svalue): New decl.
4599 (region_model_manager::asm_output_values_map_t): New typedef.
4600 (region_model_manager::m_asm_output_values_map): New field.
4601 (region_model::on_asm_stmt): New.
4602 * store.cc (binding_cluster::on_asm): New.
4603 * store.h (binding_cluster::on_asm): New decl.
4604 * svalue.cc (svalue::cmp_ptr): Handle SK_ASM_OUTPUT.
4605 (asm_output_svalue::dump_to_pp): New.
4606 (asm_output_svalue::dump_input): New.
4607 (asm_output_svalue::input_idx_to_asm_idx): New.
4608 (asm_output_svalue::accept): New.
4609 * svalue.h (enum svalue_kind): Add SK_ASM_OUTPUT.
4610 (svalue::dyn_cast_asm_output_svalue): New.
4611 (class asm_output_svalue): New.
4612 (is_a_helper <const asm_output_svalue *>::test): New.
4613 (struct default_hash_traits<asm_output_svalue::key_t>): New.
4615 2021-08-03 Jakub Jelinek <jakub@redhat.com>
4617 PR analyzer/101721
4618 * sm-malloc.cc (known_allocator_p): Only check DECL_FUNCTION_CODE on
4619 BUILT_IN_NORMAL builtins.
4621 2021-07-29 Ankur Saini <arsenic@sourceware.org>
4623 * call-string.cc (call_string::element_t::operator==): New operator.
4624 (call_String::element_t::operator!=): New operator.
4625 (call_string::element_t::get_caller_function): New function.
4626 (call_string::element_t::get_callee_function): New function.
4627 (call_string::call_string): Refactor to Initialise m_elements.
4628 (call_string::operator=): Refactor to work with m_elements.
4629 (call_string::operator==): Likewise.
4630 (call_string::to_json): Likewise.
4631 (call_string::hash): Refactor to hash e.m_caller.
4632 (call_string::push_call): Refactor to work with m_elements.
4633 (call_string::push_call): New overload to push call via supernodes.
4634 (call_string::pop): Refactor to work with m_elements.
4635 (call_string::calc_recursion_depth): Likewise.
4636 (call_string::cmp): Likewise.
4637 (call_string::validate): Likewise.
4638 (call_string::operator[]): Likewise.
4639 * call-string.h (class supernode): New forward decl.
4640 (struct call_string::element_t): New struct.
4641 (call_string::call_string): Refactor to initialise m_elements.
4642 (call_string::bool empty_p): Refactor to work with m_elements.
4643 (call_string::get_callee_node): New decl.
4644 (call_string::get_caller_node): New decl.
4645 (m_elements): Replaces m_return_edges.
4646 * program-point.cc (program_point::get_function_at_depth): Refactor to
4647 work with new call-string format.
4648 (program_point::validate): Likewise.
4649 (program_point::on_edge): Likewise.
4651 2021-07-28 David Malcolm <dmalcolm@redhat.com>
4653 * region-model.cc (region_model::on_call_pre): Treat
4654 IFN_UBSAN_BOUNDS, BUILT_IN_STACK_SAVE, and BUILT_IN_STACK_RESTORE
4655 as no-ops, rather than handling them as unknown functions.
4657 2021-07-28 David Malcolm <dmalcolm@redhat.com>
4659 * region-model-impl-calls.cc (region_model::impl_call_alloca):
4660 Drop redundant return value.
4661 (region_model::impl_call_builtin_expect): Likewise.
4662 (region_model::impl_call_calloc): Likewise.
4663 (region_model::impl_call_malloc): Likewise.
4664 (region_model::impl_call_memset): Likewise.
4665 (region_model::impl_call_operator_new): Likewise.
4666 (region_model::impl_call_operator_delete): Likewise.
4667 (region_model::impl_call_strlen): Likewise.
4668 * region-model.cc (region_model::on_call_pre): Fix return value of
4669 known functions that don't have unknown side-effects.
4670 * region-model.h (region_model::impl_call_alloca): Drop redundant
4671 return value.
4672 (region_model::impl_call_builtin_expect): Likewise.
4673 (region_model::impl_call_calloc): Likewise.
4674 (region_model::impl_call_malloc): Likewise.
4675 (region_model::impl_call_memset): Likewise.
4676 (region_model::impl_call_strlen): Likewise.
4677 (region_model::impl_call_operator_new): Likewise.
4678 (region_model::impl_call_operator_delete): Likewise.
4680 2021-07-28 Siddhesh Poyarekar <siddhesh@gotplt.org>
4682 * analyzer.cc (is_named_call_p, is_std_named_call_p): Make
4683 first argument a const_tree.
4684 * analyzer.h (is_named_call_p, -s_std_named_call_p): Likewise.
4685 * sm-malloc.cc (known_allocator_p): New function.
4686 (malloc_state_machine::on_stmt): Use it.
4688 2021-07-28 Siddhesh Poyarekar <siddhesh@gotplt.org>
4690 * sm-malloc.cc
4691 (malloc_state_machine::get_or_create_deallocator): Recognize
4692 __builtin_free.
4694 2021-07-26 David Malcolm <dmalcolm@redhat.com>
4696 * region-model.cc (region_model::on_call_pre): Always set conjured
4697 LHS, not just for SSA names.
4699 2021-07-23 David Malcolm <dmalcolm@redhat.com>
4701 * diagnostic-manager.cc
4702 (class auto_disable_complexity_checks): New.
4703 (epath_finder::explore_feasible_paths): Use it to disable
4704 complexity checks whilst processing the worklist.
4705 * region-model-manager.cc
4706 (region_model_manager::region_model_manager): Initialize
4707 m_check_complexity.
4708 (region_model_manager::reject_if_too_complex): Bail if
4709 m_check_complexity is false.
4710 * region-model.h
4711 (region_model_manager::enable_complexity_check): New.
4712 (region_model_manager::disable_complexity_check): New.
4713 (region_model_manager::m_check_complexity): New.
4715 2021-07-21 David Malcolm <dmalcolm@redhat.com>
4717 PR analyzer/101547
4718 * sm-file.cc (file_leak::emit): Handle m_arg being NULL.
4719 (file_leak::describe_final_event): Handle ev.m_expr being NULL.
4721 2021-07-21 David Malcolm <dmalcolm@redhat.com>
4723 PR analyzer/101522
4724 * store.cc (binding_cluster::purge_state_involving): Don't change
4725 m_map whilst iterating through it.
4727 2021-07-21 David Malcolm <dmalcolm@redhat.com>
4729 * region-model.cc (region_model::handle_phi): Add "old_state"
4730 param and use it.
4731 (region_model::update_for_phis): Update so that all of the phi
4732 stmts are effectively handled simultaneously, rather than in
4733 order.
4734 * region-model.h (region_model::handle_phi): Add "old_state"
4735 param.
4736 * state-purge.cc (self_referential_phi_p): Replace with...
4737 (name_used_by_phis_p): ...this new function.
4738 (state_purge_per_ssa_name::process_point): Update to use the
4739 above, so that all phi stmts at a basic block are effectively
4740 considered simultaneously, and only consider the phi arguments for
4741 the pertinent in-edge.
4742 * supergraph.cc (cfg_superedge::get_phi_arg_idx): New.
4743 (cfg_superedge::get_phi_arg): Use the above.
4744 * supergraph.h (cfg_superedge::get_phi_arg_idx): New decl.
4746 2021-07-21 David Malcolm <dmalcolm@redhat.com>
4748 * state-purge.cc (state_purge_annotator::add_node_annotations):
4749 Rather than erroneously always using the NULL in-edge, determine
4750 each relevant in-edge, and print the appropriate data for each
4751 in-edge. Use print_needed to print the data as comma-separated
4752 lists of SSA names.
4753 (print_vec_of_names): Add "within_table" param and use it.
4754 (state_purge_annotator::add_stmt_annotations): Factor out
4755 collation and printing code into...
4756 (state_purge_annotator::print_needed): ...this new function.
4757 * state-purge.h (state_purge_annotator::print_needed): New decl.
4759 2021-07-21 David Malcolm <dmalcolm@redhat.com>
4761 * program-point.cc (function_point::print): Show src BB index at
4762 BEFORE_SUPERNODE.
4764 2021-07-21 David Malcolm <dmalcolm@redhat.com>
4766 * svalue.cc (infix_p): New.
4767 (binop_svalue::dump_to_pp): Use it to print MIN_EXPR and MAX_EXPR
4768 in prefix form, rather than infix.
4770 2021-07-19 David Malcolm <dmalcolm@redhat.com>
4772 PR analyzer/101503
4773 * constraint-manager.cc (constraint_manager::add_constraint): Use
4774 can_have_associated_state_p rather than testing for unknown.
4775 (constraint_manager::get_or_add_equiv_class): Likewise.
4776 * program-state.cc (sm_state_map::set_state): Likewise.
4777 (sm_state_map::impl_set_state): Add assertion.
4778 * region-model-manager.cc
4779 (region_model_manager::maybe_fold_unaryop): Handle poisoned
4780 values.
4781 (region_model_manager::maybe_fold_binop): Move handling of unknown
4782 values...
4783 (region_model_manager::get_or_create_binop): ...to here, and
4784 generalize to use can_have_associated_state_p.
4785 (region_model_manager::maybe_fold_sub_svalue): Use
4786 can_have_associated_state_p rather than testing for unknown.
4787 (region_model_manager::maybe_fold_repeated_svalue): Use unknown
4788 when the size or repeated value is "unknown"/"poisoned".
4789 * region-model.cc (region_model::purge_state_involving): Reject
4790 attempts to purge unknown/poisoned svalues, as these svalues
4791 should not have state associated with them.
4792 * svalue.cc (sub_svalue::sub_svalue): Assert that we're building
4793 on top of an svalue with can_have_associated_state_p.
4794 (repeated_svalue::repeated_svalue): Likewise.
4795 (bits_within_svalue::bits_within_svalue): Likewise.
4796 * svalue.h (svalue::can_have_associated_state_p): New.
4797 (unknown_svalue::can_have_associated_state_p): New.
4798 (poisoned_svalue::can_have_associated_state_p): New.
4799 (unaryop_svalue::unaryop_svalue): Assert that we're building on
4800 top of an svalue with can_have_associated_state_p.
4801 (binop_svalue::binop_svalue): Likewise.
4802 (widening_svalue::widening_svalue): Likewise.
4804 2021-07-16 David Malcolm <dmalcolm@redhat.com>
4806 * analyzer.h (enum access_direction): New.
4807 * engine.cc (exploded_node::on_longjmp): Update for new param of
4808 get_store_value.
4809 * program-state.cc (program_state::prune_for_point): Likewise.
4810 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
4811 Replace call to check_for_writable_region with call to
4812 check_region_for_write.
4813 (region_model::impl_call_memset): Likewise.
4814 (region_model::impl_call_strcpy): Likewise.
4815 * region-model-reachability.cc (reachable_regions::add): Update
4816 for new param of get_store_value.
4817 * region-model.cc (region_model::get_rvalue_1): Likewise, also for
4818 get_rvalue_for_bits.
4819 (region_model::get_store_value): Add ctxt param and use it to call
4820 check_region_for_read.
4821 (region_model::get_rvalue_for_bits): Add ctxt param and use it to
4822 call get_store_value.
4823 (region_model::check_region_access): New.
4824 (region_model::check_region_for_write): New.
4825 (region_model::check_region_for_read): New.
4826 (region_model::set_value): Update comment. Replace call to
4827 check_for_writable_region with call to check_region_for_write.
4828 * region-model.h (region_model::get_rvalue_for_bits): Add ctxt
4829 param.
4830 (region_model::get_store_value): Add ctxt param.
4831 (region_model::check_region_access): New decl.
4832 (region_model::check_region_for_write): New decl.
4833 (region_model::check_region_for_read): New decl.
4834 * region.cc (region_model::copy_region): Update call to
4835 get_store_value.
4836 * svalue.cc (initial_svalue::implicitly_live_p): Likewise.
4838 2021-07-16 David Malcolm <dmalcolm@redhat.com>
4840 * engine.cc (exploded_node::on_stmt_pre): Handle
4841 __analyzer_dump_state.
4842 * program-state.cc (extrinsic_state::get_sm_idx_by_name): New.
4843 (program_state::impl_call_analyzer_dump_state): New.
4844 * program-state.h (extrinsic_state::get_sm_idx_by_name): New decl.
4845 (program_state::impl_call_analyzer_dump_state): New decl.
4846 * region-model-impl-calls.cc
4847 (call_details::get_arg_string_literal): New.
4848 * region-model.h (call_details::get_arg_string_literal): New decl.
4850 2021-07-16 David Malcolm <dmalcolm@redhat.com>
4852 * program-state.cc (program_state::detect_leaks): Simplify using
4853 svalue::maybe_get_region.
4854 * region-model-impl-calls.cc (region_model::impl_call_fgets): Likewise.
4855 (region_model::impl_call_fread): Likewise.
4856 (region_model::impl_call_free): Likewise.
4857 (region_model::impl_call_operator_delete): Likewise.
4858 * region-model.cc (selftest::test_stack_frames): Likewise.
4859 (selftest::test_state_merging): Likewise.
4860 * svalue.cc (svalue::maybe_get_region): New.
4861 * svalue.h (svalue::maybe_get_region): New decl.
4863 2021-07-15 David Malcolm <dmalcolm@redhat.com>
4865 * svalue.h (is_a_helper <placeholder_svalue *>::test): Make
4866 param and template param const.
4867 (is_a_helper <widening_svalue *>::test): Likewise.
4868 (is_a_helper <compound_svalue *>::test): Likewise.
4869 (is_a_helper <conjured_svalue *>::test): Likewise.
4871 2021-07-15 David Malcolm <dmalcolm@redhat.com>
4873 PR analyzer/95006
4874 PR analyzer/94713
4875 PR analyzer/94714
4876 * analyzer.cc (maybe_reconstruct_from_def_stmt): Split out
4877 GIMPLE_ASSIGN case into...
4878 (get_diagnostic_tree_for_gassign_1): New.
4879 (get_diagnostic_tree_for_gassign): New.
4880 * analyzer.h (get_diagnostic_tree_for_gassign): New decl.
4881 * analyzer.opt (Wanalyzer-write-to-string-literal): New.
4882 * constraint-manager.cc (class svalue_purger): New.
4883 (constraint_manager::purge_state_involving): New.
4884 * constraint-manager.h
4885 (constraint_manager::purge_state_involving): New.
4886 * diagnostic-manager.cc (saved_diagnostic::supercedes_p): New.
4887 (dedupe_winners::handle_interactions): New.
4888 (diagnostic_manager::emit_saved_diagnostics): Call it.
4889 * diagnostic-manager.h (saved_diagnostic::supercedes_p): New decl.
4890 * engine.cc (impl_region_model_context::warn): Convert return type
4891 to bool. Return false if the diagnostic isn't saved.
4892 (impl_region_model_context::purge_state_involving): New.
4893 (impl_sm_context::get_state): Use NULL ctxt when querying old
4894 rvalue.
4895 (impl_sm_context::set_next_state): Use new sval when querying old
4896 state.
4897 (class dump_path_diagnostic): Move to region-model.cc
4898 (exploded_node::on_stmt): Move to on_stmt_pre and on_stmt_post.
4899 Remove call to purge_state_involving.
4900 (exploded_node::on_stmt_pre): New, based on the above. Move most
4901 of it to region_model::on_stmt_pre.
4902 (exploded_node::on_stmt_post): Likewise, moving to
4903 region_model::on_stmt_post.
4904 (class stale_jmp_buf): Fix parent class to use curiously recurring
4905 template pattern.
4906 (feasibility_state::maybe_update_for_edge): Call on_call_pre and
4907 on_call_post on gcalls.
4908 * exploded-graph.h (impl_region_model_context::warn): Return bool.
4909 (impl_region_model_context::purge_state_involving): New decl.
4910 (exploded_node::on_stmt_pre): New decl.
4911 (exploded_node::on_stmt_post): New decl.
4912 * pending-diagnostic.h (pending_diagnostic::use_of_uninit_p): New.
4913 (pending_diagnostic::supercedes_p): New.
4914 * program-state.cc (sm_state_map::get_state): Inherit state for
4915 conjured_svalue as well as initial_svalue.
4916 (sm_state_map::purge_state_involving): Also support SK_CONJURED.
4917 * region-model-impl-calls.cc (call_details::get_uncertainty):
4918 Handle m_ctxt being NULL.
4919 (call_details::get_or_create_conjured_svalue): New.
4920 (region_model::impl_call_fgets): New.
4921 (region_model::impl_call_fread): New.
4922 * region-model-manager.cc
4923 (region_model_manager::get_or_create_initial_value): Return an
4924 uninitialized poisoned value for regions that can't have initial
4925 values.
4926 * region-model-reachability.cc
4927 (reachable_regions::mark_escaped_clusters): Handle ctxt being
4928 NULL.
4929 * region-model.cc (region_to_value_map::purge_state_involving): New.
4930 (poisoned_value_diagnostic::use_of_uninit_p): New.
4931 (poisoned_value_diagnostic::emit): Handle POISON_KIND_UNINIT.
4932 (poisoned_value_diagnostic::describe_final_event): Likewise.
4933 (region_model::check_for_poison): New.
4934 (region_model::on_assignment): Call it.
4935 (class dump_path_diagnostic): Move here from engine.cc.
4936 (region_model::on_stmt_pre): New, based on exploded_node::on_stmt.
4937 (region_model::on_call_pre): Move the setting of the LHS to a
4938 conjured svalue to before the checks for specific functions.
4939 Handle "fgets", "fgets_unlocked", and "fread".
4940 (region_model::purge_state_involving): New.
4941 (region_model::handle_unrecognized_call): Handle ctxt being NULL.
4942 (region_model::get_rvalue): Call check_for_poison.
4943 (selftest::test_stack_frames): Use NULL for context when getting
4944 uninitialized rvalue.
4945 (selftest::test_alloca): Likewise.
4946 * region-model.h (region_to_value_map::purge_state_involving): New
4947 decl.
4948 (call_details::get_or_create_conjured_svalue): New decl.
4949 (region_model::on_stmt_pre): New decl.
4950 (region_model::purge_state_involving): New decl.
4951 (region_model::impl_call_fgets): New decl.
4952 (region_model::impl_call_fread): New decl.
4953 (region_model::check_for_poison): New decl.
4954 (region_model_context::warn): Return bool.
4955 (region_model_context::purge_state_involving): New.
4956 (noop_region_model_context::warn): Return bool.
4957 (noop_region_model_context::purge_state_involving): New.
4958 (test_region_model_context:: warn): Return bool.
4959 * region.cc (region::get_memory_space): New.
4960 (region::can_have_initial_svalue_p): New.
4961 (region::involves_p): New.
4962 * region.h (enum memory_space): New.
4963 (region::get_memory_space): New decl.
4964 (region::can_have_initial_svalue_p): New decl.
4965 (region::involves_p): New decl.
4966 * sm-malloc.cc (use_after_free::supercedes_p): New.
4967 * store.cc (binding_cluster::purge_state_involving): New.
4968 (store::purge_state_involving): New.
4969 * store.h (class symbolic_binding): New forward decl.
4970 (binding_key::dyn_cast_symbolic_binding): New.
4971 (symbolic_binding::dyn_cast_symbolic_binding): New.
4972 (binding_cluster::purge_state_involving): New.
4973 (store::purge_state_involving): New.
4974 * svalue.cc (svalue::can_merge_p): Reject attempts to merge
4975 poisoned svalues with other svalues, so that we identify
4976 paths in which a variable is conditionally uninitialized.
4977 (involvement_visitor::visit_conjured_svalue): New.
4978 (svalue::involves_p): Also handle SK_CONJURED.
4979 (poison_kind_to_str): Handle POISON_KIND_UNINIT.
4980 (poisoned_svalue::maybe_fold_bits_within): New.
4981 * svalue.h (enum poison_kind): Add POISON_KIND_UNINIT.
4982 (poisoned_svalue::maybe_fold_bits_within): New decl.
4984 2021-07-15 David Malcolm <dmalcolm@redhat.com>
4986 * analyzer.opt (fdump-analyzer-exploded-paths): New.
4987 * diagnostic-manager.cc
4988 (diagnostic_manager::emit_saved_diagnostic): Implement it.
4989 * engine.cc (exploded_path::dump_to_pp): Add ext_state param and
4990 use it to dump states if non-NULL.
4991 (exploded_path::dump): Likewise.
4992 (exploded_path::dump_to_file): New.
4993 * exploded-graph.h (exploded_path::dump_to_pp): Add ext_state
4994 param.
4995 (exploded_path::dump): Likewise.
4996 (exploded_path::dump): Likewise.
4997 (exploded_path::dump_to_file): New.
4999 2021-07-15 David Malcolm <dmalcolm@redhat.com>
5001 * analyzer.cc (fixup_tree_for_diagnostic_1): Use DECL_DEBUG_EXPR
5002 if it's available.
5003 * engine.cc (readability): Likewise.
5005 2021-07-15 David Malcolm <dmalcolm@redhat.com>
5007 * state-purge.cc (self_referential_phi_p): New.
5008 (state_purge_per_ssa_name::process_point): Don't purge an SSA name
5009 at its def-stmt if the def-stmt is self-referential.
5011 2021-07-07 David Malcolm <dmalcolm@redhat.com>
5013 * diagnostic-manager.cc (null_assignment_sm_context::get_state):
5014 New overload.
5015 (null_assignment_sm_context::set_next_state): New overload.
5016 (null_assignment_sm_context::get_diagnostic_tree): New.
5017 * engine.cc (impl_sm_context::get_state): New overload.
5018 (impl_sm_context::set_next_state): New overload.
5019 (impl_sm_context::get_diagnostic_tree): New overload.
5020 (impl_region_model_context::on_condition): Convert params from
5021 tree to const svalue *.
5022 * exploded-graph.h (impl_region_model_context::on_condition):
5023 Likewise.
5024 * region-model.cc (region_model::on_call_pre): Move handling of
5025 internal calls to before checking for get_fndecl_for_call.
5026 (region_model::add_constraints_from_binop): New.
5027 (region_model::add_constraint): Split out into a new overload
5028 working on const svalue * rather than tree. Call
5029 add_constraints_from_binop. Drop call to
5030 add_any_constraints_from_ssa_def_stmt.
5031 (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
5032 (region_model::add_any_constraints_from_gassign): Delete.
5033 (region_model::add_any_constraints_from_gcall): Delete.
5034 * region-model.h
5035 (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
5036 (region_model::add_any_constraints_from_gassign): Delete.
5037 (region_model::add_any_constraints_from_gcall): Delete.
5038 (region_model::add_constraint): Add overload decl.
5039 (region_model::add_constraints_from_binop): New decl.
5040 (region_model_context::on_condition): Convert params from tree to
5041 const svalue *.
5042 (noop_region_model_context::on_condition): Likewise.
5043 * sm-file.cc (fileptr_state_machine::condition): Likewise.
5044 * sm-malloc.cc (malloc_state_machine::on_condition): Likewise.
5045 * sm-pattern-test.cc: Include tristate.h, selftest.h,
5046 analyzer/call-string.h, analyzer/program-point.h,
5047 analyzer/store.h, and analyzer/region-model.h.
5048 (pattern_test_state_machine::on_condition): Convert params from tree to
5049 const svalue *.
5050 * sm-sensitive.cc (sensitive_state_machine::on_condition): Delete.
5051 * sm-signal.cc (signal_state_machine::on_condition): Delete.
5052 * sm-taint.cc (taint_state_machine::on_condition): Convert params
5053 from tree to const svalue *.
5054 * sm.cc: Include tristate.h, selftest.h, analyzer/call-string.h,
5055 analyzer/program-point.h, analyzer/store.h, and
5056 analyzer/region-model.h.
5057 (any_pointer_p): Add overload taking const svalue *sval.
5058 * sm.h (any_pointer_p): Add overload taking const svalue *sval.
5059 (state_machine::on_condition): Convert params from tree to
5060 const svalue *. Provide no-op default implementation.
5061 (sm_context::get_state): Add overload taking const svalue *sval.
5062 (sm_context::set_next_state): Likewise.
5063 (sm_context::on_transition): Likewise.
5064 (sm_context::get_diagnostic_tree): Likewise.
5065 * svalue.cc (svalue::all_zeroes_p): New.
5066 (constant_svalue::all_zeroes_p): New.
5067 (repeated_svalue::all_zeroes_p): Convert to vfunc.
5068 * svalue.h (svalue::all_zeroes_p): New decl.
5069 (constant_svalue::all_zeroes_p): New decl.
5070 (repeated_svalue::all_zeroes_p): Convert decl to vfunc.
5072 2021-06-30 David Malcolm <dmalcolm@redhat.com>
5074 PR analyzer/95006
5075 * analyzer.h (class repeated_svalue): New forward decl.
5076 (class bits_within_svalue): New forward decl.
5077 (class sized_region): New forward decl.
5078 (get_field_at_bit_offset): New forward decl.
5079 * engine.cc (exploded_graph::get_or_create_node): Validate the
5080 merged state.
5081 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
5082 Validate the states at each stage.
5083 * program-state.cc (program_state::validate): Validate
5084 m_region_model.
5085 * region-model-impl-calls.cc (region_model::impl_call_memset):
5086 Replace special-case logic for handling constant sizes with
5087 a call to fill_region of a sized_region with the given fill value.
5088 * region-model-manager.cc (maybe_undo_optimize_bit_field_compare):
5089 Drop DK_direct.
5090 (region_model_manager::maybe_fold_sub_svalue): Fold element-based
5091 subregions of an initial value into initial values of an element.
5092 Fold subvalues of repeated svalues.
5093 (region_model_manager::maybe_fold_repeated_svalue): New.
5094 (region_model_manager::get_or_create_repeated_svalue): New.
5095 (get_bit_range_for_field): New.
5096 (get_byte_range_for_field): New.
5097 (get_field_at_byte_range): New.
5098 (region_model_manager::maybe_fold_bits_within_svalue): New.
5099 (region_model_manager::get_or_create_bits_within): New.
5100 (region_model_manager::get_sized_region): New.
5101 (region_model_manager::log_stats): Update for addition of
5102 m_repeated_values_map, m_bits_within_values_map, and
5103 m_sized_regions.
5104 * region-model.cc (region_model::validate): New.
5105 (region_model::on_assignment): Drop enum binding_kind.
5106 (region_model::get_initial_value_for_global): Likewise.
5107 (region_model::get_rvalue_for_bits): Replace body with call to
5108 get_or_create_bits_within.
5109 (region_model::get_capacity): Handle RK_SIZED.
5110 (region_model::set_value): Drop enum binding_kind.
5111 (region_model::fill_region): New.
5112 (region_model::get_representative_path_var_1): Handle RK_SIZED.
5113 * region-model.h (visitor::visit_repeated_svalue): New.
5114 (visitor::visit_bits_within_svalue): New.
5115 (region_model_manager::get_or_create_repeated_svalue): New decl.
5116 (region_model_manager::get_or_create_bits_within): New decl.
5117 (region_model_manager::get_sized_region): New decl.
5118 (region_model_manager::maybe_fold_repeated_svalue): New decl.
5119 (region_model_manager::maybe_fold_bits_within_svalue): New decl.
5120 (region_model_manager::repeated_values_map_t): New typedef.
5121 (region_model_manager::m_repeated_values_map): New field.
5122 (region_model_manager::bits_within_values_map_t): New typedef.
5123 (region_model_manager::m_bits_within_values_map): New field.
5124 (region_model_manager::m_sized_regions): New field.
5125 (region_model::fill_region): New decl.
5126 * region.cc (region::get_base_region): Handle RK_SIZED.
5127 (region::base_region_p): Likewise.
5128 (region::get_byte_size_sval): New.
5129 (get_field_at_bit_offset): Make non-static.
5130 (region::calc_offset): Move implementation of cases to
5131 get_relative_concrete_offset vfunc implementations. Handle
5132 RK_SIZED.
5133 (region::get_relative_concrete_offset): New.
5134 (decl_region::get_svalue_for_initializer): Drop enum binding_kind.
5135 (field_region::get_relative_concrete_offset): New, from
5136 region::calc_offset.
5137 (element_region::get_relative_concrete_offset): Likewise.
5138 (offset_region::get_relative_concrete_offset): Likewise.
5139 (sized_region::accept): New.
5140 (sized_region::dump_to_pp): New.
5141 (sized_region::get_byte_size): New.
5142 (sized_region::get_bit_size): New.
5143 * region.h (enum region_kind): Add RK_SIZED.
5144 (region::dyn_cast_sized_region): New.
5145 (region::get_byte_size): Make virtual.
5146 (region::get_bit_size): Likewise.
5147 (region::get_byte_size_sval): New decl.
5148 (region::get_relative_concrete_offset): New decl.
5149 (field_region::get_relative_concrete_offset): New decl.
5150 (element_region::get_relative_concrete_offset): Likewise.
5151 (offset_region::get_relative_concrete_offset): Likewise.
5152 (class sized_region): New.
5153 * store.cc (binding_kind_to_string): Delete.
5154 (binding_key::make): Drop enum binding_kind.
5155 (binding_key::dump_to_pp): Delete.
5156 (binding_key::cmp_ptrs): Drop enum binding_kind.
5157 (bit_range::contains_p): New.
5158 (byte_range::dump): New.
5159 (byte_range::contains_p): New.
5160 (byte_range::cmp): New.
5161 (concrete_binding::dump_to_pp): Drop enum binding_kind.
5162 (concrete_binding::cmp_ptr_ptr): Likewise.
5163 (symbolic_binding::dump_to_pp): Likewise.
5164 (symbolic_binding::cmp_ptr_ptr): Likewise.
5165 (binding_map::apply_ctor_val_to_range): Likewise.
5166 (binding_map::apply_ctor_pair_to_child_region): Likewise.
5167 (binding_map::get_overlapping_bindings): New.
5168 (binding_map::remove_overlapping_bindings): New.
5169 (binding_cluster::validate): New.
5170 (binding_cluster::bind): Drop enum binding_kind.
5171 (binding_cluster::bind_compound_sval): Likewise.
5172 (binding_cluster::purge_region): Likewise.
5173 (binding_cluster::zero_fill_region): Reimplement in terms of...
5174 (binding_cluster::fill_region): New.
5175 (binding_cluster::mark_region_as_unknown): Drop enum binding_kind.
5176 (binding_cluster::get_binding): Likewise.
5177 (binding_cluster::get_binding_recursive): Likewise.
5178 (binding_cluster::get_any_binding): Likewise.
5179 (binding_cluster::maybe_get_compound_binding): Reimplement.
5180 (binding_cluster::get_overlapping_bindings): Delete.
5181 (binding_cluster::remove_overlapping_bindings): Reimplement in
5182 terms of binding_map::remove_overlapping_bindings.
5183 (binding_cluster::can_merge_p): Update for removal of
5184 enum binding_kind.
5185 (binding_cluster::on_unknown_fncall): Drop enum binding_kind.
5186 (binding_cluster::maybe_get_simple_value): Likewise.
5187 (store_manager::get_concrete_binding): Likewise.
5188 (store_manager::get_symbolic_binding): Likewise.
5189 (store::validate): New.
5190 (store::set_value): Drop enum binding_kind.
5191 (store::zero_fill_region): Reimplement in terms of...
5192 (store::fill_region): New.
5193 (selftest::test_binding_key_overlap): Drop enum binding_kind.
5194 * store.h (enum binding_kind): Delete.
5195 (binding_kind_to_string): Delete decl.
5196 (binding_key::make): Drop enum binding_kind.
5197 (binding_key::dump_to_pp): Make pure virtual.
5198 (binding_key::get_kind): Delete.
5199 (binding_key::mark_deleted): Delete.
5200 (binding_key::mark_empty): Delete.
5201 (binding_key::is_deleted): Delete.
5202 (binding_key::is_empty): Delete.
5203 (binding_key::binding_key): Delete.
5204 (binding_key::impl_hash): Delete.
5205 (binding_key::impl_eq): Delete.
5206 (binding_key::m_kind): Delete.
5207 (bit_range::get_last_bit_offset): New.
5208 (bit_range::contains_p): New.
5209 (byte_range::contains_p): New.
5210 (byte_range::operator==): New.
5211 (byte_range::get_start_byte_offset): New.
5212 (byte_range::get_next_byte_offset): New.
5213 (byte_range::get_last_byte_offset): New.
5214 (byte_range::as_bit_range): New.
5215 (byte_range::cmp): New.
5216 (concrete_binding::concrete_binding): Drop enum binding_kind.
5217 (concrete_binding::hash): Likewise.
5218 (concrete_binding::operator==): Likewise.
5219 (concrete_binding::mark_deleted): New.
5220 (concrete_binding::mark_empty): New.
5221 (concrete_binding::is_deleted): New.
5222 (concrete_binding::is_empty): New.
5223 (default_hash_traits<ana::concrete_binding>::empty_zero_p): Make false.
5224 (symbolic_binding::symbolic_binding): Drop enum binding_kind.
5225 (symbolic_binding::hash): Likewise.
5226 (symbolic_binding::operator==): Likewise.
5227 (symbolic_binding::mark_deleted): New.
5228 (symbolic_binding::mark_empty): New.
5229 (symbolic_binding::is_deleted): New.
5230 (symbolic_binding::is_empty): New.
5231 (binding_map::remove_overlapping_bindings): New decl.
5232 (binding_map::get_overlapping_bindings): New decl.
5233 (binding_cluster::validate): New decl.
5234 (binding_cluster::bind): Drop enum binding_kind.
5235 (binding_cluster::fill_region): New decl.
5236 (binding_cluster::get_binding): Drop enum binding_kind.
5237 (binding_cluster::get_binding_recursive): Likewise.
5238 (binding_cluster::get_overlapping_bindings): Delete.
5239 (store::validate): New decl.
5240 (store::set_value): Drop enum binding_kind.
5241 (store::fill_region): New decl.
5242 (store_manager::get_concrete_binding): Drop enum binding_kind.
5243 (store_manager::get_symbolic_binding): Likewise.
5244 * svalue.cc (svalue::cmp_ptr): Handle SK_REPEATED and
5245 SK_BITS_WITHIN.
5246 (svalue::extract_bit_range): New.
5247 (svalue::maybe_fold_bits_within): New.
5248 (constant_svalue::maybe_fold_bits_within): New.
5249 (unknown_svalue::maybe_fold_bits_within): New.
5250 (unaryop_svalue::maybe_fold_bits_within): New.
5251 (repeated_svalue::repeated_svalue): New.
5252 (repeated_svalue::dump_to_pp): New.
5253 (repeated_svalue::accept): New.
5254 (repeated_svalue::all_zeroes_p): New.
5255 (repeated_svalue::maybe_fold_bits_within): New.
5256 (bits_within_svalue::bits_within_svalue): New.
