gcc/analyzer/ChangeLog

   1 2023-05-18  Bernhard Reutner-Fischer  <aldot@gcc.gnu.org>
   2
   3         * region-model-manager.cc (get_code_for_cast): Use _P defines from
   4         tree.h.
   5         (region_model_manager::get_or_create_cast): Ditto.
   6         (region_model_manager::get_region_for_global): Ditto.
   7         * region-model.cc (region_model::get_lvalue_1): Ditto.
   8         * region.cc (decl_region::maybe_get_constant_value): Ditto.
   9
  10 2023-03-22  David Malcolm  <dmalcolm@redhat.com>
  11
  12         PR analyzer/109239
  13         * program-point.cc: Include "analyzer/inlining-iterator.h".
  14         (program_point::effectively_intraprocedural_p): New function.
  15         * program-point.h (program_point::effectively_intraprocedural_p):
  16         New decl.
  17         * sm-malloc.cc (deref_before_check::emit): Use it when rejecting
  18         interprocedural cases, so that we reject interprocedural cases
  19         that have become intraprocedural due to inlining.
  20
  21 2023-03-18  David Malcolm  <dmalcolm@redhat.com>
  22
  23         PR analyzer/109094
  24         * region-model.cc (region_model::on_longjmp): Pass false for
  25         new "eval_return_svalue" param of pop_frame.
  26         (region_model::pop_frame): Add new "eval_return_svalue" param and
  27         use it to suppress the call to get_rvalue on the result when
  28         needed by on_longjmp.
  29         * region-model.h (region_model::pop_frame): Add new
  30         "eval_return_svalue" param.
  31
  32 2023-03-10  David Malcolm  <dmalcolm@redhat.com>
  33
  34         PR analyzer/109059
  35         * region-model.cc (region_model::mark_region_as_unknown): Gather a
  36         set of maybe-live svalues and call on_maybe_live_values with it.
  37         * store.cc (binding_map::remove_overlapping_bindings): Add new
  38         "maybe_live_values" param; add any removed svalues to it.
  39         (binding_cluster::clobber_region): Add NULL as new param of
  40         remove_overlapping_bindings.
  41         (binding_cluster::mark_region_as_unknown): Add "maybe_live_values"
  42         param and pass it to remove_overlapping_bindings.
  43         (binding_cluster::maybe_get_compound_binding): Add NULL for new
  44         param of binding_map::remove_overlapping_bindings.
  45         (binding_cluster::remove_overlapping_bindings): Add
  46         "maybe_live_values" param and pass to
  47         binding_map::remove_overlapping_bindings.
  48         (store::set_value): Capture a set of maybe-live svalues, and call
  49         on_maybe_live_values with it.
  50         (store::on_maybe_live_values): New.
  51         (store::mark_region_as_unknown): Add "maybe_live_values" param
  52         and pass it to binding_cluster::mark_region_as_unknown.
  53         (store::remove_overlapping_bindings): Pass NULL for new param of
  54         binding_cluster::remove_overlapping_bindings.
  55         * store.h (binding_map::remove_overlapping_bindings): Add
  56         "maybe_live_values" param.
  57         (binding_cluster::mark_region_as_unknown): Likewise.
  58         (binding_cluster::remove_overlapping_bindings): Likewise.
  59         (store::mark_region_as_unknown): Likewise.
  60         (store::on_maybe_live_values): New decl.
  61
  62 2023-03-10  David Malcolm  <dmalcolm@redhat.com>
  63
  64         PR analyzer/108475
  65         PR analyzer/109060
  66         * sm-malloc.cc (deref_before_check::deref_before_check):
  67         Initialize new field m_deref_expr.  Assert that arg is non-NULL.
  68         (deref_before_check::emit): Reject cases where the spelling of the
  69         thing that was dereferenced differs from that of what is checked,
  70         or if the dereference expression was not found.  Remove code to
  71         handle NULL m_arg.
  72         (deref_before_check::describe_state_change): Remove code to handle
  73         NULL m_arg.
  74         (deref_before_check::describe_final_event): Likewise.
  75         (deref_before_check::sufficiently_similar_p): New.
  76         (deref_before_check::m_deref_expr): New field.
  77         (malloc_state_machine::maybe_complain_about_deref_before_check):
  78         Don't warn if the diag_ptr is NULL.
  79
  80 2023-03-03  David Malcolm  <dmalcolm@redhat.com>
  81
  82         * kf.cc (class kf_sprintf): New.
  83         (register_known_functions): Register it.
  84
  85 2023-03-02  David Malcolm  <dmalcolm@redhat.com>
  86
  87         PR analyzer/108968
  88         * region-model.cc (region_model::get_rvalue_1): Handle VAR_DECLs
  89         with a DECL_HARD_REGISTER by returning UNKNOWN.
  90
  91 2023-03-02  Hans-Peter Nilsson  <hp@axis.com>
  92
  93         * kf.cc (register_known_functions): Add __errno function for newlib.
  94
  95 2023-03-01  David Malcolm  <dmalcolm@redhat.com>
  96
  97         PR analyzer/107565
  98         * region-model.cc (region_model::on_call_pre): Flatten logic by
  99         returning early.  Consolidate logic for detecting const and pure
 100         functions.  When considering whether an unhandled built-in
 101         function has side-effects, consider all kinds of builtin, rather
 102         than just BUILT_IN_NORMAL, and don't require
 103         gimple_builtin_call_types_compatible_p.
 104
 105 2023-03-01  David Malcolm  <dmalcolm@redhat.com>
 106
 107         PR analyzer/108935
 108         * infinite-recursion.cc (contains_unknown_p): New.
 109         (sufficiently_different_region_binding_p): New function, splitting
 110         out inner loop from...
 111         (sufficiently_different_p): ...here.  Extend detection of unknown
 112         svalues to also include svalues that contain unknown.  Treat
 113         changes in frames below the entry to the recursion as being
 114         sufficiently different to reject being an infinite recursion.
 115
 116 2023-02-21  David Malcolm  <dmalcolm@redhat.com>
 117
 118         PR analyzer/108830
 119         * analyzer.opt (fanalyzer-suppress-followups): New option.
 120         * engine.cc (impl_region_model_context::warn): Terminate the path
 121         if the diagnostic's terminate_path_p vfunc returns true and
 122         -fanalyzer-suppress-followups is true (the default).
 123         (impl_sm_context::warn): Likewise, for both overloads.
 124         * pending-diagnostic.h (pending_diagnostic::terminate_path_p): New
 125         vfunc.
 126         * program-state.cc (program_state::on_edge): Terminate the path if
 127         the ctxt requests it during updating the edge.
 128         * region-model.cc (poisoned_value_diagnostic::terminate_path_p):
 129         New vfunc.
 130         * sm-malloc.cc (null_deref::terminate_path_p): New vfunc.
 131         (null_arg::terminate_path_p): New vfunc.
 132
 133 2023-02-16  David Malcolm  <dmalcolm@redhat.com>
 134
 135         PR analyzer/108806
 136         * constraint-manager.cc (bounded_range::dump_to_pp): Use
 137         bounded_range::singleton_p.
 138         (constraint_manager::add_bounded_ranges): Handle singleton ranges
 139         by adding an EQ_EXPR constraint.
 140         (constraint_manager::impossible_derived_conditions_p): New.
 141         (constraint_manager::eval_condition): Reject EQ_EXPR when it would
 142         imply impossible derived conditions.
 143         (selftest::test_bits): New.
 144         (selftest::run_constraint_manager_tests): Run it.
 145         * constraint-manager.h (bounded_range::singleton_p): New.
 146         (constraint_manager::impossible_derived_conditions_p): New decl.
 147         * region-model.cc (region_model::get_rvalue_1): Handle
 148         BIT_AND_EXPR, BIT_IOR_EXPR, and BIT_XOR_EXPR.
 149
 150 2023-02-15  David Malcolm  <dmalcolm@redhat.com>
 151
 152         PR analyzer/108664
 153         PR analyzer/108666
 154         PR analyzer/108725
 155         * diagnostic-manager.cc (epath_finder::get_best_epath): Add
 156         "target_stmt" param.
 157         (epath_finder::explore_feasible_paths): Likewise.
 158         (epath_finder::process_worklist_item): Likewise.
 159         (saved_diagnostic::calc_best_epath): Pass m_stmt to
 160         epath_finder::get_best_epath.
 161         * engine.cc (feasibility_state::maybe_update_for_edge): Move
 162         per-stmt logic to...
 163         (feasibility_state::update_for_stmt): ...this new function.
 164         * exploded-graph.h (feasibility_state::update_for_stmt): New decl.
 165         * feasible-graph.cc (feasible_node::get_state_at_stmt): New.
 166         * feasible-graph.h: Include "analyzer/exploded-graph.h".
 167         (feasible_node::get_state_at_stmt): New decl.
 168         * infinite-recursion.cc
 169         (infinite_recursion_diagnostic::check_valid_fpath_p): Update for
 170         vfunc signature change.
 171         * pending-diagnostic.h (pending_diagnostic::check_valid_fpath_p):
 172         Convert first param to a reference.  Add stmt param.
 173         * region-model.cc: Include "analyzer/feasible-graph.h".
 174         (poisoned_value_diagnostic::poisoned_value_diagnostic): Add
 175         "check_expr" param.
 176         (poisoned_value_diagnostic::check_valid_fpath_p): New.
 177         (poisoned_value_diagnostic::m_check_expr): New field.
 178         (region_model::check_for_poison): Attempt to supply a check_expr
 179         to the diagnostic
 180         (region_model::deref_rvalue): Add NULL for new check_expr param
 181         of poisoned_value_diagnostic.
 182         (region_model::get_or_create_region_for_heap_alloc): Don't reuse
 183         regions that are marked as TOUCHED.
 184
 185 2023-02-10  David Malcolm  <dmalcolm@redhat.com>
 186
 187         PR analyzer/108745
 188         * sm-malloc.cc (deref_before_check::emit): Reject the warning if
 189         the check occurs within a macro defintion.
 190
 191 2023-02-09  David Malcolm  <dmalcolm@redhat.com>
 192
 193         PR analyzer/108733
 194         * state-purge.cc (get_candidate_for_purging): Add ADDR_EXPR
 195         and MEM_REF.
 196
 197 2023-02-08  David Malcolm  <dmalcolm@redhat.com>
 198
 199         PR analyzer/108704
 200         * state-purge.cc (state_purge_per_decl::process_point_backwards):
 201         Don't stop processing the decl if it's fully overwritten by
 202         this stmt if it's also used by this stmt.
 203
 204 2023-02-07  David Malcolm  <dmalcolm@redhat.com>
 205
 206         PR analyzer/108661
 207         * sm-fd.cc (class kf_read): New.
 208         (register_known_fd_functions): Register "read".
 209         * sm-file.cc (class kf_fread): Update comment.
 210
 211 2023-02-02  David Malcolm  <dmalcolm@redhat.com>
 212
 213         PR analyzer/108633
 214         * sm-fd.cc (fd_state_machine::check_for_fd_attrs): Add missing
 215         "continue".
 216         (fd_state_machine::on_listen): Don't issue phase-mismatch or
 217         type-mismatch warnings for the "invalid" state.