5257 (bits_within_svalue::dump_to_pp): New.
5258 (bits_within_svalue::maybe_fold_bits_within): New.
5259 (bits_within_svalue::accept): New.
5260 (bits_within_svalue::implicitly_live_p): New.
5261 (compound_svalue::maybe_fold_bits_within): New.
5262 * svalue.h (enum svalue_kind): Add SK_REPEATED and SK_BITS_WITHIN.
5263 (svalue::dyn_cast_repeated_svalue): New.
5264 (svalue::dyn_cast_bits_within_svalue): New.
5265 (svalue::extract_bit_range): New decl.
5266 (svalue::maybe_fold_bits_within): New vfunc decl.
5267 (region_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
5268 (region_svalue::key_t::is_empty): Likewise.
5269 (default_hash_traits<region_svalue::key_t>::empty_zero_p): Make false.
5270 (constant_svalue::maybe_fold_bits_within): New.
5271 (unknown_svalue::maybe_fold_bits_within): New.
5272 (poisoned_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
5273 (poisoned_svalue::key_t::is_empty): Likewise.
5274 (default_hash_traits<poisoned_svalue::key_t>::empty_zero_p): Make
5275 false.
5276 (setjmp_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
5277 (setjmp_svalue::key_t::is_empty): Likewise.
5278 (default_hash_traits<setjmp_svalue::key_t>::empty_zero_p): Make
5279 false.
5280 (unaryop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
5281 (unaryop_svalue::key_t::is_empty): Likewise.
5282 (unaryop_svalue::maybe_fold_bits_within): New.
5283 (default_hash_traits<unaryop_svalue::key_t>::empty_zero_p): Make
5284 false.
5285 (binop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
5286 (binop_svalue::key_t::is_empty): Likewise.
5287 (default_hash_traits<binop_svalue::key_t>::empty_zero_p): Make
5288 false.
5289 (sub_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
5290 (sub_svalue::key_t::is_empty): Likewise.
5291 (default_hash_traits<sub_svalue::key_t>::empty_zero_p): Make
5292 false.
5293 (class repeated_svalue): New.
5294 (is_a_helper <const repeated_svalue *>::test): New.
5295 (struct default_hash_traits<repeated_svalue::key_t>): New.
5296 (class bits_within_svalue): New.
5297 (is_a_helper <const bits_within_svalue *>::test): New.
5298 (struct default_hash_traits<bits_within_svalue::key_t>): New.
5299 (widening_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
5300 (widening_svalue::key_t::is_empty): Likewise.
5301 (default_hash_traits<widening_svalue::key_t>::empty_zero_p): Make
5302 false.
5303 (compound_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
5304 (compound_svalue::key_t::is_empty): Likewise.
5305 (compound_svalue::maybe_fold_bits_within): New.
5306 (default_hash_traits<compound_svalue::key_t>::empty_zero_p): Make
5307 false.
5309 2021-06-28 David Malcolm <dmalcolm@redhat.com>
5311 * analyzer.h (byte_offset_t): New typedef.
5312 * store.cc (bit_range::dump_to_pp): Dump as a byte range if
5313 possible.
5314 (bit_range::as_byte_range): New.
5315 (byte_range::dump_to_pp): New.
5316 * store.h (class byte_range): New forward decl.
5317 (struct bit_range): Add comment.
5318 (bit_range::as_byte_range): New decl.
5319 (struct byte_range): New.
5321 2021-06-22 David Malcolm <dmalcolm@redhat.com>
5323 PR analyzer/101143
5324 * region-model.cc (compat_types_p): New function.
5325 (region_model::create_region_for_heap_alloc): Convert assertion to
5326 an error check.
5327 (region_model::create_region_for_alloca): Likewise.
5329 2021-06-18 David Malcolm <dmalcolm@redhat.com>
5331 * store.cc (binding_cluster::get_any_binding): Make symbolic reads
5332 from a cluster with concrete bindings return unknown.
5334 2021-06-18 David Malcolm <dmalcolm@redhat.com>
5336 * region-model-manager.cc
5337 (region_model_manager::get_or_create_int_cst): New.
5338 (region_model_manager::maybe_undo_optimize_bit_field_compare): Use
5339 it to simplify away a local tree.
5340 * region-model.cc (region_model::on_setjmp): Likewise.
5341 (region_model::on_longjmp): Likewise.
5342 * region-model.h (region_model_manager::get_or_create_int_cst):
5343 New decl.
5344 * store.cc (binding_cluster::zero_fill_region): Use it to simplify
5345 away a local tree.
5347 2021-06-18 David Malcolm <dmalcolm@redhat.com>
5349 * checker-path.cc (class custom_event): Make abstract to allow for
5350 custom vfuncs, splitting existing implementation into...
5351 (class precanned_custom_event): New subclass.
5352 (custom_event::get_desc): Move to...
5353 (precanned_custom_event::get_desc): ...subclass.
5354 * checker-path.h (class custom_event): Make abstract to allow for
5355 custom vfuncs, splitting existing implementation into...
5356 (class precanned_custom_event): New subclass.
5357 * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
5358 Use precanned_custom_event.
5359 * engine.cc
5360 (stale_jmp_buf::maybe_add_custom_events_for_superedge): Likewise.
5361 * sm-signal.cc (signal_delivery_edge_info_t::add_events_to_path):
5362 Likewise.
5364 2021-06-15 David Malcolm <dmalcolm@redhat.com>
5366 PR analyzer/99212
5367 PR analyzer/101082
5368 * engine.cc: Include "target.h".
5369 (impl_run_checkers): Log BITS_BIG_ENDIAN, BYTES_BIG_ENDIAN, and
5370 WORDS_BIG_ENDIAN.
5371 * region-model-manager.cc
5372 (region_model_manager::maybe_fold_binop): Move support for masking
5373 via ARG0 & CST into...
5374 (region_model_manager::maybe_undo_optimize_bit_field_compare):
5375 ...this new function. Flatten by converting from nested
5376 conditionals to a series of early return statements to reject
5377 failures. Reject if type is not unsigned_char_type_node.
5378 Handle BYTES_BIG_ENDIAN when determining which bits are bound
5379 in the binding_map.
5380 * region-model.h
5381 (region_model_manager::maybe_undo_optimize_bit_field_compare):
5382 New decl.
5383 * store.cc (bit_range::dump): New function.
5384 * store.h (bit_range::dump): New decl.
5386 2021-06-15 David Malcolm <dmalcolm@redhat.com>
5388 * engine.cc (exploded_node::on_stmt): Handle __analyzer_dump_capacity.
5389 (exploded_node::on_stmt): Drop m_sm_changes from on_stmt_flags.
5390 (state_change_requires_new_enode_p): New function...
5391 (exploded_graph::process_node): Call it, rather than querying
5392 flags.m_sm_changes, so that dynamic-extent differences can also
5393 trigger the splitting of nodes.
5394 * exploded-graph.h (struct on_stmt_flags): Drop field m_sm_changes.
5395 * program-state.cc (program_state::detect_leaks): Purge dead
5396 heap-allocated regions from dynamic extents.
5397 (selftest::test_program_state_1): Fix type of "size_in_bytes".
5398 (selftest::test_program_state_merging): Likewise.
5399 * region-model-impl-calls.cc
5400 (region_model::impl_call_analyzer_dump_capacity): New.
5401 (region_model::impl_call_free): Remove dynamic extents from the
5402 freed region.
5403 * region-model-reachability.h
5404 (reachable_regions::begin_mutable_base_regs): New.
5405 (reachable_regions::end_mutable_base_regs): New.
5406 * region-model.cc: Include "tree-object-size.h".
5407 (region_model::region_model): Support new field m_dynamic_extents.
5408 (region_model::operator=): Likewise.
5409 (region_model::operator==): Likewise.
5410 (region_model::dump_to_pp): Dump sizes of dynamic regions.
5411 (region_model::handle_unrecognized_call): Purge dynamic extents
5412 from any regions that have escaped mutably:.
5413 (region_model::get_capacity): New function.
5414 (region_model::add_constraint): Unset dynamic extents when a
5415 heap-allocated region's address is NULL.
5416 (region_model::unbind_region_and_descendents): Purge dynamic
5417 extents of unbound regions.
5418 (region_model::can_merge_with_p): Call
5419 m_dynamic_extents.can_merge_with_p.
5420 (region_model::create_region_for_heap_alloc): Assert that
5421 size_in_bytes's type is compatible with size_type_node. Update
5422 for renaming of record_dynamic_extents to set_dynamic_extents.
5423 (region_model::create_region_for_alloca): Likewise.
5424 (region_model::record_dynamic_extents): Rename to...
5425 (region_model::set_dynamic_extents): ...this. Assert that
5426 size_in_bytes's type is compatible with size_type_node. Add it
5427 to the m_dynamic_extents map.
5428 (region_model::get_dynamic_extents): New.
5429 (region_model::unset_dynamic_extents): New.
5430 (selftest::test_state_merging): Fix type of "size".
5431 (selftest::test_malloc_constraints): Likewise.
5432 (selftest::test_malloc): Verify dynamic extents.
5433 (selftest::test_alloca): Likewise.
5434 * region-model.h (region_to_value_map::is_empty): New.
5435 (region_model::dynamic_extents_t): New typedef.
5436 (region_model::impl_call_analyzer_dump_capacity): New decl.
5437 (region_model::get_dynamic_extents): New function.
5438 (region_model::get_dynamic_extents): New decl.
5439 (region_model::set_dynamic_extents): New decl.
5440 (region_model::unset_dynamic_extents): New decl.
5441 (region_model::get_capacity): New decl.
5442 (region_model::record_dynamic_extents): Rename to set_dynamic_extents.
5443 (region_model::m_dynamic_extents): New field.
5445 2021-06-15 David Malcolm <dmalcolm@redhat.com>
5447 * region-model.cc (region_to_value_map::operator=): New.
5448 (region_to_value_map::operator==): New.
5449 (region_to_value_map::dump_to_pp): New.
5450 (region_to_value_map::dump): New.
5451 (region_to_value_map::can_merge_with_p): New.
5452 * region-model.h (class region_to_value_map): New class.
5454 2021-06-13 Trevor Saunders <tbsaunde@tbsaunde.org>
5456 * call-string.cc (call_string::call_string): Use range based for
5457 to iterate over vec<>.
5458 (call_string::to_json): Likewise.
5459 (call_string::hash): Likewise.
5460 (call_string::calc_recursion_depth): Likewise.
5461 * checker-path.cc (checker_path::fixup_locations): Likewise.
5462 * constraint-manager.cc (equiv_class::equiv_class): Likewise.
5463 (equiv_class::to_json): Likewise.
5464 (equiv_class::hash): Likewise.
5465 (constraint_manager::to_json): Likewise.
5466 * engine.cc (impl_region_model_context::on_svalue_leak):
5467 Likewise.
5468 (on_liveness_change): Likewise.
5469 (impl_region_model_context::on_unknown_change): Likewise.
5470 * program-state.cc (sm_state_map::set_state): Likewise.
5471 * region-model.cc (test_canonicalization_4): Likewise.
5473 2021-06-11 David Malcolm <dmalcolm@redhat.com>
5475 * engine.cc (worklist::key_t::cmp): Move sort by call_string to
5476 before SCC.
5478 2021-06-09 David Malcolm <dmalcolm@redhat.com>
5480 * region-model.cc (region_model::get_lvalue_1): Make const.
5481 (region_model::get_lvalue): Likewise.
5482 (region_model::get_rvalue_1): Likewise.
5483 (region_model::get_rvalue): Likewise.
5484 (region_model::deref_rvalue): Likewise.
5485 (region_model::get_rvalue_for_bits): Likewise.
5486 * region-model.h (region_model::get_lvalue): Likewise.
5487 (region_model::get_rvalue): Likewise.
5488 (region_model::deref_rvalue): Likewise.
5489 (region_model::get_rvalue_for_bits): Likewise.
5490 (region_model::get_lvalue_1): Likewise.
5491 (region_model::get_rvalue_1): Likewise.
5493 2021-06-08 David Malcolm <dmalcolm@redhat.com>
5495 PR analyzer/99212
5496 * region-model-manager.cc
5497 (region_model_manager::maybe_fold_binop): Add support for folding
5498 BIT_AND_EXPR of compound_svalue and a mask constant.
5499 * region-model.cc (region_model::get_rvalue_1): Implement
5500 BIT_FIELD_REF in terms of...
5501 (region_model::get_rvalue_for_bits): New function.
5502 * region-model.h (region_model::get_rvalue_for_bits): New decl.
5503 * store.cc (bit_range::from_mask): New function.
5504 (selftest::test_bit_range_intersects_p): New selftest.
5505 (selftest::assert_bit_range_from_mask_eq): New.
5506 (ASSERT_BIT_RANGE_FROM_MASK_EQ): New macro.
5507 (selftest::assert_no_bit_range_from_mask_eq): New.
5508 (ASSERT_NO_BIT_RANGE_FROM_MASK): New macro.
5509 (selftest::test_bit_range_from_mask): New selftest.
5510 (selftest::analyzer_store_cc_tests): Call the new selftests.
5511 * store.h (bit_range::intersects_p): New.
5512 (bit_range::from_mask): New decl.
5513 (concrete_binding::get_bit_range): New accessor.
5514 (store_manager::get_concrete_binding): New overload taking
5515 const bit_range &.
5517 2021-06-08 David Malcolm <dmalcolm@redhat.com>
5519 * analyzer.h (int_size_in_bits): New decl.
5520 * region.cc (int_size_in_bits): New function.
5521 (region::get_bit_size): Reimplement in terms of the above.
5523 2021-06-08 David Malcolm <dmalcolm@redhat.com>
5525 * store.cc (concrete_binding::dump_to_pp): Move bulk of
5526 implementation to...
5527 (bit_range::dump_to_pp): ...this new function.
5528 (bit_range::cmp): New.
5529 (concrete_binding::overlaps_p): Update for use of bit_range.
5530 (concrete_binding::cmp_ptr_ptr): Likewise.
5531 * store.h (struct bit_range): New.
5532 (class concrete_binding): Replace fields m_start_bit_offset and
5533 m_size_in_bits with new field m_bit_range.
5535 2021-06-08 David Malcolm <dmalcolm@redhat.com>
5537 * svalue.h (conjured_svalue::iterator_t): Delete.
5539 2021-06-03 David Malcolm <dmalcolm@redhat.com>
5541 * store.h (store::get_direct_binding): Remove unused decl.
5542 (store::get_default_binding): Likewise.
5544 2021-06-03 David Malcolm <dmalcolm@redhat.com>
5546 * svalue.cc (poisoned_svalue::dump_to_pp): Dump type.
5547 (compound_svalue::dump_to_pp): Dump any type.
5549 2021-05-18 David Malcolm <dmalcolm@redhat.com>
5551 PR analyzer/100615
5552 * sm-malloc.cc: Include "analyzer/function-set.h".
5553 (malloc_state_machine::on_stmt): Call unaffected_by_call_p and
5554 bail on the functions it recognizes.
5555 (malloc_state_machine::unaffected_by_call_p): New.
5557 2021-05-10 Martin Liska <mliska@suse.cz>
5559 * sm-file.cc (is_file_using_fn_p): Use startswith
5560 function instead of strncmp.
5562 2021-05-10 Martin Liska <mliska@suse.cz>
5564 * program-state.cc (program_state::operator=): Remove
5565 __cplusplus >= 201103.
5566 (program_state::program_state): Likewise.
5567 * program-state.h: Likewise.
5568 * region-model.h (class region_model): Remove dead code.
5570 2021-04-24 David Malcolm <dmalcolm@redhat.com>
5572 PR analyzer/100244
5573 * sm-malloc.cc (free_of_non_heap::describe_state_change):
5574 Bulletproof against change.m_expr being NULL.
5576 2021-04-13 David Malcolm <dmalcolm@redhat.com>
5578 PR analyzer/98599
5579 * supergraph.cc (saved_uids::make_uid_unique): New.
5580 (saved_uids::restore_uids): New.
5581 (supergraph::supergraph): Replace assignments to stmt->uid with
5582 calls to m_stmt_uids.make_uid_unique.
5583 (supergraph::~supergraph): New.
5584 * supergraph.h (class saved_uids): New.
5585 (supergraph::~supergraph): New decl.
5586 (supergraph::m_stmt_uids): New field.
5588 2021-04-10 David Malcolm <dmalcolm@redhat.com>
5590 PR analyzer/100011
5591 * region-model.cc (region_model::on_assignment): Avoid NULL
5592 dereference if ctxt is NULL when assigning from a STRING_CST.
5594 2021-04-08 David Malcolm <dmalcolm@redhat.com>
5596 PR analyzer/99042
5597 PR analyzer/99774
5598 * engine.cc
5599 (impl_region_model_context::impl_region_model_context): Add
5600 uncertainty param and use it to initialize m_uncertainty.
5601 (impl_region_model_context::get_uncertainty): New.
5602 (impl_sm_context::get_fndecl_for_call): Add NULL for new
5603 uncertainty param when constructing impl_region_model_context.
5604 (impl_sm_context::get_state): Likewise.
5605 (impl_sm_context::set_next_state): Likewise.
5606 (impl_sm_context::warn): Likewise.
5607 (exploded_node::on_stmt): Add uncertainty param
5608 and use it when constructing impl_region_model_context.
5609 (exploded_node::on_edge): Add uncertainty param and pass
5610 to on_edge call.
5611 (exploded_node::detect_leaks): Create uncertainty_t and pass to
5612 impl_region_model_context.
5613 (exploded_graph::get_or_create_node): Create uncertainty_t and
5614 pass to prune_for_point.
5615 (maybe_process_run_of_before_supernode_enodes): Create
5616 uncertainty_t and pass to impl_region_model_context.
5617 (exploded_graph::process_node): Create uncertainty_t instances and
5618 pass around as needed.
5619 * exploded-graph.h
5620 (impl_region_model_context::impl_region_model_context): Add
5621 uncertainty param.
5622 (impl_region_model_context::get_uncertainty): New decl.
5623 (impl_region_model_context::m_uncertainty): New field.
5624 (exploded_node::on_stmt): Add uncertainty param.
5625 (exploded_node::on_edge): Likewise.
5626 * program-state.cc (sm_state_map::on_liveness_change): Get
5627 uncertainty from context and use it to unset sm-state from
5628 svalues as appropriate.
5629 (program_state::on_edge): Add uncertainty param and use it when
5630 constructing impl_region_model_context. Fix indentation.
5631 (program_state::prune_for_point): Add uncertainty param and use it
5632 when constructing impl_region_model_context.
5633 (program_state::detect_leaks): Get any uncertainty from ctxt and
5634 use it to get maybe-live svalues for dest_state, rather than
5635 definitely-live ones; use this when determining which svalues
5636 have leaked.
5637 (selftest::test_program_state_merging): Create uncertainty_t and
5638 pass to impl_region_model_context.
5639 * program-state.h (program_state::on_edge): Add uncertainty param.
5640 (program_state::prune_for_point): Likewise.
5641 * region-model-impl-calls.cc (call_details::get_uncertainty): New.
5642 (region_model::impl_call_memcpy): Pass uncertainty to
5643 mark_region_as_unknown call.
5644 (region_model::impl_call_memset): Likewise.
5645 (region_model::impl_call_strcpy): Likewise.
5646 * region-model-reachability.cc (reachable_regions::handle_sval):
5647 Also add sval to m_mutable_svals.
5648 * region-model.cc (region_model::on_assignment): Pass any
5649 uncertainty from ctxt to the store::set_value call.
5650 (region_model::handle_unrecognized_call): Get any uncertainty from
5651 ctxt and use it to record mutable svalues at the unknown call.
5652 (region_model::get_reachable_svalues): Add uncertainty param and
5653 use it to mark any maybe-bound svalues as being reachable.
5654 (region_model::set_value): Pass any uncertainty from ctxt to the
5655 store::set_value call.
5656 (region_model::mark_region_as_unknown): Add uncertainty param and
5657 pass it on to the store::mark_region_as_unknown call.
5658 (region_model::update_for_call_summary): Add uncertainty param and
5659 pass it on to the region_model::mark_region_as_unknown call.
5660 * region-model.h (call_details::get_uncertainty): New decl.
5661 (region_model::get_reachable_svalues): Add uncertainty param.
5662 (region_model::mark_region_as_unknown): Add uncertainty param.
5663 (region_model_context::get_uncertainty): New vfunc.
5664 (noop_region_model_context::get_uncertainty): New vfunc
5665 implementation.
5666 * store.cc (dump_svalue_set): New.
5667 (uncertainty_t::dump_to_pp): New.
5668 (uncertainty_t::dump): New.
5669 (binding_cluster::clobber_region): Pass NULL for uncertainty to
5670 remove_overlapping_bindings.
5671 (binding_cluster::mark_region_as_unknown): Add uncertainty param
5672 and pass it to remove_overlapping_bindings.
5673 (binding_cluster::remove_overlapping_bindings): Add uncertainty param.
5674 Use it to record any svalues that were in clobbered bindings.
5675 (store::set_value): Add uncertainty param. Pass it to
5676 binding_cluster::mark_region_as_unknown when handling symbolic
5677 regions.
5678 (store::mark_region_as_unknown): Add uncertainty param and pass it
5679 to binding_cluster::mark_region_as_unknown.
5680 (store::remove_overlapping_bindings): Add uncertainty param and
5681 pass it to binding_cluster::remove_overlapping_bindings.
5682 * store.h (binding_cluster::mark_region_as_unknown): Add
5683 uncertainty param.
5684 (binding_cluster::remove_overlapping_bindings): Likewise.
5685 (store::set_value): Likewise.
5686 (store::mark_region_as_unknown): Likewise.
5688 2021-04-05 David Malcolm <dmalcolm@redhat.com>
5690 PR analyzer/99906
5691 * analyzer.cc (maybe_reconstruct_from_def_stmt): Fix NULL
5692 dereference on calls with zero arguments.
5693 * sm-malloc.cc (malloc_state_machine::on_stmt): When handling
5694 __attribute__((nonnull)), only call get_diagnostic_tree if the
5695 result will be used.
5697 2021-04-05 David Malcolm <dmalcolm@redhat.com>
5699 PR analyzer/99886
5700 * diagnostic-manager.cc
5701 (diagnostic_manager::prune_interproc_events): Use signed integers
5702 when subtracting one from path->num_events ().
5703 (diagnostic_manager::consolidate_conditions): Likewise. Convert
5704 next_idx to a signed int.
5706 2021-04-01 David Malcolm <dmalcolm@redhat.com>
5708 * diagnostic-manager.cc (diagnostic_manager::add_diagnostic): Make
5709 enode param non-constant, and call add_diagnostic on it. Add
5710 enode index to log message.
5711 (diagnostic_manager::add_diagnostic): Make enode param
5712 non-constant.
5713 * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
5714 Likewise for both decls.
5715 * engine.cc
5716 (impl_region_model_context::impl_region_model_context): Likewise
5717 for enode_for_diag.
5718 (impl_sm_context::impl_sm_context): Likewise.
5719 (impl_sm_context::m_enode_for_diag): Likewise.
5720 (exploded_node::dump_dot): Don't pass the diagnostic manager
5721 to dump_saved_diagnostics.
5722 (exploded_node::dump_saved_diagnostics): Drop param. Iterate
5723 directly through all saved diagnostics for the enode, rather
5724 than all saved diagnostics in the diagnostic_manager and
5725 filtering.
5726 (exploded_node::on_stmt): Make non-const.
5727 (exploded_node::on_edge): Likewise.
5728 (exploded_node::on_longjmp): Likewise.
5729 (exploded_node::detect_leaks): Likewise.
5730 (exploded_graph::get_or_create_node): Make enode_for_diag param
5731 non-const.
5732 (exploded_graph_annotator::print_enode): Iterate
5733 directly through all saved diagnostics for the enode, rather
5734 than all saved diagnostics in the diagnostic_manager and
5735 filtering.
5736 * exploded-graph.h
5737 (impl_region_model_context::impl_region_model_context): Make
5738 enode_for_diag param non-constant.
5739 (impl_region_model_context::m_enode_for_diag): Likewise.
5740 (exploded_node::dump_saved_diagnostics): Drop param.
5741 (exploded_node::on_stmt): Make non-const.
5742 (exploded_node::on_edge): Likewise.
5743 (exploded_node::on_longjmp): Likewise.
5744 (exploded_node::detect_leaks): Likewise.
5745 (exploded_node::add_diagnostic): New.
5746 (exploded_node::get_num_diagnostics): New.
5747 (exploded_node::get_saved_diagnostic): New.
5748 (exploded_node::m_saved_diagnostics): New.
5749 (exploded_graph::get_or_create_node): Make enode_for_diag param
5750 non-constant.
5751 * feasible-graph.cc (feasible_node::dump_dot): Drop
5752 diagnostic_manager from call to dump_saved_diagnostics.
5753 * program-state.cc (program_state::on_edge): Convert enode param
5754 to non-const pointer.
5755 (program_state::prune_for_point): Likewise for enode_for_diag
5756 param.
5757 * program-state.h (program_state::on_edge): Convert enode param
5758 to non-const pointer.
5759 (program_state::prune_for_point): Likewise for enode_for_diag
5760 param.
5762 2021-03-31 David Malcolm <dmalcolm@redhat.com>
5764 PR analyzer/99771
5765 * analyzer.cc (maybe_reconstruct_from_def_stmt): New.
5766 (fixup_tree_for_diagnostic_1): New.
5767 (fixup_tree_for_diagnostic): New.
5768 * analyzer.h (fixup_tree_for_diagnostic): New decl.
5769 * checker-path.cc (call_event::get_desc): Call
5770 fixup_tree_for_diagnostic and use it for the call_with_state call.
5771 (warning_event::get_desc): Likewise for the final_event and
5772 make_label_text calls.
5773 * engine.cc (impl_region_model_context::on_state_leak): Likewise
5774 for the on_leak and add_diagnostic calls.
5775 * region-model.cc (region_model::get_representative_tree):
5776 Likewise for the result.
5778 2021-03-30 David Malcolm <dmalcolm@redhat.com>
5780 * region.h (region::dump_to_pp): Remove old decl.
5782 2021-03-30 David Malcolm <dmalcolm@redhat.com>
5784 * sm-file.cc (fileptr_state_machine::on_stmt): Only call
5785 get_diagnostic_tree if the result will be used.
5786 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
5787 (malloc_state_machine::on_deallocator_call): Likewise.
5788 (malloc_state_machine::on_realloc_call): Likewise.
5789 (malloc_state_machine::on_realloc_call): Likewise.
5790 * sm-sensitive.cc
5791 (sensitive_state_machine::warn_for_any_exposure): Likewise.
5792 * sm-taint.cc (taint_state_machine::on_stmt): Likewise.
5794 2021-03-25 David Malcolm <dmalcolm@redhat.com>
5796 PR analyzer/93695
5797 PR analyzer/99044
5798 PR analyzer/99716
5799 * engine.cc (exploded_node::on_stmt): Clear sm-state involving
5800 an SSA name at the def-stmt of that SSA name.
5801 * program-state.cc (sm_state_map::purge_state_involving): New.
5802 * program-state.h (sm_state_map::purge_state_involving): New decl.
5803 * region-model.cc (selftest::test_involves_p): New.
5804 (selftest::analyzer_region_model_cc_tests): Call it.
5805 * svalue.cc (class involvement_visitor): New class
5806 (svalue::involves_p): New.
5807 * svalue.h (svalue::involves_p): New decl.
5809 2021-03-19 David Malcolm <dmalcolm@redhat.com>
5811 PR analyzer/99614
5812 * diagnostic-manager.cc (class epath_finder): Add
5813 DISABLE_COPY_AND_ASSIGN.
5815 2021-03-15 Martin Liska <mliska@suse.cz>
5817 * sm-file.cc (get_file_using_fns): Add missing comma in initializer.
5819 2021-03-11 David Malcolm <dmalcolm@redhat.com>
5821 PR analyzer/96374
5822 * analyzer.opt (-param=analyzer-max-infeasible-edges=): New param.
5823 (fdump-analyzer-feasibility): New flag.
5824 * diagnostic-manager.cc: Include "analyzer/trimmed-graph.h" and
5825 "analyzer/feasible-graph.h".
5826 (epath_finder::epath_finder): Convert m_sep to a pointer and
5827 only create it if !flag_analyzer_feasibility.
5828 (epath_finder::~epath_finder): New.
5829 (epath_finder::m_sep): Convert to a pointer.
5830 (epath_finder::get_best_epath): Add param "diag_idx" and use it
5831 when logging. Rather than finding the shortest path and then
5832 checking feasibility, instead use explore_feasible_paths unless
5833 !flag_analyzer_feasibility, in which case simply use the shortest
5834 path, and note if it is infeasible. Update for m_sep becoming a
5835 pointer.
5836 (class feasible_worklist): New.
5837 (epath_finder::explore_feasible_paths): New.
5838 (epath_finder::process_worklist_item): New.
5839 (class dump_eg_with_shortest_path): New.
5840 (epath_finder::dump_trimmed_graph): New.
5841 (epath_finder::dump_feasible_graph): New.
5842 (saved_diagnostic::saved_diagnostic): Add "idx" param, using it
5843 on new field m_idx.
5844 (saved_diagnostic::to_json): Dump m_idx.
5845 (saved_diagnostic::calc_best_epath): Pass m_idx to get_best_epath.
5846 Remove assertion that m_problem was set when m_best_epath is NULL.
5847 (diagnostic_manager::add_diagnostic): Pass an index when created
5848 saved_diagnostic instances.
5849 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add
5850 "idx" param.
5851 (saved_diagnostic::get_index): New accessor.
5852 (saved_diagnostic::m_idx): New field.
5853 * engine.cc (exploded_node::dump_dot): Call args.dump_extra_info.
5854 Move code to...
5855 (exploded_node::dump_processed_stmts): ...this new function and...
5856 (exploded_node::dump_saved_diagnostics): ...this new function.
5857 Add index of each diagnostic.
5858 (exploded_edge::dump_dot): Move bulk of code to...
5859 (exploded_edge::dump_dot_label): ...this new function.
5860 * exploded-graph.h (eg_traits::dump_args_t::dump_extra_info): New
5861 vfunc.
5862 (exploded_node::dump_processed_stmts): New decl.
5863 (exploded_node::dump_saved_diagnostics): New decl.
5864 (exploded_edge::dump_dot_label): New decl.
5865 * feasible-graph.cc: New file.
5866 * feasible-graph.h: New file.
5867 * trimmed-graph.cc: New file.
5868 * trimmed-graph.h: New file.
5870 2021-03-11 David Malcolm <dmalcolm@redhat.com>
5872 * diagnostic-manager.cc (epath_finder::epath_finder):
5873 Update shortest_paths init for new param.
5875 2021-03-10 David Malcolm <dmalcolm@redhat.com>
5877 PR analyzer/96374
5878 * engine.cc (exploded_path::feasible_p): Move "snodes_visited" and
5879 "model" locals into a new class feasibility_state. Move heart
5880 of per-edge processing into
5881 feasibility_state::maybe_update_for_edge.
5882 (feasibility_state::feasibility_state): New.
5883 (feasibility_state::maybe_update_for_edge): New, based on loop
5884 body in exploded_path::feasible_p.
5885 * exploded-graph.h (class feasibility_state): New.
5887 2021-03-10 David Malcolm <dmalcolm@redhat.com>
5889 * supergraph.h
5890 (callgraph_superedge::dyn_cast_callgraph_superedge): New.
5891 (call_superedge::dyn_cast_callgraph_superedge): Delete.
5892 (return_superedge::dyn_cast_callgraph_superedge): Delete.
5894 2021-03-02 Martin Liska <mliska@suse.cz>
5896 * diagnostic-manager.cc (diagnostic_manager::emit_saved_diagnostics):
5897 Do not pass engine.
5899 2021-02-26 David Malcolm <dmalcolm@redhat.com>
5901 * engine.cc (exploded_path::exploded_path): New copy-ctor.
5902 * exploded-graph.h (exploded_path::operator=): Drop decl.
5904 2021-02-26 David Malcolm <dmalcolm@redhat.com>
5906 PR analyzer/96374
5907 * diagnostic-manager.cc (class epath_finder): New.
5908 (epath_finder::get_best_epath): New.
5909 (saved_diagnostic::saved_diagnostic): Update for replacement of
5910 m_state and m_epath_length with m_best_epath.
5911 (saved_diagnostic::~saved_diagnostic): Delete m_best_epath.
5912 (saved_diagnostic::to_json): Update "path_length" to be optional.
5913 (saved_diagnostic::calc_best_epath): New, based on
5914 dedupe_winners::add and parts of dedupe_key::dedupe_key.
5915 (saved_diagnostic::get_epath_length): New.
5916 (saved_diagnostic::add_duplicate): New.
5917 (dedupe_key::dedupe_key): Drop epath param. Move invocation of
5918 stmt_finder to saved_diagnostic::calc_best_epath.
5919 (class dedupe_candidate): Delete.
5920 (class dedupe_hash_map_traits): Update to use saved_diagnotic *
5921 rather than dedupe_candidate * as the value_type/compare_type.
5922 (dedupe_winners::~dedupe_winners): Don't delete the values.
5923 (dedupe_winners::add): Convert param from shortest_exploded_paths to
5924 epath_finder. Drop "eg" param. Drop dedupe_candidate, moving
5925 path generation and feasiblity checking to
5926 epath_finder::get_best_epath. Update winner-selection for move
5927 of epaths from dedupe_candidate to saved_diagnostic.
5928 (dedupe_winners::emit_best): Update for removal of class
5929 dedupe_candidate.
5930 (dedupe_winners::map_t): Update to use saved_diagnotic * rather
5931 than dedupe_candidate * as the value_type/compare_type.
5932 (diagnostic_manager::emit_saved_diagnostics): Move
5933 shortest_exploded_paths instance into epath_finder and pass that
5934 around instead.
5935 (diagnostic_manager::emit_saved_diagnostic): Drop epath, stmt
5936 and num_dupes params, instead getting these from the
5937 saved_diagnostic. Use correct location in inform_n call.
5938 * diagnostic-manager.h (class epath_finder): New forward decl.
5939 (saved_diagnostic::status): Drop enum.
5940 (saved_diagnostic::set_feasible): Drop.
5941 (saved_diagnostic::set_infeasible): Drop.
5942 (saved_diagnostic::get_status): Drop.
5943 (saved_diagnostic::calc_best_epath): New decl.
5944 (saved_diagnostic::get_best_epath): New decl.
5945 (saved_diagnostic::get_epath_length): New decl.
5946 (saved_diagnostic::set_epath_length): Drop.
5947 (saved_diagnostic::get_epath_length): Drop inline implementation.
5948 (saved_diagnostic::add_duplicate): New.
5949 (saved_diagnostic::get_num_dupes): New.
5950 (saved_diagnostic::m_d): Document ownership.
5951 (saved_diagnostic::m_trailing_eedge): Make const.
5952 (saved_diagnostic::m_status): Drop field.
5953 (saved_diagnostic::m_epath_length): Drop field.
5954 (saved_diagnostic::m_best_epath): New field.
5955 (saved_diagnostic::m_problem): Document ownership.
5956 (saved_diagnostic::m_duplicates): New field.
5957 (diagnostic_manager::emit_saved_diagnostic): Drop params epath,
5958 stmt, and num_dupes.
5959 * engine.cc (exploded_graph_annotator::print_saved_diagnostic):
5960 Update for changes to saved_diagnostic class.
5961 * exploded-graph.h (exploded_path::feasible_p): Drop unused
5962 overloaded decl.
5964 2021-02-25 David Malcolm <dmalcolm@redhat.com>
5966 PR analyzer/99193
5967 * region-model-impl-calls.cc (region_model::impl_call_realloc): New.
5968 * region-model.cc (region_model::on_call_pre): Call it.
5969 * region-model.h (region_model::impl_call_realloc): New decl.
5970 * sm-malloc.cc (enum wording): Add WORDING_REALLOCATED.
5971 (malloc_state_machine::m_realloc): New field.
5972 (use_after_free::describe_state_change): Add case for
5973 WORDING_REALLOCATED.
5974 (use_after_free::describe_final_event): Likewise.
5975 (malloc_state_machine::malloc_state_machine): Initialize
5976 m_realloc.
5977 (malloc_state_machine::on_stmt): Handle realloc by calling...
5978 (malloc_state_machine::on_realloc_call): New.
5980 2021-02-22 David Malcolm <dmalcolm@redhat.com>
5982 PR analyzer/99196
5983 * engine.cc (exploded_node::on_stmt): Provide terminate_path
5984 flag as a way for on_call_pre to terminate the current analysis
5985 path.
5986 * region-model-impl-calls.cc (call_details::num_args): New.
5987 (region_model::impl_call_error): New.
5988 * region-model.cc (region_model::on_call_pre): Add param
5989 "out_terminate_path". Handle "error" and "error_at_line".
5990 * region-model.h (call_details::num_args): New decl.
5991 (region_model::on_call_pre): Add param "out_terminate_path".
5992 (region_model::impl_call_error): New decl.
5994 2021-02-17 David Malcolm <dmalcolm@redhat.com>
5996 PR analyzer/98969
5997 * constraint-manager.cc (dead_svalue_purger::should_purge_p):
5998 Update for change to svalue::live_p.
5999 * program-state.cc (sm_state_map::on_liveness_change): Likewise.
6000 (program_state::detect_leaks): Likewise.
6001 * region-model-reachability.cc (reachable_regions::init_cluster):
6002 When dealing with a symbolic region, if the underlying pointer is
6003 implicitly live, add the region to the reachable regions.
6004 * region-model.cc (region_model::compare_initial_and_pointer):
6005 Move logic for detecting initial values of params to
6006 initial_svalue::initial_value_of_param_p.
6007 * svalue.cc (svalue::live_p): Convert "live_svalues" from a
6008 reference to a pointer; support it being NULL.
6009 (svalue::implicitly_live_p): Convert first param from a
6010 refererence to a pointer.
6011 (region_svalue::implicitly_live_p): Likewise.
6012 (constant_svalue::implicitly_live_p): Likewise.
6013 (initial_svalue::implicitly_live_p): Likewise. Treat the initial
6014 values of params for the top level frame as still live.
6015 (initial_svalue::initial_value_of_param_p): New function, taken
6016 from a test in region_model::compare_initial_and_pointer.
6017 (unaryop_svalue::implicitly_live_p): Convert first param from a
6018 refererence to a pointer.
6019 (binop_svalue::implicitly_live_p): Likewise.
6020 (sub_svalue::implicitly_live_p): Likewise.
6021 (unmergeable_svalue::implicitly_live_p): Likewise.
6022 * svalue.h (svalue::live_p): Likewise.
6023 (svalue::implicitly_live_p): Likewise.
6024 (region_svalue::implicitly_live_p): Likewise.
6025 (constant_svalue::implicitly_live_p): Likewise.
6026 (initial_svalue::implicitly_live_p): Likewise.
6027 (initial_svalue::initial_value_of_param_p): New decl.
6028 (unaryop_svalue::implicitly_live_p): Convert first param from a
6029 refererence to a pointer.
6030 (binop_svalue::implicitly_live_p): Likewise.
6031 (sub_svalue::implicitly_live_p): Likewise.
6032 (unmergeable_svalue::implicitly_live_p): Likewise.
6034 2021-02-12 David Malcolm <dmalcolm@redhat.com>
6036 PR analyzer/98969
6037 * engine.cc (readability): Add names for the various arbitrary
6038 values. Handle NOP_EXPR and INTEGER_CST.
6039 (readability_comparator): Combine the readability tests for
6040 tree and stack depth, rather than performing them sequentially.
6041 (impl_region_model_context::on_state_leak): Strip off top-level
6042 casts.
6043 * region-model.cc (region_model::get_representative_path_var): Add
6044 type-checking, moving the bulk of the implementation to...
6045 (region_model::get_representative_path_var_1): ...here. Respect
6046 types in casts by recursing and re-adding the cast, rather than
6047 merely stripping them off. Use the correct type when handling
6048 region_svalue.
6049 (region_model::get_representative_tree): Strip off any top-level
6050 cast.
6051 (region_model::get_representative_path_var): Add type-checking,
6052 moving the bulk of the implementation to...
6053 (region_model::get_representative_path_var_1): ...here.
6054 * region-model.h (region_model::get_representative_path_var_1):
6055 New decl
6056 (region_model::get_representative_path_var_1): New decl.
6057 * store.cc (append_pathvar_with_type): New.
6058 (binding_cluster::get_representative_path_vars): Cast path_vars
6059 to the correct type when adding them to *OUT_PVS.
6061 2021-02-09 David Malcolm <dmalcolm@redhat.com>
6063 PR analyzer/98575
6064 * sm-file.cc (is_file_using_fn_p): Support "_IO_"-prefixed
6065 variants.
6067 2021-02-09 David Malcolm <dmalcolm@redhat.com>
6069 PR analyzer/98575
6070 * store.cc (store::set_value): Treat a pointer written to *UNKNOWN
6071 as having escaped.
6073 2021-02-02 David Malcolm <dmalcolm@redhat.com>
6075 PR analyzer/93355
6076 PR analyzer/96374
6077 * engine.cc (toplevel_function_p): Simplify so that
6078 we only reject functions with a "__analyzer_" prefix.
6079 (add_any_callbacks): Delete.
6080 (exploded_graph::build_initial_worklist): Update for
6081 dropped param of toplevel_function_p.
6082 (exploded_graph::build_initial_worklist): Don't bother
6083 looking for callbacks that are reachable from global
6084 initializers.
6086 2021-02-01 David Malcolm <dmalcolm@redhat.com>
6088 PR analyzer/98918
6089 * region-model-manager.cc
6090 (region_model_manager::get_or_create_initial_value):
6091 Fold the initial value of *UNKNOWN_PTR to an UNKNOWN value.
6092 (region_model_manager::get_field_region): Fold the value
6093 of UNKNOWN_PTR->FIELD to *UNKNOWN_PTR_OF_&FIELD_TYPE.
6095 2021-01-29 David Malcolm <dmalcolm@redhat.com>
6097 * checker-path.cc (event_kind_to_string): Handle
6098 EK_START_CONSOLIDATED_CFG_EDGES and
6099 EK_END_CONSOLIDATED_CFG_EDGES.
6100 (start_consolidated_cfg_edges_event::get_desc): New.
6101 (checker_path::cfg_edge_pair_at_p): New.
6102 * checker-path.h (enum event_kind): Add
6103 EK_START_CONSOLIDATED_CFG_EDGES and
6104 EK_END_CONSOLIDATED_CFG_EDGES.
6105 (class start_consolidated_cfg_edges_event): New class.
6106 (class end_consolidated_cfg_edges_event): New class.
6107 (checker_path::delete_events): New.
6108 (checker_path::replace_event): New.
6109 (checker_path::cfg_edge_pair_at_p): New decl.
6110 * diagnostic-manager.cc (diagnostic_manager::prune_path): Call
6111 consolidate_conditions.
6112 (same_line_as_p): New.
6113 (diagnostic_manager::consolidate_conditions): New.
6114 * diagnostic-manager.h
6115 (diagnostic_manager::consolidate_conditions): New decl.
6117 2021-01-18 David Malcolm <dmalcolm@redhat.com>
6119 * analyzer.h (is_std_named_call_p): New decl.
6120 * diagnostic-manager.cc (path_builder::get_sm): New.
6121 (state_change_event_creator::state_change_event_creator): Add "pb"
6122 param.
6123 (state_change_event_creator::on_global_state_change): Don't consider
6124 state changes affecting other state_machines.
6125 (state_change_event_creator::on_state_change): Likewise.
6126 (state_change_event_creator::m_pb): New field.
6127 (diagnostic_manager::add_events_for_eedge): Pass pb to visitor
6128 ctor.
6129 * region-model-impl-calls.cc
6130 (region_model::impl_deallocation_call): New.
6131 * region-model.cc: Include "attribs.h".
6132 (region_model::on_call_post): Handle fndecls referenced by
6133 __attribute__((deallocated_by(FOO))).
6134 * region-model.h (region_model::impl_deallocation_call): New decl.
6135 * sm-malloc.cc: Include "stringpool.h" and "attribs.h". Add
6136 leading comment.
6137 (class api): Delete.
6138 (enum resource_state): Update comment for change from api to
6139 deallocator and deallocator_set.
6140 (allocation_state::allocation_state): Drop api param. Add
6141 "deallocators" and "deallocator".
6142 (allocation_state::m_api): Drop field in favor of...
6143 (allocation_state::m_deallocators): New field.
6144 (allocation_state::m_deallocator): New field.
6145 (enum wording): Add WORDING_DEALLOCATED.
6146 (struct deallocator): New.
6147 (struct standard_deallocator): New.
6148 (struct custom_deallocator): New.
6149 (struct deallocator_set): New.
6150 (struct custom_deallocator_set): New.
6151 (struct standard_deallocator_set): New.
6152 (struct deallocator_set_map_traits): New.
6153 (malloc_state_machine::m_malloc): Drop field
6154 (malloc_state_machine::m_scalar_new): Likewise.
6155 (malloc_state_machine::m_vector_new): Likewise.
6156 (malloc_state_machine::m_free): New field
6157 (malloc_state_machine::m_scalar_delete): Likewise.
6158 (malloc_state_machine::m_vector_delete): Likewise.
6159 (malloc_state_machine::deallocator_map_t): New typedef.
6160 (malloc_state_machine::m_deallocator_map): New field.
6161 (malloc_state_machine::deallocator_set_cache_t): New typedef.
6162 (malloc_state_machine::m_custom_deallocator_set_cache): New field.
6163 (malloc_state_machine::custom_deallocator_set_map_t): New typedef.
6164 (malloc_state_machine::m_custom_deallocator_set_map): New field.
6165 (malloc_state_machine::m_dynamic_sets): New field.
6166 (malloc_state_machine::m_dynamic_deallocators): New field.
6167 (api::api): Delete.
6168 (deallocator::deallocator): New ctor.
6169 (deallocator::hash): New.
6170 (deallocator::dump_to_pp): New.
6171 (deallocator::cmp): New.
6172 (deallocator::cmp_ptr_ptr): New.
6173 (standard_deallocator::standard_deallocator): New ctor.
6174 (deallocator_set::deallocator_set): New ctor.
6175 (deallocator_set::dump): New.
6176 (custom_deallocator_set::custom_deallocator_set): New ctor.
6177 (custom_deallocator_set::contains_p): New.
6178 (custom_deallocator_set::maybe_get_single): New.
6179 (custom_deallocator_set::dump_to_pp): New.
6180 (standard_deallocator_set::standard_deallocator_set): New ctor.
6181 (standard_deallocator_set::contains_p): New.
6182 (standard_deallocator_set::maybe_get_single): New.
6183 (standard_deallocator_set::dump_to_pp): New.
6184 (start_p): New.
6185 (class mismatching_deallocation): Update for conversion from api
6186 to deallocator_set and deallocator.
6187 (double_free::emit): Use %qs.
6188 (class use_after_free): Update for conversion from api to
6189 deallocator_set and deallocator.
6190 (malloc_leak::describe_state_change): Only emit "allocated here" on
6191 a start->nonnull transition, rather than on other transitions to
6192 nonnull.
6193 (allocation_state::dump_to_pp): Update for conversion from api to
6194 deallocator_set.
6195 (allocation_state::get_nonnull): Likewise.
6196 (malloc_state_machine::malloc_state_machine): Likewise.
6197 (malloc_state_machine::~malloc_state_machine): New.
6198 (malloc_state_machine::add_state): Update for conversion from api
6199 to deallocator_set.
6200 (malloc_state_machine::get_or_create_custom_deallocator_set): New.
6201 (malloc_state_machine::maybe_create_custom_deallocator_set): New.
6202 (malloc_state_machine::get_or_create_deallocator): New.
6203 (malloc_state_machine::on_stmt): Update for conversion from api
6204 to deallocator_set. Handle "__attribute__((malloc(FOO)))", and
6205 the special attribute set on FOO.
6206 (malloc_state_machine::on_allocator_call): Update for conversion
6207 from api to deallocator_set. Add "returns_nonnull" param and use
6208 it to affect which state to transition to.
6209 (malloc_state_machine::on_deallocator_call): Update for conversion
6210 from api to deallocator_set.
6212 2021-01-14 David Malcolm <dmalcolm@redhat.com>
6214 * engine.cc (strongly_connected_components::to_json): New.
6215 (worklist::to_json): New.
6216 (exploded_graph::to_json): JSON-ify the worklist.
6217 * exploded-graph.h (strongly_connected_components::to_json): New
6218 decl.
6219 (worklist::to_json): New decl.
6220 * store.cc (store::to_json): Fix comment.
6221 * supergraph.cc (supernode::to_json): Fix reference to
6222 "returning_call" in comment. Add optional "fun" to JSON.
6223 (edge_kind_to_string): New.
6224 (superedge::to_json): Add "kind" to JSON.
6226 2021-01-14 David Malcolm <dmalcolm@redhat.com>
6228 PR analyzer/98679
6229 * analyzer.h (region_offset::operator==): Make const.
6230 * pending-diagnostic.h (pending_diagnostic::equal_p): Likewise.
6231 * store.h (binding_cluster::for_each_value): Likewise.
6232 (binding_cluster::for_each_binding): Likewise.
6234 2021-01-12 David Malcolm <dmalcolm@redhat.com>
6236 PR analyzer/98628
6237 * store.cc (binding_cluster::make_unknown_relative_to): Don't mark
6238 dereferenced unknown pointers as having escaped.
6240 2021-01-07 David Malcolm <dmalcolm@redhat.com>
6242 PR analyzer/98580
6243 * region.cc (decl_region::get_svalue_for_initializer): Gracefully
6244 handle when LTO writes out DECL_INITIAL as error_mark_node.
6246 2021-01-07 David Malcolm <dmalcolm@redhat.com>
6248 PR analyzer/97074
6249 * store.cc (binding_cluster::can_merge_p): Add "out_store" param
6250 and pass to calls to binding_cluster::make_unknown_relative_to.
6251 (binding_cluster::make_unknown_relative_to): Add "out_store"
6252 param. Use it to mark base regions that are pointed to by
6253 pointers that become unknown as having escaped.
6254 (store::can_merge_p): Pass out_store to
6255 binding_cluster::can_merge_p.
6256 * store.h (binding_cluster::can_merge_p): Add "out_store" param.
6257 (binding_cluster::make_unknown_relative_to): Likewise.
6258 * svalue.cc (region_svalue::implicitly_live_p): New vfunc.
6259 * svalue.h (region_svalue::implicitly_live_p): New vfunc decl.
6261 2021-01-07 David Malcolm <dmalcolm@redhat.com>
6263 PR analyzer/98564
6264 * engine.cc (exploded_path::feasible_p): Add missing call to
6265 bitmap_clear.
6267 2021-01-06 David Malcolm <dmalcolm@redhat.com>
6269 PR analyzer/97072
6270 * region-model-reachability.cc (reachable_regions::init_cluster):
6271 Convert symbolic region handling to a switch statement. Add cases
6272 to handle SK_UNKNOWN and SK_CONJURED.
6274 2021-01-05 David Malcolm <dmalcolm@redhat.com>
6276 PR analyzer/98293
6277 * store.cc (binding_map::apply_ctor_to_region): When "index" is
6278 NULL, iterate through the fields for RECORD_TYPEs, rather than
6279 creating an INTEGER_CST index.
6281 2020-11-30 David Malcolm <dmalcolm@redhat.com>
6283 * analyzer-pass.cc: Include "analyzer/analyzer.h" for the
6284 declaration of sorry_no_analyzer; include "tree.h" and
6285 "function.h" as these are needed by it.
6287 2020-11-30 David Malcolm <dmalcolm@redhat.com>
6289 * analyzer-pass.cc (pass_analyzer::execute): Move sorry call to...
6290 (sorry_no_analyzer): New.
6291 * analyzer.h (class state_machine): New forward decl.
6292 (class logger): New forward decl.
6293 (class plugin_analyzer_init_iface): New.
6294 (sorry_no_analyzer): New decl.
6295 * checker-path.cc (checker_path::fixup_locations): New.
6296 * checker-path.h (checker_event::set_location): New.
6297 (checker_path::fixup_locations): New decl.
6298 * diagnostic-manager.cc
6299 (diagnostic_manager::emit_saved_diagnostic): Call
6300 checker_path::fixup_locations, and call fixup_location
6301 on the primary location.
6302 * engine.cc: Include "plugin.h".
6303 (class plugin_analyzer_init_impl): New.
6304 (impl_run_checkers): Invoke PLUGIN_ANALYZER_INIT callbacks.
6305 * pending-diagnostic.h (pending_diagnostic::fixup_location): New
6306 vfunc.
6308 2020-11-18 David Malcolm <dmalcolm@redhat.com>
6310 PR analyzer/97893
6311 * sm-malloc.cc (null_deref::emit): Use CWE-476 rather than
6312 CWE-690, as this isn't due to an unchecked return value.
6313 (null_arg::emit): Likewise.
6315 2020-11-12 David Malcolm <dmalcolm@redhat.com>
6317 * checker-path.h (checker_event::get_id_ptr): New.
6318 * diagnostic-manager.cc (path_builder::path_builder): Add "sd"
6319 param and use it to initialize new field "m_sd".
6320 (path_builder::get_pending_diagnostic): New.
6321 (path_builder::m_sd): New field.
6322 (diagnostic_manager::emit_saved_diagnostic): Pass sd to
6323 path_builder ctor.
6324 (diagnostic_manager::add_events_for_superedge): Call new
6325 maybe_add_custom_events_for_superedge vfunc.
6326 * engine.cc (stale_jmp_buf::stale_jmp_buf): Add "setjmp_point"
6327 param and use it to initialize new field "m_setjmp_point".
6328 Initialize new field "m_stack_pop_event".
6329 (stale_jmp_buf::maybe_add_custom_events_for_superedge): New vfunc
6330 implementation.
6331 (stale_jmp_buf::describe_final_event): New vfunc implementation.
6332 (stale_jmp_buf::m_setjmp_point): New field.
6333 (stale_jmp_buf::m_stack_pop_event): New field.
6334 (exploded_node::on_longjmp): Pass setjmp_point to stale_jmp_buf
6335 ctor.
6336 * pending-diagnostic.h
6337 (pending_diagnostic::maybe_add_custom_events_for_superedge): New
6338 vfunc.
6340 2020-11-12 David Malcolm <dmalcolm@redhat.com>
6342 PR tree-optimization/97424
6343 * analyzer.opt (Wanalyzer-shift-count-negative): New.
6344 (Wanalyzer-shift-count-overflow): New.
6345 * region-model.cc (class shift_count_negative_diagnostic): New.
6346 (class shift_count_overflow_diagnostic): New.
6347 (region_model::get_gassign_result): Complain about shift counts that
6348 are negative or are >= the operand's type's width.
6350 2020-11-10 Martin Liska <mliska@suse.cz>
6352 * constraint-manager.cc (constraint_manager::merge): Remove
6353 unused code.
6354 * constraint-manager.h: Likewise.
6355 * program-state.cc (sm_state_map::sm_state_map): Likewise.
6356 (program_state::program_state): Likewise.
6357 (test_sm_state_map): Likewise.
6358 * program-state.h: Likewise.
6359 * region-model-reachability.cc (reachable_regions::reachable_regions): Likewise.
6360 * region-model-reachability.h: Likewise.
6361 * region-model.cc (region_model::handle_unrecognized_call): Likewise.
6362 (region_model::get_reachable_svalues): Likewise.
6363 (region_model::can_merge_with_p): Likewise.
6365 2020-11-05 David Malcolm <dmalcolm@redhat.com>
6367 PR analyzer/97668
6368 * svalue.cc (cmp_cst): Handle COMPLEX_CST.
6370 2020-10-29 David Malcolm <dmalcolm@redhat.com>
6372 * program-state.cc (sm_state_map::on_liveness_change): Sort the
6373 leaking svalues before calling on_state_leak.
6374 (program_state::detect_leaks): Likewise when calling
6375 on_svalue_leak.
6376 * region-model-reachability.cc
6377 (reachable_regions::mark_escaped_clusters): Likewise when
6378 calling on_escaped_function.
6380 2020-10-29 David Malcolm <dmalcolm@redhat.com>
6382 PR analyzer/97608
6383 * region-model-reachability.cc (reachable_regions::handle_sval):
6384 Operands of reachable reversible operations are reachable.
6386 2020-10-29 David Malcolm <dmalcolm@redhat.com>
6388 * analyzer.h (class state_machine): New forward decl.
6389 (class logger): Likewise.
6390 (class visitor): Likewise.
6391 * complexity.cc: New file, taken from svalue.cc.
6392 * complexity.h: New file, taken from region-model.h.
6393 * region-model.h: Include "analyzer/svalue.h" and
6394 "analyzer/region.h". Move struct complexity to complexity.h.
6395 Move svalue, its subclasses and supporting decls to svalue.h.
6396 Move region, its subclasses and supporting decls to region.h.
6397 * region.cc: Include "analyzer/region.h".
6398 (symbolic_region::symbolic_region): Move here from region-model.h.
6399 * region.h: New file, based on material from region-model.h.
6400 * svalue.cc: Include "analyzer/svalue.h".
6401 (complexity::complexity): Move to complexity.cc.
6402 (complexity::from_pair): Likewise.
6403 * svalue.h: New file, based on material from region-model.h.
6405 2020-10-29 David Malcolm <dmalcolm@redhat.com>
6407 * program-state.cc (sm_state_map::print): Guard the printing of
6408 the origin pointer with !flag_dump_noaddr.
6409 * region.cc (string_region::dump_to_pp): Likewise for
6410 m_string_cst.
6412 2020-10-27 David Malcolm <dmalcolm@redhat.com>
6414 PR analyzer/97568
6415 * region-model.cc (region_model::get_initial_value_for_global):
6416 Move check that !DECL_EXTERNAL from here to...
6417 * region.cc (decl_region::get_svalue_for_initializer): ...here,
6418 using it to reject zero initialization.
6420 2020-10-27 Markus Böck <markus.boeck02@gmail.com>
6422 PR analyzer/96608
6423 * store.h (hash): Cast to intptr_t instead of long
6425 2020-10-27 David Malcolm <dmalcolm@redhat.com>
6427 * constraint-manager.cc (svalue_cmp_by_ptr): Delete.
6428 (equiv_class::canonicalize): Use svalue::cmp_ptr_ptr instead.
6429 (equiv_class_cmp): Eliminate pointer comparison.
6430 * diagnostic-manager.cc (dedupe_key::comparator): If they are at
6431 the same location, also compare epath ength and pending_diagnostic
6432 kind.
6433 * engine.cc (readability_comparator): If two path_vars have the
6434 same readability, then impose an arbitrary ordering on them.
6435 (worklist::key_t::cmp): If two points have the same plan ordering,
6436 continue the comparison. Call sm_state_map::cmp rather than
6437 comparing hash values.
6438 * program-state.cc (sm_state_map::entry_t::cmp): New.
6439 (sm_state_map::cmp): New.
6440 * program-state.h (sm_state_map::entry_t::cmp): New decl.
6441 (sm_state_map::elements): New.
6442 (sm_state_map::cmp): New.
6444 2020-10-27 David Malcolm <dmalcolm@redhat.com>
6446 * engine.cc (setjmp_record::cmp): New.
6447 (supernode_cluster::dump_dot): Avoid embedding pointer in cluster
6448 name.
6449 (supernode_cluster::cmp_ptr_ptr): New.
6450 (function_call_string_cluster::dump_dot): Avoid embedding pointer
6451 in cluster name. Sort m_map when dumping child clusters.
6452 (function_call_string_cluster::cmp_ptr_ptr): New.
6453 (root_cluster::dump_dot): Sort m_map when dumping child clusters.
6454 * program-point.cc (function_point::cmp): New.
6455 (function_point::cmp_ptr): New.
6456 * program-point.h (function_point::cmp): New decl.
6457 (function_point::cmp_ptr): New decl.
6458 * program-state.cc (sm_state_map::print): Sort the values. Guard
6459 the printing of pointers with !flag_dump_noaddr.
6460 (program_state::prune_for_point): Sort the regions.
6461 (log_set_of_svalues): Sort the values. Guard the printing of
6462 pointers with !flag_dump_noaddr.
6463 * region-model-manager.cc (log_uniq_map): Sort the values.
6464 * region-model-reachability.cc (dump_set): New function template.
6465 (reachable_regions::dump_to_pp): Use it.
6466 * region-model.h (svalue::cmp_ptr): New decl.
6467 (svalue::cmp_ptr_ptr): New decl.
6468 (setjmp_record::cmp): New decl.
6469 (placeholder_svalue::get_name): New accessor.
6470 (widening_svalue::get_point): New accessor.
6471 (compound_svalue::get_map): New accessor.
6472 (conjured_svalue::get_stmt): New accessor.
6473 (conjured_svalue::get_id_region): New accessor.
6474 (region::cmp_ptrs): Rename to...
6475 (region::cmp_ptr_ptr): ...this.
6476 * region.cc (region::cmp_ptrs): Rename to...
6477 (region::cmp_ptr_ptr): ...this.
6478 * state-purge.cc
6479 (state_purge_per_ssa_name::state_purge_per_ssa_name): Sort
6480 m_points_needing_name when dumping.
6481 * store.cc (concrete_binding::cmp_ptr_ptr): New.
6482 (symbolic_binding::cmp_ptr_ptr): New.
6483 (binding_map::cmp): New.
6484 (get_sorted_parent_regions): Update for renaming of
6485 region::cmp_ptrs to region::cmp_ptr_ptr.
6486 (store::dump_to_pp): Likewise.
6487 (store::to_json): Likewise.
6488 (store::can_merge_p): Sort the base regions before considering
6489 them.
6490 * store.h (concrete_binding::cmp_ptr_ptr): New decl.
6491 (symbolic_binding::cmp_ptr_ptr): New decl.
6492 (binding_map::cmp): New decl.
6493 * supergraph.cc (supergraph::supergraph): Assign UIDs to the
6494 gimple stmts.
6495 * svalue.cc (cmp_cst): New.
6496 (svalue::cmp_ptr): New.
6497 (svalue::cmp_ptr_ptr): New.
6499 2020-10-27 David Malcolm <dmalcolm@redhat.com>
6501 * engine.cc (exploded_graph::get_or_create_node): Fix off-by-one
6502 when imposing param_analyzer_max_enodes_per_program_point limit.
6504 2020-10-27 David Malcolm <dmalcolm@redhat.com>
6506 * region-model.cc (region_model::get_representative_path_var):
6507 Implement case RK_LABEL.
6508 * region-model.h (label_region::get_label): New accessor.
6510 2020-10-22 David Malcolm <dmalcolm@redhat.com>
6512 PR analyzer/97514
6513 * engine.cc (exploded_graph::add_function_entry): Handle failure
6514 to create an enode, rather than asserting.
6516 2020-10-22 David Malcolm <dmalcolm@redhat.com>
6518 PR analyzer/97489
6519 * engine.cc (exploded_graph::add_function_entry): Assert that we
6520 have a function body.
6521 (exploded_graph::on_escaped_function): Reject fndecls that don't
6522 have a function body.
6524 2020-10-14 David Malcolm <dmalcolm@redhat.com>
6526 PR analyzer/93388
6527 * region-model.cc (region_model::get_initial_value_for_global):
6528 Fall back to returning an initial_svalue if
6529 decl_region::get_svalue_for_initializer fails.
6530 * region.cc (decl_region::get_svalue_for_initializer): Don't
6531 attempt to create a compound_svalue if the region has an unknown
6532 size.
6534 2020-10-14 David Malcolm <dmalcolm@redhat.com>
6536 PR analyzer/93723
6537 * store.cc (binding_map::apply_ctor_to_region): Remove redundant
6538 assertion.
6540 2020-10-12 David Malcolm <dmalcolm@redhat.com>
6542 PR analyzer/97258
6543 * engine.cc (impl_region_model_context::on_escaped_function): New
6544 vfunc.
6545 (exploded_graph::add_function_entry): Use m_functions_with_enodes
6546 to implement idempotency.
6547 (add_any_callbacks): New.
6548 (exploded_graph::build_initial_worklist): Use the above to find
6549 callbacks that are reachable from global initializers.
6550 (exploded_graph::on_escaped_function): New.
6551 * exploded-graph.h
6552 (impl_region_model_context::on_escaped_function): New decl.
6553 (exploded_graph::on_escaped_function): New decl.
6554 (exploded_graph::m_functions_with_enodes): New field.
6555 * region-model-reachability.cc
6556 (reachable_regions::reachable_regions): Replace "store" param with
6557 "model" param; use it to initialize m_model.
6558 (reachable_regions::add): When getting the svalue for the region,
6559 call get_store_value on the model rather than using an initial
6560 value.
6561 (reachable_regions::mark_escaped_clusters): Add ctxt param and
6562 use it to call on_escaped_function when a function_region escapes.
6563 * region-model-reachability.h
6564 (reachable_regions::reachable_regions): Replace "store" param with
6565 "model" param.
6566 (reachable_regions::mark_escaped_clusters): Add ctxt param.
6567 (reachable_regions::m_model): New field.
6568 * region-model.cc (region_model::handle_unrecognized_call): Update
6569 for change in reachable_regions ctor.
6570 (region_model::handle_unrecognized_call): Pass ctxt to
6571 mark_escaped_clusters.
6572 (region_model::get_reachable_svalues): Update for change in
6573 reachable_regions ctor.
6574 (region_model::get_initial_value_for_global): Read-only variables
6575 keep their initial values.
6576 * region-model.h (region_model_context::on_escaped_function): New
6577 vfunc.
6578 (noop_region_model_context::on_escaped_function): New.
6580 2020-10-12 David Malcolm <dmalcolm@redhat.com>
6582 * analyzer.opt (Wanalyzer-write-to-const): New.
6583 (Wanalyzer-write-to-string-literal): New.
6584 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
6585 Call check_for_writable_region.
6586 (region_model::impl_call_memset): Likewise.
6587 (region_model::impl_call_strcpy): Likewise.
6588 * region-model.cc (class write_to_const_diagnostic): New.
6589 (class write_to_string_literal_diagnostic): New.
6590 (region_model::check_for_writable_region): New.
6591 (region_model::set_value): Call check_for_writable_region.
6592 * region-model.h (region_model::check_for_writable_region): New
6593 decl.
6595 2020-10-07 David Malcolm <dmalcolm@redhat.com>
6597 PR analyzer/97116
6598 * sm-malloc.cc (method_p): New.
6599 (describe_argument_index): New.
6600 (inform_nonnull_attribute): Use describe_argument_index.
6601 (possible_null_arg::describe_final_event): Likewise.
6602 (null_arg::describe_final_event): Likewise.
6604 2020-09-29 David Malcolm <dmalcolm@redhat.com>
6606 PR analyzer/95188
6607 * engine.cc (stmt_requires_new_enode_p): Split enodes before
6608 "signal" calls.
6610 2020-09-29 David Malcolm <dmalcolm@redhat.com>
6612 * constraint-manager.cc
6613 (constraint_manager::add_constraint_internal): Whitespace fixes.
6614 Silence -Wsign-compare warning.
6615 * engine.cc (maybe_process_run_of_before_supernode_enodes):
6616 Silence -Wsign-compare warning.
6618 2020-09-28 David Malcolm <dmalcolm@redhat.com>
6620 * region-model.h (binop_svalue::dyn_cast_binop_svalue): Remove
6621 redundant "virtual". Add FINAL OVERRIDE.
6622 (widening_svalue::dyn_cast_widening_svalue): Add FINAL OVERRIDE.
6623 (compound_svalue::dyn_cast_compound_svalue): Likewise.
6624 (conjured_svalue::dyn_cast_conjured_svalue): Likewise.
6626 2020-09-28 David Malcolm <dmalcolm@redhat.com>
6628 * diagnostic-manager.cc (null_assignment_sm_context::m_visitor):
6629 Remove unused field.
6631 2020-09-28 David Malcolm <dmalcolm@redhat.com>
6633 PR analyzer/97233
6634 * analyzer.cc (is_longjmp_call_p): Require the initial argument
6635 to be a pointer.
6636 * engine.cc (exploded_node::on_longjmp): Likewise.
6638 2020-09-28 David Malcolm <dmalcolm@redhat.com>
6640 * program-state.cc (sm_state_map::print): Update check
6641 for m_global_state being the start state.
6643 2020-09-26 David Malcolm <dmalcolm@redhat.com>
6645 PR analyzer/96646
6646 PR analyzer/96841
6647 * region-model.cc (region_model::get_representative_path_var):
6648 When handling offset_region, wrap the MEM_REF's first argument in
6649 an ADDR_EXPR of pointer type, rather than simply using the tree
6650 for the parent region. Require the MEM_REF's second argument to
6651 be an integer constant.
6653 2020-09-24 David Malcolm <dmalcolm@redhat.com>
6655 * analyzer.h (struct rejected_constraint): New decl.
6656 * analyzer.opt (fanalyzer-feasibility): New option.
6657 * diagnostic-manager.cc (path_builder::path_builder): Add
6658 "problem" param and use it to initialize new field.
6659 (path_builder::get_feasibility_problem): New accessor.
6660 (path_builder::m_feasibility_problem): New field.
6661 (dedupe_winners::add): Remove inversion of logic in "if" clause,
6662 swapping if/else suites. In the !feasible_p suite, inspect
6663 flag_analyzer_feasibility and add code to handle when this
6664 is off, accepting the infeasible path, but recording the
6665 feasibility_problem.