 218
 219 2023-02-01  David Malcolm  <dmalcolm@redhat.com>
 220
 221         PR analyzer/108616
 222         * pending-diagnostic.cc (fixup_location_in_macro_p): Add "alloca"
 223         to macros that we shouldn't unwind inside.
 224
 225 2023-01-26  David Malcolm  <dmalcolm@redhat.com>
 226
 227         PR analyzer/108524
 228         * analyzer.h (class feasible_node): New forward decl.
 229         * diagnostic-manager.cc (epath_finder::get_best_epath): Add "pd"
 230         param.
 231         (epath_finder::explore_feasible_paths): Likewise.
 232         (epath_finder::process_worklist_item): Likewise.  Use it to call
 233         pending_diagnostic::check_valid_fpath_p on the final fpath to
 234         give pending_diagnostic a way to add additional restrictions on
 235         feasibility.
 236         (saved_diagnostic::calc_best_epath): Pass pending_diagnostic to
 237         epath_finder::get_best_epath.
 238         * infinite-recursion.cc: Include "analyzer/feasible-graph.h".
 239         (infinite_recursion_diagnostic::check_valid_fpath_p): New.
 240         (infinite_recursion_diagnostic::fedge_uses_conjured_svalue_p): New.
 241         (infinite_recursion_diagnostic::expr_uses_conjured_svalue_p): New.
 242         * pending-diagnostic.h (pending_diagnostic::check_valid_fpath_p):
 243         New vfunc.
 244
 245 2023-01-19  David Malcolm  <dmalcolm@redhat.com>
 246
 247         PR analyzer/108455
 248         * analyzer.h (class checker_event): New forward decl.
 249         (class state_change_event): Indent.
 250         (class warning_event): New forward decl.
 251         * checker-event.cc (state_change_event::state_change_event): Add
 252         "enode" param.
 253         (warning_event::get_desc): Update for new param of
 254         evdesc::final_event ctor.
 255         * checker-event.h (state_change_event::state_change_event): Add
 256         "enode" param.
 257         (state_change_event::get_exploded_node): New accessor.
 258         (state_change_event::m_enode): New field.
 259         (warning_event::warning_event): New "enode" param.
 260         (warning_event::get_exploded_node): New accessor.
 261         (warning_event::m_enode): New field.
 262         * diagnostic-manager.cc
 263         (state_change_event_creator::on_global_state_change): Pass
 264         src_node to state_change_event ctor.
 265         (state_change_event_creator::on_state_change): Likewise.
 266         (null_assignment_sm_context::set_next_state): Pass NULL for
 267         new param of state_change_event ctor.
 268         * infinite-recursion.cc
 269         (infinite_recursion_diagnostic::add_final_event): Update for new
 270         param of warning_event ctor.
 271         * pending-diagnostic.cc (pending_diagnostic::add_final_event):
 272         Pass enode to warning_event ctor.
 273         * pending-diagnostic.h (evdesc::final_event): Add reference to
 274         warning_event.
 275         * sm-malloc.cc: Include "analyzer/checker-event.h" and
 276         "analyzer/exploded-graph.h".
 277         (deref_before_check::deref_before_check): Initialize new fields.
 278         (deref_before_check::emit): Reject warnings in which we were
 279         unable to determine the enodes of the dereference and the check.
 280         Reject warnings interprocedural warnings. Reject warnings in which
 281         the dereference doesn't dominate the check.
 282         (deref_before_check::describe_state_change): Set m_deref_enode.
 283         (deref_before_check::describe_final_event): Set m_check_enode.
 284         (deref_before_check::m_deref_enode): New field.
 285         (deref_before_check::m_check_enode): New field.
 286
 287 2023-01-13  David Malcolm  <dmalcolm@redhat.com>
 288
 289         PR analyzer/105273
 290         * region-model.cc (has_nondefault_case_for_value_p): New.
 291         (has_nondefault_cases_for_all_enum_values_p): New.
 292         (region_model::apply_constraints_for_gswitch): Skip
 293         implicitly-created "default" when switching on an enum
 294         and all enum values have non-default cases.
 295         (rejected_default_case::dump_to_pp): New.
 296         * region-model.h (region_model_context::possibly_tainted_p): New
 297         decl.
 298         (class rejected_default_case): New.
 299         * sm-taint.cc (region_model_context::possibly_tainted_p): New.
 300         * supergraph.cc (switch_cfg_superedge::dump_label_to_pp): Dump
 301         when implicitly_created_default_p.
 302         (switch_cfg_superedge::implicitly_created_default_p): New.
 303         * supergraph.h
 304         (switch_cfg_superedge::implicitly_created_default_p): New decl.
 305
 306 2023-01-11  David Malcolm  <dmalcolm@redhat.com>
 307
 308         PR analyzer/108252
 309         * kf.cc (class kf_strdup): New.
 310         (class kf_strndup): New.
 311         (register_known_functions): Register them.
 312         * region-model.cc (region_model::on_call_pre): Use
 313         &HEAP_ALLOCATED_REGION for the default result of an external
 314         function with the "malloc" attribute, rather than CONJURED_SVALUE.
 315         (region_model::get_or_create_region_for_heap_alloc): Allow
 316         "size_in_bytes" to be NULL.
 317         * store.cc (store::set_value): When handling *UNKNOWN = VAL,
 318         mark VAL as "maybe bound".
 319
 320 2022-12-16  David Malcolm  <dmalcolm@redhat.com>
 321
 322         PR analyzer/106479
 323         * kf.cc (kf_memcpy_memmove::impl_call_pre): Pass in source region
 324         to region_model::check_for_poison.
 325         * region-model-asm.cc (region_model::on_asm_stmt): Pass NULL
 326         region to region_model::check_for_poison.
 327         * region-model.cc (region_model::check_for_poison): Add
 328         "src_region" param, and pass it to poisoned_value_diagnostic.
 329         (region_model::on_assignment): Pass NULL region to
 330         region_model::check_for_poison.
 331         (region_model::get_rvalue): Likewise.
 332         * region-model.h (region_model::check_for_poison): Add
 333         "src_region" param.
 334         * sm-fd.cc (fd_state_machine::on_accept): Pass in source region
 335         to region_model::check_for_poison.
 336         * varargs.cc (kf_va_copy::impl_call_pre): Pass NULL region to
 337         region_model::check_for_poison.
 338         (kf_va_arg::impl_call_pre): Pass in source region to
 339         region_model::check_for_poison.
 340
 341 2022-12-14  David Malcolm  <dmalcolm@redhat.com>
 342
 343         PR analyzer/108065
 344         * region.cc (decl_region::get_svalue_for_initializer): Bail out to
 345         avoid calling binding_key::make with an empty region.
 346         * store.cc (binding_map::apply_ctor_val_to_range): Likewise.
 347         (binding_map::apply_ctor_pair_to_child_region): Likewise.
 348         (binding_cluster::bind): Likewise.
 349         (binding_cluster::purge_region): Likewise.
 350         (binding_cluster::maybe_get_compound_binding): Likewise.
 351         (binding_cluster::maybe_get_simple_value): Likewise.
 352
 353 2022-12-09  David Malcolm  <dmalcolm@redhat.com>
 354
 355         * analyzer.h (class known_function): Expand comment.
 356         * region-model-impl-calls.cc: Rename to...
 357         * kf.cc: ...this.
 358         * known-function-manager.h (class known_function_manager): Add
 359         leading comment.
 360
 361 2022-12-09  David Malcolm  <dmalcolm@redhat.com>
 362
 363         PR analyzer/108003
 364         * call-summary.cc
 365         (call_summary_replay::convert_region_from_summary_1): Convert
 366         heap_regs_in_use from auto_sbitmap to auto_bitmap.
 367         * region-model-manager.cc
 368         (region_model_manager::get_or_create_region_for_heap_alloc):
 369         Convert from sbitmap to bitmap.
 370         * region-model-manager.h: Likewise.
 371         * region-model.cc
 372         (region_model::get_or_create_region_for_heap_alloc): Convert from
 373         auto_sbitmap to auto_bitmap.
 374         (region_model::get_referenced_base_regions): Likewise.
 375         * region-model.h: Include "bitmap.h" rather than "sbitmap.h".
 376         (region_model::get_referenced_base_regions): Convert from
 377         auto_sbitmap to auto_bitmap.
 378
 379 2022-12-09  David Malcolm  <dmalcolm@redhat.com>
 380
 381         * region-model-impl-calls.cc (class kf_memcpy): Rename to...
 382         (class kf_memcpy_memmove): ...this.
 383         (kf_memcpy::impl_call_pre): Rename to...
 384         (kf_memcpy_memmove::impl_call_pre): ...this, and check the src for
 385         poison.
 386         (register_known_functions): Update for above renaming, and
 387         register BUILT_IN_MEMMOVE and BUILT_IN_MEMMOVE_CHK.
 388
 389 2022-12-06  David Malcolm  <dmalcolm@redhat.com>
 390
 391         PR analyzer/107882
 392         * region-model.cc (region_model::get_store_value): Return an
 393         unknown value for empty regions.
 394         (region_model::set_value): Bail on empty regions.
 395         * region.cc (region::empty_p): New.
 396         * region.h (region::empty_p): New decl.
 397         * state-purge.cc (same_binding_p): Bail if either region is empty.
 398         * store.cc (binding_key::make): Assert that a concrete binding's
 399         bit_size must be > 0.
 400         (binding_cluster::mark_region_as_unknown): Bail on empty regions.
 401         (binding_cluster::get_binding): Likewise.
 402         (binding_cluster::remove_overlapping_bindings): Likewise.
 403         (binding_cluster::on_unknown_fncall): Don't conjure values for
 404         empty regions.
 405         (store::fill_region): Bail on empty regions.
 406         * store.h (class concrete_binding): Update comment to reflect that
 407         the range of bits must be non-empty.
 408         (concrete_binding::concrete_binding): Assert that bit range is
 409         non-empty.
 410
 411 2022-12-06  David Malcolm  <dmalcolm@redhat.com>
 412
 413         PR analyzer/106325
 414         * region-model-manager.cc
 415         (region_model_manager::get_or_create_null_ptr): New.
 416         * region-model-manager.h
 417         (region_model_manager::get_or_create_null_ptr): New decl.
 418         * region-model.cc (region_model::on_top_level_param): Add
 419         "nonnull" param and make use of it.
 420         (region_model::push_frame): When handling a top-level entrypoint
 421         to the analysis, determine which params __attribute__((nonnull))
 422         applies to, and pass to on_top_level_param.
 423         * region-model.h (region_model::on_top_level_param): Add "nonnull"
 424         param.
 425
 426 2022-12-06  David Malcolm  <dmalcolm@redhat.com>
 427
 428         * analyzer.h (register_known_analyzer_functions): New decl.
 429         (register_known_functions_lang_cp): New decl.
 430         * call-details.cc: New file, split out from
 431         region-model-impl-calls.cc.
 432         * call-details.h: New file, split out from region-model.h.
 433         * call-info.cc: Include "analyzer/call-details.h".
 434         * call-summary.h: Likewise.
 435         * kf-analyzer.cc: New file, split out from
 436         region-model-impl-calls.cc.
 437         * kf-lang-cp.cc: Likewise.
 438         * known-function-manager.cc: Include "analyzer/call-details.h".
 439         * region-model-impl-calls.cc: Move definitions of call_details's
 440         member functions to call-details.cc.  Move class kf_analyzer_* to
 441         kf-analyzer.cc.  Move kf_operator_new and kf_operator_delete to
 442         kf-lang-cp.cc.  Refresh #includes accordingly.
 443         (register_known_functions): Replace registration of __analyzer_*
 444         functions with a call to register_known_analyzer_functions.
 445         Replace registration of C++ support functions with a call to
 446         register_known_functions_lang_cp.
 447         * region-model.h (class call_details): Move to new call-details.h.
 448         * sm-fd.cc: Include "analyzer/call-details.h".
 449         * sm-file.cc: Likewise.
 450         * sm-malloc.cc: Likewise.
 451         * varargs.cc: Likewise.
 452
 453 2022-12-02  David Malcolm  <dmalcolm@redhat.com>
 454
 455         * analyzer.h (struct event_loc_info): New forward decl.
 456         * bounds-checking.cc: Use event_loc_info throughout to bundle the
 457         loc, fndecl, depth triples.
 458         * call-info.cc: Likewise.
 459         * checker-event.cc: Likewise.
 460         * checker-event.h (struct event_loc_info): New decl.  Use it
 461         throughout to bundle the loc, fndecl, depth triples.
 462         * checker-path.cc: Likewise.
 463         * checker-path.h: Likewise.
 464         * diagnostic-manager.cc: Likewise.
 465         * engine.cc: Likewise.
 466         * infinite-recursion.cc: Likewise.
 467         * pending-diagnostic.cc: Likewise.
 468         * pending-diagnostic.h: Likewise.
 469         * region-model.cc: Likewise.
 470         * sm-signal.cc: Likewise.
 471         * varargs.cc: Likewise.
 472
 473 2022-12-02  David Malcolm  <dmalcolm@redhat.com>
 474
 475         PR analyzer/107851
 476         * analyzer.cc (make_label_text_n): Convert param "n" from int to
 477         unsigned HOST_WIDE_INT.
 478         * analyzer.h (make_label_text_n): Likewise for decl.
 479         * bounds-checking.cc: Include "analyzer/checker-event.h" and
 480         "analyzer/checker-path.h".
 481         (out_of_bounds::add_region_creation_events): New.
 482         (concrete_past_the_end::describe_region_creation_event): Replace
 483         with...
 484         (concrete_past_the_end::add_region_creation_events): ...this.
 485         (symbolic_past_the_end::describe_region_creation_event): Delete.
 486         * checker-event.cc (region_creation_event::region_creation_event):
 487         Update for dropping all member data.
 488         (region_creation_event::get_desc): Delete, splitting out into
 489         region_creation_event_memory_space::get_desc,
 490         region_creation_event_capacity::get_desc, and
 491         region_creation_event_debug::get_desc.
 492         (region_creation_event_memory_space::get_desc): New.
 493         (region_creation_event_capacity::get_desc): New.
 494         (region_creation_event_allocation_size::get_desc): New.
 495         (region_creation_event_debug::get_desc): New.
 496         * checker-event.h: Include "analyzer/program-state.h".
 497         (enum rce_kind): Delete.
 498         (class region_creation_event): Drop all member data.
 499         (region_creation_event::region_creation_event): Make protected.
 500         (region_creation_event::get_desc): Delete.
 501         (class region_creation_event_memory_space): New.
 502         (class region_creation_event_capacity): New.
 503         (class region_creation_event_allocation_size): New.
 504         (class region_creation_event_debug): New.
 505         * checker-path.cc (checker_path::add_region_creation_events): Add
 506         "pd" param.  Call pending_diangnostic::add_region_creation_events.
 507         Update for conversion of RCE_DEBUG to region_creation_event_debug.
 508         * checker-path.h (checker_path::add_region_creation_events): Add
 509         "pd" param.
 510         * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
 511         Pass pending_diagnostic to
 512         emission_path::add_region_creation_events.
 513         (diagnostic_manager::build_emission_path): Pass path_builder to
 514         add_event_on_final_node.
 515         (diagnostic_manager::add_event_on_final_node): Add "pb" param.
 516         Pass pending_diagnostic to
 517         emission_path::add_region_creation_events.
 518         (diagnostic_manager::add_events_for_eedge): Pass
 519         pending_diagnostic to emission_path::add_region_creation_events.
 520         * diagnostic-manager.h
 521         (diagnostic_manager::add_event_on_final_node): Add "pb" param.
 522         * pending-diagnostic.cc
 523         (pending_diagnostic::add_region_creation_events): New.
 524         * pending-diagnostic.h (struct region_creation): Delete.
 525         (pending_diagnostic::describe_region_creation_event): Delete.
 526         (pending_diagnostic::add_region_creation_events): New vfunc.
 527         * region-model.cc: Include "analyzer/checker-event.h" and
 528         "analyzer/checker-path.h".
 529         (dubious_allocation_size::dubious_allocation_size): Initialize
 530         m_has_allocation_event.
 531         (dubious_allocation_size::describe_region_creation_event): Delete.
 532         (dubious_allocation_size::describe_final_event): Update for
 533         replacement of m_allocation_event with m_has_allocation_event.
 534         (dubious_allocation_size::add_region_creation_events): New.
 535         (dubious_allocation_size::m_allocation_event): Replace with...
 536         (dubious_allocation_size::m_has_allocation_event): ...this.
 537
 538 2022-12-02  David Malcolm  <dmalcolm@redhat.com>
 539
 540         PR analyzer/107948
 541         * region-model-manager.cc
 542         (region_model_manager::maybe_fold_binop): Fold (0 - VAL) to -VAL.
 543         * region-model.cc (region_model::eval_condition): Handle e.g.
 544         "-X <= 0" as equivalent to X >= 0".
 545
 546 2022-12-01  David Malcolm  <dmalcolm@redhat.com>
 547
 548         PR analyzer/106626
 549         * bounds-checking.cc
 550         (symbolic_past_the_end::describe_final_event): Delete, moving to
 551         symbolic_buffer_overflow::describe_final_event and
 552         symbolic_buffer_over_read::describe_final_event, eliminating
 553         composition of text strings via "byte_str" and "m_dir_str".
 554         (symbolic_past_the_end::m_dir_str): Delete field.
 555         (symbolic_buffer_overflow::symbolic_buffer_overflow): Drop
 556         m_dir_str.
 557         (symbolic_buffer_overflow::describe_final_event): New, as noted
 558         above.
 559         (symbolic_buffer_over_read::symbolic_buffer_overflow): Drop
 560         m_dir_str.
 561         (symbolic_buffer_over_read::describe_final_event): New, as noted
 562         above.
 563
 564 2022-12-01  David Malcolm  <dmalcolm@redhat.com>
 565
 566         * bounds-checking.cc (class out_of_bounds): Split out from...
 567         (class concrete_out_of_bounds): New abstract subclass.
 568         (class past_the_end): Rename to...
 569         (class concrete_past_the_end): ...this, and make a subclass of
 570         concrete_out_of_bounds.
 571         (class buffer_overflow): Rename to...
 572         (class concrete_buffer_overflow): ...this, and make a subclass of
 573         concrete_past_the_end.
 574         (class buffer_over_read): Rename to...
 575         (class concrete_buffer_over_read): ...this, and make a subclass of
 576         concrete_past_the_end.
 577         (class buffer_underwrite): Rename to...
 578         (class concrete_buffer_underwrite): ...this, and make a subclass
 579         of concrete_out_of_bounds.
 580         (class buffer_under_read): Rename to...
 581         (class concrete_buffer_under_read): ...this, and make a subclass
 582         of concrete_out_of_bounds.
 583         (class symbolic_past_the_end): Convert to a subclass of
 584         out_of_bounds.
 585         (symbolic_buffer_overflow::get_kind): New.
 586         (symbolic_buffer_over_read::get_kind): New.
 587         (region_model::check_region_bounds): Update for renamings.
 588         * engine.cc (impl_sm_context::set_next_state): Eliminate
 589         "new_ctxt", passing NULL to get_rvalue instead.
 590         (impl_sm_context::warn): Likewise.
 591
 592 2022-12-01  David Malcolm  <dmalcolm@redhat.com>
 593
 594         PR analyzer/106626
 595         * bounds-checking.cc (out_of_bounds::get_memory_space): New.
 596         (buffer_overflow::emit): Use it.
 597         (class buffer_overread): Rename to...
 598         (class buffer_over_read): ...this.
 599         (buffer_over_read::emit): Specify which memory space the read is
 600         from, where known.  Change "overread" to "over-read".
 601         (class buffer_underflow): Rename to...
 602         (class buffer_underwrite): ...this.
 603         (buffer_underwrite::emit): Specify which memory space the write is
 604         to, where known.  Change "underflow" to "underwrite".
 605         (class buffer_underread): Rename to...
 606         (class buffer_under_read): Rename to...
 607         (buffer_under_read::emit): Specify which memory space the read is
 608         from, where known.  Change "underread" to "under-read".
 609         (symbolic_past_the_end::get_memory_space): New.
 610         (symbolic_buffer_overflow::emit): Use it.
 611         (class symbolic_buffer_overread): Rename to...
 612         (class symbolic_buffer_over_read): ...this.
 613         (symbolic_buffer_over_read::emit): Specify which memory space the
 614         read is from, where known.  Change "overread" to "over-read".
 615         (region_model::check_symbolic_bounds): Update for class renaming.
 616         (region_model::check_region_bounds): Likewise.
 617
 618 2022-12-01  David Malcolm  <dmalcolm@redhat.com>
 619
 620         PR analyzer/106626
 621         * bounds-checking.cc (out_of_bounds::maybe_describe_array_bounds):
 622         New.
 623         (buffer_overflow::emit): Call maybe_describe_array_bounds.
 624         (buffer_overread::emit): Likewise.
 625         (buffer_underflow::emit): Likewise.
 626         (buffer_underread::emit): Likewise.
 627
 628 2022-12-01  David Malcolm  <dmalcolm@redhat.com>
 629
 630         PR analyzer/106626
 631         * bounds-checking.cc (buffer_overflow::emit): Use inform_n.
 632         Update wording to clarify that we're talking about the size of
 633         the bad access, rather than its position.
 634         (buffer_overread::emit): Likewise.
 635
 636 2022-12-01  David Malcolm  <dmalcolm@redhat.com>
 637
 638         * bounds-checking.cc: New file, taken from region-model.cc.
 639         * region-model.cc (class out_of_bounds): Move to
 640         bounds-checking.cc.
 641         (class past_the_end): Likewise.
 642         (class buffer_overflow): Likewise.
 643         (class buffer_overread): Likewise.
 644         (class buffer_underflow): Likewise.
 645         (class buffer_underread): Likewise.
 646         (class symbolic_past_the_end): Likewise.
 647         (class symbolic_buffer_overflow): Likewise.
 648         (class symbolic_buffer_overread): Likewise.
 649         (region_model::check_symbolic_bounds): Likewise.
 650         (maybe_get_integer_cst_tree): Likewise.
 651         (region_model::check_region_bounds): Likewise.
 652         * region-model.h: Add comment.