6666 (diagnostic_manager::emit_saved_diagnostic): Pass the
6667 feasibility_problem to the path_builder.
6668 (diagnostic_manager::add_events_for_eedge): If we have
6669 a feasibility_problem at this edge, use it to add a custom event.
6670 * engine.cc (exploded_path::feasible_p): Pass a
6671 rejected_constraint ** to model.maybe_update_for_edge and transfer
6672 ownership of any created instance to any feasibility_problem.
6673 (feasibility_problem::dump_to_pp): New.
6674 * exploded-graph.h (feasibility_problem::feasibility_problem):
6675 Drop "model" param; add rejected_constraint * param.
6676 (feasibility_problem::~feasibility_problem): New.
6677 (feasibility_problem::dump_to_pp): New decl.
6678 (feasibility_problem::m_model): Drop field.
6679 (feasibility_problem::m_rc): New field.
6680 * program-point.cc (function_point::get_location): Handle
6681 PK_BEFORE_SUPERNODE and PK_AFTER_SUPERNODE.
6682 * program-state.cc (program_state::on_edge): Pass NULL to new
6683 param of region_model::maybe_update_for_edge.
6684 * region-model.cc (region_model::add_constraint): New overload
6685 adding a rejected_constraint ** param.
6686 (region_model::maybe_update_for_edge): Add rejected_constraint **
6687 param and pass it to the various apply_constraints_for_ calls.
6688 (region_model::apply_constraints_for_gcond): Add
6689 rejected_constraint ** param and pass it to add_constraint calls.
6690 (region_model::apply_constraints_for_gswitch): Likewise.
6691 (region_model::apply_constraints_for_exception): Likewise.
6692 (rejected_constraint::dump_to_pp): New.
6693 * region-model.h (region_model::maybe_update_for_edge):
6694 Add rejected_constraint ** param.
6695 (region_model::add_constraint): New overload adding a
6696 rejected_constraint ** param.
6697 (region_model::apply_constraints_for_gcond): Add
6698 rejected_constraint ** param.
6699 (region_model::apply_constraints_for_gswitch): Likewise.
6700 (region_model::apply_constraints_for_exception): Likewise.
6701 (struct rejected_constraint): New.
6703 2020-09-23 David Malcolm <dmalcolm@redhat.com>
6705 PR analyzer/97178
6706 * engine.cc (impl_run_checkers): Update for change to ext_state
6707 ctor.
6708 * program-state.cc (selftest::test_sm_state_map): Pass an engine
6709 instance to ext_state ctor.
6710 (selftest::test_program_state_1): Likewise.
6711 (selftest::test_program_state_2): Likewise.
6712 (selftest::test_program_state_merging): Likewise.
6713 (selftest::test_program_state_merging_2): Likewise.
6714 * program-state.h (extrinsic_state::extrinsic_state): Remove NULL
6715 default value for "eng" param.
6717 2020-09-23 Tobias Burnus <tobias@codesourcery.com>
6719 * analyzer-logging.cc: Guard '#pragma ... ignored "-Wformat-diag"'
6720 by '#if __GNUC__ >= 10'
6721 * analyzer.h: Likewise.
6722 * call-string.cc: Likewise.
6724 2020-09-23 David Malcolm <dmalcolm@redhat.com>
6726 * engine.cc (exploded_node::on_stmt): Replace sequence of dyn_cast
6727 with switch.
6729 2020-09-22 David Malcolm <dmalcolm@redhat.com>
6731 * analysis-plan.cc: Include "json.h".
6732 * analyzer.opt (fdump-analyzer-json): New.
6733 * call-string.cc: Include "json.h".
6734 (call_string::to_json): New.
6735 * call-string.h (call_string::to_json): New decl.
6736 * checker-path.cc: Include "json.h".
6737 * constraint-manager.cc: Include "json.h".
6738 (equiv_class::to_json): New.
6739 (constraint::to_json): New.
6740 (constraint_manager::to_json): New.
6741 * constraint-manager.h (equiv_class::to_json): New decl.
6742 (constraint::to_json): New decl.
6743 (constraint_manager::to_json): New decl.
6744 * diagnostic-manager.cc: Include "json.h".
6745 (saved_diagnostic::to_json): New.
6746 (diagnostic_manager::to_json): New.
6747 * diagnostic-manager.h (saved_diagnostic::to_json): New decl.
6748 (diagnostic_manager::to_json): New decl.
6749 * engine.cc: Include "json.h", <zlib.h>.
6750 (exploded_node::status_to_str): New.
6751 (exploded_node::to_json): New.
6752 (exploded_edge::to_json): New.
6753 (exploded_graph::to_json): New.
6754 (dump_analyzer_json): New.
6755 (impl_run_checkers): Call it.
6756 * exploded-graph.h (exploded_node::status_to_str): New decl.
6757 (exploded_node::to_json): New.
6758 (exploded_edge::to_json): New.
6759 (exploded_graph::to_json): New.
6760 * pending-diagnostic.cc: Include "json.h".
6761 * program-point.cc: Include "json.h".
6762 (program_point::to_json): New.
6763 * program-point.h (program_point::to_json): New decl.
6764 * program-state.cc: Include "json.h".
6765 (extrinsic_state::to_json): New.
6766 (sm_state_map::to_json): New.
6767 (program_state::to_json): New.
6768 * program-state.h (extrinsic_state::to_json): New decl.
6769 (sm_state_map::to_json): New decl.
6770 (program_state::to_json): New decl.
6771 * region-model-impl-calls.cc: Include "json.h".
6772 * region-model-manager.cc: Include "json.h".
6773 * region-model-reachability.cc: Include "json.h".
6774 * region-model.cc: Include "json.h".
6775 * region-model.h (svalue::to_json): New decl.
6776 (region::to_json): New decl.
6777 * region.cc: Include "json.h".
6778 (region::to_json: New.
6779 * sm-file.cc: Include "json.h".
6780 * sm-malloc.cc: Include "json.h".
6781 * sm-pattern-test.cc: Include "json.h".
6782 * sm-sensitive.cc: Include "json.h".
6783 * sm-signal.cc: Include "json.h".
6784 (signal_delivery_edge_info_t::to_json): New.
6785 * sm-taint.cc: Include "json.h".
6786 * sm.cc: Include "diagnostic.h", "tree-diagnostic.h", and
6787 "json.h".
6788 (state_machine::state::to_json): New.
6789 (state_machine::to_json): New.
6790 * sm.h (state_machine::state::to_json): New.
6791 (state_machine::to_json): New.
6792 * state-purge.cc: Include "json.h".
6793 * store.cc: Include "json.h".
6794 (binding_key::get_desc): New.
6795 (binding_map::to_json): New.
6796 (binding_cluster::to_json): New.
6797 (store::to_json): New.
6798 * store.h (binding_key::get_desc): New decl.
6799 (binding_map::to_json): New decl.
6800 (binding_cluster::to_json): New decl.
6801 (store::to_json): New decl.
6802 * supergraph.cc: Include "json.h".
6803 (supergraph::to_json): New.
6804 (supernode::to_json): New.
6805 (superedge::to_json): New.
6806 * supergraph.h (supergraph::to_json): New decl.
6807 (supernode::to_json): New decl.
6808 (superedge::to_json): New decl.
6809 * svalue.cc: Include "json.h".
6810 (svalue::to_json): New.
6812 2020-09-21 David Malcolm <dmalcolm@redhat.com>
6814 PR analyzer/97130
6815 * region-model-impl-calls.cc (call_details::get_arg_type): New.
6816 * region-model.cc (region_model::on_call_pre): Check that the
6817 initial arg is a pointer before calling impl_call_memset and
6818 impl_call_strlen.
6819 * region-model.h (call_details::get_arg_type): New decl.
6821 2020-09-21 David Malcolm <dmalcolm@redhat.com>
6823 PR analyzer/93355
6824 * sm-malloc.cc (malloc_state_machine::get_default_state): Look at
6825 the base region when considering pointers. Treat pointers to
6826 decls as being non-heap.
6828 2020-09-18 David Malcolm <dmalcolm@redhat.com>
6830 * checker-path.cc (warning_event::get_desc): Handle global state
6831 changes.
6833 2020-09-18 David Malcolm <dmalcolm@redhat.com>
6835 * sm-malloc.cc (malloc_state_machine::on_stmt): Handle strdup and
6836 strndup as being malloc-like allocators.
6838 2020-09-16 David Malcolm <dmalcolm@redhat.com>
6840 * engine.cc (strongly_connected_components::strong_connect): Only
6841 consider intraprocedural edges when creating SCCs.
6842 (worklist::key_t::cmp): Add comment. Treat call_string
6843 differences as more important than differences of program_point
6844 within a supernode.
6846 2020-09-16 David Malcolm <dmalcolm@redhat.com>
6848 * engine.cc (supernode_cluster::dump_dot): Show the SCC id
6849 in the per-supernode clusters in FILENAME.eg.dot output.
6850 (exploded_graph_annotator::add_node_annotations):
6851 Show the SCC of the supernode in FILENAME.supernode.eg.dot output.
6852 * exploded-graph.h (worklist::scc_id): New.
6853 (exploded_graph::get_scc_id): New.
6855 2020-09-16 David Malcolm <dmalcolm@redhat.com>
6857 * engine.cc (exploded_node::dump_dot): Show STATUS_BULK_MERGED.
6858 (exploded_graph::process_worklist): Call
6859 maybe_process_run_of_before_supernode_enodes.
6860 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
6861 New.
6862 (exploded_graph_annotator::print_enode): Show STATUS_BULK_MERGED.
6863 * exploded-graph.h (enum exploded_node::status): Add
6864 STATUS_BULK_MERGED.
6866 2020-09-16 David Malcolm <dmalcolm@redhat.com>
6868 * engine.cc
6869 (exploded_graph::process_node) <case PK_BEFORE_SUPERNODE>:
6870 Simplify by using program_point::get_next.
6871 * program-point.cc (program_point::get_next): New.
6872 * program-point.h (program_point::get_next): New decl.
6874 2020-09-16 David Malcolm <dmalcolm@redhat.com>
6876 * engine.cc (exploded_graph::get_or_create_node): Show the
6877 program point when issuing -Wanalyzer-too-complex due to hitting
6878 the per-program-point limit.
6880 2020-09-16 David Malcolm <dmalcolm@redhat.com>
6882 * region-model.cc (region_model::on_call_pre): Treat getchar as
6883 having no side-effects.
6885 2020-09-15 David Malcolm <dmalcolm@redhat.com>
6887 PR analyzer/96650
6888 * constraint-manager.cc (merger_fact_visitor::on_fact): Replace
6889 assertion that add_constraint succeeded with an assertion that
6890 if it fails, -fanalyzer-transitivity is off.
6892 2020-09-14 David Malcolm <dmalcolm@redhat.com>
6894 * analyzer.opt (-param=analyzer-max-constraints=): New param.
6895 * constraint-manager.cc
6896 (constraint_manager::add_constraint_internal): Silently reject
6897 attempts to add constraints when the above limit is reached.
6899 2020-09-14 David Malcolm <dmalcolm@redhat.com>
6901 PR analyzer/96653
6902 * constraint-manager.cc
6903 (constraint_manager::get_or_add_equiv_class): Don't accumulate
6904 transitive closure of all constraints on constants.
6906 2020-09-14 David Malcolm <dmalcolm@redhat.com>
6908 PR analyzer/97029
6909 * analyzer.cc (is_setjmp_call_p): Require the initial arg to be a
6910 pointer.
6911 * region-model.cc (region_model::deref_rvalue): Assert that the
6912 svalue is of pointer type.
6914 2020-09-11 David Malcolm <dmalcolm@redhat.com>
6916 PR analyzer/96798
6917 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
6918 New.
6919 (region_model::impl_call_strcpy): New.
6920 * region-model.cc (region_model::on_call_pre): Flag unhandled
6921 builtins that are non-pure as having unknown side-effects.
6922 Implement BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_STRCPY,
6923 BUILT_IN_STRCPY_CHK, BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED,
6924 BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_FPUTC,
6925 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
6926 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
6927 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR,
6928 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED,
6929 BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF.
6930 * region-model.h (region_model::impl_call_memcpy): New decl.
6931 (region_model::impl_call_strcpy): New decl.
6933 2020-09-09 David Malcolm <dmalcolm@redhat.com>
6935 PR analyzer/94355
6936 * analyzer.opt (Wanalyzer-mismatching-deallocation): New warning.
6937 * region-model-impl-calls.cc
6938 (region_model::impl_call_operator_new): New.
6939 (region_model::impl_call_operator_delete): New.
6940 * region-model.cc (region_model::on_call_pre): Detect operator new
6941 and operator delete.
6942 (region_model::on_call_post): Likewise.
6943 (region_model::maybe_update_for_edge): Detect EH edges and call...
6944 (region_model::apply_constraints_for_exception): New function.
6945 * region-model.h (region_model::impl_call_operator_new): New decl.
6946 (region_model::impl_call_operator_delete): New decl.
6947 (region_model::apply_constraints_for_exception): New decl.
6948 * sm-malloc.cc (enum resource_state): New.
6949 (struct allocation_state): New state subclass.
6950 (enum wording): New.
6951 (struct api): New.
6952 (malloc_state_machine::custom_data_t): New typedef.
6953 (malloc_state_machine::add_state): New decl.
6954 (malloc_state_machine::m_unchecked)
6955 (malloc_state_machine::m_nonnull)
6956 (malloc_state_machine::m_freed): Delete these states in favor
6957 of...
6958 (malloc_state_machine::m_malloc)
6959 (malloc_state_machine::m_scalar_new)
6960 (malloc_state_machine::m_vector_new): ...this new api instances,
6961 which own their own versions of these states.
6962 (malloc_state_machine::on_allocator_call): New decl.
6963 (malloc_state_machine::on_deallocator_call): New decl.
6964 (api::api): New ctor.
6965 (dyn_cast_allocation_state): New.
6966 (as_a_allocation_state): New.
6967 (get_rs): New.
6968 (unchecked_p): New.
6969 (nonnull_p): New.
6970 (freed_p): New.
6971 (malloc_diagnostic::describe_state_change): Use unchecked_p and
6972 nonnull_p.
6973 (class mismatching_deallocation): New.
6974 (double_free::double_free): Add funcname param for initializing
6975 m_funcname.
6976 (double_free::emit): Use m_funcname in warning message rather
6977 than hardcoding "free".
6978 (double_free::describe_state_change): Likewise. Use freed_p.
6979 (double_free::describe_call_with_state): Use freed_p.
6980 (double_free::describe_final_event): Use m_funcname in message
6981 rather than hardcoding "free".
6982 (double_free::m_funcname): New field.
6983 (possible_null::describe_state_change): Use unchecked_p.
6984 (possible_null::describe_return_of_state): Likewise.
6985 (use_after_free::use_after_free): Add param for initializing m_api.
6986 (use_after_free::emit): Use m_api->m_dealloc_funcname in message
6987 rather than hardcoding "free".
6988 (use_after_free::describe_state_change): Use freed_p. Change the
6989 wording of the message based on the API.
6990 (use_after_free::describe_final_event): Use
6991 m_api->m_dealloc_funcname in message rather than hardcoding
6992 "free". Change the wording of the message based on the API.
6993 (use_after_free::m_api): New field.
6994 (malloc_leak::describe_state_change): Use unchecked_p. Update
6995 for renaming of m_malloc_event to m_alloc_event.
6996 (malloc_leak::describe_final_event): Update for renaming of
6997 m_malloc_event to m_alloc_event.
6998 (malloc_leak::m_malloc_event): Rename...
6999 (malloc_leak::m_alloc_event): ...to this.
7000 (free_of_non_heap::free_of_non_heap): Add param for initializing
7001 m_funcname.
7002 (free_of_non_heap::emit): Use m_funcname in message rather than
7003 hardcoding "free".
7004 (free_of_non_heap::describe_final_event): Likewise.
7005 (free_of_non_heap::m_funcname): New field.
7006 (allocation_state::dump_to_pp): New.
7007 (allocation_state::get_nonnull): New.
7008 (malloc_state_machine::malloc_state_machine): Update for changes
7009 to state fields and new api fields.
7010 (malloc_state_machine::add_state): New.
7011 (malloc_state_machine::on_stmt): Move malloc/calloc handling to
7012 on_allocator_call and call it, passing in the API pointer.
7013 Likewise for free, moving it to on_deallocator_call. Handle calls
7014 to operator new and delete in an analogous way. Use unchecked_p
7015 when testing for possibly-null-arg and possibly-null-deref, and
7016 transition to the non-null for the correct API. Remove redundant
7017 node param from call to on_zero_assignment. Use freed_p for
7018 use-after-free check, and pass in API.
7019 (malloc_state_machine::on_allocator_call): New, based on code in
7020 on_stmt.
7021 (malloc_state_machine::on_deallocator_call): Likewise.
7022 (malloc_state_machine::on_phi): Mark node param with
7023 ATTRIBUTE_UNUSED; don't pass it to on_zero_assignment.
7024 (malloc_state_machine::on_condition): Mark node param with
7025 ATTRIBUTE_UNUSED. Replace on_transition calls with get_state and
7026 set_next_state pairs, transitioning to the non-null state for the
7027 appropriate API.
7028 (malloc_state_machine::can_purge_p): Port to new state approach.
7029 (malloc_state_machine::on_zero_assignment): Replace on_transition
7030 calls with get_state and set_next_state pairs. Drop redundant
7031 node param.
7032 * sm.h (state_machine::add_custom_state): New.
7034 2020-09-09 David Malcolm <dmalcolm@redhat.com>
7036 * diagnostic-manager.cc
7037 (null_assignment_sm_context::warn_for_state): Replace with...
7038 (null_assignment_sm_context::warn): ...this.
7039 * engine.cc (impl_sm_context::warn_for_state): Replace with...
7040 (impl_sm_context::warn): ...this.
7041 * sm-file.cc (fileptr_state_machine::on_stmt): Replace
7042 warn_for_state and on_transition calls with a get_state
7043 test guarding warn and set_next_state calls.
7044 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
7045 * sm-pattern-test.cc (pattern_test_state_machine::on_condition):
7046 Replace warn_for_state call with warn call.
7047 * sm-sensitive.cc
7048 (sensitive_state_machine::warn_for_any_exposure): Replace
7049 warn_for_state call with a get_state test guarding a warn call.
7050 * sm-signal.cc (signal_state_machine::on_stmt): Likewise.
7051 * sm-taint.cc (taint_state_machine::on_stmt): Replace
7052 warn_for_state and on_transition calls with a get_state
7053 test guarding warn and set_next_state calls.
7054 * sm.h (sm_context::warn_for_state): Replace with...
7055 (sm_context::warn): ...this.
7057 2020-09-09 David Malcolm <dmalcolm@redhat.com>
7059 * diagnostic-manager.cc
7060 (null_assignment_sm_context::null_assignment_sm_context): Add old_state
7061 and ext_state params, initializing m_old_state and m_ext_state.
7062 (null_assignment_sm_context::on_transition): Split into...
7063 (null_assignment_sm_context::get_state): ...this new vfunc
7064 implementation and...
7065 (null_assignment_sm_context::set_next_state): ...this new vfunc
7066 implementation.
7067 (null_assignment_sm_context::m_old_state): New field.
7068 (null_assignment_sm_context::m_ext_state): New field.
7069 (diagnostic_manager::add_events_for_eedge): Pass in old state and
7070 ext_state when creating sm_ctxt.
7071 * engine.cc (impl_sm_context::on_transition): Split into...
7072 (impl_sm_context::get_state): ...this new vfunc
7073 implementation and...
7074 (impl_sm_context::set_next_state): ...this new vfunc
7075 implementation.
7076 * sm.h (sm_context::get_state): New pure virtual function.
7077 (sm_context::set_next_state): Likewise.
7078 (sm_context::on_transition): Convert from a pure virtual function
7079 to a regular function implemented in terms of get_state and
7080 set_next_state.
7082 2020-09-09 David Malcolm <dmalcolm@redhat.com>
7084 * checker-path.cc (state_change_event::get_desc): Update
7085 state_machine::get_state_name calls to state::get_name.
7086 (warning_event::get_desc): Likewise.
7087 * diagnostic-manager.cc
7088 (null_assignment_sm_context::on_transition): Update comparison
7089 against 0 with comparison with m_sm.get_start_state.
7090 (diagnostic_manager::prune_for_sm_diagnostic): Update
7091 state_machine::get_state_name calls to state::get_name.
7092 * engine.cc (impl_sm_context::on_transition): Likewise.
7093 (exploded_node::get_dot_fillcolor): Use get_id when summing
7094 the sm states.
7095 * program-state.cc (sm_state_map::sm_state_map): Don't hardcode
7096 0 as the start state when initializing m_global_state.
7097 (sm_state_map::print): Use dump_to_pp rather than get_state_name
7098 when dumping states.
7099 (sm_state_map::is_empty_p): Don't hardcode 0 as the start state
7100 when examining m_global_state.
7101 (sm_state_map::hash): Use get_id when hashing states.
7102 (selftest::test_sm_state_map): Use state objects rather than
7103 arbitrary hardcoded integers.
7104 (selftest::test_program_state_merging): Likewise.
7105 (selftest::test_program_state_merging_2): Likewise.
7106 * sm-file.cc (fileptr_state_machine::m_start): Move to base class.
7107 (file_diagnostic::describe_state_change): Use get_start_state.
7108 (fileptr_state_machine::fileptr_state_machine): Drop m_start
7109 initialization.
7110 * sm-malloc.cc (malloc_state_machine::m_start): Move to base
7111 class.
7112 (malloc_diagnostic::describe_state_change): Use get_start_state.
7113 (possible_null::describe_state_change): Likewise.
7114 (malloc_state_machine::malloc_state_machine): Drop m_start
7115 initialization.
7116 * sm-pattern-test.cc (pattern_test_state_machine::m_start): Move
7117 to base class.
7118 (pattern_test_state_machine::pattern_test_state_machine): Drop
7119 m_start initialization.
7120 * sm-sensitive.cc (sensitive_state_machine::m_start): Move to base
7121 class.
7122 (sensitive_state_machine::sensitive_state_machine): Drop m_start
7123 initialization.
7124 * sm-signal.cc (signal_state_machine::m_start): Move to base
7125 class.
7126 (signal_state_machine::signal_state_machine): Drop m_start
7127 initialization.
7128 * sm-taint.cc (taint_state_machine::m_start): Move to base class.
7129 (taint_state_machine::taint_state_machine): Drop m_start
7130 initialization.
7131 * sm.cc (state_machine::state::dump_to_pp): New.
7132 (state_machine::state_machine): Move here from sm.h. Initialize
7133 m_next_state_id and m_start.
7134 (state_machine::add_state): Reimplement in terms of state objects.
7135 (state_machine::get_state_name): Delete.
7136 (state_machine::get_state_by_name): Reimplement in terms of state
7137 objects. Make const.
7138 (state_machine::validate): Delete.
7139 (state_machine::dump_to_pp): Reimplement in terms of state
7140 objects.
7141 * sm.h (state_machine::state): New class.
7142 (state_machine::state_t): Convert typedef from "unsigned" to
7143 "const state_machine::state *".
7144 (state_machine::state_machine): Move to sm.cc.
7145 (state_machine::get_default_state): Use m_start rather than
7146 hardcoding 0.
7147 (state_machine::get_state_name): Delete.
7148 (state_machine::get_state_by_name): Make const.
7149 (state_machine::get_start_state): New accessor.
7150 (state_machine::alloc_state_id): New.
7151 (state_machine::m_state_names): Drop in favor of...
7152 (state_machine::m_states): New field
7153 (state_machine::m_start): New field
7154 (start_start_p): Delete.
7156 2020-09-08 David Malcolm <dmalcolm@redhat.com>
7158 PR analyzer/96949
7159 * store.cc (binding_map::apply_ctor_val_to_range): Add
7160 error-handling for the cases where we have symbolic offsets.
7162 2020-09-08 David Malcolm <dmalcolm@redhat.com>
7164 PR analyzer/96950
7165 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
7166 where min_index == max_index.
7167 (binding_map::apply_ctor_val_to_range): Replace assertion that we
7168 don't have a CONSTRUCTOR value with error-handling.
7170 2020-09-08 David Malcolm <dmalcolm@redhat.com>
7172 PR analyzer/96962
7173 * region-model.cc (region_model::on_call_pre): Fix guard on switch
7174 on built-ins to only consider BUILT_IN_NORMAL, rather than other
7175 kinds of build-ins.
7177 2020-09-01 David Malcolm <dmalcolm@redhat.com>
7179 PR analyzer/96792
7180 * region-model.cc (region_model::deref_rvalue): Add the constraint
7181 that PTR_SVAL is non-NULL.
7183 2020-08-31 David Malcolm <dmalcolm@redhat.com>
7185 PR analyzer/96798
7186 * region-model.cc (region_model::on_call_pre): Handle
7187 BUILT_IN_MEMSET_CHK.
7189 2020-08-31 David Malcolm <dmalcolm@redhat.com>
7191 * region-model.cc (region_model::on_call_pre): Gather handling of
7192 builtins and of internal fns into switch statements. Handle
7193 "alloca" and BUILT_IN_ALLOCA_WITH_ALIGN.
7195 2020-08-31 David Malcolm <dmalcolm@redhat.com>
7197 PR analyzer/96860
7198 * region.cc (decl_region::get_svalue_for_constructor): Support
7199 apply_ctor_to_region failing.
7200 * store.cc (binding_map::apply_ctor_to_region): Add failure
7201 handling.
7202 (binding_map::apply_ctor_val_to_range): Likewise.
7203 (binding_map::apply_ctor_pair_to_child_region): Likewise. Replace
7204 assertion that child_base_offset is not symbolic with error
7205 handling.
7206 * store.h (binding_map::apply_ctor_to_region): Convert return type
7207 from void to bool.
7208 (binding_map::apply_ctor_val_to_range): Likewise.
7209 (binding_map::apply_ctor_pair_to_child_region): Likewise.
7211 2020-08-31 David Malcolm <dmalcolm@redhat.com>
7213 PR analyzer/96763
7214 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
7215 by calling a new binding_map::apply_ctor_val_to_range subroutine.
7216 Split out the existing non-CONSTRUCTOR-handling code to a new
7217 apply_ctor_pair_to_child_region subroutine.
7218 (binding_map::apply_ctor_val_to_range): New.
7219 (binding_map::apply_ctor_pair_to_child_region): New, split out
7220 from binding_map::apply_ctor_to_region as noted above.
7221 * store.h (binding_map::apply_ctor_val_to_range): New decl.
7222 (binding_map::apply_ctor_pair_to_child_region): New decl.
7224 2020-08-31 David Malcolm <dmalcolm@redhat.com>
7226 PR analyzer/96764
7227 * region-model-manager.cc
7228 (region_model_manager::maybe_fold_unaryop): Handle VIEW_CONVERT_EXPR.
7229 (region_model_manager::get_or_create_cast): Move logic for
7230 real->integer casting to...
7231 (get_code_for_cast): ...this new function, and add logic for
7232 real->non-integer casts.
7233 (region_model_manager::maybe_fold_sub_svalue): Handle
7234 VIEW_CONVERT_EXPR.
7235 * region-model.cc
7236 (region_model::add_any_constraints_from_gassign): Likewise.
7237 * svalue.cc (svalue::maybe_undo_cast): Likewise.
7238 (unaryop_svalue::dump_to_pp): Likewise.
7240 2020-08-26 David Malcolm <dmalcolm@redhat.com>
7242 PR analyzer/94858
7243 * region-model-manager.cc
7244 (region_model_manager::get_or_create_widening_svalue): Assert that
7245 neither of the inputs are themselves widenings.
7246 * store.cc (store::eval_alias_1): The initial value of a pointer
7247 can't point to a region that was allocated on the heap after the
7248 beginning of the path. A widened pointer value can't alias anything
7249 that the initial pointer value can't alias.
7250 * svalue.cc (svalue::can_merge_p): Merge BINOP (X, OP, CST) with X
7251 to a widening svalue. Merge
7252 BINOP(WIDENING(BASE, BINOP(BASE, X)), X) and BINOP(BASE, X) to
7253 to the LHS of the first BINOP.
7255 2020-08-26 David Malcolm <dmalcolm@redhat.com>
7257 PR analyzer/96777
7258 * region-model.h (class compound_svalue): Document that all keys
7259 must be concrete.
7260 (compound_svalue::compound_svalue): Move definition to svalue.cc.
7261 * store.cc (binding_map::apply_ctor_to_region): Handle
7262 initializers for trailing arrays with incomplete size.
7263 * svalue.cc (compound_svalue::compound_svalue): Move definition
7264 here from region-model.h. Add assertion that all keys are
7265 concrete.
7267 2020-08-22 David Malcolm <dmalcolm@redhat.com>
7269 PR analyzer/94851
7270 * region-model-manager.cc
7271 (region_model_manager::maybe_fold_binop): Fold bitwise "& 0" to 0.
7273 2020-08-22 David Malcolm <dmalcolm@redhat.com>
7275 * store.cc (store::eval_alias): Make const. Split out 2nd half
7276 into store::eval_alias_1 and call it twice for symmetry, avoiding
7277 test duplication.
7278 (store::eval_alias_1): New function, split out from the above.
7279 * store.h (store::eval_alias): Make const.
7280 (store::eval_alias_1): New decl.
7282 2020-08-22 David Malcolm <dmalcolm@redhat.com>
7284 * region-model.cc (region_model::push_frame): Bind the default
7285 SSA name for each parm if it exists, falling back to the parm
7286 itself otherwise, rather than doing both.
7288 2020-08-20 David Malcolm <dmalcolm@redhat.com>
7290 PR analyzer/96723
7291 * region-model-manager.cc
7292 (region_model_manager::get_field_region): Assert that field is a
7293 FIELD_DECL.
7294 * region.cc (region::get_subregions_for_binding): In
7295 union-handling, filter the TYPE_FIELDS traversal to just FIELD_DECLs.
7297 2020-08-20 David Malcolm <dmalcolm@redhat.com>
7299 PR analyzer/96713
7300 * region-model.cc (region_model::get_gassign_result): For
7301 comparisons, only use eval_condition when the lhs has boolean
7302 type, and use get_or_create_constant_svalue on the boolean
7303 constants directly rather than via get_rvalue.
7305 2020-08-19 David Malcolm <dmalcolm@redhat.com>
7307 PR analyzer/96643
7308 * region-model.cc (region_model::deref_rvalue): Rather than
7309 attempting to handle all svalue kinds in the switch, only cover
7310 the special cases, and move symbolic-region handling to after
7311 the switch, thus implicitly handling the missing case SK_COMPOUND.
7313 2020-08-19 David Malcolm <dmalcolm@redhat.com>
7315 PR analyzer/96705
7316 * region-model-manager.cc
7317 (region_model_manager::maybe_fold_binop): Check that we have an
7318 integral type before calling build_int_cst.
7320 2020-08-19 David Malcolm <dmalcolm@redhat.com>
7322 PR analyzer/96699
7323 * region-model-manager.cc
7324 (region_model_manager::get_or_create_cast): Use FIX_TRUNC_EXPR for
7325 casting from REAL_TYPE to INTEGER_TYPE.
7327 2020-08-19 David Malcolm <dmalcolm@redhat.com>
7329 PR analyzer/96651
7330 * region-model.cc (region_model::called_from_main_p): New.
7331 (region_model::get_store_value): Move handling for globals into...
7332 (region_model::get_initial_value_for_global): ...this new
7333 function, and add logic for extracting values from decl
7334 initializers.
7335 * region-model.h (decl_region::get_svalue_for_constructor): New
7336 decl.
7337 (decl_region::get_svalue_for_initializer): New decl.
7338 (region_model::called_from_main_p): New decl.
7339 (region_model::get_initial_value_for_global): New.
7340 * region.cc (decl_region::maybe_get_constant_value): Move logic
7341 for getting an svalue from a CONSTRUCTOR node to...
7342 (decl_region::get_svalue_for_constructor): ...this new function.
7343 (decl_region::get_svalue_for_initializer): New.
7344 * store.cc (get_svalue_for_ctor_val): Rewrite in terms of
7345 region_model::get_rvalue.
7346 * store.h (binding_cluster::get_map): New accessor.
7348 2020-08-19 David Malcolm <dmalcolm@redhat.com>
7350 PR analyzer/96648
7351 * region.cc (get_field_at_bit_offset): Gracefully handle negative
7352 values for bit_offset.
7354 2020-08-18 David Malcolm <dmalcolm@redhat.com>
7356 * region-model.cc (region_model::get_rvalue_1): Fix name of local.
7358 2020-08-18 David Malcolm <dmalcolm@redhat.com>
7360 PR analyzer/96641
7361 * region-model.cc (region_model::get_rvalue_1): Handle
7362 unrecognized tree codes by returning "UNKNOWN.
7364 2020-08-18 David Malcolm <dmalcolm@redhat.com>
7366 PR analyzer/96640
7367 * region-model.cc (region_model::get_gassign_result): Handle various
7368 VEC_* tree codes by returning UNKNOWN.
7369 (region_model::on_assignment): Handle unrecognized tree codes by
7370 setting lhs to an unknown value, rather than issuing a "sorry" and
7371 asserting.
7373 2020-08-17 David Malcolm <dmalcolm@redhat.com>
7375 PR analyzer/96644
7376 * region-model-manager.cc (get_region_for_unexpected_tree_code):
7377 Handle ctxt being NULL.
7379 2020-08-17 David Malcolm <dmalcolm@redhat.com>
7381 PR analyzer/96639
7382 * region.cc (region::get_subregions_for_binding): Check for "type"
7383 being NULL.
7385 2020-08-17 David Malcolm <dmalcolm@redhat.com>
7387 PR analyzer/96642
7388 * store.cc (get_svalue_for_ctor_val): New.
7389 (binding_map::apply_ctor_to_region): Call it.
7391 2020-08-14 David Malcolm <dmalcolm@redhat.com>
7393 PR testsuite/96609
7394 PR analyzer/96616
7395 * region-model.cc (region_model::get_store_value): Call
7396 maybe_get_constant_value on decl_regions first.
7397 * region-model.h (decl_region::maybe_get_constant_value): New decl.
7398 * region.cc (decl_region::get_stack_depth): Likewise.
7399 (decl_region::maybe_get_constant_value): New.
7400 * store.cc (get_subregion_within_ctor): New.
7401 (binding_map::apply_ctor_to_region): New.
7402 * store.h (binding_map::apply_ctor_to_region): New decl.
7404 2020-08-14 David Malcolm <dmalcolm@redhat.com>
7406 PR analyzer/96611
7407 * store.cc (store::mark_as_escaped): Reject attempts to
7408 get a cluster for an unknown pointer.