 653
 654 2022-12-01  David Malcolm  <dmalcolm@redhat.com>
 655
 656         PR analyzer/107928
 657         * sm-fd.cc (fd_state_machine::on_bind): Handle m_constant_fd in
 658         the "success" outcome.
 659         (fd_state_machine::on_connect): Likewise.
 660         * sm-fd.dot: Add "constant_fd" state and its transitions.
 661
 662 2022-11-30  David Malcolm  <dmalcolm@redhat.com>
 663
 664         * region-model-impl-calls.cc (class kf_fgets): Move to sm-file.cc.
 665         (kf_fgets::impl_call_pre): Likewise.
 666         (class kf_fread): Likewise.
 667         (kf_fread::impl_call_pre): Likewise.
 668         (class kf_getchar): Likewise.
 669         (class kf_stdio_output_fn): Likewise.
 670         (register_known_functions): Move registration of
 671         BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
 672         BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
 673         BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
 674         BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
 675         BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
 676         BUILT_IN_PUTS_UNLOCKED, BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF,
 677         "getchar", "fgets", "fgets_unlocked", and "fread" to
 678         register_known_file_functions.
 679         * sm-file.cc (class kf_stdio_output_fn): Move here from
 680         region-model-impl-calls.cc.
 681         (class kf_fgets): Likewise.
 682         (class kf_fread): Likewise.
 683         (class kf_getchar): Likewise.
 684         (register_known_file_functions): Move registration of
 685         BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
 686         BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
 687         BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
 688         BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
 689         BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
 690         BUILT_IN_PUTS_UNLOCKED, BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF,
 691         "fgets", "fgets_unlocked", "fread", and "getchar" to here from
 692         register_known_functions.
 693
 694 2022-11-30  David Malcolm  <dmalcolm@redhat.com>
 695
 696         PR analyzer/103546
 697         * analyzer.h (register_known_file_functions): New decl.
 698         * program-state.cc (sm_state_map::replay_call_summary): Rejct
 699         attempts to store sm-state for caller_sval that can't have
 700         associated state.
 701         * region-model-impl-calls.cc (register_known_functions): Call
 702         register_known_file_functions.
 703         * sm-fd.cc (class kf_isatty): New.
 704         (register_known_fd_functions): Register it.
 705         * sm-file.cc (class kf_ferror): New.
 706         (class kf_fileno): New.
 707         (class kf_getc): New.
 708         (register_known_file_functions): New.
 709
 710 2022-11-30  David Malcolm  <dmalcolm@redhat.com>
 711
 712         PR analyzer/105784
 713         * region-model-manager.cc
 714         (region_model_manager::maybe_fold_binop): For POINTER_PLUS_EXPR,
 715         PLUS_EXPR and MINUS_EXPR, eliminate requirement that the final
 716         type matches that of arg0 in favor of a cast.
 717
 718 2022-11-24  Martin Liska  <mliska@suse.cz>
 719
 720         * varargs.cc: Fix Clang warnings.
 721
 722 2022-11-24  David Malcolm  <dmalcolm@redhat.com>
 723
 724         PR analyzer/106473
 725         * call-summary.cc
 726         (call_summary_replay::convert_region_from_summary_1): Update for
 727         change to creation of heap-allocated regions.
 728         * program-state.cc (test_program_state_1): Likewise.
 729         (test_program_state_merging): Likewise.
 730         * region-model-impl-calls.cc (kf_calloc::impl_call_pre): Likewise.
 731         (kf_malloc::impl_call_pre): Likewise.
 732         (kf_operator_new::impl_call_pre): Likewise.
 733         (kf_realloc::impl_call_postsuccess_with_move::update_model): Likewise.
 734         * region-model-manager.cc
 735         (region_model_manager::create_region_for_heap_alloc): Convert
 736         to...
 737         (region_model_manager::get_or_create_region_for_heap_alloc):
 738         ...this, reusing an existing region if it's unreferenced in the
 739         client state.
 740         * region-model-manager.h (region_model_manager::get_num_regions): New.
 741          (region_model_manager::create_region_for_heap_alloc): Convert to...
 742          (region_model_manager::get_or_create_region_for_heap_alloc): ...this.
 743         * region-model.cc (region_to_value_map::can_merge_with_p): Reject
 744         merger when the values are different.
 745         (region_model::create_region_for_heap_alloc): Convert to...
 746         (region_model::get_or_create_region_for_heap_alloc): ...this.
 747         (region_model::get_referenced_base_regions): New.
 748         (selftest::test_state_merging):  Update for change to creation of
 749         heap-allocated regions.
 750         (selftest::test_malloc_constraints): Likewise.
 751         (selftest::test_malloc): Likewise.
 752         * region-model.h: Include "sbitmap.h".
 753         (region_model::create_region_for_heap_alloc): Convert to...
 754         (region_model::get_or_create_region_for_heap_alloc): ...this.
 755         (region_model::get_referenced_base_regions): New decl.
 756         * store.cc (store::canonicalize): Don't purge a heap-allocated region
 757         that's been marked as escaping.
 758
 759 2022-11-24  David Malcolm  <dmalcolm@redhat.com>
 760
 761         * checker-path.cc (checker_path::inject_any_inlined_call_events):
 762         Don't dump the address of the block when -fdump-noaddr.
 763
 764 2022-11-24  David Malcolm  <dmalcolm@redhat.com>
 765
 766         * region-model.h (region_model::on_socket): Delete decl.
 767         (region_model::on_bind): Likewise.
 768         (region_model::on_listen): Likewise.
 769         (region_model::on_accept): Likewise.
 770         (region_model::on_connect): Likewise.
 771         * sm-fd.cc (kf_socket::outcome_of_socket::update_model): Move body
 772         of region_model::on_socket into here, ...
 773         (region_model::on_socket): ...eliminating this function.
 774         (kf_bind::outcome_of_bind::update_model): Likewise for on_bind...
 775         (region_model::on_bind): ...eliminating this function.
 776         (kf_listen::outcome_of_listen::update_model): Likewise fo
 777         on_listen...
 778         (region_model::on_listen): ...eliminating this function.
 779         (kf_accept::outcome_of_accept::update_model): Likewise fo
 780         on_accept...
 781         (region_model::on_accept): ...eliminating this function.
 782         (kf_connect::outcome_of_connect::update_model): Likewise fo
 783         on_connect...
 784         (region_model::on_connect): ...eliminating this function.
 785
 786 2022-11-24  David Malcolm  <dmalcolm@redhat.com>
 787
 788         * analyzer.h (register_known_fd_functions): New decl.
 789         * region-model-impl-calls.cc (class kf_accept): Move to sm-fd.cc.
 790         (class kf_bind): Likewise.
 791         (class kf_connect): Likewise.
 792         (class kf_listen): Likewise.
 793         (class kf_pipe): Likewise.
 794         (class kf_socket): Likewise.
 795         (register_known_functions): Remove registration of the above
 796         functions, instead calling register_known_fd_functions.
 797         * sm-fd.cc: Include "analyzer/call-info.h".
 798         (class kf_socket): Move here from region-model-impl-calls.cc.
 799         (class kf_bind): Likewise.
 800         (class kf_listen): Likewise.
 801         (class kf_accept): Likewise.
 802         (class kf_connect): Likewise.
 803         (class kf_pipe): Likewise.
 804         (register_known_fd_functions): New.
 805
 806 2022-11-22  David Malcolm  <dmalcolm@redhat.com>
 807
 808         PR analyzer/107788
 809         * known-function-manager.cc (known_function_manager::get_match):
 810         Don't look up fndecls by name when they're not in the root
 811         namespace.
 812
 813 2022-11-22  David Malcolm  <dmalcolm@redhat.com>
 814
 815         PR analyzer/107783
 816         * sm-fd.cc (fd_state_machine::check_for_new_socket_fd): Don't
 817         complain when old state is "fd-constant".
 818         (fd_state_machine::on_listen): Likewise.
 819         (fd_state_machine::on_accept): Likewise.
 820
 821 2022-11-22  David Malcolm  <dmalcolm@redhat.com>
 822
 823         PR analyzer/107807
 824         * region-model-impl-calls.cc (register_known_functions): Register
 825         "___errno" and "__error" as synonyms  for "__errno_location".
 826
 827 2022-11-22  David Malcolm  <dmalcolm@redhat.com>
 828
 829         * analyzer.h (class internal_known_function): New.
 830         (register_varargs_builtins): New decl.
 831         * engine.cc (exploded_node::on_stmt_pre): Remove
 832         "out_terminate_path" param from call to region_model::on_stmt_pre.
 833         (feasibility_state::maybe_update_for_edge): Likewise.
 834         * known-function-manager.cc: Include "basic-block.h", "gimple.h",
 835         and "analyzer/region-model.h".
 836         (known_function_manager::known_function_manager): Initialize
 837         m_combined_fns_arr.
 838         (known_function_manager::~known_function_manager): Clean up
 839         m_combined_fns_arr.
 840         (known_function_manager::get_by_identifier): Make const.
 841         (known_function_manager::add): New overloaded definitions for
 842         enum built_in_function and enum internal_fn.
 843         (known_function_manager::get_by_fndecl): Delete.
 844         (known_function_manager::get_match): New.
 845         (known_function_manager::get_internal_fn): New.
 846         (known_function_manager::get_normal_builtin): New.
 847         * known-function-manager.h
 848         (known_function_manager::get_by_identifier): Make private and
 849         add const qualifier.
 850         (known_function_manager::get_by_fndecl): Delete.
 851         (known_function_manager::add): Add overloaded decls for
 852         enum built_in_function name and enum internal_fn.
 853         (known_function_manager::get_match): New decl.
 854         (known_function_manager::get_internal_fn): New decl.
 855         (known_function_manager::get_normal_builtin): New decl.
 856         (known_function_manager::m_combined_fns_arr): New field.
 857         * region-model-impl-calls.cc (call_details::arg_is_size_p): New.
 858         (class kf_alloca): New.
 859         (region_model::impl_call_alloca): Convert to...
 860         (kf_alloca::impl_call_pre): ...this.
 861         (kf_analyzer_dump_capacity::matches_call_types_p): Rewrite check
 862         to use call_details::arg_is_pointer_p.
 863         (region_model::impl_call_builtin_expect): Convert to...
 864         (class kf_expect): ...this.
 865         (class kf_calloc): New, adding check that both arguments are
 866         size_t.
 867         (region_model::impl_call_calloc): Convert to...
 868         (kf_calloc::impl_call_pre): ...this.
 869         (kf_connect::matches_call_types_p): Rewrite check to use
 870         call_details::arg_is_pointer_p.
 871         (region_model::impl_call_error): Convert to...
 872         (class kf_error): ...this, and...
 873         (kf_error::impl_call_pre): ...this.
 874         (class kf_fgets): New, adding checks that args 0 and 2 are
 875         pointers.
 876         (region_model::impl_call_fgets): Convert to...
 877         (kf_fgets::impl_call_pre): ...this.
 878         (class kf_fread): New, adding checks on the argument types.
 879         (region_model::impl_call_fread): Convert to...
 880         (kf_fread::impl_call_pre): ...this.
 881         (class kf_free): New, adding check that the argument is a pointer.
 882         (region_model::impl_call_free): Convert to...
 883         (kf_free::impl_call_post): ...this.
 884         (class kf_getchar): New.
 885         (class kf_malloc): New, adding check that the argument is a
 886         size_t.
 887         (region_model::impl_call_malloc): Convert to...
 888         (kf_malloc::impl_call_pre): ...this.
 889         (class kf_memcpy): New, adding checks on arguments.
 890         (region_model::impl_call_memcpy): Convert to...
 891         (kf_memcpy::impl_call_pre): ...this.
 892         (class kf_memset): New.
 893         (region_model::impl_call_memset): Convert to...
 894         (kf_memset::impl_call_pre): ...this.
 895         (kf_pipe::matches_call_types_p): Rewrite check to use
 896         call_details::arg_is_pointer_p.
 897         (kf_putenv::matches_call_types_p): Likewise.
 898         (class kf_realloc): New, adding checks on the argument types.
 899         (region_model::impl_call_realloc): Convert to...
 900         (kf_realloc::impl_call_post): ...this.
 901         (class kf_strchr): New.
 902         (region_model::impl_call_strchr): Convert to...
 903         (kf_strchr::impl_call_post): ...this.
 904         (class kf_stack_restore): New.
 905         (class kf_stack_save): New.
 906         (class kf_stdio_output_fn): New.
 907         (class kf_strcpy): New,
 908         (region_model::impl_call_strcpy): Convert to...
 909         (kf_strcpy::impl_call_pre): ...this.
 910         (class kf_strlen): New.
 911         (region_model::impl_call_strlen): Convert to...
 912         (kf_strlen::impl_call_pre): ...this.
 913         (class kf_ubsan_bounds): New.
 914         (region_model::impl_deallocation_call): Reimplement to avoid call
 915         to impl_call_free.
 916         (register_known_functions): Add handlers for IFN_BUILTIN_EXPECT
 917         and IFN_UBSAN_BOUNDS.  Add handlers for BUILT_IN_ALLOCA,
 918         BUILT_IN_ALLOCA_WITH_ALIGN, BUILT_IN_CALLOC, BUILT_IN_EXPECT,
 919         BUILT_IN_EXPECT_WITH_PROBABILITY, BUILT_IN_FPRINTF,
 920         BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
 921         BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
 922         BUILT_IN_FREE, BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED,
 923         BUILT_IN_MALLOC, BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK,
 924         BUILT_IN_MEMSET, BUILT_IN_MEMSET_CHK, BUILT_IN_PRINTF,
 925         BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
 926         BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
 927         BUILT_IN_PUTS_UNLOCKED, BUILT_IN_REALLOC, BUILT_IN_STACK_RESTORE,
 928         BUILT_IN_STACK_SAVE, BUILT_IN_STRCHR, BUILT_IN_STRCPY,
 929         BUILT_IN_STRCPY_CHK, BUILT_IN_STRLEN, BUILT_IN_VFPRINTF, and
 930         BUILT_IN_VPRINTF. Call register_varargs_builtins.  Add handlers
 931         for "getchar", "memset", "fgets", "fgets_unlocked", "fread",
 932         "error", and "error_at_line".
 933         * region-model.cc (region_model::on_stmt_pre): Drop
 934         "out_terminate_path" param.
 935         (region_model::get_known_function): Reimplement by calling
 936         known_function_manager::get_match, passing new "cd" param.
 937         Add overload taking enum internal_fn.
 938         (region_model::on_call_pre): Drop "out_terminate_path" param.
 939         Remove special-case handling of internal fns IFN_BUILTIN_EXPECT,
 940         IFN_UBSAN_BOUNDS, and IFN_VA_ARG, of built-in fns BUILT_IN_ALLOCA,
 941         BUILT_IN_ALLOCA_WITH_ALIGN, BUILT_IN_CALLOC, BUILT_IN_EXPECT,
 942         BUILT_IN_EXPECT_WITH_PROBABILITY, BUILT_IN_FREE, BUILT_IN_MALLOC,
 943         BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_MEMSET,
 944         BUILT_IN_MEMSET_CHK, BUILT_IN_REALLOC, BUILT_IN_STRCHR,
 945         BUILT_IN_STRCPY, BUILT_IN_STRCPY_CHK, BUILT_IN_STRLEN,
 946         BUILT_IN_STACK_SAVE, BUILT_IN_STACK_RESTORE, BUILT_IN_FPRINTF,
 947         BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED,
 948         BUILT_IN_FPUTC, BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS,
 949         BUILT_IN_FPUTS_UNLOCKED, BUILT_IN_FWRITE,
 950         BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
 951         BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR,
 952         BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED,
 953         BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF, BUILT_IN_VA_START, and
 954         BUILT_IN_VA_COPY, and of named functions "malloc", "calloc",
 955         "alloca", "realloc", "error", "error_at_line", "fgets",
 956         "fgets_unlocked", "fread", "getchar", "memset", "strchr", and
 957         "strlen".  Replace all this special-casing with calls to
 958         get_known_function for internal fns and for fn decls.
 959         (region_model::on_call_post): Remove special-casing handling for
 960         "free" and "strchr", and for BUILT_IN_REALLOC, BUILT_IN_STRCHR,
 961         and BUILT_IN_VA_END.  Replace by consolidating on usage of
 962         get_known_function.
 963         * region-model.h (call_details::arg_is_size_p): New.
 964         (region_model::on_stmt_pre): Drop "out_terminate_path" param.
 965         (region_model::on_call_pre): Likewise.
 966         (region_model::impl_call_alloca): Delete.
 967         (region_model::impl_call_builtin_expect): Delete.
 968         (region_model::impl_call_calloc): Delete.
 969         (region_model::impl_call_error): Delete.
 970         (region_model::impl_call_fgets): Delete.
 971         (region_model::impl_call_fread): Delete.
 972         (region_model::impl_call_free): Delete.
 973         (region_model::impl_call_malloc): Delete.
 974         (region_model::impl_call_memcpy): Delete.
 975         (region_model::impl_call_memset): Delete.
 976         (region_model::impl_call_realloc): Delete.
 977         (region_model::impl_call_strchr): Delete.
 978         (region_model::impl_call_strcpy): Delete.
 979         (region_model::impl_call_strlen): Delete.
 980         (region_model::impl_call_va_start): Delete.
 981         (region_model::impl_call_va_copy): Delete.
 982         (region_model::impl_call_va_arg): Delete.
 983         (region_model::impl_call_va_end): Delete.
 984         (region_model::check_region_for_write): Public.
 985         (region_model::get_known_function): Add "cd" param.  Add
 986         overloaded decl taking enum internal_fn.
 987         * sm-malloc.cc: Update comments.
 988         * varargs.cc (class kf_va_start): New.
 989         (region_model::impl_call_va_start): Convert to...
 990         (kf_va_start::impl_call_pre): ...this.
 991         (class kf_va_copy): New.
 992         (region_model::impl_call_va_copy): Convert to...
 993         (kf_va_copy::impl_call_pre): ...this.
 994         (class kf_va_arg): New.
 995         (region_model::impl_call_va_arg): Convert to...
 996         (kf_va_arg::impl_call_pre): ...this.
 997         (class kf_va_end): New.
 998         (region_model::impl_call_va_end): Delete.
 999         (register_varargs_builtins): New.
1000
1001 2022-11-22  David Malcolm  <dmalcolm@redhat.com>
1002
1003         PR analyzer/107788
1004         * region-model.cc (region_model::update_for_int_cst_return):
1005         Require that the return type be an integer type.
1006         (region_model::update_for_nonzero_return): Likewise.
1007
1008 2022-11-22  David Malcolm  <dmalcolm@redhat.com>
1009
1010         PR analyzer/107783
1011         * region-model-impl-calls.cc (kf_accept::matches_call_types_p):
1012         Require that args 1 and 2 be pointers.
1013         (kf_bind::matches_call_types_p): Require that arg 1 be a pointer.
1014         * region-model.h (call_details::arg_is_pointer_p): New
1015
1016 2022-11-22  David Malcolm  <dmalcolm@redhat.com>
1017
1018         PR analyzer/107777
1019         * call-summary.cc
1020         (call_summary_replay::convert_region_from_summary_1): Handle
1021         RK_THREAD_LOCAL and RK_ERRNO in switch.
1022         * region-model.cc (region_model::get_representative_path_var_1):
1023         Likewise.
1024
1025 2022-11-19  David Malcolm  <dmalcolm@redhat.com>
1026
1027         PR analyzer/107582
1028         * engine.cc (dynamic_call_info_t::update_model): Update the model
1029         by pushing or pop a frame, rather than by clobbering it with the
1030         model from the exploded_node's state.
1031
1032 2022-11-18  David Malcolm  <dmalcolm@redhat.com>
1033
1034         * analyzer.cc (is_pipe_call_p): Delete.
1035         * analyzer.h (is_pipe_call_p): Delete.
1036         * region-model-impl-calls.cc (call_details::get_location): New.
1037         (class kf_analyzer_break): New, adapted from
1038         region_model::on_stmt_pre.
1039         (region_model::impl_call_analyzer_describe): Convert to...
1040         (class kf_analyzer_describe): ...this.
1041         (region_model::impl_call_analyzer_dump_capacity): Convert to...
1042         (class kf_analyzer_dump_capacity): ...this.
1043         (region_model::impl_call_analyzer_dump_escaped): Convert to...
1044         (class kf_analyzer_dump_escaped): ...this.
1045         (class kf_analyzer_dump_exploded_nodes): New.
1046         (region_model::impl_call_analyzer_dump_named_constant): Convert
1047         to...
1048         (class kf_analyzer_dump_named_constant): ...this.
1049         (class dump_path_diagnostic): Move here from region-model.cc.
1050         (class kf_analyzer_dump_path) New, adapted from
1051         region_model::on_stmt_pre.
1052         (class kf_analyzer_dump_region_model): Likewise.
1053         (region_model::impl_call_analyzer_eval): Convert to...
1054         (class kf_analyzer_eval): ...this.
1055         (region_model::impl_call_analyzer_get_unknown_ptr): Convert to...
1056         (class kf_analyzer_get_unknown_ptr): ...this.
1057         (class known_function_accept): Rename to...
1058         (class kf_accept): ...this.
1059         (class known_function_bind): Rename to...
1060         (class kf_bind): ...this.
1061         (class known_function_connect): Rename to...
1062         (class kf_connect): ...this.
1063         (region_model::impl_call_errno_location): Convert to...
1064         (class kf_errno_location): ...this.
1065         (class known_function_listen): Rename to...
1066         (class kf_listen): ...this.
1067         (region_model::impl_call_pipe): Convert to...
1068         (class kf_pipe): ...this.
1069         (region_model::impl_call_putenv): Convert to...
1070         (class kf_putenv): ...this.
1071         (region_model::impl_call_operator_new): Convert to...
1072         (class kf_operator_new): ...this.
1073         (region_model::impl_call_operator_delete): Convert to...
1074         (class kf_operator_delete): ...this.
1075         (class known_function_socket): Rename to...
1076         (class kf_socket): ...this.