7410 2020-08-13 David Malcolm <dmalcolm@redhat.com>
7412 PR analyzer/93032
7413 PR analyzer/93938
7414 PR analyzer/94011
7415 PR analyzer/94099
7416 PR analyzer/94399
7417 PR analyzer/94458
7418 PR analyzer/94503
7419 PR analyzer/94640
7420 PR analyzer/94688
7421 PR analyzer/94689
7422 PR analyzer/94839
7423 PR analyzer/95026
7424 PR analyzer/95042
7425 PR analyzer/95240
7426 * analyzer-logging.cc: Ignore "-Wformat-diag".
7427 (logger::enter_scope): Use inc_indent in both overloads.
7428 (logger::exit_scope): Use dec_indent.
7429 * analyzer-logging.h (logger::inc_indent): New.
7430 (logger::dec_indent): New.
7431 * analyzer-selftests.cc (run_analyzer_selftests): Call
7432 analyzer_store_cc_tests.
7433 * analyzer-selftests.h (analyzer_store_cc_tests): New decl.
7434 * analyzer.cc (get_stmt_location): New function.
7435 * analyzer.h (class initial_svalue): New forward decl.
7436 (class unaryop_svalue): New forward decl.
7437 (class binop_svalue): New forward decl.
7438 (class sub_svalue): New forward decl.
7439 (class unmergeable_svalue): New forward decl.
7440 (class placeholder_svalue): New forward decl.
7441 (class widening_svalue): New forward decl.
7442 (class compound_svalue): New forward decl.
7443 (class conjured_svalue): New forward decl.
7444 (svalue_set): New typedef.
7445 (class map_region): Delete.
7446 (class array_region): Delete.
7447 (class frame_region): New forward decl.
7448 (class function_region): New forward decl.
7449 (class label_region): New forward decl.
7450 (class decl_region): New forward decl.
7451 (class element_region): New forward decl.
7452 (class offset_region): New forward decl.
7453 (class cast_region): New forward decl.
7454 (class field_region): New forward decl.
7455 (class string_region): New forward decl.
7456 (class region_model_manager): New forward decl.
7457 (class store_manager): New forward decl.
7458 (class store): New forward decl.
7459 (class call_details): New forward decl.
7460 (struct svalue_id_merger_mapping): Delete.
7461 (struct canonicalization): Delete.
7462 (class function_point): New forward decl.
7463 (class engine): New forward decl.
7464 (dump_tree): New function decl.
7465 (print_quoted_type): New function decl.
7466 (readability_comparator): New function decl.
7467 (tree_cmp): New function decl.
7468 (class path_var): Move here from region-model.h
7469 (bit_offset_t, bit_size_t, byte_size_t): New typedefs.
7470 (class region_offset): New class.
7471 (get_stmt_location): New decl.
7472 (struct member_function_hash_traits): New struct.
7473 (class consolidation_map): New class.
7474 Ignore "-Wformat-diag".
7475 * analyzer.opt (-param=analyzer-max-svalue-depth=): New param.
7476 (-param=analyzer-max-enodes-for-full-dump=): New param.
7477 * call-string.cc: Ignore -Wformat-diag.
7478 * checker-path.cc: Move includes of "analyzer/call-string.h" and
7479 "analyzer/program-point.h" to before "analyzer/region-model.h",
7480 and also include "analyzer/store.h" before it.
7481 (state_change_event::state_change_event): Replace "tree var" param
7482 with "const svalue *sval". Convert "origin" param from tree to
7483 "const svalue *".
7484 (state_change_event::get_desc): Call get_representative_tree to
7485 convert the var and origin from const svalue * to tree. Use
7486 svalue::get_desc rather than %qE when describing state changes.
7487 (checker_path::add_final_event): Use get_stmt_location.
7488 * checker-path.h (state_change_event::state_change_event): Port
7489 from tree to const svalue *.
7490 (state_change_event::get_lvalue): Delete.
7491 (state_change_event::get_dest_function): New.
7492 (state_change_event::m_var): Replace with...
7493 (state_change_event::m_sval): ...this.
7494 (state_change_event::m_origin): Convert from tree to
7495 const svalue *.
7496 * constraint-manager.cc: Include "analyzer/call-string.h",
7497 "analyzer/program-point.h", and "analyzer/store.h" before
7498 "analyzer/region-model.h".
7499 (struct bound, struct range): Move to constraint-manager.h.
7500 (compare_constants): New function.
7501 (range::dump): Rename to...
7502 (range::dump_to_pp): ...this. Support NULL constants.
7503 (range::dump): Reintroduce for dumping to stderr.
7504 (range::constrained_to_single_element): Return result, rather than
7505 writing to *OUT.
7506 (range::eval_condition): New.
7507 (range::below_lower_bound): New.
7508 (range::above_upper_bound): New.
7509 (equiv_class::equiv_class): Port from svalue_id to const svalue *.
7510 (equiv_class::print): Likewise.
7511 (equiv_class::hash): Likewise.
7512 (equiv_class::operator==): Port from svalue_id to const svalue *.
7513 (equiv_class::add): Port from svalue_id to const svalue *. Drop
7514 "cm" param.
7515 (equiv_class::del): Port from svalue_id to const svalue *.
7516 (equiv_class::get_representative): Likewise.
7517 (equiv_class::remap_svalue_ids): Delete.
7518 (svalue_id_cmp_by_id): Rename to...
7519 (svalue_cmp_by_ptr): ...this, porting from svalue_id to
7520 const svalue *.
7521 (equiv_class::canonicalize): Update qsort comparator.
7522 (constraint::implied_by): New.
7523 (constraint_manager::constraint_manager): Copy m_mgr in copy ctor.
7524 (constraint_manager::dump_to_pp): Add "multiline" param
7525 (constraint_manager::dump): Pass "true" for "multiline".
7526 (constraint_manager::add_constraint): Port from svalue_id to
7527 const svalue *. Split out second part into...
7528 (constraint_manager::add_unknown_constraint): ...this new
7529 function. Remove self-constraints when merging equivalence
7530 classes.
7531 (constraint_manager::add_constraint_internal): Remove constraints
7532 that would be implied by the new constraint. Port from svalue_id
7533 to const svalue *.
7534 (constraint_manager::get_equiv_class_by_sid): Rename to...
7535 (constraint_manager::get_equiv_class_by_svalue): ...this, porting
7536 from svalue_id to const svalue *.
7537 (constraint_manager::get_or_add_equiv_class): Port from svalue_id
7538 to const svalue *.
7539 (constraint_manager::eval_condition): Make const. Call
7540 compare_constants and return early if it provides a known result.
7541 (constraint_manager::get_ec_bounds): New.
7542 (constraint_manager::eval_condition): New overloads. Make
7543 existing one const, and use compare_constants.
7544 (constraint_manager::purge): Convert "p" param to a template
7545 rather that an abstract base class. Port from svalue_id to
7546 const svalue *.
7547 (class dead_svalue_purger): New class.
7548 (constraint_manager::remap_svalue_ids): Delete.
7549 (constraint_manager::on_liveness_change): New.
7550 (equiv_class_cmp): Port from svalue_id to const svalue *.
7551 (constraint_manager::canonicalize): Likewise. Combine with
7552 purging of redundant equivalence classes and constraints.
7553 (class cleaned_constraint_manager): Delete.
7554 (class merger_fact_visitor): Make "m_cm_b" const. Add "m_merger"
7555 field.
7556 (merger_fact_visitor::fact): Port from svalue_id to const svalue *.
7557 Add special case for widening.
7558 (constraint_manager::merge): Port from svalue_id to const svalue *.
7559 (constraint_manager::clean_merger_input): Delete.
7560 (constraint_manager::for_each_fact): Port from svalue_id to
7561 const svalue *.
7562 (constraint_manager::validate): Likewise.
7563 (selftest::test_constraint_conditions): Provide a
7564 region_model_manager when creating region_model instances.
7565 Add test for self-equality not creating equivalence classes.
7566 (selftest::test_transitivity): Provide a region_model_manager when
7567 creating region_model instances. Verify that EC-merging happens
7568 when constraints are implied.
7569 (selftest::test_constant_comparisons): Provide a
7570 region_model_manager when creating region_model instances.
7571 (selftest::test_constraint_impl): Likewise. Remove over-specified
7572 assertions.
7573 (selftest::test_equality): Provide a region_model_manager when
7574 creating region_model instances.
7575 (selftest::test_many_constants): Likewise. Provide a
7576 program_point when testing merging.
7577 (selftest::run_constraint_manager_tests): Move call to
7578 test_constant_comparisons to outside the transitivity guard.
7579 * constraint-manager.h (struct bound): Move here from
7580 constraint-manager.cc.
7581 (struct range): Likewise.
7582 (struct::eval_condition): New decl.
7583 (struct::below_lower_bound): New decl.
7584 (struct::above_upper_bound): New decl.
7585 (equiv_class::add): Port from svalue_id to const svalue *.
7586 (equiv_class::del): Likewise.
7587 (equiv_class::get_representative): Likewise.
7588 (equiv_class::remap_svalue_ids): Drop.
7589 (equiv_class::m_cst_sid): Convert to..
7590 (equiv_class::m_cst_sval): ...this.
7591 (equiv_class::m_vars): Port from svalue_id to const svalue *.
7592 (constraint::bool implied_by): New decl.
7593 (fact_visitor::on_fact): Port from svalue_id to const svalue *.
7594 (constraint_manager::constraint_manager): Add mgr param.
7595 (constraint_manager::clone): Delete.
7596 (constraint_manager::maybe_get_constant): Delete.
7597 (constraint_manager::get_sid_for_constant): Delete.
7598 (constraint_manager::get_num_svalues): Delete.
7599 (constraint_manager::dump_to_pp): Add "multiline" param.
7600 (constraint_manager::get_equiv_class): Port from svalue_id to
7601 const svalue *.
7602 (constraint_manager::add_constraint): Likewise.
7603 (constraint_manager::get_equiv_class_by_sid): Rename to...
7604 (constraint_manager::get_equiv_class_by_svalue): ...this, porting
7605 from svalue_id to const svalue *.
7606 (constraint_manager::add_unknown_constraint): New decl.
7607 (constraint_manager::get_or_add_equiv_class): Port from svalue_id
7608 to const svalue *.
7609 (constraint_manager::eval_condition): Likewise. Add overloads.
7610 (constraint_manager::get_ec_bounds): New decl.
7611 (constraint_manager::purge): Convert to template.
7612 (constraint_manager::remap_svalue_ids): Delete.
7613 (constraint_manager::on_liveness_change): New decl.
7614 (constraint_manager::canonicalize): Drop param.
7615 (constraint_manager::clean_merger_input): Delete.
7616 (constraint_manager::m_mgr): New field.
7617 * diagnostic-manager.cc: Move includes of
7618 "analyzer/call-string.h" and "analyzer/program-point.h" to before
7619 "analyzer/region-model.h", and also include "analyzer/store.h"
7620 before it.
7621 (saved_diagnostic::saved_diagnostic): Add "sval" param.
7622 (diagnostic_manager::diagnostic_manager): Add engine param.
7623 (diagnostic_manager::add_diagnostic): Add "sval" param, passing it
7624 to saved_diagnostic ctor. Update overload to pass NULL for it.
7625 (dedupe_winners::dedupe_winners): Add engine param.
7626 (dedupe_winners::add): Add "eg" param. Pass m_engine to
7627 feasible_p.
7628 (dedupe_winner::m_engine): New field.
7629 (diagnostic_manager::emit_saved_diagnostics): Pass engine to
7630 dedupe_winners. Pass &eg when adding candidates. Pass svalue
7631 rather than tree to prune_path. Use get_stmt_location to get
7632 primary location of diagnostic.
7633 (diagnostic_manager::emit_saved_diagnostic): Likewise.
7634 (get_any_origin): Drop.
7635 (state_change_event_creator::on_global_state_change): Pass NULL
7636 const svalue * rather than NULL_TREE trees to state_change_event
7637 ctor.
7638 (state_change_event_creator::on_state_change): Port from tree and
7639 svalue_id to const svalue *.
7640 (for_each_state_change): Port from svalue_id to const svalue *.
7641 (struct null_assignment_sm_context): New.
7642 (diagnostic_manager::add_events_for_eedge): Add state change
7643 events for assignment to NULL.
7644 (diagnostic_manager::prune_path): Update param from tree to
7645 const svalue *.
7646 (diagnostic_manager::prune_for_sm_diagnostic): Port from tracking
7647 by tree to by const svalue *.
7648 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add sval
7649 param.
7650 (saved_diagnostic::m_sval): New field.
7651 (diagnostic_manager::diagnostic_manager): Add engine param.
7652 (diagnostic_manager::get_engine): New.
7653 (diagnostic_manager::add_diagnostic): Add "sval" param.
7654 (diagnostic_manager::prune_path): Likewise.
7655 (diagnostic_manager::prune_for_sm_diagnostic): New overload.
7656 (diagnostic_manager::m_eng): New field.
7657 * engine.cc: Move includes of "analyzer/call-string.h" and
7658 "analyzer/program-point.h" to before "analyzer/region-model.h",
7659 and also include "analyzer/store.h" before it.
7660 (impl_region_model_context::impl_region_model_context): Update for
7661 removal of m_change field.
7662 (impl_region_model_context::remap_svalue_ids): Delete.
7663 (impl_region_model_context::on_svalue_leak): New.
7664 (impl_region_model_context::on_svalue_purge): Delete.
7665 (impl_region_model_context::on_liveness_change): New.
7666 (impl_region_model_context::on_unknown_change): Update param
7667 from svalue_id to const svalue *. Add is_mutable param.
7668 (setjmp_svalue::compare_fields): Delete.
7669 (setjmp_svalue::accept): New.
7670 (setjmp_svalue::add_to_hash): Delete.
7671 (setjmp_svalue::dump_to_pp): New.
7672 (setjmp_svalue::print_details): Delete.
7673 (impl_sm_context::impl_sm_context): Drop "change" param.
7674 (impl_sm_context::get_fndecl_for_call): Drop "m_change".
7675 (impl_sm_context::on_transition): Drop ATTRIBUTE_UNUSED from
7676 "stmt" param. Drop m_change. Port from svalue_id to
7677 const svalue *.
7678 (impl_sm_context::warn_for_state): Drop m_change. Port from
7679 svalue_id to const svalue *.
7680 (impl_sm_context::get_readable_tree): Rename to...
7681 (impl_sm_context::get_diagnostic_tree): ...this. Port from
7682 svalue_id to const svalue *.
7683 (impl_sm_context::is_zero_assignment): New.
7684 (impl_sm_context::m_change): Delete field.
7685 (leak_stmt_finder::find_stmt): Handle m_var being NULL.
7686 (readability): Increase penalty for MEM_REF. For SSA_NAMEs,
7687 slightly favor the underlying var over the SSA name. Heavily
7688 penalize temporaries. Handle RESULT_DECL.
7689 (readability_comparator): Make non-static. Consider stack depths.
7690 (impl_region_model_context::on_state_leak): Convert from svalue_id
7691 to const svalue *, updating for region_model changes. Use
7692 id_equal.
7693 (impl_region_model_context::on_inherited_svalue): Delete.
7694 (impl_region_model_context::on_cast): Delete.
7695 (impl_region_model_context::on_condition): Drop m_change.
7696 (impl_region_model_context::on_phi): Likewise.
7697 (impl_region_model_context::on_unexpected_tree_code): Handle t
7698 being NULL.
7699 (point_and_state::validate): Update stack checking for
7700 region_model changes.
7701 (eg_traits::dump_args_t::show_enode_details_p): New.
7702 (exploded_node::exploded_node): Initialize m_num_processed_stmts.
7703 (exploded_node::get_processed_stmt): New function.
7704 (exploded_node::get_dot_fillcolor): Add more colors.
7705 (exploded_node::dump_dot): Guard the printing of the point and
7706 state with show_enode_details_p. Print the processed stmts for
7707 this enode after the initial state.
7708 (exploded_node::dump_to_pp): Pass true for new multiline param
7709 of program_state::dump_to_pp.
7710 (exploded_node::on_stmt): Drop "change" param. Log the stmt.
7711 Set input_location. Implement __analyzer_describe. Update
7712 implementation of __analyzer_dump and __analyzer_eval.
7713 Remove purging of sm-state for unknown fncalls from here.
7714 (exploded_node::on_edge): Drop "change" param.
7715 (exploded_node::on_longjmp): Port from region_id/svalue_id to
7716 const region */const svalue *. Call program_state::detect_leaks.
7717 Drop state_change.
7718 (exploded_node::detect_leaks): Update for changes to region_model.
7719 Call program_state::detect_leaks.
7720 (exploded_edge::exploded_edge): Drop ext_state and change params.
7721 (exploded_edge::dump_dot): "args" is no longer used. Drop dumping
7722 of m_change.
7723 (exploded_graph::exploded_graph): Pass engine to
7724 m_diagnostic_manager ctor. Use program_point::origin.
7725 (exploded_graph::add_function_entry): Drop ctxt. Use
7726 program_state::push_frame. Drop state_change.
7727 (exploded_graph::get_or_create_node): Drop "change" param. Add
7728 "enode_for_diag" param. Update dumping calls for API changes.
7729 Pass point to can_merge_with_p. Show enode indices
7730 within -Wanalyzer-too-complex diagnostic for hitting the per-point
7731 limit.
7732 (exploded_graph::add_edge): Drop "change" param. Log which nodes
7733 are being connected. Update for changes to exploded_edge ctor.
7734 (exploded_graph::get_per_program_point_data): New.
7735 (exploded_graph::process_worklist): Pass point to
7736 can_merge_with_p. Drop state_change. Update dumping call for API
7737 change.
7738 (exploded_graph::process_node): Drop state_change. Split the
7739 node in-place if an sm-state-change occurs. Update
7740 m_num_processed_stmts. Update dumping calls for API change.
7741 (exploded_graph::log_stats): Call engine::log_stats.
7742 (exploded_graph::dump_states_for_supernode): Update dumping
7743 call.
7744 (exploded_path::feasible_p): Add "eng" and "eg" params.
7745 Rename "i" to "end_idx". Pass the manager to the region_model
7746 ctor. Update for every processed stmt in the enode, not just the
7747 first. Keep track of which snodes have been visited, and call
7748 loop_replay_fixup when revisiting one.
7749 (enode_label::get_text): Update dump call for new param.
7750 (exploded_graph::dump_exploded_nodes): Likewise.
7751 (exploded_graph::get_node_by_index): New.
7752 (impl_run_checkers): Create engine instance and pass its address
7753 to extrinsic_state ctor.
7754 * exploded-graph.h
7755 (impl_region_model_context::impl_region_model_context): Drop
7756 "change" params.
7757 (impl_region_model_context::void remap_svalue_ids): Delete.
7758 (impl_region_model_context::on_svalue_purge): Delete.
7759 (impl_region_model_context::on_svalue_leak): New.
7760 (impl_region_model_context::on_liveness_change): New.
7761 (impl_region_model_context::on_state_leak): Update signature.
7762 (impl_region_model_context::on_inherited_svalue): Delete.
7763 (impl_region_model_context::on_cast): Delete.
7764 (impl_region_model_context::on_unknown_change): Update signature.
7765 (impl_region_model_context::m_change): Delete.
7766 (eg_traits::dump_args_t::show_enode_details_p): New.
7767 (exploded_node::on_stmt): Drop "change" param.
7768 (exploded_node::on_edge): Likewise.
7769 (exploded_node::get_processed_stmt): New decl.
7770 (exploded_node::m_num_processed_stmts): New field.
7771 (exploded_edge::exploded_edge): Drop ext_state and change params.
7772 (exploded_edge::m_change): Delete.
7773 (exploded_graph::get_engine): New accessor.
7774 (exploded_graph::get_or_create_node): Drop "change" param. Add
7775 "enode_for_diag" param.
7776 (exploded_graph::add_edge): Drop "change" param.
7777 (exploded_graph::get_per_program_point_data): New decl.
7778 (exploded_graph::get_node_by_index): New decl.
7779 (exploded_path::feasible_p): Add "eng" and "eg" params.
7780 * program-point.cc: Include "analyzer/store.h" before including
7781 "analyzer/region-model.h".
7782 (function_point::function_point): Move here from
7783 program-point.h.
7784 (function_point::get_function): Likewise.
7785 (function_point::from_function_entry): Likewise.
7786 (function_point::before_supernode): Likewise.
7787 (function_point::next_stmt): New function.
7788 * program-point.h (function_point::function_point): Move
7789 implementation from here to program-point.cc.
7790 (function_point::get_function): Likewise.
7791 (function_point::from_function_entry): Likewise.
7792 (function_point::before_supernode): Likewise.
7793 (function_point::next_stmt): New decl.
7794 (program_point::operator!=): New.
7795 (program_point::origin): New.
7796 (program_point::next_stmt): New.
7797 (program_point::m_function_point): Make non-const.
7798 * program-state.cc: Move includes of "analyzer/call-string.h" and
7799 "analyzer/program-point.h" to before "analyzer/region-model.h",
7800 and also include "analyzer/store.h" before it.
7801 (extrinsic_state::get_model_manager): New.
7802 (sm_state_map::sm_state_map): Pass in sm and sm_idx to ctor,
7803 rather than pass the around.
7804 (sm_state_map::clone_with_remapping): Delete.
7805 (sm_state_map::print): Remove "sm" param in favor of "m_sm". Add
7806 "simple" and "multiline" params and support multiline vs single
7807 line dumping.
7808 (sm_state_map::dump): Remove "sm" param in favor of "m_sm". Add
7809 "simple" param.
7810 (sm_state_map::hash): Port from svalue_id to const svalue *.
7811 (sm_state_map::operator==): Likewise.
7812 (sm_state_map::get_state): Likewise. Call canonicalize_svalue on
7813 input. Handle inheritance of sm-state. Call get_default_state.
7814 (sm_state_map::get_origin): Port from svalue_id to const svalue *.
7815 (sm_state_map::set_state): Likewise. Pass in ext_state. Reject
7816 attempts to set state on UNKNOWN.
7817 (sm_state_map::impl_set_state): Port from svalue_id to
7818 const svalue *. Pass in ext_state. Call canonicalize_svalue on
7819 input.
7820 (sm_state_map::purge_for_unknown_fncall): Delete.
7821 (sm_state_map::on_svalue_leak): New.
7822 (sm_state_map::remap_svalue_ids): Delete.
7823 (sm_state_map::on_liveness_change): New.
7824 (sm_state_map::on_unknown_change): Reimplement.
7825 (sm_state_map::on_svalue_purge): Delete.
7826 (sm_state_map::on_inherited_svalue): Delete.
7827 (sm_state_map::on_cast): Delete.
7828 (sm_state_map::validate): Delete.
7829 (sm_state_map::canonicalize_svalue): New.
7830 (program_state::program_state): Update to pass manager to
7831 region_model's ctor. Constify num_states and pass state machine
7832 and index to sm_state_map ctor.
7833 (program_state::print): Update for changes to dump API.
7834 (program_state::dump_to_pp): Ignore the summarize param. Add
7835 "multiline" param.
7836 (program_state::dump_to_file): Add "multiline" param.
7837 (program_state::dump): Pass "true" for new "multiline" param.
7838 (program_state::push_frame): New.
7839 (program_state::on_edge): Drop "change" param. Call
7840 program_state::detect_leaks.
7841 (program_state::prune_for_point): Add enode_for_diag param.
7842 Reimplement based on store class. Call detect_leaks
7843 (program_state::remap_svalue_ids): Delete.
7844 (program_state::get_representative_tree): Port from svalue_id to
7845 const svalue *.
7846 (program_state::can_merge_with_p): Add "point" param. Add early
7847 reject for sm-differences. Drop id remapping.
7848 (program_state::validate): Drop region model and sm_state_map
7849 validation.
7850 (state_change::sm_change::dump): Delete.
7851 (state_change::sm_change::remap_svalue_ids): Delete.
7852 (state_change::sm_change::on_svalue_purge): Delete.
7853 (log_set_of_svalues): New.
7854 (state_change::sm_change::validate): Delete.
7855 (state_change::state_change): Delete.
7856 (state_change::add_sm_change): Delete.
7857 (state_change::affects_p): Delete.
7858 (state_change::dump): Delete.
7859 (state_change::remap_svalue_ids): Delete.
7860 (state_change::on_svalue_purge): Delete.
7861 (state_change::validate): Delete.
7862 (selftest::assert_dump_eq): Delete.
7863 (ASSERT_DUMP_EQ): Delete.
7864 (selftest::test_sm_state_map): Update for changes to region_model
7865 and sm_state_map, porting from svalue_id to const svalue *.
7866 (selftest::test_program_state_dumping): Likewise. Drop test of
7867 dumping, renaming to...
7868 (selftest::test_program_state_1): ...this.
7869 (selftest::test_program_state_dumping_2): Likewise, renaming to...
7870 (selftest::test_program_state_2): ...this.
7871 (selftest::test_program_state_merging): Update for changes to
7872 region_model.
7873 (selftest::test_program_state_merging_2): Likewise.
7874 (selftest::analyzer_program_state_cc_tests): Update for renamed
7875 tests.
7876 * program-state.h (extrinsic_state::extrinsic_state): Add logger
7877 and engine params.
7878 (extrinsic_state::get_logger): New accessor.
7879 (extrinsic_state::get_engine): New accessor.
7880 (extrinsic_state::get_model_manager): New accessor.
7881 (extrinsic_state::m_logger): New field.
7882 (extrinsic_state::m_engine): New field.
7883 (struct default_hash_traits<svalue_id>): Delete.
7884 (pod_hash_traits<svalue_id>::hash): Delete.
7885 (pod_hash_traits<svalue_id>::equal): Delete.
7886 (pod_hash_traits<svalue_id>::mark_deleted): Delete.
7887 (pod_hash_traits<svalue_id>::mark_empty): Delete.
7888 (pod_hash_traits<svalue_id>::is_deleted): Delete.
7889 (pod_hash_traits<svalue_id>::is_empty): Delete.
7890 (sm_state_map::entry_t::entry_t): Port from svalue_id to
7891 const svalue *.
7892 (sm_state_map::entry_t::m_origin): Likewise.
7893 (sm_state_map::map_t): Likewise.
7894 (sm_state_map::sm_state_map): Add state_machine and index params.
7895 (sm_state_map::clone_with_remapping): Delete.
7896 (sm_state_map::print): Drop sm param; add simple and multiline
7897 params.
7898 (sm_state_map::dump): Drop sm param; add simple param.
7899 (sm_state_map::get_state): Port from svalue_id to const svalue *.
7900 Add ext_state param.
7901 (sm_state_map::get_origin): Likewise.
7902 (sm_state_map::set_state): Likewise.
7903 (sm_state_map::impl_set_state): Likewise.
7904 (sm_state_map::purge_for_unknown_fncall): Delete.
7905 (sm_state_map::remap_svalue_ids): Delete.
7906 (sm_state_map::on_svalue_purge): Delete.
7907 (sm_state_map::on_svalue_leak): New.
7908 (sm_state_map::on_liveness_change): New.
7909 (sm_state_map::on_inherited_svalue): Delete.
7910 (sm_state_map::on_cast): Delete.
7911 (sm_state_map::validate): Delete.
7912 (sm_state_map::on_unknown_change): Port from svalue_id to
7913 const svalue *. Add is_mutable and ext_state params.
7914 (sm_state_map::canonicalize_svalue): New.
7915 (sm_state_map::m_sm): New field.
7916 (sm_state_map::m_sm_idx): New field.
7917 (program_state::operator=): Delete.
7918 (program_state::dump_to_pp): Drop "summarize" param, adding
7919 "simple" and "multiline".
7920 (program_state::dump_to_file): Likewise.
7921 (program_state::dump): Rename "summarize" to "simple".
7922 (program_state::push_frame): New.
7923 (program_state::get_current_function): New.
7924 (program_state::on_edge): Drop "change" param.
7925 (program_state::prune_for_point): Likewise. Add enode_for_diag
7926 param.
7927 (program_state::remap_svalue_ids): Delete.
7928 (program_state::get_representative_tree): Port from svalue_id to
7929 const svalue *.
7930 (program_state::can_purge_p): Likewise. Pass ext_state to get_state.
7931 (program_state::can_merge_with_p): Add point param.
7932 (program_state::detect_leaks): New.
7933 (state_change_visitor::on_state_change): Port from tree and
7934 svalue_id to a pair of const svalue *.
7935 (class state_change): Delete.
7936 * region.cc: New file.
7937 * region-model-impl-calls.cc: New file.
7938 * region-model-manager.cc: New file.
7939 * region-model-reachability.cc: New file.
7940 * region-model-reachability.h: New file.
7941 * region-model.cc: Include "analyzer/call-string.h",
7942 "analyzer/program-point.h", and "analyzer/store.h" before
7943 "analyzer/region-model.h". Include
7944 "analyzer/region-model-reachability.h".
7945 (dump_tree): Make non-static.
7946 (dump_quoted_tree): Make non-static.
7947 (print_quoted_type): Make non-static.
7948 (path_var::dump): Delete.
7949 (dump_separator): Delete.
7950 (class impl_constraint_manager): Delete.
7951 (svalue_id::print): Delete.
7952 (svalue_id::dump_node_name_to_pp): Delete.
7953 (svalue_id::validate): Delete.
7954 (region_id::print): Delete.
7955 (region_id::dump_node_name_to_pp): Delete.
7956 (region_id::validate): Delete.
7957 (region_id_set::region_id_set): Delete.
7958 (svalue_id_set::svalue_id_set): Delete.
7959 (svalue::operator==): Delete.
7960 (svalue::hash): Delete.
7961 (svalue::print): Delete.
7962 (svalue::dump_dot_to_pp): Delete.
7963 (svalue::remap_region_ids): Delete.
7964 (svalue::walk_for_canonicalization): Delete.
7965 (svalue::get_child_sid): Delete.
7966 (svalue::maybe_get_constant): Delete.
7967 (region_svalue::compare_fields): Delete.
7968 (region_svalue::add_to_hash): Delete.
7969 (region_svalue::print_details): Delete.
7970 (region_svalue::dump_dot_to_pp): Delete.
7971 (region_svalue::remap_region_ids): Delete.
7972 (region_svalue::merge_values): Delete.
7973 (region_svalue::walk_for_canonicalization): Delete.
7974 (region_svalue::eval_condition): Delete.
7975 (constant_svalue::compare_fields): Delete.
7976 (constant_svalue::add_to_hash): Delete.
7977 (constant_svalue::merge_values): Delete.
7978 (constant_svalue::eval_condition): Move to svalue.cc.
7979 (constant_svalue::print_details): Delete.
7980 (constant_svalue::get_child_sid): Delete.
7981 (unknown_svalue::compare_fields): Delete.
7982 (unknown_svalue::add_to_hash): Delete.
7983 (unknown_svalue::print_details): Delete.
7984 (poison_kind_to_str): Move to svalue.cc.
7985 (poisoned_svalue::compare_fields): Delete.
7986 (poisoned_svalue::add_to_hash): Delete.
7987 (poisoned_svalue::print_details): Delete.
7988 (region_kind_to_str): Move to region.cc and reimplement.
7989 (region::operator==): Delete.
7990 (region::get_parent_region): Delete.
7991 (region::set_value): Delete.
7992 (region::become_active_view): Delete.
7993 (region::deactivate_any_active_view): Delete.
7994 (region::deactivate_view): Delete.
7995 (region::get_value): Delete.
7996 (region::get_inherited_child_sid): Delete.
7997 (region_model::copy_region): Delete.
7998 (region_model::copy_struct_region): Delete.
7999 (region_model::copy_union_region): Delete.
8000 (region_model::copy_array_region): Delete.
8001 (region::hash): Delete.
8002 (region::print): Delete.
8003 (region::dump_dot_to_pp): Delete.
8004 (region::dump_to_pp): Delete.
8005 (region::dump_child_label): Delete.
8006 (region::validate): Delete.
8007 (region::remap_svalue_ids): Delete.
8008 (region::remap_region_ids): Delete.
8009 (region::add_view): Delete.
8010 (region::get_view): Delete.
8011 (region::region): Move to region.cc.
8012 (region::add_to_hash): Delete.
8013 (region::print_fields): Delete.
8014 (region::non_null_p): Delete.
8015 (primitive_region::clone): Delete.
8016 (primitive_region::walk_for_canonicalization): Delete.
8017 (map_region::map_region): Delete.
8018 (map_region::compare_fields): Delete.
8019 (map_region::print_fields): Delete.
8020 (map_region::validate): Delete.
8021 (map_region::dump_dot_to_pp): Delete.
8022 (map_region::dump_child_label): Delete.
8023 (map_region::get_or_create): Delete.
8024 (map_region::get): Delete.
8025 (map_region::add_to_hash): Delete.
8026 (map_region::remap_region_ids): Delete.
8027 (map_region::unbind): Delete.
8028 (map_region::get_tree_for_child_region): Delete.
8029 (map_region::get_tree_for_child_region): Delete.
8030 (tree_cmp): Move to region.cc.
8031 (map_region::can_merge_p): Delete.
8032 (map_region::walk_for_canonicalization): Delete.
8033 (map_region::get_value_by_name): Delete.
8034 (struct_or_union_region::valid_key_p): Delete.
8035 (struct_or_union_region::compare_fields): Delete.
8036 (struct_region::clone): Delete.
8037 (struct_region::compare_fields): Delete.
8038 (union_region::clone): Delete.
8039 (union_region::compare_fields): Delete.
8040 (frame_region::compare_fields): Delete.
8041 (frame_region::clone): Delete.
8042 (frame_region::valid_key_p): Delete.
8043 (frame_region::print_fields): Delete.
8044 (frame_region::add_to_hash): Delete.
8045 (globals_region::compare_fields): Delete.
8046 (globals_region::clone): Delete.
8047 (globals_region::valid_key_p): Delete.
8048 (code_region::compare_fields): Delete.
8049 (code_region::clone): Delete.
8050 (code_region::valid_key_p): Delete.
8051 (array_region::array_region): Delete.
8052 (array_region::get_element): Delete.
8053 (array_region::clone): Delete.
8054 (array_region::compare_fields): Delete.
8055 (array_region::print_fields): Delete.
8056 (array_region::validate): Delete.
8057 (array_region::dump_dot_to_pp): Delete.
8058 (array_region::dump_child_label): Delete.
8059 (array_region::get_or_create): Delete.
8060 (array_region::get): Delete.
8061 (array_region::add_to_hash): Delete.
8062 (array_region::remap_region_ids): Delete.
8063 (array_region::get_key_for_child_region): Delete.
8064 (array_region::key_cmp): Delete.
8065 (array_region::walk_for_canonicalization): Delete.
8066 (array_region::key_from_constant): Delete.
8067 (array_region::constant_from_key): Delete.
8068 (function_region::compare_fields): Delete.
8069 (function_region::clone): Delete.
8070 (function_region::valid_key_p): Delete.
8071 (stack_region::stack_region): Delete.
8072 (stack_region::compare_fields): Delete.
8073 (stack_region::clone): Delete.
8074 (stack_region::print_fields): Delete.
8075 (stack_region::dump_child_label): Delete.
8076 (stack_region::validate): Delete.
8077 (stack_region::push_frame): Delete.
8078 (stack_region::get_current_frame_id): Delete.
8079 (stack_region::pop_frame): Delete.
8080 (stack_region::add_to_hash): Delete.
8081 (stack_region::remap_region_ids): Delete.
8082 (stack_region::can_merge_p): Delete.
8083 (stack_region::walk_for_canonicalization): Delete.
8084 (stack_region::get_value_by_name): Delete.
8085 (heap_region::heap_region): Delete.
8086 (heap_region::compare_fields): Delete.
8087 (heap_region::clone): Delete.
8088 (heap_region::walk_for_canonicalization): Delete.
8089 (root_region::root_region): Delete.
8090 (root_region::compare_fields): Delete.
8091 (root_region::clone): Delete.
8092 (root_region::print_fields): Delete.
8093 (root_region::validate): Delete.
8094 (root_region::dump_child_label): Delete.
8095 (root_region::push_frame): Delete.
8096 (root_region::get_current_frame_id): Delete.
8097 (root_region::pop_frame): Delete.
8098 (root_region::ensure_stack_region): Delete.
8099 (root_region::get_stack_region): Delete.
8100 (root_region::ensure_globals_region): Delete.
8101 (root_region::get_code_region): Delete.
8102 (root_region::ensure_code_region): Delete.
8103 (root_region::get_globals_region): Delete.
8104 (root_region::ensure_heap_region): Delete.
8105 (root_region::get_heap_region): Delete.
8106 (root_region::remap_region_ids): Delete.
8107 (root_region::can_merge_p): Delete.
8108 (root_region::add_to_hash): Delete.
8109 (root_region::walk_for_canonicalization): Delete.
8110 (root_region::get_value_by_name): Delete.
8111 (symbolic_region::symbolic_region): Delete.
8112 (symbolic_region::compare_fields): Delete.
8113 (symbolic_region::clone): Delete.
8114 (symbolic_region::walk_for_canonicalization): Delete.
8115 (symbolic_region::print_fields): Delete.
8116 (region_model::region_model): Add region_model_manager * param.
8117 Reimplement in terms of store, dropping impl_constraint_manager
8118 subclass.
8119 (region_model::operator=): Reimplement in terms of store
8120 (region_model::operator==): Likewise.
8121 (region_model::hash): Likewise.
8122 (region_model::print): Delete.
8123 (region_model::print_svalue): Delete.
8124 (region_model::dump_dot_to_pp): Delete.
8125 (region_model::dump_dot_to_file): Delete.
8126 (region_model::dump_dot): Delete.
8127 (region_model::dump_to_pp): Replace "summarize" param with
8128 "simple" and "multiline". Port to store-based implementation.
8129 (region_model::dump): Replace "summarize" param with "simple" and
8130 "multiline".
8131 (dump_vec_of_tree): Delete.
8132 (region_model::dump_summary_of_rep_path_vars): Delete.
8133 (region_model::validate): Delete.
8134 (svalue_id_cmp_by_constant_svalue_model): Delete.
8135 (svalue_id_cmp_by_constant_svalue): Delete.
8136 (region_model::canonicalize): Drop "ctxt" param. Reimplement in
8137 terms of store and constraints.
8138 (region_model::canonicalized_p): Remove NULL arg to canonicalize.
8139 (region_model::loop_replay_fixup): New.
8140 (poisoned_value_diagnostic::emit): Tweak wording of warnings.
8141 (region_model::check_for_poison): Delete.
8142 (region_model::get_gassign_result): New.
8143 (region_model::on_assignment): Port to store-based implementation.
8144 (region_model::on_call_pre): Delete calls to check_for_poison.
8145 Move implementations to region-model-impl-calls.c and port to
8146 store-based implementation.
8147 (region_model::on_call_post): Likewise.
8148 (class reachable_regions): Move to region-model-reachability.h/cc
8149 and port to store-based implementation.
8150 (region_model::handle_unrecognized_call): Port to store-based
8151 implementation.
8152 (region_model::get_reachable_svalues): New.
8153 (region_model::on_setjmp): Port to store-based implementation.
8154 (region_model::on_longjmp): Likewise.
8155 (region_model::handle_phi): Drop is_back_edge param and the logic
8156 using it.
8157 (region_model::get_lvalue_1): Port from region_id to const region *.
8158 (region_model::make_region_for_unexpected_tree_code): Delete.
8159 (assert_compat_types): If the check fails, use internal_error to
8160 show the types.
8161 (region_model::get_lvalue): Port from region_id to const region *.
8162 (region_model::get_rvalue_1): Port from svalue_id to const svalue *.
8163 (region_model::get_rvalue): Likewise.
8164 (region_model::get_or_create_ptr_svalue): Delete.
8165 (region_model::get_or_create_constant_svalue): Delete.
8166 (region_model::get_svalue_for_fndecl): Delete.
8167 (region_model::get_region_for_fndecl): Delete.
8168 (region_model::get_svalue_for_label): Delete.
8169 (region_model::get_region_for_label): Delete.
8170 (build_cast): Delete.
8171 (region_model::maybe_cast_1): Delete.
8172 (region_model::maybe_cast): Delete.
8173 (region_model::get_field_region): Delete.
8174 (region_model::get_store_value): New.
8175 (region_model::region_exists_p): New.
8176 (region_model::deref_rvalue): Port from svalue_id to const svalue *.
8177 (region_model::set_value): Likewise.
8178 (region_model::clobber_region): New.
8179 (region_model::purge_region): New.
8180 (region_model::zero_fill_region): New.
8181 (region_model::mark_region_as_unknown): New.
8182 (region_model::eval_condition): Port from svalue_id to
8183 const svalue *.
8184 (region_model::eval_condition_without_cm): Likewise.
8185 (region_model::compare_initial_and_pointer): New.
8186 (region_model::add_constraint): Port from svalue_id to
8187 const svalue *.
8188 (region_model::maybe_get_constant): Delete.
8189 (region_model::get_representative_path_var): New.
8190 (region_model::add_new_malloc_region): Delete.
8191 (region_model::get_representative_tree): Port to const svalue *.
8192 (region_model::get_representative_path_var): Port to
8193 const region *.
8194 (region_model::get_path_vars_for_svalue): Delete.
8195 (region_model::set_to_new_unknown_value): Delete.
8196 (region_model::update_for_phis): Don't pass is_back_edge to handle_phi.
8197 (region_model::update_for_call_superedge): Port from svalue_id to
8198 const svalue *.
8199 (region_model::update_for_return_superedge): Port to store-based
8200 implementation.
8201 (region_model::update_for_call_summary): Replace
8202 set_to_new_unknown_value with mark_region_as_unknown.
8203 (region_model::get_root_region): Delete.
8204 (region_model::get_stack_region_id): Delete.
8205 (region_model::push_frame): Delete.
8206 (region_model::get_current_frame_id): Delete.
8207 (region_model::get_current_function): Delete.
8208 (region_model::pop_frame): Delete.
8209 (region_model::on_top_level_param): New.
8210 (region_model::get_stack_depth): Delete.
8211 (region_model::get_function_at_depth): Delete.
8212 (region_model::get_globals_region_id): Delete.
8213 (region_model::add_svalue): Delete.
8214 (region_model::replace_svalue): Delete.
8215 (region_model::add_region): Delete.
8216 (region_model::get_svalue): Delete.
8217 (region_model::get_region): Delete.
8218 (make_region_for_type): Delete.
8219 (region_model::add_region_for_type): Delete.
8220 (region_model::on_top_level_param): New.
8221 (class restrict_to_used_svalues): Delete.
8222 (region_model::purge_unused_svalues): Delete.
8223 (region_model::push_frame): New.
8224 (region_model::remap_svalue_ids): Delete.
8225 (region_model::remap_region_ids): Delete.
8226 (region_model::purge_regions): Delete.
8227 (region_model::get_descendents): Delete.
8228 (region_model::delete_region_and_descendents): Delete.
8229 (region_model::poison_any_pointers_to_bad_regions): Delete.
8230 (region_model::can_merge_with_p): Delete.
8231 (region_model::get_current_function): New.
8232 (region_model::get_value_by_name): Delete.
8233 (region_model::convert_byte_offset_to_array_index): Delete.
8234 (region_model::pop_frame): New.
8235 (region_model::get_or_create_mem_ref): Delete.
8236 (region_model::get_stack_depth): New.
8237 (region_model::get_frame_at_index): New.
8238 (region_model::unbind_region_and_descendents): New.
8239 (struct bad_pointer_finder): New.
8240 (region_model::get_or_create_pointer_plus_expr): Delete.
8241 (region_model::poison_any_pointers_to_descendents): New.
8242 (region_model::get_or_create_view): Delete.
8243 (region_model::can_merge_with_p): New.
8244 (region_model::get_fndecl_for_call): Port from svalue_id to
8245 const svalue *.
8246 (struct append_ssa_names_cb_data): New.
8247 (get_ssa_name_regions_for_current_frame): New.
8248 (region_model::append_ssa_names_cb): New.
8249 (model_merger::dump_to_pp): Add "simple" param. Drop dumping of
8250 remappings.
8251 (model_merger::dump): Add "simple" param to both overloads.
8252 (model_merger::can_merge_values_p): Delete.
8253 (model_merger::record_regions): Delete.
8254 (model_merger::record_svalues): Delete.
8255 (svalue_id_merger_mapping::svalue_id_merger_mapping): Delete.
8256 (svalue_id_merger_mapping::dump_to_pp): Delete.
8257 (svalue_id_merger_mapping::dump): Delete.
8258 (region_model::create_region_for_heap_alloc): New.
8259 (region_model::create_region_for_alloca): New.
8260 (region_model::record_dynamic_extents): New.
8261 (canonicalization::canonicalization): Delete.
8262 (canonicalization::walk_rid): Delete.
8263 (canonicalization::walk_sid): Delete.
8264 (canonicalization::dump_to_pp): Delete.
8265 (canonicalization::dump): Delete.
8266 (inchash::add): Delete overloads for svalue_id and region_id.
8267 (engine::log_stats): New.
8268 (assert_condition): Add overload comparing svalues.
8269 (assert_dump_eq): Pass "true" for multiline.
8270 (selftest::test_dump): Update for rewrite of region_model.
8271 (selftest::test_dump_2): Rename to...
8272 (selftest::test_struct): ...this. Provide a region_model_manager
8273 when creating region_model instance. Remove dump test. Add
8274 checks for get_offset.
8275 (selftest::test_dump_3): Rename to...
8276 (selftest::test_array_1): ...this. Provide a region_model_manager
8277 when creating region_model instance. Remove dump test.
8278 (selftest::test_get_representative_tree): Port from svalue_id to
8279 new API. Add test coverage for various expressions.
8280 (selftest::test_unique_constants): Provide a region_model_manager
8281 for the region_model. Add test coverage for comparing const vs
8282 non-const.
8283 (selftest::test_svalue_equality): Delete.
8284 (selftest::test_region_equality): Delete.
8285 (selftest::test_unique_unknowns): New.
8286 (class purge_all_svalue_ids): Delete.
8287 (class purge_one_svalue_id): Delete.
8288 (selftest::test_purging_by_criteria): Delete.
8289 (selftest::test_initial_svalue_folding): New.
8290 (selftest::test_unaryop_svalue_folding): New.
8291 (selftest::test_binop_svalue_folding): New.
8292 (selftest::test_sub_svalue_folding): New.
8293 (selftest::test_purge_unused_svalues): Delete.
8294 (selftest::test_descendent_of_p): New.
8295 (selftest::test_assignment): Provide a region_model_manager for
8296 the region_model. Drop the dump test.
8297 (selftest::test_compound_assignment): Likewise.
8298 (selftest::test_stack_frames): Port to new implementation.
8299 (selftest::test_get_representative_path_var): Likewise.
8300 (selftest::test_canonicalization_1): Rename to...
8301 (selftest::test_equality_1): ...this. Port to new API, and add
8302 (selftest::test_canonicalization_2): Provide a
8303 region_model_manager when creating region_model instances.
8304 Remove redundant canicalization.
8305 (selftest::test_canonicalization_3): Provide a
8306 region_model_manager when creating region_model instances.
8307 Remove param from calls to region_model::canonicalize.
8308 (selftest::test_canonicalization_4): Likewise.
8309 (selftest::assert_region_models_merge): Constify
8310 out_merged_svalue. Port to new API.
8311 (selftest::test_state_merging): Provide a
8312 region_model_manager when creating region_model instances.
8313 Provide a program_point point when merging them. Replace
8314 set_to_new_unknown_value with usage of placeholder_svalues.
8315 Drop get_value_by_name. Port from svalue_id to const svalue *.
8316 Add test of heap allocation.
8317 (selftest::test_constraint_merging): Provide a
8318 region_model_manager when creating region_model instances.
8319 Provide a program_point point when merging them. Eliminate use
8320 of set_to_new_unknown_value.
8321 (selftest::test_widening_constraints): New.
8322 (selftest::test_iteration_1): New.
8323 (selftest::test_malloc_constraints): Port to store-based
8324 implementation.
8325 (selftest::test_var): New test.
8326 (selftest::test_array_2): New test.
8327 (selftest::test_mem_ref): New test.
8328 (selftest::test_POINTER_PLUS_EXPR_then_MEM_REF): New.
8329 (selftest::test_malloc): New.
8330 (selftest::test_alloca): New.
8331 (selftest::analyzer_region_model_cc_tests): Update for renamings.
8332 Call new functions.
8333 * region-model.h (class path_var): Move to analyzer.h.
8334 (class svalue_id): Delete.
8335 (class region_id): Delete.
8336 (class id_map): Delete.
8337 (svalue_id_map): Delete.
8338 (region_id_map): Delete.
8339 (id_map<T>::id_map): Delete.
8340 (id_map<T>::put): Delete.
8341 (id_map<T>::get_dst_for_src): Delete.
8342 (id_map<T>::get_src_for_dst): Delete.
8343 (id_map<T>::dump_to_pp): Delete.
8344 (id_map<T>::dump): Delete.
8345 (id_map<T>::update): Delete.
8346 (one_way_svalue_id_map): Delete.
8347 (one_way_region_id_map): Delete.
8348 (class region_id_set): Delete.
8349 (class svalue_id_set): Delete.
8350 (struct complexity): New.
8351 (class visitor): New.
8352 (enum svalue_kind): Add SK_SETJMP, SK_INITIAL, SK_UNARYOP,
8353 SK_BINOP, SK_SUB,SK_UNMERGEABLE, SK_PLACEHOLDER, SK_WIDENING,
8354 SK_COMPOUND, and SK_CONJURED.
8355 (svalue::operator==): Delete.
8356 (svalue::operator!=): Delete.
8357 (svalue::clone): Delete.
8358 (svalue::hash): Delete.
8359 (svalue::dump_dot_to_pp): Delete.
8360 (svalue::dump_to_pp): New.
8361 (svalue::dump): New.
8362 (svalue::get_desc): New.
8363 (svalue::dyn_cast_initial_svalue): New.
8364 (svalue::dyn_cast_unaryop_svalue): New.
8365 (svalue::dyn_cast_binop_svalue): New.
8366 (svalue::dyn_cast_sub_svalue): New.
8367 (svalue::dyn_cast_unmergeable_svalue): New.
8368 (svalue::dyn_cast_widening_svalue): New.
8369 (svalue::dyn_cast_compound_svalue): New.
8370 (svalue::dyn_cast_conjured_svalue): New.
8371 (svalue::maybe_undo_cast): New.
8372 (svalue::unwrap_any_unmergeable): New.
8373 (svalue::remap_region_ids): Delete
8374 (svalue::can_merge_p): New.
8375 (svalue::walk_for_canonicalization): Delete
8376 (svalue::get_complexity): New.
8377 (svalue::get_child_sid): Delete
8378 (svalue::accept): New.
8379 (svalue::live_p): New.
8380 (svalue::implicitly_live_p): New.
8381 (svalue::svalue): Add complexity param.
8382 (svalue::add_to_hash): Delete
8383 (svalue::print_details): Delete
8384 (svalue::m_complexity): New field.
8385 (region_svalue::key_t): New struct.
8386 (region_svalue::region_svalue): Port from region_id to
8387 const region_id *. Add complexity.
8388 (region_svalue::compare_fields): Delete.
8389 (region_svalue::clone): Delete.
8390 (region_svalue::dump_dot_to_pp): Delete.
8391 (region_svalue::get_pointee): Port from region_id to
8392 const region_id *.
8393 (region_svalue::remap_region_ids): Delete.
8394 (region_svalue::merge_values): Delete.
8395 (region_svalue::dump_to_pp): New.
8396 (region_svalue::accept): New.
8397 (region_svalue::walk_for_canonicalization): Delete.
8398 (region_svalue::eval_condition): Make params const.
8399 (region_svalue::add_to_hash): Delete.
8400 (region_svalue::print_details): Delete.
8401 (region_svalue::m_rid): Replace with...
8402 (region_svalue::m_reg): ...this.
8403 (is_a_helper <region_svalue *>::test): Convert to...
8404 (is_a_helper <const region_svalue *>::test): ...this.
8405 (template <> struct default_hash_traits<region_svalue::key_t>):
8406 New.
8407 (constant_svalue::constant_svalue): Add complexity.
8408 (constant_svalue::compare_fields): Delete.
8409 (constant_svalue::clone): Delete.
8410 (constant_svalue::add_to_hash): Delete.
8411 (constant_svalue::dump_to_pp): New.
8412 (constant_svalue::accept): New.
8413 (constant_svalue::implicitly_live_p): New.
8414 (constant_svalue::merge_values): Delete.
8415 (constant_svalue::eval_condition): Make params const.
8416 (constant_svalue::get_child_sid): Delete.
8417 (constant_svalue::print_details): Delete.
8418 (is_a_helper <constant_svalue *>::test): Convert to...
8419 (is_a_helper <const constant_svalue *>::test): ...this.
8420 (class unknown_svalue): Update leading comment.
8421 (unknown_svalue::unknown_svalue): Add complexity.
8422 (unknown_svalue::compare_fields): Delete.
8423 (unknown_svalue::add_to_hash): Delete.
8424 (unknown_svalue::dyn_cast_unknown_svalue): Delete.
8425 (unknown_svalue::print_details): Delete.
8426 (unknown_svalue::dump_to_pp): New.
8427 (unknown_svalue::accept): New.
8428 (poisoned_svalue::key_t): New struct.
8429 (poisoned_svalue::poisoned_svalue): Add complexity.
8430 (poisoned_svalue::compare_fields): Delete.
8431 (poisoned_svalue::clone): Delete.
8432 (poisoned_svalue::add_to_hash): Delete.
8433 (poisoned_svalue::dump_to_pp): New.
8434 (poisoned_svalue::accept): New.
8435 (poisoned_svalue::print_details): Delete.
8436 (is_a_helper <poisoned_svalue *>::test): Convert to...
8437 (is_a_helper <const poisoned_svalue *>::test): ...this.
8438 (template <> struct default_hash_traits<poisoned_svalue::key_t>):
8439 New.
8440 (setjmp_record::add_to_hash): New.
8441 (setjmp_svalue::key_t): New struct.
8442 (setjmp_svalue::compare_fields): Delete.
8443 (setjmp_svalue::clone): Delete.
8444 (setjmp_svalue::add_to_hash): Delete.
8445 (setjmp_svalue::setjmp_svalue): Add complexity.
8446 (setjmp_svalue::dump_to_pp): New.
8447 (setjmp_svalue::accept): New.
8448 (setjmp_svalue::void print_details): Delete.
8449 (is_a_helper <const setjmp_svalue *>::test): New.
8450 (template <> struct default_hash_traits<setjmp_svalue::key_t>): New.
8451 (class initial_svalue : public svalue): New.
8452 (is_a_helper <const initial_svalue *>::test): New.
8453 (class unaryop_svalue): New.
8454 (is_a_helper <const unaryop_svalue *>::test): New.
8455 (template <> struct default_hash_traits<unaryop_svalue::key_t>): New.
8456 (class binop_svalue): New.
8457 (is_a_helper <const binop_svalue *>::test): New.
8458 (template <> struct default_hash_traits<binop_svalue::key_t>): New.
8459 (class sub_svalue): New.
8460 (is_a_helper <const sub_svalue *>::test): New.
8461 (template <> struct default_hash_traits<sub_svalue::key_t>): New.
8462 (class unmergeable_svalue): New.
8463 (is_a_helper <const unmergeable_svalue *>::test): New.
8464 (class placeholder_svalue): New.
8465 (is_a_helper <placeholder_svalue *>::test): New.
8466 (class widening_svalue): New.
8467 (is_a_helper <widening_svalue *>::test): New.
8468 (template <> struct default_hash_traits<widening_svalue::key_t>): New.
8469 (class compound_svalue): New.
8470 (is_a_helper <compound_svalue *>::test): New.
8471 (template <> struct default_hash_traits<compound_svalue::key_t>): New.
8472 (class conjured_svalue): New.
8473 (is_a_helper <conjured_svalue *>::test): New.
8474 (template <> struct default_hash_traits<conjured_svalue::key_t>): New.
8475 (enum region_kind): Delete RK_PRIMITIVE, RK_STRUCT, RK_UNION, and
8476 RK_ARRAY. Add RK_LABEL, RK_DECL, RK_FIELD, RK_ELEMENT, RK_OFFSET,
8477 RK_CAST, RK_HEAP_ALLOCATED, RK_ALLOCA, RK_STRING, and RK_UNKNOWN.
8478 (region_kind_to_str): Delete.
8479 (region::~region): Move implementation to region.cc.
8480 (region::operator==): Delete.
8481 (region::operator!=): Delete.
8482 (region::clone): Delete.
8483 (region::get_id): New.
8484 (region::cmp_ids): New.
8485 (region::dyn_cast_map_region): Delete.
8486 (region::dyn_cast_array_region): Delete.
8487 (region::region_id get_parent): Delete.
8488 (region::get_parent_region): Convert to a simple accessor.
8489 (region::void set_value): Delete.
8490 (region::svalue_id get_value): Delete.
8491 (region::svalue_id get_value_direct): Delete.
8492 (region::svalue_id get_inherited_child_sid): Delete.
8493 (region::dyn_cast_frame_region): New.
8494 (region::dyn_cast_function_region): New.
8495 (region::dyn_cast_decl_region): New.
8496 (region::dyn_cast_field_region): New.
8497 (region::dyn_cast_element_region): New.
8498 (region::dyn_cast_offset_region): New.
8499 (region::dyn_cast_cast_region): New.
8500 (region::dyn_cast_string_region): New.
8501 (region::accept): New.
8502 (region::get_base_region): New.
8503 (region::base_region_p): New.
8504 (region::descendent_of_p): New.
8505 (region::maybe_get_frame_region): New.
8506 (region::maybe_get_decl): New.
8507 (region::hash): Delete.
8508 (region::rint): Delete.
8509 (region::dump_dot_to_pp): Delete.
8510 (region::get_desc): New.
8511 (region::dump_to_pp): Convert to vfunc, changing signature.
8512 (region::dump_child_label): Delete.
8513 (region::remap_svalue_ids): Delete.
8514 (region::remap_region_ids): Delete.
8515 (region::dump): New.
8516 (region::walk_for_canonicalization): Delete.
8517 (region::non_null_p): Drop region_model param.
8518 (region::add_view): Delete.
8519 (region::get_view): Delete.
8520 (region::get_active_view): Delete.
8521 (region::is_view_p): Delete.
8522 (region::cmp_ptrs): New.
8523 (region::validate): Delete.
8524 (region::get_offset): New.
8525 (region::get_byte_size): New.
8526 (region::get_bit_size): New.
8527 (region::get_subregions_for_binding): New.
8528 (region::region): Add complexity param. Convert parent from
8529 region_id to const region *. Drop svalue_id. Drop copy ctor.
8530 (region::symbolic_for_unknown_ptr_p): New.
8531 (region::add_to_hash): Delete.
8532 (region::print_fields): Delete.
8533 (region::get_complexity): New accessor.
8534 (region::become_active_view): Delete.
8535 (region::deactivate_any_active_view): Delete.
8536 (region::deactivate_view): Delete.
8537 (region::calc_offset): New.
8538 (region::m_parent_rid): Delete.
8539 (region::m_sval_id): Delete.
8540 (region::m_complexity): New.
8541 (region::m_id): New.
8542 (region::m_parent): New.
8543 (region::m_view_rids): Delete.
8544 (region::m_is_view): Delete.
8545 (region::m_active_view_rid): Delete.
8546 (region::m_cached_offset): New.
8547 (is_a_helper <region *>::test): Convert to...
8548 (is_a_helper <const region *>::test): ... this.
8549 (class primitive_region): Delete.
8550 (class space_region): New.
8551 (class map_region): Delete.
8552 (is_a_helper <map_region *>::test): Delete.
8553 (class frame_region): Reimplement.
8554 (template <> struct default_hash_traits<frame_region::key_t>):
8555 New.
8556 (class globals_region): Reimplement.
8557 (is_a_helper <globals_region *>::test): Convert to...
8558 (is_a_helper <const globals_region *>::test): ...this.
8559 (class struct_or_union_region): Delete.
8560 (is_a_helper <struct_or_union_region *>::test): Delete.
8561 (class code_region): Reimplement.
8562 (is_a_helper <const code_region *>::test): New.
8563 (class struct_region): Delete.
8564 (is_a_helper <struct_region *>::test): Delete.
8565 (class function_region): Reimplement.
8566 (is_a_helper <function_region *>::test): Convert to...
8567 (is_a_helper <const function_region *>::test): ...this.
8568 (class union_region): Delete.
8569 (is_a_helper <union_region *>::test): Delete.
8570 (class label_region): New.
8571 (is_a_helper <const label_region *>::test): New.
8572 (class scope_region): Delete.
8573 (class stack_region): Reimplement.
8574 (is_a_helper <stack_region *>::test): Convert to...
8575 (is_a_helper <const stack_region *>::test): ...this.
8576 (class heap_region): Reimplement.
8577 (is_a_helper <heap_region *>::test): Convert to...
8578 (is_a_helper <const heap_region *>::test): ...this.
8579 (class root_region): Reimplement.
8580 (is_a_helper <root_region *>::test): Convert to...
8581 (is_a_helper <const root_region *>::test): ...this.
8582 (class symbolic_region): Reimplement.
8583 (is_a_helper <const symbolic_region *>::test): New.
8584 (template <> struct default_hash_traits<symbolic_region::key_t>):
8585 New.
8586 (class decl_region): New.
8587 (is_a_helper <const decl_region *>::test): New.
8588 (class field_region): New.
8589 (template <> struct default_hash_traits<field_region::key_t>): New.
8590 (class array_region): Delete.
8591 (class element_region): New.
8592 (is_a_helper <array_region *>::test): Delete.
8593 (is_a_helper <const element_region *>::test): New.
8594 (template <> struct default_hash_traits<element_region::key_t>):
8595 New.
8596 (class offset_region): New.
8597 (is_a_helper <const offset_region *>::test): New.
8598 (template <> struct default_hash_traits<offset_region::key_t>):
8599 New.
8600 (class cast_region): New.
8601 (is_a_helper <const cast_region *>::test): New.
8602 (template <> struct default_hash_traits<cast_region::key_t>): New.
8603 (class heap_allocated_region): New.
8604 (class alloca_region): New.
8605 (class string_region): New.
8606 (is_a_helper <const string_region *>::test): New.
8607 (class unknown_region): New.
8608 (class region_model_manager): New.
8609 (struct append_ssa_names_cb_data): New.
8610 (class call_details): New.
8611 (region_model::region_model): Add region_model_manager param.
8612 (region_model::print_svalue): Delete.
8613 (region_model::dump_dot_to_pp): Delete.
8614 (region_model::dump_dot_to_file): Delete.
8615 (region_model::dump_dot): Delete.
8616 (region_model::dump_to_pp): Drop summarize param in favor of
8617 simple and multiline.
8618 (region_model::dump): Likewise.
8619 (region_model::summarize_to_pp): Delete.
8620 (region_model::summarize): Delete.
8621 (region_model::void canonicalize): Drop ctxt param.
8622 (region_model::void check_for_poison): Delete.
8623 (region_model::get_gassign_result): New.
8624 (region_model::impl_call_alloca): New.
8625 (region_model::impl_call_analyzer_describe): New.
8626 (region_model::impl_call_analyzer_eval): New.
8627 (region_model::impl_call_builtin_expect): New.
8628 (region_model::impl_call_calloc): New.
8629 (region_model::impl_call_free): New.
8630 (region_model::impl_call_malloc): New.
8631 (region_model::impl_call_memset): New.
8632 (region_model::impl_call_strlen): New.
8633 (region_model::get_reachable_svalues): New.
8634 (region_model::handle_phi): Drop is_back_edge param.
8635 (region_model::region_id get_root_rid): Delete.
8636 (region_model::root_region *get_root_region): Delete.
8637 (region_model::region_id get_stack_region_id): Delete.
8638 (region_model::push_frame): Convert from region_id and svalue_id
8639 to const region * and const svalue *.
8640 (region_model::get_current_frame_id): Replace with...
8641 (region_model::get_current_frame): ...this.
8642 (region_model::pop_frame): Convert from region_id to
8643 const region *. Drop purge and stats param. Add out_result.
8644 (region_model::function *get_function_at_depth): Delete.
8645 (region_model::get_globals_region_id): Delete.
8646 (region_model::add_svalue): Delete.
8647 (region_model::replace_svalue): Delete.
8648 (region_model::add_region): Delete.
8649 (region_model::add_region_for_type): Delete.
8650 (region_model::get_svalue): Delete.
8651 (region_model::get_region): Delete.
8652 (region_model::get_lvalue): Convert from region_id to
8653 const region *.
8654 (region_model::get_rvalue): Convert from svalue_id to
8655 const svalue *.
8656 (region_model::get_or_create_ptr_svalue): Delete.
8657 (region_model::get_or_create_constant_svalue): Delete.
8658 (region_model::get_svalue_for_fndecl): Delete.
8659 (region_model::get_svalue_for_label): Delete.
8660 (region_model::get_region_for_fndecl): Delete.
8661 (region_model::get_region_for_label): Delete.
8662 (region_model::get_frame_at_index (int index) const;): New.
8663 (region_model::maybe_cast): Delete.
8664 (region_model::maybe_cast_1): Delete.
8665 (region_model::get_field_region): Delete.
8666 (region_model::id deref_rvalue): Convert from region_id and
8667 svalue_id to const region * and const svalue *. Drop overload,
8668 passing in both a tree and an svalue.
8669 (region_model::set_value): Convert from region_id and svalue_id to
8670 const region * and const svalue *.
8671 (region_model::set_to_new_unknown_value): Delete.
8672 (region_model::clobber_region (const region *reg);): New.
8673 (region_model::purge_region (const region *reg);): New.
8674 (region_model::zero_fill_region (const region *reg);): New.
8675 (region_model::mark_region_as_unknown (const region *reg);): New.
8676 (region_model::copy_region): Convert from region_id to
8677 const region *.
8678 (region_model::eval_condition): Convert from svalue_id to
8679 const svalue *.
8680 (region_model::eval_condition_without_cm): Likewise.
8681 (region_model::compare_initial_and_pointer): New.
8682 (region_model:maybe_get_constant): Delete.
8683 (region_model::add_new_malloc_region): Delete.
8684 (region_model::get_representative_tree): Convert from svalue_id to
8685 const svalue *.
8686 (region_model::get_representative_path_var): Delete decl taking a
8687 region_id in favor of two decls, for svalue vs region, with an
8688 svalue_set to ensure termination.
8689 (region_model::get_path_vars_for_svalue): Delete.
8690 (region_model::create_region_for_heap_alloc): New.
8691 (region_model::create_region_for_alloca): New.
8692 (region_model::purge_unused_svalues): Delete.
8693 (region_model::remap_svalue_ids): Delete.
8694 (region_model::remap_region_ids): Delete.
8695 (region_model::purge_regions): Delete.
8696 (region_model::get_num_svalues): Delete.
8697 (region_model::get_num_regions): Delete.
8698 (region_model::get_descendents): Delete.
8699 (region_model::get_store): New.
8700 (region_model::delete_region_and_descendents): Delete.
8701 (region_model::get_manager): New.
8702 (region_model::unbind_region_and_descendents): New.
8703 (region_model::can_merge_with_p): Add point param. Drop
8704 svalue_id_merger_mapping.
8705 (region_model::get_value_by_name): Delete.
8706 (region_model::convert_byte_offset_to_array_index): Delete.
8707 (region_model::get_or_create_mem_ref): Delete.
8708 (region_model::get_or_create_pointer_plus_expr): Delete.
8709 (region_model::get_or_create_view): Delete.
8710 (region_model::get_lvalue_1): Convert from region_id to
8711 const region *.
8712 (region_model::get_rvalue_1): Convert from svalue_id to
8713 const svalue *.
8714 (region_model::get_ssa_name_regions_for_current_frame): New.
8715 (region_model::append_ssa_names_cb): New.
8716 (region_model::get_store_value): New.
8717 (region_model::copy_struct_region): Delete.
8718 (region_model::copy_union_region): Delete.
8719 (region_model::copy_array_region): Delete.
8720 (region_model::region_exists_p): New.
8721 (region_model::make_region_for_unexpected_tree_code): Delete.
8722 (region_model::loop_replay_fixup): New.
8723 (region_model::poison_any_pointers_to_bad_regions): Delete.
8724 (region_model::poison_any_pointers_to_descendents): New.
8725 (region_model::dump_summary_of_rep_path_vars): Delete.
8726 (region_model::on_top_level_param): New.
8727 (region_model::record_dynamic_extents): New.
8728 (region_model::m_mgr;): New.
8729 (region_model::m_store;): New.
8730 (region_model::m_svalues;): Delete.
8731 (region_model::m_regions;): Delete.
8732 (region_model::m_root_rid;): Delete.
8733 (region_model::m_current_frame;): New.
8734 (region_model_context::remap_svalue_ids): Delete.
8735 (region_model_context::can_purge_p): Delete.
8736 (region_model_context::on_svalue_leak): New.
8737 (region_model_context::on_svalue_purge): Delete.
8738 (region_model_context::on_liveness_change): New.
8739 (region_model_context::on_inherited_svalue): Delete.
8740 (region_model_context::on_cast): Delete.
8741 (region_model_context::on_unknown_change): Convert from svalue_id to
8742 const svalue * and add is_mutable.
8743 (class noop_region_model_context): Update for region_model_context
8744 changes.