1077         (register_known_functions): Rename param to KFM.  Break out
1078         existing known functions into a "POSIX" section, and add "pipe",
1079         "pipe2", and "putenv".  Add debugging functions
1080         "__analyzer_break", "__analyzer_describe",
1081         "__analyzer_dump_capacity", "__analyzer_dump_escaped",
1082         "__analyzer_dump_exploded_nodes",
1083         "__analyzer_dump_named_constant", "__analyzer_dump_path",
1084         "__analyzer_dump_region_model", "__analyzer_eval",
1085         "__analyzer_get_unknown_ptr".  Add C++ support functions
1086         "operator new", "operator new []", "operator delete", and
1087         "operator delete []".
1088         * region-model.cc (class dump_path_diagnostic): Move to
1089         region-model-impl-calls.cc.
1090         (region_model::on_stmt_pre): Eliminate special-casing of
1091         "__analyzer_describe", "__analyzer_dump_capacity",
1092         "__analyzer_dump_escaped", "__analyzer_dump_named_constant",
1093         "__analyzer_dump_path", "__analyzer_dump_region_model",
1094         "__analyzer_eval", "__analyzer_break",
1095         "__analyzer_dump_exploded_nodes", "__analyzer_get_unknown_ptr",
1096         "__errno_location", "pipe", "pipe2", "putenv", "operator new",
1097         "operator new []", "operator delete", "operator delete []"
1098         "pipe" and "pipe2", handling them instead via the known_functions
1099         mechanism.
1100         * region-model.h (call_details::get_location): New decl.
1101         (region_model::impl_call_analyzer_describe): Delete decl.
1102         (region_model::impl_call_analyzer_dump_capacity): Delete decl.
1103         (region_model::impl_call_analyzer_dump_escaped): Delete decl.
1104         (region_model::impl_call_analyzer_dump_named_constant): Delete decl.
1105         (region_model::impl_call_analyzer_eval): Delete decl.
1106         (region_model::impl_call_analyzer_get_unknown_ptr): Delete decl.
1107         (region_model::impl_call_errno_location): Delete decl.
1108         (region_model::impl_call_pipe): Delete decl.
1109         (region_model::impl_call_putenv): Delete decl.
1110         (region_model::impl_call_operator_new): Delete decl.
1111         (region_model::impl_call_operator_delete): Delete decl.
1112         * sm-fd.cc: Update comments.
1113
1114 2022-11-16  David Malcolm  <dmalcolm@redhat.com>
1115
1116         PR analyzer/107711
1117         * analyzer-language.cc: Include "diagnostic.h".
1118         (maybe_stash_named_constant): Add logger param and use it to log
1119         the name being looked up, and the result.
1120         (stash_named_constants): New, splitting out from...
1121         (on_finish_translation_unit): ...this function.  Call
1122         get_or_create_logfile and use the result to create a logger
1123         instance, passing it to stash_named_constants.
1124         * analyzer.h (get_or_create_any_logfile): New decl.
1125         * engine.cc (dump_fout, owns_dump_fout): New globals, split out
1126         from run_checkers.
1127         (get_or_create_any_logfile): New function, split out from...
1128         (run_checkers): ...here, so that the logfile can be opened by
1129         on_finish_translation_unit.  Clear the globals when closing the
1130         dump file.
1131
1132 2022-11-16  David Malcolm  <dmalcolm@redhat.com>
1133
1134         * analyzer.h (known_function::matches_call_types_p): New vfunc.
1135         (known_function::impl_call_pre): Provide base implementation.
1136         (known_function::impl_call_post): New vfunc.
1137         (register_known_functions): New.
1138         * engine.cc (impl_run_checkers): Call register_known_functions.
1139         * region-model-impl-calls.cc (region_model::impl_call_accept):
1140         Convert to...
1141         (class known_function_accept): ...this.
1142         (region_model::impl_call_bind): Convert to...
1143         (class known_function_bind): ...this.
1144         (region_model::impl_call_connect): Convert to...
1145         (class known_function_connect): ...this.
1146         (region_model::impl_call_listen): Convert to...
1147         (class known_function_listen): ...this.
1148         (region_model::impl_call_socket): Convert to...
1149         (class known_function_socket): ...this.
1150         (register_known_functions): New.
1151         * region-model.cc (region_model::on_call_pre): Remove special
1152         case for "bind" in favor of the known_function-handling dispatch.
1153         Add call to known_function::matches_call_types_p to latter.
1154         (region_model::on_call_post): Remove special cases for "accept",
1155         "bind", "connect", "listen", and "socket" in favor of dispatch
1156         to known_function::impl_call_post.
1157         * region-model.h (region_model::impl_call_accept): Delete decl.
1158         (region_model::impl_call_bind): Delete decl.
1159         (region_model::impl_call_connect): Delete decl.
1160         (region_model::impl_call_listen): Delete decl.
1161         (region_model::impl_call_socket): Delete decl.
1162         * sm-fd.cc: Update comments.
1163
1164 2022-11-16  David Malcolm  <dmalcolm@redhat.com>
1165
1166         * checker-event.cc: New file, split out from...
1167         * checker-path.cc: ...this file.
1168
1169 2022-11-15  David Malcolm  <dmalcolm@redhat.com>
1170
1171         PR analyzer/106140
1172         * analyzer-language.cc (on_finish_translation_unit): Stash named
1173         constants "SOCK_STREAM" and "SOCK_DGRAM".
1174         * analyzer.opt (Wanalyzer-fd-phase-mismatch): New.
1175         (Wanalyzer-fd-type-mismatch): New.
1176         * engine.cc (impl_region_model_context::get_state_map_by_name):
1177         Add "out_sm_context" param.  Allow out_sm_idx to be NULL.
1178         * exploded-graph.h
1179         (impl_region_model_context::get_state_map_by_name):
1180         Add "out_sm_context" param.
1181         * region-model-impl-calls.cc (region_model::impl_call_accept): New.
1182         (region_model::impl_call_bind): New.
1183         (region_model::impl_call_connect): New.
1184         (region_model::impl_call_listen): New.
1185         (region_model::impl_call_socket): New.
1186         * region-model.cc (region_model::on_call_pre): Special-case
1187         "bind".
1188         (region_model::on_call_post): Special-case "accept", "bind",
1189         "connect", "listen", and "socket".
1190         * region-model.h (region_model::impl_call_accept): New decl.
1191         (region_model::impl_call_bind): New decl.
1192         (region_model::impl_call_connect): New decl.
1193         (region_model::impl_call_listen): New decl.
1194         (region_model::impl_call_socket): New decl.
1195         (region_model::on_socket): New decl.
1196         (region_model::on_bind): New decl.
1197         (region_model::on_listen): New decl.
1198         (region_model::on_accept): New decl.
1199         (region_model::on_connect): New decl.
1200         (region_model::add_constraint): Make public.
1201         (region_model::check_for_poison): Make public.
1202         (region_model_context::get_state_map_by_name): Add out_sm_context param.
1203         (region_model_context::get_fd_map): Likewise.
1204         (region_model_context::get_malloc_map): Likewise.
1205         (region_model_context::get_taint_map): Likewise.
1206         (noop_region_model_context::get_state_map_by_name): Likewise.
1207         (region_model_context_decorator::get_state_map_by_name): Likewise.
1208         * sm-fd.cc: Include "analyzer/supergraph.h" and
1209         "analyzer/analyzer-language.h".
1210         (enum expected_phase): New enum.
1211         (fd_state_machine::m_new_datagram_socket): New.
1212         (fd_state_machine::m_new_stream_socket): New.
1213         (fd_state_machine::m_new_unknown_socket): New.
1214         (fd_state_machine::m_bound_datagram_socket): New.
1215         (fd_state_machine::m_bound_stream_socket): New.
1216         (fd_state_machine::m_bound_unknown_socket): New.
1217         (fd_state_machine::m_listening_stream_socket): New.
1218         (fd_state_machine::m_m_connected_stream_socket): New.
1219         (fd_state_machine::m_SOCK_STREAM): New.
1220         (fd_state_machine::m_SOCK_DGRAM): New.
1221         (fd_diagnostic::describe_state_change): Handle socket states.
1222         (fd_diagnostic::get_meaning_for_state_change): Likewise.
1223         (class fd_phase_mismatch): New.
1224         (enum expected_type): New enum.
1225         (class fd_type_mismatch): New.
1226         (fd_state_machine::fd_state_machine): Initialize new states and
1227         stashed named constants.
1228         (fd_state_machine::is_socket_fd_p): New.
1229         (fd_state_machine::is_datagram_socket_fd_p): New.
1230         (fd_state_machine::is_stream_socket_fd_p): New.
1231         (fd_state_machine::on_close): Handle the socket states.
1232         (fd_state_machine::check_for_open_fd): Complain about fncalls on
1233         sockets in the wrong phase.  Support socket FDs.
1234         (add_constraint_ge_zero): New.
1235         (fd_state_machine::get_state_for_socket_type): New.
1236         (fd_state_machine::on_socket): New.
1237         (fd_state_machine::check_for_socket_fd): New.
1238         (fd_state_machine::check_for_new_socket_fd): New.
1239         (fd_state_machine::on_bind): New.
1240         (fd_state_machine::on_listen): New.
1241         (fd_state_machine::on_accept): New.
1242         (fd_state_machine::on_connect): New.
1243         (fd_state_machine::can_purge_p): Don't purge socket values.
1244         (get_fd_state): New.
1245         (region_model::mark_as_valid_fd): Use get_fd_state.
1246         (region_model::on_socket): New.
1247         (region_model::on_bind): New.
1248         (region_model::on_listen): New.
1249         (region_model::on_accept): New.
1250         (region_model::on_connect): New.
1251         * sm-fd.dot: Update to reflect sm-fd.cc changes.
1252
1253 2022-11-15  David Malcolm  <dmalcolm@redhat.com>
1254
1255         PR analyzer/106302
1256         * analyzer-language.cc: New file.
1257         * analyzer-language.h: New file.
1258         * analyzer.h (get_stashed_constant_by_name): New decl.
1259         (log_stashed_constants): New decl.
1260         * engine.cc (impl_run_checkers): Call log_stashed_constants.
1261         * region-model-impl-calls.cc
1262         (region_model::impl_call_analyzer_dump_named_constant): New.
1263         * region-model.cc (region_model::on_stmt_pre): Handle
1264         __analyzer_dump_named_constant.
1265         * region-model.h
1266         (region_model::impl_call_analyzer_dump_named_constant): New decl.
1267         * sm-fd.cc (fd_state_machine::m_O_ACCMODE): New.
1268         (fd_state_machine::m_O_RDONLY): New.
1269         (fd_state_machine::m_O_WRONLY): New.
1270         (fd_state_machine::fd_state_machine): Initialize the new fields.
1271         (fd_state_machine::get_access_mode_from_flag): Use the new fields,
1272         rather than using the host values.
1273
1274 2022-11-13  David Malcolm  <dmalcolm@redhat.com>
1275
1276         PR analyzer/106235
1277         * analyzer.opt (Wanalyzer-tainted-assertion): New.
1278         * checker-path.cc (checker_path::fixup_locations): Pass false to
1279         pending_diagnostic::fixup_location.
1280         * diagnostic-manager.cc (get_emission_location): Pass true to
1281         pending_diagnostic::fixup_location.