8745 (model_merger::model_merger): Add program_point. Drop
8746 svalue_id_merger_mapping.
8747 (model_merger::dump_to_pp): Add "simple" param.
8748 (model_merger::dump): Likewise.
8749 (model_merger::get_region_a): Delete.
8750 (model_merger::get_region_b): Delete.
8751 (model_merger::can_merge_values_p): Delete.
8752 (model_merger::record_regions): Delete.
8753 (model_merger::record_svalues): Delete.
8754 (model_merger::m_point): New field.
8755 (model_merger::m_map_regions_from_a_to_m): Delete.
8756 (model_merger::m_map_regions_from_b_to_m): Delete.
8757 (model_merger::m_sid_mapping): Delete.
8758 (struct svalue_id_merger_mapping): Delete.
8759 (class engine): New.
8760 (struct canonicalization): Delete.
8761 (inchash::add): Delete decls for hashing svalue_id and region_id.
8762 (test_region_model_context::on_unexpected_tree_code): Require t to
8763 be non-NULL.
8764 (selftest::assert_condition): Add overload comparing a pair of
8765 const svalue *.
8766 * sm-file.cc: Include "tristate.h", "selftest.h",
8767 "analyzer/call-string.h", "analyzer/program-point.h",
8768 "analyzer/store.h", and "analyzer/region-model.h".
8769 (fileptr_state_machine::get_default_state): New.
8770 (fileptr_state_machine::on_stmt): Remove calls to
8771 get_readable_tree in favor of get_diagnostic_tree.
8772 * sm-malloc.cc: Include "tristate.h", "selftest.h",
8773 "analyzer/call-string.h", "analyzer/program-point.h",
8774 "analyzer/store.h", and "analyzer/region-model.h".
8775 (malloc_state_machine::get_default_state): New.
8776 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New.
8777 (malloc_diagnostic::describe_state_change): Handle change.m_expr
8778 being NULL.
8779 (null_arg::emit): Avoid printing "NULL '0'".
8780 (null_arg::describe_final_event): Avoid printing "(0) NULL".
8781 (malloc_leak::emit): Handle m_arg being NULL.
8782 (malloc_leak::describe_final_event): Handle ev.m_expr being NULL.
8783 (malloc_state_machine::on_stmt): Don't call get_readable_tree.
8784 Call get_diagnostic_tree when creating pending diagnostics.
8785 Update for is_zero_assignment becoming a member function of
8786 sm_ctxt.
8787 Don't transition to m_non_heap for ADDR_EXPR(MEM_REF()).
8788 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New
8789 vfunc implementation.
8790 * sm-sensitive.cc (sensitive_state_machine::warn_for_any_exposure): Call
8791 get_diagnostic_tree and pass the result to warn_for_state.
8792 * sm-signal.cc: Move includes of "analyzer/call-string.h" and
8793 "analyzer/program-point.h" to before "analyzer/region-model.h",
8794 and also include "analyzer/store.h" before it.
8795 (signal_unsafe_call::describe_state_change): Use
8796 get_dest_function to get handler.
8797 (update_model_for_signal_handler): Pass manager to region_model
8798 ctor.
8799 (register_signal_handler::impl_transition): Update for changes to
8800 get_or_create_node and add_edge.
8801 * sm-taint.cc (taint_state_machine::on_stmt): Remove calls to
8802 get_readable_tree, replacing them when calling warn_for_state with
8803 calls to get_diagnostic_tree.
8804 * sm.cc (is_zero_assignment): Delete.
8805 (any_pointer_p): Move to within namespace ana.
8806 * sm.h (is_zero_assignment): Remove decl.
8807 (any_pointer_p): Move decl to within namespace ana.
8808 (state_machine::get_default_state): New vfunc.
8809 (state_machine::reset_when_passed_to_unknown_fn_p): New vfunc.
8810 (sm_context::get_readable_tree): Rename to...
8811 (sm_context::get_diagnostic_tree): ...this.
8812 (sm_context::is_zero_assignment): New vfunc.
8813 * store.cc: New file.
8814 * store.h: New file.
8815 * svalue.cc: New file.
8817 2020-05-22 Mark Wielaard <mark@klomp.org>
8819 * sm-signal.cc(signal_unsafe_call::emit): Possibly add
8820 gcc_rich_location note for replacement.
8821 (signal_unsafe_call::get_replacement_fn): New private function.
8822 (get_async_signal_unsafe_fns): Add "exit".
8824 2020-04-28 David Malcolm <dmalcolm@redhat.com>
8826 PR analyzer/94816
8827 * engine.cc (impl_region_model_context::on_unexpected_tree_code):
8828 Handle NULL tree.
8829 * region-model.cc (region_model::add_region_for_type): Handle
8830 NULL type.
8831 * region-model.h
8832 (test_region_model_context::on_unexpected_tree_code): Handle NULL
8833 tree.
8835 2020-04-28 David Malcolm <dmalcolm@redhat.com>
8837 PR analyzer/94447
8838 PR analyzer/94639
8839 PR analyzer/94732
8840 PR analyzer/94754
8841 * analyzer.opt (Wanalyzer-use-of-uninitialized-value): Delete.
8842 * program-state.cc (selftest::test_program_state_dumping): Update
8843 expected dump result for removal of "uninit".
8844 * region-model.cc (poison_kind_to_str): Delete POISON_KIND_UNINIT
8845 case.
8846 (root_region::ensure_stack_region): Initialize stack with null
8847 svalue_id rather than with a typeless POISON_KIND_UNINIT value.
8848 (root_region::ensure_heap_region): Likewise for the heap.
8849 (region_model::dump_summary_of_rep_path_vars): Remove
8850 summarization of uninit values.
8851 (region_model::validate): Remove check that the stack has a
8852 POISON_KIND_UNINIT value.
8853 (poisoned_value_diagnostic::emit): Remove POISON_KIND_UNINIT
8854 case.
8855 (poisoned_value_diagnostic::describe_final_event): Likewise.
8856 (selftest::test_dump): Update expected dump result for removal of
8857 "uninit".
8858 (selftest::test_svalue_equality): Remove "uninit" and "freed".
8859 * region-model.h (enum poison_kind): Remove POISON_KIND_UNINIT.
8861 2020-04-01 David Malcolm <dmalcolm@redhat.com>
8863 PR analyzer/94378
8864 * checker-path.cc: Include "bitmap.h".
8865 * constraint-manager.cc: Likewise.
8866 * diagnostic-manager.cc: Likewise.
8867 * engine.cc: Likewise.
8868 (exploded_node::detect_leaks): Pass null region_id to pop_frame.
8869 * program-point.cc: Include "bitmap.h".
8870 * program-state.cc: Likewise.
8871 * region-model.cc (id_set<region_id>::id_set): Convert to...
8872 (region_id_set::region_id_set): ...this.
8873 (svalue_id_set::svalue_id_set): New ctor.
8874 (region_model::copy_region): New function.
8875 (region_model::copy_struct_region): New function.
8876 (region_model::copy_union_region): New function.
8877 (region_model::copy_array_region): New function.
8878 (stack_region::pop_frame): Drop return value. Add
8879 "result_dst_rid" param; if it is non-null, use copy_region to copy
8880 the result to it. Rather than capture and pass a single "known
8881 used" return value to be used by purge_unused_values, instead
8882 gather and pass a set of known used return values.
8883 (root_region::pop_frame): Drop return value. Add "result_dst_rid"
8884 param.
8885 (region_model::on_assignment): Use copy_region.
8886 (region_model::on_return): Likewise for the result.
8887 (region_model::on_longjmp): Pass null for pop_frame's
8888 result_dst_rid.
8889 (region_model::update_for_return_superedge): Pass the region for the
8890 return value of the call, if any, to pop_frame, rather than setting
8891 the lvalue for the lhs of the result.
8892 (region_model::pop_frame): Drop return value. Add
8893 "result_dst_rid" param.
8894 (region_model::purge_unused_svalues): Convert third param from an
8895 svalue_id * to an svalue_id_set *, updating the initial populating
8896 of the "used" bitmap accordingly. Don't remap it when done.
8897 (struct selftest::coord_test): New selftest fixture, extracted from...
8898 (selftest::test_dump_2): ...here.
8899 (selftest::test_compound_assignment): New selftest.
8900 (selftest::test_stack_frames): Pass null to new param of pop_frame.
8901 (selftest::analyzer_region_model_cc_tests): Call the new selftest.
8902 * region-model.h (class id_set): Delete template.
8903 (class region_id_set): Reimplement, using old id_set implementation.
8904 (class svalue_id_set): Likewise. Convert from auto_sbitmap to
8905 auto_bitmap.
8906 (region::get_active_view): New accessor.
8907 (stack_region::pop_frame): Drop return value. Add
8908 "result_dst_rid" param.
8909 (root_region::pop_frame): Likewise.
8910 (region_model::pop_frame): Likewise.
8911 (region_model::copy_region): New decl.
8912 (region_model::purge_unused_svalues): Convert third param from an
8913 svalue_id * to an svalue_id_set *.
8914 (region_model::copy_struct_region): New decl.
8915 (region_model::copy_union_region): New decl.
8916 (region_model::copy_array_region): New decl.
8918 2020-03-27 David Malcolm <dmalcolm@redhat.com>
8920 * program-state.cc (selftest::test_program_state_dumping): Update
8921 expected dump to include symbolic_region's possibly_null field.
8922 * region-model.cc (symbolic_region::print_fields): New vfunc
8923 implementation.
8924 (region_model::add_constraint): Clear m_possibly_null from
8925 symbolic_regions now known to be non-NULL.
8926 (selftest::test_malloc_constraints): New selftest.
8927 (selftest::analyzer_region_model_cc_tests): Call it.
8928 * region-model.h (region::dyn_cast_symbolic_region): Add non-const
8929 overload.
8930 (symbolic_region::dyn_cast_symbolic_region): Implement it.
8931 (symbolic_region::print_fields): New vfunc override decl.
8933 2020-03-27 David Malcolm <dmalcolm@redhat.com>
8935 * analyzer.h (class feasibility_problem): New forward decl.
8936 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
8937 Initialize new fields m_status, m_epath_length, and m_problem.
8938 (saved_diagnostic::~saved_diagnostic): Delete m_problem.
8939 (dedupe_candidate::dedupe_candidate): Convert "sd" param from a
8940 const ref to a mutable ptr.
8941 (dedupe_winners::add): Convert "sd" param from a const ref to a
8942 mutable ptr. Record the length of the exploded_path. Record the
8943 feasibility/infeasibility of sd into sd, capturing a
8944 feasibility_problem when feasible_p fails, and storing it in sd.
8945 (diagnostic_manager::emit_saved_diagnostics): Update for pass by
8946 ptr rather than by const ref.
8947 * diagnostic-manager.h (class saved_diagnostic): Add new enum
8948 status. Add fields m_status, m_epath_length and m_problem.
8949 (saved_diagnostic::set_feasible): New member function.
8950 (saved_diagnostic::set_infeasible): New member function.
8951 (saved_diagnostic::get_feasibility_problem): New accessor.
8952 (saved_diagnostic::get_status): New accessor.
8953 (saved_diagnostic::set_epath_length): New member function.
8954 (saved_diagnostic::get_epath_length): New accessor.
8955 * engine.cc: Include "gimple-pretty-print.h".
8956 (exploded_path::feasible_p): Add OUT param and, if non-NULL, write
8957 a new feasibility_problem to it on failure.
8958 (viz_callgraph_node::dump_dot): Convert begin_tr calls to
8959 begin_trtd. Convert end_tr calls to end_tdtr.
8960 (class exploded_graph_annotator): New subclass of dot_annotator.
8961 (impl_run_checkers): Add a second -fdump-analyzer-supergraph dump
8962 after the analysis runs, using exploded_graph_annotator. dumping
8963 to DUMP_BASE_NAME.supergraph-eg.dot.
8964 * exploded-graph.h (exploded_node::get_dot_fillcolor): Make
8965 public.
8966 (exploded_path::feasible_p): Add OUT param.
8967 (class feasibility_problem): New class.
8968 * state-purge.cc (state_purge_annotator::add_node_annotations):
8969 Return a bool, add a "within_table" param.
8970 (print_vec_of_names): Convert begin_tr calls to begin_trtd.
8971 Convert end_tr calls to end_tdtr.
8972 (state_purge_annotator::add_stmt_annotations): Add "within_row"
8973 param.
8974 * state-purge.h ((state_purge_annotator::add_node_annotations):
8975 Return a bool, add a "within_table" param.
8976 (state_purge_annotator::add_stmt_annotations): Add "within_row"
8977 param.
8978 * supergraph.cc (supernode::dump_dot): Call add_node_annotations
8979 twice: as before, passing false for "within_table", then again
8980 with true when within the TABLE element. Convert some begin_tr
8981 calls to begin_trtd, and some end_tr calls to end_tdtr.
8982 Repeat each add_stmt_annotations call, distinguishing between
8983 calls that add TRs and those that add TDs to an existing TR.
8984 Add a call to add_after_node_annotations.
8985 * supergraph.h (dot_annotator::add_node_annotations): Add a
8986 "within_table" param.
8987 (dot_annotator::add_stmt_annotations): Add a "within_row" param.
8988 (dot_annotator::add_after_node_annotations): New vfunc.
8990 2020-03-27 David Malcolm <dmalcolm@redhat.com>
8992 * diagnostic-manager.cc (dedupe_winners::add): Show the
8993 exploded_node index in the log messages.
8994 (diagnostic_manager::emit_saved_diagnostics): Log a summary of
8995 m_saved_diagnostics at entry.
8997 2020-03-27 David Malcolm <dmalcolm@redhat.com>
8999 * supergraph.cc (superedge::dump): Add space before description;
9000 move newline to non-pretty_printer overload.
9002 2020-03-18 David Malcolm <dmalcolm@redhat.com>
9004 * region-model.cc: Include "stor-layout.h".
9005 (region_model::dump_to_pp): Rather than calling
9006 dump_summary_of_map on each of the current frame and the globals,
9007 instead get a vec of representative path_vars for all regions,
9008 and then dump a summary of all of them.
9009 (region_model::dump_summary_of_map): Delete, rewriting into...
9010 (region_model::dump_summary_of_rep_path_vars): ...this new
9011 function, working on a vec of path_vars.
9012 (region_model::set_value): New overload.
9013 (region_model::get_representative_path_var): Rename
9014 "parent_region" local to "parent_reg" and consolidate with other
9015 local. Guard test for grandparent being stack on parent_reg being
9016 non-NULL. Move handling for parent being an array_region to
9017 within guard for parent_reg being non-NULL.
9018 (selftest::make_test_compound_type): New function.
9019 (selftest::test_dump_2): New selftest.
9020 (selftest::test_dump_3): New selftest.
9021 (selftest::test_stack_frames): Update expected output from
9022 simplified dump to show "a" and "b" from parent frame and "y" in
9023 child frame.
9024 (selftest::analyzer_region_model_cc_tests): Call test_dump_2 and
9025 test_dump_3.
9026 * region-model.h (region_model::set_value): New overload decl.
9027 (region_model::dump_summary_of_map): Delete.
9028 (region_model::dump_summary_of_rep_path_vars): New.
9030 2020-03-18 David Malcolm <dmalcolm@redhat.com>
9032 * region-model.h (class noop_region_model_context): New subclass
9033 of region_model_context.
9034 (class tentative_region_model_context): Inherit from
9035 noop_region_model_context rather than from region_model_context;
9036 drop redundant vfunc implementations.
9037 (class test_region_model_context): Likewise.
9039 2020-03-18 David Malcolm <dmalcolm@redhat.com>
9041 * engine.cc (exploded_node::exploded_node): Move implementation
9042 here from header; accept point_and_state by const reference rather
9043 than by value.
9044 * exploded-graph.h (exploded_node::exploded_node): Pass
9045 point_and_state by const reference rather than by value. Move
9046 body to engine.cc.
9048 2020-03-18 Jakub Jelinek <jakub@redhat.com>
9050 * sm-malloc.cc (malloc_state_machine::on_stmt): Fix up duplicated word
9051 issue in a comment.
9052 * region-model.cc (region_model::make_region_for_unexpected_tree_code,
9053 region_model::delete_region_and_descendents): Likewise.
9054 * engine.cc (class exploded_cluster): Likewise.
9055 * diagnostic-manager.cc (class path_builder): Likewise.
9057 2020-03-13 David Malcolm <dmalcolm@redhat.com>
9059 PR analyzer/94099
9060 PR analyzer/94105
9061 * diagnostic-manager.cc (for_each_state_change): Bulletproof
9062 against errors in get_rvalue by passing a
9063 tentative_region_model_context and rejecting if there's an error.
9064 * region-model.cc (region_model::get_lvalue_1): When handling
9065 ARRAY_REF, handle results of error-handling. Handle NOP_EXPR.
9067 2020-03-06 David Malcolm <dmalcolm@redhat.com>
9069 * analyzer.h (class array_region): New forward decl.
9070 * program-state.cc (selftest::test_program_state_dumping_2): New.
9071 (selftest::analyzer_program_state_cc_tests): Call it.
9072 * region-model.cc (array_region::constant_from_key): New.
9073 (region_model::get_representative_tree): Handle region_svalue by
9074 generating an ADDR_EXPR.
9075 (region_model::get_representative_path_var): In view handling,
9076 remove erroneous TREE_TYPE when determining the type of the tree.
9077 Handle array regions and STRING_CST.
9078 (selftest::assert_dump_tree_eq): New.
9079 (ASSERT_DUMP_TREE_EQ): New macro.
9080 (selftest::test_get_representative_tree): New selftest.
9081 (selftest::analyzer_region_model_cc_tests): Call it.
9082 * region-model.h (region::dyn_cast_array_region): New vfunc.
9083 (array_region::dyn_cast_array_region): New vfunc implementation.
9084 (array_region::constant_from_key): New decl.
9086 2020-03-06 David Malcolm <dmalcolm@redhat.com>
9088 * analyzer.h (dump_quoted_tree): New decl.
9089 * engine.cc (exploded_node::dump_dot): Pass region model to
9090 sm_state_map::print.
9091 * program-state.cc: Include diagnostic-core.h.
9092 (sm_state_map::print): Add "model" param and use it to print
9093 representative trees. Only print origin information if non-null.
9094 (sm_state_map::dump): Pass NULL for model to print call.
9095 (program_state::print): Pass region model to sm_state_map::print.
9096 (program_state::dump_to_pp): Use spaces rather than newlines when
9097 summarizing. Pass region_model to sm_state_map::print.
9098 (ana::selftest::assert_dump_eq): New function.
9099 (ASSERT_DUMP_EQ): New macro.
9100 (ana::selftest::test_program_state_dumping): New function.
9101 (ana::selftest::analyzer_program_state_cc_tests): Call it.
9102 * program-state.h (program_state::print): Add model param.
9103 * region-model.cc (dump_quoted_tree): New function.
9104 (map_region::print_fields): Use dump_quoted_tree rather than
9105 %qE to avoid lang-dependent output.
9106 (map_region::dump_child_label): Likewise.
9107 (region_model::dump_summary_of_map): For SK_REGION, when
9108 get_representative_path_var fails, print the region id rather than
9109 erroneously printing NULL.
9110 * sm.cc (state_machine::get_state_by_name): New function.
9111 * sm.h (state_machine::get_state_by_name): New decl.
9113 2020-03-04 David Malcolm <dmalcolm@redhat.com>
9115 * region-model.cc (region::validate): Convert model param from ptr
9116 to reference. Update comment to reflect that it's now a vfunc.
9117 (map_region::validate): New vfunc implementation.
9118 (array_region::validate): New vfunc implementation.
9119 (stack_region::validate): New vfunc implementation.
9120 (root_region::validate): New vfunc implementation.
9121 (region_model::validate): Pass a reference rather than a pointer
9122 to the region::validate vfunc.
9123 * region-model.h (region::validate): Make virtual. Convert model
9124 param from ptr to reference.
9125 (map_region::validate): New vfunc decl.
9126 (array_region::validate): New vfunc decl.
9127 (stack_region::validate): New vfunc decl.
9128 (root_region::validate): New vfunc decl.
9130 2020-03-04 David Malcolm <dmalcolm@redhat.com>
9132 PR analyzer/93993
9133 * region-model.cc (region_model::on_call_pre): Handle
9134 BUILT_IN_EXPECT and its variants.
9135 (region_model::add_any_constraints_from_ssa_def_stmt): Split out
9136 gassign handling into add_any_constraints_from_gassign; add gcall
9137 handling.
9138 (region_model::add_any_constraints_from_gassign): New function,
9139 based on the above. Add handling for NOP_EXPR.
9140 (region_model::add_any_constraints_from_gcall): New function.
9141 (region_model::get_representative_path_var): Handle views.
9142 * region-model.h
9143 (region_model::add_any_constraints_from_ssa_def_stmt): New decl.
9144 (region_model::add_any_constraints_from_gassign): New decl.
9146 2020-03-04 David Malcolm <dmalcolm@redhat.com>
9148 PR analyzer/93993
9149 * checker-path.h (state_change_event::get_lvalue): Add ctxt param
9150 and pass it to region_model::get_value call.
9151 * diagnostic-manager.cc (get_any_origin): Pass a
9152 tentative_region_model_context to the calls to get_lvalue and reject
9153 the comparison if errors occur.
9154 (can_be_expr_of_interest_p): New function.
9155 (diagnostic_manager::prune_for_sm_diagnostic): Replace checks for
9156 CONSTANT_CLASS_P with calls to update_for_unsuitable_sm_exprs.
9157 Pass a tentative_region_model_context to the calls to
9158 state_change_event::get_lvalue and reject the comparison if errors
9159 occur.
9160 (diagnostic_manager::update_for_unsuitable_sm_exprs): New.
9161 * diagnostic-manager.h
9162 (diagnostic_manager::update_for_unsuitable_sm_exprs): New decl.
9163 * region-model.h (class tentative_region_model_context): New class.
9165 2020-03-04 David Malcolm <dmalcolm@redhat.com>
9167 * engine.cc (worklist::worklist): Remove unused field m_eg.
9168 (class viz_callgraph_edge): Remove unused field m_call_sedge.
9169 (class viz_callgraph): Remove unused field m_sg.
9170 * exploded-graph.h (worklist::::m_eg): Remove unused field.
9172 2020-03-02 David Malcolm <dmalcolm@redhat.com>
9174 * analyzer.opt (fanalyzer-show-duplicate-count): New option.
9175 * diagnostic-manager.cc
9176 (diagnostic_manager::emit_saved_diagnostic): Use the above to
9177 guard the printing of the duplicate count.
9179 2020-03-02 David Malcolm <dmalcolm@redhat.com>
9181 PR analyzer/93959
9182 * analyzer.cc (is_std_function_p): New function.
9183 (is_std_named_call_p): New functions.
9184 * analyzer.h (is_std_named_call_p): New decl.
9185 * sm-malloc.cc (malloc_state_machine::on_stmt): Check for "std::"
9186 variants when checking for malloc, calloc and free.
9188 2020-02-26 David Malcolm <dmalcolm@redhat.com>
9190 PR analyzer/93950
9191 * diagnostic-manager.cc
9192 (diagnostic_manager::prune_for_sm_diagnostic): Assert that var is
9193 either NULL or not a constant. When updating var, bulletproof
9194 against constant values.
9196 2020-02-26 David Malcolm <dmalcolm@redhat.com>
9198 PR analyzer/93947
9199 * region-model.cc (region_model::get_fndecl_for_call): Gracefully
9200 fail for fn_decls that don't have a cgraph_node.
9202 2020-02-26 David Malcolm <dmalcolm@redhat.com>
9204 * bar-chart.cc: New file.
9205 * bar-chart.h: New file.
9206 * engine.cc: Include "analyzer/bar-chart.h".
9207 (stats::log): Only log the m_num_nodes kinds that are non-zero.
9208 (stats::dump): Likewise when dumping.
9209 (stats::get_total_enodes): New.
9210 (exploded_graph::get_or_create_node): Increment the per-point-data
9211 m_excess_enodes when hitting the per-program-point limit on
9212 enodes.
9213 (exploded_graph::print_bar_charts): New.
9214 (exploded_graph::log_stats): Log the number of unprocessed enodes
9215 in the worklist. Call print_bar_charts.
9216 (exploded_graph::dump_stats): Print the number of unprocessed
9217 enodes in the worklist.
9218 * exploded-graph.h (stats::get_total_enodes): New decl.
9219 (struct per_program_point_data): Add field m_excess_enodes.
9220 (exploded_graph::print_bar_charts): New decl.
9221 * supergraph.cc (superedge::dump): New.
9222 (superedge::dump): New.
9223 * supergraph.h (supernode::get_function): New.
9224 (superedge::dump): New decl.
9225 (superedge::dump): New decl.
9227 2020-02-24 David Malcolm <dmalcolm@redhat.com>
9229 * engine.cc (exploded_graph::get_or_create_node): Dump the
9230 program_state to the pp, rather than to stderr.
9232 2020-02-24 David Malcolm <dmalcolm@redhat.com>
9234 PR analyzer/93032
9235 * sm.cc (make_checkers): Require the "taint" checker to be
9236 explicitly enabled.
9238 2020-02-24 David Malcolm <dmalcolm@redhat.com>
9240 PR analyzer/93899
9241 * engine.cc
9242 (impl_region_model_context::impl_region_model_context): Add logger
9243 param.
9244 * engine.cc (exploded_graph::add_function_entry): Create an
9245 impl_region_model_context and pass it to the push_frame call.
9246 Bail if the resulting state is invalid.
9247 (exploded_graph::build_initial_worklist): Likewise.
9248 (exploded_graph::build_initial_worklist): Handle the case where
9249 add_function_entry fails.
9250 * exploded-graph.h
9251 (impl_region_model_context::impl_region_model_context): Add logger
9252 param.
9253 * region-model.cc (map_region::get_or_create): Add ctxt param and
9254 pass it to add_region_for_type.
9255 (map_region::can_merge_p): Pass NULL as a ctxt to call to
9256 get_or_create.
9257 (array_region::get_element): Pass ctxt to call to get_or_create.
9258 (array_region::get_or_create): Add ctxt param and pass it to
9259 add_region_for_type.
9260 (root_region::push_frame): Pass ctxt to get_or_create calls.
9261 (region_model::get_lvalue_1): Likewise.
9262 (region_model::make_region_for_unexpected_tree_code): Assert that
9263 ctxt is non-NULL.
9264 (region_model::get_rvalue_1): Pass ctxt to get_svalue_for_fndecl
9265 and get_svalue_for_label calls.
9266 (region_model::get_svalue_for_fndecl): Add ctxt param and pass it
9267 to get_region_for_fndecl.
9268 (region_model::get_region_for_fndecl): Add ctxt param and pass it
9269 to get_or_create.
9270 (region_model::get_svalue_for_label): Add ctxt param and pass it
9271 to get_region_for_label.
9272 (region_model::get_region_for_label): Add ctxt param and pass it
9273 to get_region_for_fndecl and get_or_create.
9274 (region_model::get_field_region): Add ctxt param and pass it to
9275 get_or_create_view and get_or_create.
9276 (make_region_for_type): Replace gcc_unreachable with return NULL.
9277 (region_model::add_region_for_type): Add ctxt param. Handle a
9278 return of NULL from make_region_for_type by calling
9279 make_region_for_unexpected_tree_code.
9280 (region_model::get_or_create_mem_ref): Pass ctxt to calls to
9281 get_or_create_view.
9282 (region_model::get_or_create_view): Add ctxt param and pass it to
9283 add_region_for_type.
9284 (selftest::test_state_merging): Pass ctxt to get_or_create_view.
9285 * region-model.h (region_model::get_or_create): Add ctxt param.
9286 (region_model::add_region_for_type): Likewise.
9287 (region_model::get_svalue_for_fndecl): Likewise.
9288 (region_model::get_svalue_for_label): Likewise.
9289 (region_model::get_region_for_fndecl): Likewise.
9290 (region_model::get_region_for_label): Likewise.
9291 (region_model::get_field_region): Likewise.
9292 (region_model::get_or_create_view): Likewise.
9294 2020-02-24 David Malcolm <dmalcolm@redhat.com>
9296 * checker-path.cc (superedge_event::should_filter_p): Update
9297 filter for empty descriptions to cover verbosity level 3 as well
9298 as 2.
9299 * diagnostic-manager.cc: Include "analyzer/reachability.h".
9300 (class path_builder): New class.
9301 (diagnostic_manager::emit_saved_diagnostic): Create a path_builder
9302 and pass it to build_emission_path, rather passing eg; similarly
9303 for add_events_for_eedge and ext_state.
9304 (diagnostic_manager::build_emission_path): Replace "eg" param
9305 with a path_builder, pass it to add_events_for_eedge.
9306 (diagnostic_manager::add_events_for_eedge): Replace ext_state
9307 param with path_builder; pass it to add_events_for_superedge.
9308 (diagnostic_manager::significant_edge_p): New.
9309 (diagnostic_manager::add_events_for_superedge): Add path_builder
9310 param. Reject insignificant edges at verbosity levels below 3.
9311 (diagnostic_manager::prune_for_sm_diagnostic): Update highest
9312 verbosity level to 4.
9313 * diagnostic-manager.h (class path_builder): New forward decl.
9314 (diagnostic_manager::build_emission_path): Replace "eg" param
9315 with a path_builder.
9316 (diagnostic_manager::add_events_for_eedge): Replace ext_state
9317 param with path_builder.
9318 (diagnostic_manager::significant_edge_p): New.
9319 (diagnostic_manager::add_events_for_superedge): Add path_builder
9320 param.
9321 * reachability.h: New file.
9323 2020-02-18 David Malcolm <dmalcolm@redhat.com>
9325 PR analyzer/93692
9326 * analyzer.opt (fdump-analyzer-callgraph): Rewrite description.
9328 2020-02-18 David Malcolm <dmalcolm@redhat.com>
9330 PR analyzer/93777
9331 * region-model.cc (region_model::maybe_cast_1): Replace assertion
9332 that build_cast returns non-NULL with a conditional, falling
9333 through to the logic which returns a new unknown value of the
9334 desired type if it fails.
9336 2020-02-18 David Malcolm <dmalcolm@redhat.com>
9338 PR analyzer/93778
9339 * engine.cc (impl_region_model_context::on_unknown_tree_code):
9340 Rename to...
9341 (impl_region_model_context::on_unexpected_tree_code): ...this and
9342 convert first argument from path_var to tree.
9343 (exploded_node::on_stmt): Pass ctxt to purge_for_unknown_fncall.
9344 * exploded-graph.h (region_model_context::on_unknown_tree_code):
9345 Rename to...
9346 (region_model_context::on_unexpected_tree_code): ...this and
9347 convert first argument from path_var to tree.
9348 * program-state.cc (sm_state_map::purge_for_unknown_fncall): Add
9349 ctxt param and pass on to calls to get_rvalue.
9350 * program-state.h (sm_state_map::purge_for_unknown_fncall): Add
9351 ctxt param.
9352 * region-model.cc (region_model::handle_unrecognized_call): Pass
9353 ctxt on to call to get_rvalue.
9354 (region_model::get_lvalue_1): Move body of default case to
9355 region_model::make_region_for_unexpected_tree_code and call it.
9356 Within COMPONENT_REF case, reject attempts to handle types other
9357 than RECORD_TYPE and UNION_TYPE.
9358 (region_model::make_region_for_unexpected_tree_code): New
9359 function, based on default case of region_model::get_lvalue_1.
9360 * region-model.h
9361 (region_model::make_region_for_unexpected_tree_code): New decl.
9362 (region_model::on_unknown_tree_code): Rename to...
9363 (region_model::on_unexpected_tree_code): ...this and convert first
9364 argument from path_var to tree.
9365 (class test_region_model_context): Update vfunc implementation for
9366 above change.
9368 2020-02-18 David Malcolm <dmalcolm@redhat.com>
9370 PR analyzer/93774
9371 * region-model.cc
9372 (region_model::convert_byte_offset_to_array_index): Use
9373 int_size_in_bytes before calling size_in_bytes, to gracefully fail
9374 on incomplete types.
9376 2020-02-17 David Malcolm <dmalcolm@redhat.com>
9378 PR analyzer/93775
9379 * region-model.cc (region_model::get_fndecl_for_call): Handle the
9380 case where the code_region's get_tree_for_child_region returns
9381 NULL.
9383 2020-02-17 David Malcolm <dmalcolm@redhat.com>
9385 PR analyzer/93388
9386 * engine.cc (impl_region_model_context::on_unknown_tree_code):
9387 New.
9388 (exploded_graph::get_or_create_node): Reject invalid states.
9389 * exploded-graph.h
9390 (impl_region_model_context::on_unknown_tree_code): New decl.
9391 (point_and_state::point_and_state): Assert that the state is
9392 valid.
9393 * program-state.cc (program_state::program_state): Initialize
9394 m_valid to true.
9395 (program_state::operator=): Copy m_valid.
9396 (program_state::program_state): Likewise for move constructor.
9397 (program_state::print): Print m_valid.
9398 (program_state::dump_to_pp): Likewise.
9399 * program-state.h (program_state::m_valid): New field.
9400 * region-model.cc (region_model::get_lvalue_1): Implement the
9401 default case by returning a new symbolic region and calling
9402 the context's on_unknown_tree_code, rather than issuing an
9403 internal_error. Implement VIEW_CONVERT_EXPR.
9404 * region-model.h (region_model_context::on_unknown_tree_code): New
9405 vfunc.
9406 (test_region_model_context::on_unknown_tree_code): New.
9408 2020-02-17 David Malcolm <dmalcolm@redhat.com>
9410 * sm-malloc.cc (malloc_diagnostic::describe_state_change): For
9411 transition to the "null" state, only say "assuming" when
9412 transitioning from the "unchecked" state.
9414 2020-02-17 David Malcolm <dmalcolm@redhat.com>
9416 * diagnostic-manager.h (diagnostic_manager::get_saved_diagnostic):
9417 Add const overload.
9418 * engine.cc (exploded_node::dump_dot): Dump saved_diagnostics.
9419 * exploded-graph.h (exploded_graph::get_diagnostic_manager): Add
9420 const overload.
9422 2020-02-11 David Malcolm <dmalcolm@redhat.com>
9424 PR analyzer/93288
9425 * analysis-plan.cc (analysis_plan::use_summary_p): Look through
9426 the ultimate_alias_target when getting the called function.
9427 * engine.cc (exploded_node::on_stmt): Rename second "ctxt" to
9428 "sm_ctxt". Use the region_model's get_fndecl_for_call rather than
9429 gimple_call_fndecl.
9430 * region-model.cc (region_model::get_fndecl_for_call): Use
9431 ultimate_alias_target on fndecl.
9432 * supergraph.cc (get_ultimate_function_for_cgraph_edge): New
9433 function.