1282         * pending-diagnostic.cc (pending_diagnostic::fixup_location): Add
1283         bool param.
1284         * pending-diagnostic.h (pending_diagnostic::fixup_location): Add
1285         bool param to decl.
1286         * sm-taint.cc (taint_state_machine::m_tainted_control_flow): New.
1287         (taint_diagnostic::describe_state_change): Drop "final".
1288         (class tainted_assertion): New.
1289         (taint_state_machine::taint_state_machine): Initialize
1290         m_tainted_control_flow.
1291         (taint_state_machine::alt_get_inherited_state): Support
1292         comparisons being tainted, based on their arguments.
1293         (is_assertion_failure_handler_p): New.
1294         (taint_state_machine::on_stmt): Complain about calls to assertion
1295         failure handlers guarded by an attacker-controller conditional.
1296         Detect attacker-controlled gcond conditionals and gswitch index
1297         values.
1298         (taint_state_machine::check_control_flow_arg_for_taint): New.
1299
1300 2022-11-11  David Malcolm  <dmalcolm@redhat.com>
1301
1302         * sm-fd.dot: Fix typo in comment.
1303         * sm-file.dot: New file.
1304         * varargs.cc: Fix typo in comment.
1305         * varargs.dot: New file.
1306
1307 2022-11-11  David Malcolm  <dmalcolm@redhat.com>
1308
1309         * checker-path.h: Split out checker_event and its subclasses to...
1310         * checker-event.h: ...this new header.
1311
1312 2022-11-11  David Malcolm  <dmalcolm@redhat.com>
1313
1314         PR analyzer/106147
1315         * analyzer.opt (Wanalyzer-infinite-recursion): New.
1316         * call-string.cc (call_string::count_occurrences_of_function):
1317         New.
1318         * call-string.h (call_string::count_occurrences_of_function): New
1319         decl.
1320         * checker-path.cc (function_entry_event::function_entry_event):
1321         New ctor.
1322         (checker_path::add_final_event): Delete.
1323         * checker-path.h (function_entry_event::function_entry_event): New
1324         ctor.
1325         (function_entry_event::get_desc): Drop "final".
1326         (checker_path::add_final_event): Delete.
1327         * diagnostic-manager.cc
1328         (diagnostic_manager::emit_saved_diagnostic): Create the final
1329         event via a new pending_diagnostic::add_final_event vfunc, rather
1330         than checker_path::add_final_event.
1331         (diagnostic_manager::add_events_for_eedge): Create function entry
1332         events via a new pending_diagnostic::add_function_entry_event
1333         vfunc.
1334         * engine.cc (exploded_graph::process_node): When creating a new
1335         PK_BEFORE_SUPERNODE node, call
1336         exploded_graph::detect_infinite_recursion on it after adding the
1337         in-edge.
1338         * exploded-graph.h (exploded_graph::detect_infinite_recursion):
1339         New decl.
1340         (exploded_graph::find_previous_entry_to): New decl.
1341         * infinite-recursion.cc: New file.
1342         * pending-diagnostic.cc
1343         (pending_diagnostic::add_function_entry_event): New.
1344         (pending_diagnostic::add_final_event): New.
1345         * pending-diagnostic.h
1346         (pending_diagnostic::add_function_entry_event): New vfunc.
1347         (pending_diagnostic::add_final_event): New vfunc.
1348
1349 2022-11-10  David Malcolm  <dmalcolm@redhat.com>
1350
1351         PR analyzer/99671
1352         * analyzer.opt (Wanalyzer-deref-before-check): New warning.
1353         * diagnostic-manager.cc
1354         (null_assignment_sm_context::set_next_state): Only add state
1355         change events for transition to "null" state.
1356         (null_assignment_sm_context::is_transition_to_null): New.
1357         * engine.cc (impl_region_model_context::on_pop_frame): New.
1358         * exploded-graph.h (impl_region_model_context::on_pop_frame): New
1359         decl.
1360         * program-state.cc (sm_state_map::clear_any_state): New.
1361         (sm_state_map::can_merge_with_p): New.
1362         (program_state::can_merge_with_p): Replace requirement that
1363         sm-states be equal in favor of an attempt to merge them.
1364         * program-state.h (sm_state_map::clear_any_state): New decl.
1365         (sm_state_map::can_merge_with_p): New decl.
1366         * region-model.cc (region_model::eval_condition): Make const.
1367         (region_model::pop_frame): Call ctxt->on_pop_frame.
1368         * region-model.h (region_model::eval_condition): Make const.
1369         (region_model_context::on_pop_frame): New vfunc.
1370         (noop_region_model_context::on_pop_frame): New.
1371         (region_model_context_decorator::on_pop_frame): New.
1372         * sm-malloc.cc (enum resource_state): Add RS_ASSUMED_NON_NULL.
1373         (allocation_state::dump_to_pp): Drop "final".
1374         (struct assumed_non_null_state): New subclass.
1375         (malloc_state_machine::m_assumed_non_null): New.
1376         (assumed_non_null_p): New.
1377         (class deref_before_check): New.
1378         (assumed_non_null_state::dump_to_pp): New.
1379         (malloc_state_machine::get_or_create_assumed_non_null_state_for_frame):
1380         New.
1381         (malloc_state_machine::maybe_assume_non_null): New.
1382         (malloc_state_machine::on_stmt): Transition from start state to
1383         "assumed-non-null" state for pointers passed to
1384         __attribute__((nonnull)) arguments, and for pointers explicitly
1385         dereferenced.  Call maybe_complain_about_deref_before_check for
1386         pointers explicitly compared against NULL.
1387         (malloc_state_machine::maybe_complain_about_deref_before_check):
1388         New.
1389         (malloc_state_machine::on_deallocator_call): Also transition
1390         "assumed-non-null" states to "freed".
1391         (malloc_state_machine::on_pop_frame): New.
1392         (malloc_state_machine::maybe_get_merged_states_nonequal): New.
1393         * sm-malloc.dot: Update for changes to sm-malloc.cc.
1394         * sm.h (state_machine::on_pop_frame): New.
1395         (state_machine::maybe_get_merged_state): New.
1396         (state_machine::maybe_get_merged_states_nonequal): New.
1397
1398 2022-11-09  David Malcolm  <dmalcolm@redhat.com>
1399
1400         * checker-path.cc (checker_event::debug): New.
1401         (checker_path::add_event): Move here from checker-path.h.  Add
1402         logging.
1403         * checker-path.h (checker_event::debug): New decl.
1404         (checker_path::checker_path): Add logger param.
1405         (checker_path::add_event): Move definition from here to
1406         checker-path.cc.
1407         (checker_path::m_logger): New field.
1408         * diagnostic-manager.cc
1409         (diagnostic_manager::emit_saved_diagnostic): Pass logger to
1410         checker_path ctor.
1411         (diagnostic_manager::add_events_for_eedge): Log scope when
1412         processing a run of stmts.
1413
1414 2022-11-08  David Malcolm  <dmalcolm@redhat.com>
1415
1416         PR analyzer/101962
1417         * region-model-impl-calls.cc: Update comment.
1418         * region-model.cc (region_model::check_symbolic_bounds): Fix
1419         layout of "void" return.  Replace usage of
1420         eval_condition_without_cm with eval_condition.
1421         (region_model::eval_condition): Take over body of...
1422         (region_model::eval_condition_without_cm): ...this subroutine,
1423         dropping the latter.  Eliminating this distinction avoids issues
1424         where constraints were not considered when recursing.
1425         (region_model::compare_initial_and_pointer): Update comment.
1426         (region_model::symbolic_greater_than): Replace usage of
1427         eval_condition_without_cm with eval_condition.
1428         * region-model.h
1429         (region_model::eval_condition_without_cm): Delete decl.
1430
1431 2022-11-08  David Malcolm  <dmalcolm@redhat.com>
1432
1433         * region-model-impl-calls.cc
1434         (region_model::impl_call_errno_location): New.
1435         * region-model-manager.cc
1436         (region_model_manager::region_model_manager): Initialize
1437         m_thread_local_region and m_errno_region.
1438         * region-model-manager.h (region_model_manager::get_errno_region):
1439         New accessor.
1440         (region_model_manager::m_thread_local_region): New.
1441         (region_model_manager::m_errno_region): New.
1442         * region-model.cc (region_model::on_call_pre): Special-case
1443         "__errno_location".
1444         (region_model::set_errno): New.
1445         * region-model.h (impl_call_errno_location): New decl.
1446         (region_model::set_errno): New decl.
1447         * region.cc (thread_local_region::dump_to_pp): New.
1448         (errno_region::dump_to_pp): New.
1449         * region.h (enum memory_space): Add MEMSPACE_THREAD_LOCAL.
1450         (enum region_kind): Add RK_THREAD_LOCAL and RK_ERRNO.
1451         (class thread_local_region): New.
1452         (is_a_helper <const thread_local_region *>::test): New.
1453         (class errno_region): New.
1454         (is_a_helper <const errno_region *>::test): New.
1455         * store.cc (binding_cluster::escaped_p): New.
1456         (store::escaped_p): Treat errno as always having escaped.
1457         (store::replay_call_summary_cluster): Handle RK_THREAD_LOCAL and
1458         RK_ERRNO.
1459         * store.h (binding_cluster::escaped_p): Remove definition.
1460
1461 2022-11-08  David Malcolm  <dmalcolm@redhat.com>
1462
1463         * call-info.cc (success_call_info::get_desc): Delete.
1464         (failed_call_info::get_desc): Likewise.
1465         (succeed_or_fail_call_info::get_desc): New.
1466         * call-info.h (class succeed_or_fail_call_info): New.
1467         (class success_call_info): Convert to a subclass of
1468         succeed_or_fail_call_info.
1469         (class failed_call_info): Likewise.
1470
1471 2022-11-08  David Malcolm  <dmalcolm@redhat.com>
1472
1473         * region-model-impl-calls.cc (region_model::impl_call_strchr):
1474         Move to on_call_post.  Handle both outcomes using bifurcation,
1475         rather than just the "not found" case.
1476         * region-model.cc (region_model::on_call_pre): Move
1477         BUILT_IN_STRCHR and "strchr" to...
1478         (region_model::on_call_post): ...here.
1479
1480 2022-11-03  David Malcolm  <dmalcolm@redhat.com>
1481
1482         * analyzer.h: Use std::unique_ptr for state machines from plugins.
1483         * engine.cc: Likewise.
1484
1485 2022-11-03  David Malcolm  <dmalcolm@redhat.com>
1486
1487         * analyzer.h: Use std::unique_ptr for known functions.
1488         * engine.cc: Likewise.
1489         * known-function-manager.cc: Likewise.
1490         * known-function-manager.h: Likewise.
1491
1492 2022-11-03  David Malcolm  <dmalcolm@redhat.com>
1493
1494         * analysis-plan.cc: Define INCLUDE_MEMORY before including
1495         system.h.
1496         * analyzer-pass.cc: Likewise.
1497         * analyzer-selftests.cc: Likewise.
1498         * analyzer.cc: Likewise.
1499         * analyzer.h: Use std::unique_ptr in bifurcation code.
1500         * call-string.cc: Define INCLUDE_MEMORY before including system.h.
1501         * complexity.cc: Likewise.