9434 (supergraph_call_edge): Use it when rejecting edges without
9435 functions.
9436 (supergraph::supergraph): Use it to get the function for the
9437 cgraph_edge when building interprocedural superedges.
9438 (callgraph_superedge::get_callee_function): Use it.
9439 * supergraph.h (supergraph::get_num_snodes): Make param const.
9440 (supergraph::function_to_num_snodes_t): Make first type param
9441 const.
9443 2020-02-11 David Malcolm <dmalcolm@redhat.com>
9445 PR analyzer/93374
9446 * engine.cc (exploded_edge::exploded_edge): Add ext_state param
9447 and pass it to change.validate.
9448 (exploded_graph::get_or_create_node): Move purging of change
9449 svalues to also cover the case of reusing an existing enode.
9450 (exploded_graph::add_edge): Pass m_ext_state to exploded_edge's
9451 ctor.
9452 * exploded-graph.h (exploded_edge::exploded_edge): Add ext_state
9453 param.
9454 * program-state.cc (state_change::sm_change::validate): Likewise.
9455 Assert that m_sm_idx is sane. Use ext_state to validate
9456 m_old_state and m_new_state.
9457 (state_change::validate): Add ext_state param and pass it to
9458 the sm_change validate calls.
9459 * program-state.h (state_change::sm_change::validate): Add
9460 ext_state param.
9461 (state_change::validate): Likewise.
9463 2020-02-11 David Malcolm <dmalcolm@redhat.com>
9465 PR analyzer/93669
9466 * engine.cc (exploded_graph::dump_exploded_nodes): Handle missing
9467 case of STATUS_WORKLIST in implementation of
9468 "__analyzer_dump_exploded_nodes".
9470 2020-02-11 David Malcolm <dmalcolm@redhat.com>
9472 PR analyzer/93649
9473 * constraint-manager.cc (constraint_manager::add_constraint): When
9474 merging equivalence classes and updating m_constant, also update
9475 m_cst_sid.
9476 (constraint_manager::validate): If m_constant is non-NULL assert
9477 that m_cst_sid is non-null and is valid.
9479 2020-02-11 David Malcolm <dmalcolm@redhat.com>
9481 PR analyzer/93657
9482 * analyzer.opt (fdump-analyzer): Reword description.
9483 (fdump-analyzer-stderr): Likewise.
9485 2020-02-11 David Malcolm <dmalcolm@redhat.com>
9487 * region-model.cc (print_quoted_type): New function.
9488 (svalue::print): Use it to replace %qT.
9489 (region::dump_to_pp): Likewise.
9490 (region::dump_child_label): Likewise.
9491 (region::print_fields): Likewise.
9493 2020-02-10 David Malcolm <dmalcolm@redhat.com>
9495 PR analyzer/93659
9496 * analyzer.opt (-param=analyzer-max-recursion-depth=): Fix "tha"
9497 -> "that" typo.
9498 (Wanalyzer-use-of-uninitialized-value): Fix "initialized" ->
9499 "uninitialized" typo.
9501 2020-02-10 David Malcolm <dmalcolm@redhat.com>
9503 PR analyzer/93350
9504 * region-model.cc (region_model::get_lvalue_1):
9505 Handle BIT_FIELD_REF.
9506 (make_region_for_type): Handle VECTOR_TYPE.
9508 2020-02-10 David Malcolm <dmalcolm@redhat.com>
9510 PR analyzer/93647
9511 * diagnostic-manager.cc
9512 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof against
9513 VAR being constant.
9514 * region-model.cc (region_model::get_lvalue_1): Provide a better
9515 error message when encountering an unhandled tree code.
9517 2020-02-10 David Malcolm <dmalcolm@redhat.com>
9519 PR analyzer/93405
9520 * region-model.cc (region_model::get_lvalue_1): Implement
9521 CONST_DECL.
9523 2020-02-06 David Malcolm <dmalcolm@redhat.com>
9525 * region-model.cc (region_model::maybe_cast_1): Attempt to provide
9526 a region_svalue if either type is a pointer, rather than if both
9527 types are pointers.
9529 2020-02-05 David Malcolm <dmalcolm@redhat.com>
9531 * engine.cc (exploded_node::dump_dot): Show merger enodes.
9532 (worklist::add_node): Assert that the node's m_status is
9533 STATUS_WORKLIST.
9534 (exploded_graph::process_worklist): Likewise for nodes from the
9535 worklist. Set status of merged nodes to STATUS_MERGER.
9536 (exploded_graph::process_node): Set status of node to
9537 STATUS_PROCESSED.
9538 (exploded_graph::dump_exploded_nodes): Rework handling of
9539 "__analyzer_dump_exploded_nodes", splitting enodes by status into
9540 "processed" and "merger", showing the count of just the processed
9541 enodes at the call, rather than the count of all enodes.
9542 * exploded-graph.h (exploded_node::status): New enum.
9543 (exploded_node::exploded_node): Initialize m_status to
9544 STATUS_WORKLIST.
9545 (exploded_node::get_status): New getter.
9546 (exploded_node::set_status): New setter.
9548 2020-02-04 David Malcolm <dmalcolm@redhat.com>
9550 PR analyzer/93543
9551 * engine.cc (pod_hash_traits<function_call_string>::mark_empty):
9552 Eliminate reinterpret_cast.
9553 (pod_hash_traits<function_call_string>::is_empty): Likewise.
9555 2020-02-03 David Malcolm <dmalcolm@redhat.com>
9557 * constraint-manager.cc (range::constrained_to_single_element):
9558 Replace fold_build2 with fold_binary. Remove unnecessary newline.
9559 (constraint_manager::get_or_add_equiv_class): Replace fold_build2
9560 with fold_binary in two places, and remove out-of-date comment.
9561 (constraint_manager::eval_condition): Replace fold_build2 with
9562 fold_binary.
9563 * region-model.cc (constant_svalue::eval_condition): Likewise.
9564 (region_model::on_assignment): Likewise.
9566 2020-02-03 David Malcolm <dmalcolm@redhat.com>
9568 PR analyzer/93544
9569 * diagnostic-manager.cc
9570 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof
9571 against bad choices due to bad paths.
9572 * engine.cc (impl_region_model_context::on_phi): New.
9573 * exploded-graph.h (impl_region_model_context::on_phi): New decl.
9574 * region-model.cc (region_model::on_longjmp): Likewise.
9575 (region_model::handle_phi): Add phi param. Call the ctxt's on_phi
9576 vfunc.
9577 (region_model::update_for_phis): Pass phi to handle_phi.
9578 * region-model.h (region_model::handle_phi): Add phi param.
9579 (region_model_context::on_phi): New vfunc.
9580 (test_region_model_context::on_phi): New.
9581 * sm-malloc.cc (malloc_state_machine::on_phi): New.
9582 (malloc_state_machine::on_zero_assignment): New.
9583 * sm.h (state_machine::on_phi): New vfunc.
9585 2020-02-03 David Malcolm <dmalcolm@redhat.com>
9587 * engine.cc (supernode_cluster::dump_dot): Show BB index as
9588 well as SN index.
9589 * supergraph.cc (supernode::dump_dot): Likewise.
9591 2020-02-03 David Malcolm <dmalcolm@redhat.com>
9593 PR analyzer/93546
9594 * region-model.cc (region_model::on_call_pre): Update for new
9595 param of symbolic_region ctor.
9596 (region_model::deref_rvalue): Likewise.
9597 (region_model::add_new_malloc_region): Likewise.
9598 (make_region_for_type): Likewise, preserving type.
9599 * region-model.h (symbolic_region::symbolic_region): Add "type"
9600 param and pass it to base class ctor.
9602 2020-02-03 David Malcolm <dmalcolm@redhat.com>
9604 PR analyzer/93547
9605 * constraint-manager.cc
9606 (constraint_manager::get_or_add_equiv_class): Ensure types are
9607 compatible before comparing constants.
9609 2020-01-31 David Malcolm <dmalcolm@redhat.com>
9611 PR analyzer/93457
9612 * region-model.cc (make_region_for_type): Use VOID_TYPE_P rather
9613 than checking against void_type_node.
9615 2020-01-31 David Malcolm <dmalcolm@redhat.com>
9617 PR analyzer/93373
9618 * region-model.cc (ASSERT_COMPAT_TYPES): Convert to...
9619 (assert_compat_types): ...this, and bail when either type is NULL,
9620 or when VOID_TYPE_P (dst_type).
9621 (region_model::get_lvalue): Update for above conversion.
9622 (region_model::get_rvalue): Likewise.
9624 2020-01-31 David Malcolm <dmalcolm@redhat.com>
9626 PR analyzer/93379
9627 * region-model.cc (region_model::update_for_return_superedge):
9628 Move check for null result so that it also guards setting the
9629 lhs.
9631 2020-01-31 David Malcolm <dmalcolm@redhat.com>
9633 PR analyzer/93438
9634 * region-model.cc (stack_region::can_merge_p): Split into a two
9635 pass approach, creating all stack regions first, then populating
9636 them.
9637 (selftest::test_state_merging): Add test coverage for (a) the case
9638 of self-merging a model in which a local in an older stack frame
9639 points to a local in a more recent stack frame (which previously
9640 would ICE), and (b) the case of self-merging a model in which a
9641 local points to a global (which previously worked OK).
9643 2020-01-31 David Malcolm <dmalcolm@redhat.com>
9645 * analyzer.cc (is_named_call_p): Replace tests for fndecl being
9646 extern at file scope and having a non-NULL DECL_NAME with a call
9647 to maybe_special_function_p.
9648 * function-set.cc (function_set::contains_decl_p): Add call to
9649 maybe_special_function_p.
9651 2020-01-31 David Malcolm <dmalcolm@redhat.com>
9653 PR analyzer/93450
9654 * constraint-manager.cc
9655 (constraint_manager::get_or_add_equiv_class): Only compare constants
9656 if their types are compatible.
9657 * region-model.cc (constant_svalue::eval_condition): Replace check
9658 for identical types with call to types_compatible_p.
9660 2020-01-30 David Malcolm <dmalcolm@redhat.com>
9662 * program-state.cc (extrinsic_state::dump_to_pp): New.
9663 (extrinsic_state::dump_to_file): New.
9664 (extrinsic_state::dump): New.
9665 * program-state.h (extrinsic_state::dump_to_pp): New decl.
9666 (extrinsic_state::dump_to_file): New decl.
9667 (extrinsic_state::dump): New decl.
9668 * sm.cc: Include "pretty-print.h".
9669 (state_machine::dump_to_pp): New.
9670 * sm.h (state_machine::dump_to_pp): New decl.
9672 2020-01-30 David Malcolm <dmalcolm@redhat.com>
9674 * diagnostic-manager.cc (for_each_state_change): Use
9675 extrinsic_state::get_num_checkers rather than accessing m_checkers
9676 directly.
9677 * program-state.cc (program_state::program_state): Likewise.
9678 * program-state.h (extrinsic_state::m_checkers): Make private.
9680 2020-01-30 David Malcolm <dmalcolm@redhat.com>
9682 PR analyzer/93356
9683 * region-model.cc (region_model::eval_condition): In both
9684 overloads, bail out immediately on floating-point types.
9685 (region_model::eval_condition_without_cm): Likewise.
9686 (region_model::add_constraint): Likewise.
9688 2020-01-30 David Malcolm <dmalcolm@redhat.com>
9690 PR analyzer/93450
9691 * program-state.cc (sm_state_map::set_state): For the overload
9692 taking an svalue_id, bail out if the set_state on the ec does
9693 nothing. Convert the latter's return type from void to bool,
9694 returning true if anything changed.
9695 (sm_state_map::impl_set_state): Convert the return type from void
9696 to bool, returning true if the state changed.
9697 * program-state.h (sm_state_map::set_state): Convert return type
9698 from void to bool.
9699 (sm_state_map::impl_set_state): Likewise.
9700 * region-model.cc (constant_svalue::eval_condition): Only call
9701 fold_build2 if the types are the same.
9703 2020-01-29 Jakub Jelinek <jakub@redhat.com>
9705 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Remove.
9706 * constraint-manager.cc: Include diagnostic-core.h before graphviz.h.
9707 (range::dump, equiv_class::print): Don't use PUSH_IGNORE_WFORMAT or
9708 POP_IGNORE_WFORMAT.
9709 * state-purge.cc: Include diagnostic-core.h before
9710 gimple-pretty-print.h.
9711 (state_purge_annotator::add_node_annotations, print_vec_of_names):
9712 Don't use PUSH_IGNORE_WFORMAT or POP_IGNORE_WFORMAT.
9713 * region-model.cc: Move diagnostic-core.h include before graphviz.h.
9714 (path_var::dump, svalue::print, constant_svalue::print_details,
9715 region::dump_to_pp, region::dump_child_label, region::print_fields,
9716 map_region::print_fields, map_region::dump_dot_to_pp,
9717 map_region::dump_child_label, array_region::print_fields,
9718 array_region::dump_dot_to_pp): Don't use PUSH_IGNORE_WFORMAT or
9719 POP_IGNORE_WFORMAT.
9721 2020-01-28 David Malcolm <dmalcolm@redhat.com>
9723 PR analyzer/93316
9724 * engine.cc (rewind_info_t::update_model): Get the longjmp call
9725 stmt via get_longjmp_call () rather than assuming it is the last
9726 stmt in the longjmp's supernode.
9727 (rewind_info_t::add_events_to_path): Get the location_t for the
9728 rewind_from_longjmp_event via get_longjmp_call () rather than from
9729 the supernode's get_end_location ().
9731 2020-01-28 David Malcolm <dmalcolm@redhat.com>
9733 * region-model.cc (poisoned_value_diagnostic::emit): Update for
9734 renaming of warning_at overload to warning_meta.
9735 * sm-file.cc (file_leak::emit): Likewise.
9736 * sm-malloc.cc (double_free::emit): Likewise.
9737 (possible_null_deref::emit): Likewise.
9738 (possible_null_arg::emit): Likewise.
9739 (null_deref::emit): Likewise.
9740 (null_arg::emit): Likewise.
9741 (use_after_free::emit): Likewise.
9742 (malloc_leak::emit): Likewise.
9743 (free_of_non_heap::emit): Likewise.
9744 * sm-sensitive.cc (exposure_through_output_file::emit): Likewise.
9745 * sm-signal.cc (signal_unsafe_call::emit): Likewise.
9746 * sm-taint.cc (tainted_array_index::emit): Likewise.
9748 2020-01-27 David Malcolm <dmalcolm@redhat.com>
9750 PR analyzer/93451
9751 * region-model.cc (tree_cmp): For the REAL_CST case, impose an
9752 arbitrary order on NaNs relative to other NaNs and to non-NaNs;
9753 const-correctness tweak.
9754 (ana::selftests::build_real_cst_from_string): New function.
9755 (ana::selftests::append_interesting_constants): New function.
9756 (ana::selftests::test_tree_cmp_on_constants): New test.
9757 (ana::selftests::test_canonicalization_4): New test.
9758 (ana::selftests::analyzer_region_model_cc_tests): Call the new
9759 tests.
9761 2020-01-27 David Malcolm <dmalcolm@redhat.com>
9763 PR analyzer/93349
9764 * engine.cc (run_checkers): Save and restore input_location.
9766 2020-01-27 David Malcolm <dmalcolm@redhat.com>
9768 * call-string.cc (call_string::cmp_1): Delete, moving body to...
9769 (call_string::cmp): ...here.
9770 * call-string.h (call_string::cmp_1): Delete decl.
9771 * engine.cc (worklist::key_t::cmp_1): Delete, moving body to...
9772 (worklist::key_t::cmp): ...here. Implement hash comparisons
9773 via comparison rather than subtraction to avoid overflow issues.
9774 * exploded-graph.h (worklist::key_t::cmp_1): Delete decl.
9775 * region-model.cc (tree_cmp): Eliminate buggy checking for
9776 symmetry.
9778 2020-01-27 David Malcolm <dmalcolm@redhat.com>
9780 * analyzer.cc (is_named_call_p): Check that fndecl is "extern"
9781 and at file scope. Potentially disregard prefix _ or __ in
9782 fndecl's name. Bail if the identifier is NULL.
9783 (is_setjmp_call_p): Expect a gcall rather than plain gimple.
9784 Remove special-case check for leading prefix, and also check for
9785 sigsetjmp.
9786 (is_longjmp_call_p): Also check for siglongjmp.
9787 (get_user_facing_name): New function.
9788 * analyzer.h (is_setjmp_call_p): Expect a gcall rather than plain
9789 gimple.
9790 (get_user_facing_name): New decl.
9791 * checker-path.cc (setjmp_event::get_desc): Use
9792 get_user_facing_name to avoid hardcoding the function name.
9793 (rewind_event::rewind_event): Add rewind_info param, using it to
9794 initialize new m_rewind_info field, and strengthen the assertion.
9795 (rewind_from_longjmp_event::get_desc): Use get_user_facing_name to
9796 avoid hardcoding the function name.
9797 (rewind_to_setjmp_event::get_desc): Likewise.
9798 * checker-path.h (setjmp_event::setjmp_event): Add setjmp_call
9799 param and use it to initialize...
9800 (setjmp_event::m_setjmp_call): New field.
9801 (rewind_event::rewind_event): Add rewind_info param.
9802 (rewind_event::m_rewind_info): New protected field.
9803 (rewind_from_longjmp_event::rewind_from_longjmp_event): Add
9804 rewind_info param.
9805 (class rewind_to_setjmp_event): Move rewind_info field to parent
9806 class.
9807 * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
9808 Update setjmp-handling for is_setjmp_call_p requiring a gcall;
9809 pass the call to the new setjmp_event.
9810 * engine.cc (exploded_node::on_stmt): Update for is_setjmp_call_p
9811 requiring a gcall.
9812 (stale_jmp_buf::emit): Use get_user_facing_name to avoid
9813 hardcoding the function names.
9814 (exploded_node::on_longjmp): Pass the longjmp_call when
9815 constructing rewind_info.
9816 (rewind_info_t::add_events_to_path): Pass the rewind_info_t to the
9817 rewind_from_longjmp_event's ctor.
9818 * exploded-graph.h (rewind_info_t::rewind_info_t): Add
9819 longjmp_call param.
9820 (rewind_info_t::get_longjmp_call): New.
9821 (rewind_info_t::m_longjmp_call): New.
9822 * region-model.cc (region_model::on_setjmp): Update comment to
9823 indicate this is also for sigsetjmp.
9824 * region-model.h (struct setjmp_record): Likewise.
9825 (class setjmp_svalue): Likewise.
9827 2020-01-27 David Malcolm <dmalcolm@redhat.com>
9829 PR analyzer/93276
9830 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Guard these
9831 macros with GCC_VERSION >= 4006, making them no-op otherwise.
9832 * engine.cc (exploded_edge::exploded_edge): Specify template for
9833 base class initializer.
9834 (exploded_graph::add_edge): Specify template when chaining up to
9835 base class add_edge implementation.
9836 (viz_callgraph_node::dump_dot): Drop redundant "typename".
9837 (viz_callgraph_edge::viz_callgraph_edge): Specify template for
9838 base class initializer.
9839 * program-state.cc (sm_state_map::clone_with_remapping): Drop
9840 redundant "typename".
9841 (sm_state_map::print): Likewise.
9842 (sm_state_map::hash): Likewise.
9843 (sm_state_map::operator==): Likewise.
9844 (sm_state_map::remap_svalue_ids): Likewise.
9845 (sm_state_map::on_svalue_purge): Likewise.
9846 (sm_state_map::validate): Likewise.
9847 * program-state.h (sm_state_map::iterator_t): Likewise.
9848 * supergraph.h (superedge::superedge): Specify template for base
9849 class initializer.
9851 2020-01-23 David Malcolm <dmalcolm@redhat.com>
9853 PR analyzer/93375
9854 * supergraph.cc (callgraph_superedge::get_arg_for_parm): Fail
9855 gracefully is the number of parameters at the callee exceeds the
9856 number of arguments at the call stmt.
9857 (callgraph_superedge::get_parm_for_arg): Likewise.
9859 2020-01-22 David Malcolm <dmalcolm@redhat.com>
9861 PR analyzer/93382
9862 * program-state.cc (sm_state_map::on_svalue_purge): If the
9863 entry survives, but the origin is being purged, then reset the
9864 origin to null.
9866 2020-01-22 David Malcolm <dmalcolm@redhat.com>
9868 * sm-signal.cc: Fix nesting of CHECKING_P and namespace ana.
9870 2020-01-22 David Malcolm <dmalcolm@redhat.com>
9872 PR analyzer/93378
9873 * engine.cc (setjmp_svalue::compare_fields): Update for
9874 replacement of m_enode with m_setjmp_record.
9875 (setjmp_svalue::add_to_hash): Likewise.
9876 (setjmp_svalue::get_index): Rename...
9877 (setjmp_svalue::get_enode_index): ...to this.
9878 (setjmp_svalue::print_details): Update for replacement of m_enode
9879 with m_setjmp_record.
9880 (exploded_node::on_longjmp): Likewise.
9881 * exploded-graph.h (rewind_info_t::m_enode_origin): Replace...
9882 (rewind_info_t::m_setjmp_record): ...with this.
9883 (rewind_info_t::rewind_info_t): Update for replacement of m_enode
9884 with m_setjmp_record.
9885 (rewind_info_t::get_setjmp_point): Likewise.
9886 (rewind_info_t::get_setjmp_call): Likewise.
9887 * region-model.cc (region_model::dump_summary_of_map): Likewise.
9888 (region_model::on_setjmp): Likewise.
9889 * region-model.h (struct setjmp_record): New struct.
9890 (setjmp_svalue::m_enode): Replace...
9891 (setjmp_svalue::m_setjmp_record): ...with this.
9892 (setjmp_svalue::setjmp_svalue): Update for replacement of m_enode
9893 with m_setjmp_record.
9894 (setjmp_svalue::clone): Likewise.
9895 (setjmp_svalue::get_index): Rename...
9896 (setjmp_svalue::get_enode_index): ...to this.
9897 (setjmp_svalue::get_exploded_node): Replace...
9898 (setjmp_svalue::get_setjmp_record): ...with this.
9900 2020-01-22 David Malcolm <dmalcolm@redhat.com>
9902 PR analyzer/93316
9903 * analyzer.cc (is_setjmp_call_p): Check for "setjmp" as well as
9904 "_setjmp".
9906 2020-01-22 David Malcolm <dmalcolm@redhat.com>
9908 PR analyzer/93307
9909 * analysis-plan.h: Wrap everything namespace "ana".
9910 * analyzer-logging.cc: Likewise.
9911 * analyzer-logging.h: Likewise.
9912 * analyzer-pass.cc (pass_analyzer::execute): Update for "ana"
9913 namespace.
9914 * analyzer-selftests.cc: Wrap everything namespace "ana".
9915 * analyzer-selftests.h: Likewise.
9916 * analyzer.h: Likewise for forward decls of types.
9917 * call-string.h: Likewise.
9918 * checker-path.cc: Likewise.
9919 * checker-path.h: Likewise.
9920 * constraint-manager.cc: Likewise.
9921 * constraint-manager.h: Likewise.
9922 * diagnostic-manager.cc: Likewise.
9923 * diagnostic-manager.h: Likewise.
9924 * engine.cc: Likewise.
9925 * engine.h: Likewise.
9926 * exploded-graph.h: Likewise.
9927 * function-set.cc: Likewise.
9928 * function-set.h: Likewise.
9929 * pending-diagnostic.cc: Likewise.
9930 * pending-diagnostic.h: Likewise.
9931 * program-point.cc: Likewise.
9932 * program-point.h: Likewise.
9933 * program-state.cc: Likewise.
9934 * program-state.h: Likewise.
9935 * region-model.cc: Likewise.
9936 * region-model.h: Likewise.
9937 * sm-file.cc: Likewise.
9938 * sm-malloc.cc: Likewise.
9939 * sm-pattern-test.cc: Likewise.
9940 * sm-sensitive.cc: Likewise.
9941 * sm-signal.cc: Likewise.
9942 * sm-taint.cc: Likewise.
9943 * sm.cc: Likewise.
9944 * sm.h: Likewise.
9945 * state-purge.h: Likewise.
9946 * supergraph.cc: Likewise.
9947 * supergraph.h: Likewise.
9949 2020-01-21 David Malcolm <dmalcolm@redhat.com>
9951 PR analyzer/93352
9952 * region-model.cc (int_cmp): Rename to...
9953 (array_region::key_cmp): ...this, using key_t rather than int.
9954 Rewrite in terms of comparisons rather than subtraction to
9955 ensure qsort is anti-symmetric when handling extreme values.
9956 (array_region::walk_for_canonicalization): Update for above
9957 renaming.
9958 * region-model.h (array_region::key_cmp): New decl.
9960 2020-01-17 David Malcolm <dmalcolm@redhat.com>
9962 PR analyzer/93290
9963 * region-model.cc (region_model::eval_condition_without_cm): Avoid
9964 gcc_unreachable for unexpected operations for the case where
9965 we're comparing an svalue against itself.
9967 2020-01-17 David Malcolm <dmalcolm@redhat.com>
9969 PR analyzer/93281
9970 * region-model.cc
9971 (region_model::convert_byte_offset_to_array_index): Convert to
9972 ssizetype before dividing by byte_size. Use fold_binary rather
9973 than fold_build2 to avoid needlessly constructing a tree for the
9974 non-const case.
9976 2020-01-15 David Malcolm <dmalcolm@redhat.com>
9978 * engine.cc (class impl_region_model_context): Fix comment.
9980 2020-01-14 David Malcolm <dmalcolm@redhat.com>
9982 PR analyzer/93212
9983 * region-model.cc (make_region_for_type): Use
9984 FUNC_OR_METHOD_TYPE_P rather than comparing against FUNCTION_TYPE.
9985 * region-model.h (function_region::function_region): Likewise.
9987 2020-01-14 David Malcolm <dmalcolm@redhat.com>
9989 * program-state.cc (sm_state_map::clone_with_remapping): Copy
9990 m_global_state.
9991 (selftest::test_program_state_merging_2): New selftest.
9992 (selftest::analyzer_program_state_cc_tests): Call it.
9994 2020-01-14 David Malcolm <dmalcolm@redhat.com>
9996 * checker-path.h (checker_path::get_checker_event): New function.
9997 (checker_path): Add DISABLE_COPY_AND_ASSIGN; make fields private.
9998 * diagnostic-manager.cc
9999 (diagnostic_manager::prune_for_sm_diagnostic): Replace direct
10000 access to checker_path::m_events with accessor functions. Fix
10001 overlong line.
10002 (diagnostic_manager::prune_interproc_events): Replace direct
10003 access to checker_path::m_events with accessor functions.
10004 (diagnostic_manager::finish_pruning): Likewise.
10006 2020-01-14 David Malcolm <dmalcolm@redhat.com>
10008 * checker-path.h (checker_event::clone): Delete vfunc decl.
10009 (debug_event::clone): Delete vfunc impl.
10010 (custom_event::clone): Delete vfunc impl.
10011 (statement_event::clone): Delete vfunc impl.
10012 (function_entry_event::clone): Delete vfunc impl.
10013 (state_change_event::clone): Delete vfunc impl.
10014 (start_cfg_edge_event::clone): Delete vfunc impl.
10015 (end_cfg_edge_event::clone): Delete vfunc impl.
10016 (call_event::clone): Delete vfunc impl.
10017 (return_event::clone): Delete vfunc impl.
10018 (setjmp_event::clone): Delete vfunc impl.
10019 (rewind_from_longjmp_event::clone): Delete vfunc impl.
10020 (rewind_to_setjmp_event::clone): Delete vfunc impl.
10021 (warning_event::clone): Delete vfunc impl.
10023 2020-01-14 David Malcolm <dmalcolm@redhat.com>
10025 * supergraph.cc (supernode::dump_dot): Ensure that the TABLE
10026 element has at least one TR.
10028 2020-01-14 David Malcolm <dmalcolm@redhat.com>
10030 PR analyzer/58237
10031 * engine.cc (leak_stmt_finder::find_stmt): Use get_pure_location
10032 when comparing against UNKNOWN_LOCATION.
10033 (stmt_requires_new_enode_p): Likewise.
10034 (exploded_graph::dump_exploded_nodes): Likewise.
10035 * supergraph.cc (supernode::get_start_location): Likewise.
10036 (supernode::get_end_location): Likewise.
10038 2020-01-14 David Malcolm <dmalcolm@redhat.com>
10040 PR analyzer/58237
10041 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
10042 selftest::analyzer_sm_file_cc_tests.
10043 * analyzer-selftests.h (selftest::analyzer_sm_file_cc_tests): New
10044 decl.
10045 * sm-file.cc: Include "analyzer/function-set.h" and
10046 "analyzer/analyzer-selftests.h".
10047 (get_file_using_fns): New function.
10048 (is_file_using_fn_p): New function.
10049 (fileptr_state_machine::on_stmt): Return true for known functions.
10050 (selftest::analyzer_sm_file_cc_tests): New function.
10052 2020-01-14 David Malcolm <dmalcolm@redhat.com>
10054 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
10055 selftest::analyzer_sm_signal_cc_tests.
10056 * analyzer-selftests.h (selftest::analyzer_sm_signal_cc_tests):
10057 New decl.
10058 * sm-signal.cc: Include "analyzer/function-set.h" and
10059 "analyzer/analyzer-selftests.h".
10060 (get_async_signal_unsafe_fns): New function.
10061 (signal_unsafe_p): Reimplement in terms of the above.
10062 (selftest::analyzer_sm_signal_cc_tests): New function.
10064 2020-01-14 David Malcolm <dmalcolm@redhat.com>
10066 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
10067 selftest::analyzer_function_set_cc_tests.
10068 * analyzer-selftests.h (selftest::analyzer_function_set_cc_tests):
10069 New decl.
10070 * function-set.cc: New file.
10071 * function-set.h: New file.
10073 2020-01-14 David Malcolm <dmalcolm@redhat.com>
10075 * analyzer.h (fndecl_has_gimple_body_p): New decl.
10076 * engine.cc (impl_region_model_context::on_unknown_change): New
10077 function.
10078 (fndecl_has_gimple_body_p): Make non-static.
10079 (exploded_node::on_stmt): Treat __analyzer_dump_exploded_nodes as
10080 known. Track whether we have a call with unknown side-effects and
10081 pass it to on_call_post.
10082 * exploded-graph.h (impl_region_model_context::on_unknown_change):
10083 New decl.
10084 * program-state.cc (sm_state_map::on_unknown_change): New function.
10085 * program-state.h (sm_state_map::on_unknown_change): New decl.
10086 * region-model.cc: Include "bitmap.h".
10087 (region_model::on_call_pre): Return a bool, capturing whether the
10088 call has unknown side effects.
10089 (region_model::on_call_post): Add arg "bool unknown_side_effects"
10090 and if true, call handle_unrecognized_call.
10091 (class reachable_regions): New class.
10092 (region_model::handle_unrecognized_call): New function.
10093 * region-model.h (region_model::on_call_pre): Return a bool.
10094 (region_model::on_call_post): Add arg "bool unknown_side_effects".
10095 (region_model::handle_unrecognized_call): New decl.
10096 (region_model_context::on_unknown_change): New vfunc.
10097 (test_region_model_context::on_unknown_change): New function.
10099 2020-01-14 David Malcolm <dmalcolm@redhat.com>
10101 * diagnostic-manager.cc (saved_diagnostic::operator==): Move here
10102 from header. Replace pointer equality test on m_var with call to
10103 pending_diagnostic::same_tree_p.
10104 * diagnostic-manager.h (saved_diagnostic::operator==): Move to
10105 diagnostic-manager.cc.
10106 * pending-diagnostic.cc (pending_diagnostic::same_tree_p): New.
10107 * pending-diagnostic.h (pending_diagnostic::same_tree_p): New.
10108 * sm-file.cc (file_diagnostic::subclass_equal_p): Replace pointer
10109 equality on m_arg with call to pending_diagnostic::same_tree_p.
10110 * sm-malloc.cc (malloc_diagnostic::subclass_equal_p): Likewise.
10111 (possible_null_arg::subclass_equal_p): Likewise.
10112 (null_arg::subclass_equal_p): Likewise.
10113 (free_of_non_heap::subclass_equal_p): Likewise.
10114 * sm-pattern-test.cc (pattern_match::operator==): Likewise.
10115 * sm-sensitive.cc (exposure_through_output_file::operator==):
10116 Likewise.
10117 * sm-taint.cc (tainted_array_index::operator==): Likewise.
10119 2020-01-14 David Malcolm <dmalcolm@redhat.com>
10121 * diagnostic-manager.cc (dedupe_winners::add): Add logging
10122 of deduplication decisions made.
10124 2020-01-14 David Malcolm <dmalcolm@redhat.com>
10126 * ChangeLog: New file.
10127 * analyzer-selftests.cc: New file.
10128 * analyzer-selftests.h: New file.
10129 * analyzer.opt: New file.
10130 * analysis-plan.cc: New file.
10131 * analysis-plan.h: New file.
10132 * analyzer-logging.cc: New file.
10133 * analyzer-logging.h: New file.
10134 * analyzer-pass.cc: New file.
10135 * analyzer.cc: New file.
10136 * analyzer.h: New file.
10137 * call-string.cc: New file.
10138 * call-string.h: New file.
10139 * checker-path.cc: New file.
10140 * checker-path.h: New file.
10141 * constraint-manager.cc: New file.
10142 * constraint-manager.h: New file.
10143 * diagnostic-manager.cc: New file.
10144 * diagnostic-manager.h: New file.
10145 * engine.cc: New file.
10146 * engine.h: New file.
10147 * exploded-graph.h: New file.
10148 * pending-diagnostic.cc: New file.
10149 * pending-diagnostic.h: New file.
10150 * program-point.cc: New file.
10151 * program-point.h: New file.
10152 * program-state.cc: New file.
10153 * program-state.h: New file.
10154 * region-model.cc: New file.
10155 * region-model.h: New file.
10156 * sm-file.cc: New file.
10157 * sm-malloc.cc: New file.
10158 * sm-malloc.dot: New file.
10159 * sm-pattern-test.cc: New file.
10160 * sm-sensitive.cc: New file.
10161 * sm-signal.cc: New file.
10162 * sm-taint.cc: New file.
10163 * sm.cc: New file.
10164 * sm.h: New file.
10165 * state-purge.cc: New file.
10166 * state-purge.h: New file.
10167 * supergraph.cc: New file.
10168 * supergraph.h: New file.
10170 2019-12-13 David Malcolm <dmalcolm@redhat.com>
10172 * Initial creation
10174 \f
10175 Copyright (C) 2019-2023 Free Software Foundation, Inc.
10177 Copying and distribution of this file, with or without modification,
10178 are permitted in any medium without royalty provided the copyright
10179 notice and this notice are preserved.