1502         * engine.cc: Use std::unique_ptr in bifurcation code.
1503         * exploded-graph.h: Likewise.
1504         * known-function-manager.cc: Define INCLUDE_MEMORY before
1505         including system.h.
1506         * region-model-impl-calls.cc: Use std::unique_ptr in bifurcation
1507         code.
1508         * region-model.cc: Likewise.
1509         * region-model.h: Likewise.
1510         * supergraph.cc: Define INCLUDE_MEMORY before including system.h.
1511
1512 2022-11-03  David Malcolm  <dmalcolm@redhat.com>
1513
1514         * call-info.cc: Use std::unique_ptr for checker_event.
1515         * checker-path.cc: Likewise.
1516         * checker-path.h: Likewise.
1517         * diagnostic-manager.cc: Likewise.
1518         * engine.cc: Likewise.
1519         * pending-diagnostic.cc: Likewise.
1520         * sm-signal.cc: Likewise.
1521         * varargs.cc: Likewise.
1522
1523 2022-11-03  David Malcolm  <dmalcolm@redhat.com>
1524
1525         * diagnostic-manager.cc: Include "make-unique.h".
1526         Use std::unique_ptr for feasibility_problems and exploded_path.
1527         Delete explicit saved_diagnostic dtor.
1528         * diagnostic-manager.h: Likewise.
1529         * engine.cc: Likewise.
1530         * exploded-graph.h: Likewise.
1531         * feasible-graph.cc: Likewise.
1532         * feasible-graph.h: Likewise.
1533
1534 2022-11-03  David Malcolm  <dmalcolm@redhat.com>
1535
1536         * checker-path.cc (rewind_event::rewind_event): Update for usage of
1537         std::unique_ptr on custom_edge_info.
1538         * engine.cc (exploded_node::on_longjmp): Likewise.
1539         (exploded_edge::exploded_edge): Likewise.
1540         (exploded_edge::~exploded_edge): Delete.
1541         (exploded_graph::add_function_entry): Update for usage of
1542         std::unique_ptr on custom_edge_info.
1543         (exploded_graph::add_edge): Likewise.
1544         (add_tainted_args_callback): Likewise.
1545         (exploded_graph::maybe_create_dynamic_call): Likewise.
1546         (exploded_graph::process_node): Likewise.
1547         * exploded-graph.h (exploded_edge::~exploded_edge): Delete.
1548         (exploded_edge::m_custom_info): Use std::unique_ptr.
1549         (exploded_edge::add_edge): Likewise.
1550         * sm-signal.cc (register_signal_handler::impl_transition): Use
1551         make_unique.
1552
1553 2022-11-03  David Malcolm  <dmalcolm@redhat.com>
1554
1555         * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic): Make
1556         stmt_finder const.
1557         (saved_diagnostic::~saved_diagnostic): Remove explicit delete of
1558         m_stmt_finder.
1559         (diagnostic_manager::add_diagnostic): Make stmt_finder const.
1560         * diagnostic-manager.h (saved_diagnostic::saved_diagnostic):
1561         Likewise.
1562         (saved_diagnostic::m_stmt_finder): Convert to std::unique_ptr.
1563         (diagnostic_manager::add_diagnostic): Make stmt_finder const.
1564         * engine.cc (impl_sm_context::impl_sm_context): Likewise.
1565         (impl_sm_context::m_stmt_finder): Likewise.
1566         (leak_stmt_finder::clone): Convert return type to std::unique_ptr.
1567         * exploded-graph.h (stmt_finder::clone): Likewise.
1568
1569 2022-11-03  David Malcolm  <dmalcolm@redhat.com>
1570
1571         * call-info.cc: Add define of INCLUDE_MEMORY.
1572         * call-summary.cc: Likewise.
1573         * checker-path.cc: Likewise.
1574         * constraint-manager.cc: Likewise.
1575         * diagnostic-manager.cc: Likewise.
1576         (saved_diagnostic::saved_diagnostic): Use std::unique_ptr for
1577         param d and field m_d.
1578         (saved_diagnostic::~saved_diagnostic): Remove explicit delete of m_d.
1579         (saved_diagnostic::add_note): Use std::unique_ptr for
1580         param pn.
1581         (saved_diagnostic::get_pending_diagnostic): Update for conversion
1582         of m_sd.m_d to unique_ptr.
1583         (diagnostic_manager::add_diagnostic): Use std::unique_ptr for
1584         param d.  Remove explicit deletion.
1585         (diagnostic_manager::add_note): Use std::unique_ptr for param pn.
1586         (diagnostic_manager::emit_saved_diagnostic): Update for conversion
1587         of m_sd.m_d to unique_ptr.
1588         (null_assignment_sm_context::warn): Use std::unique_ptr for
1589         param d.  Remove explicit deletion.
1590         * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Use
1591         std::unique_ptr for param d.
1592         (saved_diagnostic::add_note): Likewise for param pn.
1593         (saved_diagnostic::m_d): Likewise.
1594         (diagnostic_manager::add_diagnostic): Use std::unique_ptr for
1595         param d.
1596         (diagnostic_manager::add_note): Use std::unique_ptr for param pn.
1597         * engine.cc: Include "make-unique.h".
1598         (impl_region_model_context::warn): Update to use std::unique_ptr
1599         for param, removing explicit deletion.
1600         (impl_region_model_context::add_note): Likewise.
1601         (impl_sm_context::warn): Update to use std::unique_ptr
1602         for param.
1603         (impl_region_model_context::on_state_leak): Likewise for result of
1604         on_leak.
1605         (exploded_node::on_longjmp): Use make_unique when creating
1606         pending_diagnostic.
1607         (exploded_graph::process_node): Likewise.
1608         * exploded-graph.h (impl_region_model_context::warn): Update to
1609         use std::unique_ptr for param.
1610         (impl_region_model_context::add_note): Likewise.
1611         * feasible-graph.cc: Add define of INCLUDE_MEMORY.
1612         * pending-diagnostic.cc: Likewise.
1613         * pending-diagnostic.h: Include analyzer.sm.h"
1614         * program-point.cc: Add define of INCLUDE_MEMORY.
1615         * program-state.cc: Likewise.
1616         * region-model-asm.cc: Likewise.
1617         * region-model-impl-calls.cc: Likewise.  Include "make-unique.h".
1618         (region_model::impl_call_putenv): Use make_unique when creating
1619         pending_diagnostic.
1620         * region-model-manager.cc: Add define of INCLUDE_MEMORY.
1621         * region-model-reachability.cc: Likewise.
1622         * region-model.cc: Likewise.  Include "make-unique.h".
1623         (region_model::get_gassign_result): Use make_unique when creating
1624         pending_diagnostic.
1625         (region_model::check_for_poison): Likewise.
1626         (region_model::on_stmt_pre): Likewise.
1627         (region_model::check_symbolic_bounds): Likewise.
1628         (region_model::check_region_bounds): Likewise.
1629         (annotating_ctxt: make_note): Use std::unique_ptr for result.
1630         (region_model::deref_rvalue): Use make_unique when creating
1631         pending_diagnostic.
1632         (region_model::check_for_writable_region): Likewise.
1633         (region_model::check_region_size): Likewise.
1634         (region_model::check_dynamic_size_for_floats): Likewise.
1635         (region_model::maybe_complain_about_infoleak): Likewise.
1636         (noop_region_model_context::add_note): Use std::unique_ptr for
1637         param.  Remove explicit deletion.
1638         * region-model.h: Include "analyzer/pending-diagnostic.h".
1639         (region_model_context::warn): Convert param to std::unique_ptr.
1640         (region_model_context::add_note): Likewise.
1641         (noop_region_model_context::warn): Likewise.
1642         (noop_region_model_context::add_note): Likewise.
1643         (region_model_context_decorator::warn): Likewise.
1644         (region_model_context_decorator::add_note): Likewise.
1645         (note_adding_context::warn): Likewise.
1646         (note_adding_context::make_note): Likewise for return type.
1647         (test_region_model_context::warn): Convert param to
1648         std::unique_ptr.
1649         * region.cc: Add define of INCLUDE_MEMORY.
1650         * sm-fd.cc: Likewise.  Include "make-unique.h".
1651         (fd_state_machine::check_for_fd_attrs): Use make_unique when
1652         creating pending_diagnostics.
1653         (fd_state_machine::on_open): Likewise.
1654         (fd_state_machine::on_creat): Likewise.
1655         (fd_state_machine::check_for_dup): Likewise.
1656         (fd_state_machine::on_close): Likewise.
1657         (fd_state_machine::check_for_open_fd): Likewise.
1658         (fd_state_machine::on_leak): Likewise, converting return type to
1659         std::unique_ptr.
1660         * sm-file.cc: Add define of INCLUDE_MEMORY.  Include
1661         "make-unique.h".
1662         (fileptr_state_machine::on_stmt): Use make_unique when creating
1663         pending_diagnostic.
1664         (fileptr_state_machine::on_leak): Likewise, converting return type
1665         to std::unique_ptr.
1666         * sm-malloc.cc: Add define of INCLUDE_MEMORY.  Include
1667         "make-unique.h".
1668         (malloc_state_machine::on_stmt): Use make_unique when creating
1669         pending_diagnostic.
1670         (malloc_state_machine::handle_free_of_non_heap): Likewise.
1671         (malloc_state_machine::on_deallocator_call): Likewise.
1672         (malloc_state_machine::on_realloc_call): Likewise.
1673         (malloc_state_machine::on_leak): Likewise, converting return type
1674         to std::unique_ptr.
1675         * sm-pattern-test.cc: Add define of INCLUDE_MEMORY.  Include
1676         "make-unique.h".
1677         (pattern_test_state_machine::on_condition): Use make_unique when
1678         creating pending_diagnostic.
1679         * sm-sensitive.cc: Add define of INCLUDE_MEMORY.  Include
1680         "make-unique.h".
1681         (sensitive_state_machine::warn_for_any_exposure): Use make_unique
1682         when creating pending_diagnostic.
1683         * sm-signal.cc: Add define of INCLUDE_MEMORY.  Include
1684         "make-unique.h".
1685         (signal_state_machine::on_stmt): Use make_unique when creating
1686         pending_diagnostic.
1687         * sm-taint.cc: Add define of INCLUDE_MEMORY.  Include
1688         "make-unique.h".
1689         (taint_state_machine::check_for_tainted_size_arg): Use make_unique
1690         when creating pending_diagnostic.
1691         (taint_state_machine::check_for_tainted_divisor): Likewise.
1692         (region_model::check_region_for_taint): Likewise.
1693         (region_model::check_dynamic_size_for_taint): Likewise.
1694         * sm.cc: Add define of INCLUDE_MEMORY.  Include
1695         "analyzer/pending-diagnostic.h".
1696         (state_machine::on_leak): Move here from sm.h, changing return
1697         type to std::unique_ptr.
1698         * sm.h (state_machine::on_leak): Change return type to
1699         std::unique_ptr.  Move defn of base impl to sm.cc
1700         (sm_context::warn): Convert param d to std_unique_ptr.
1701         * state-purge.cc: Add define of INCLUDE_MEMORY.
1702         * store.cc: Likewise.
1703         * svalue.cc: Likewise.
1704         * trimmed-graph.cc: Likewise.
1705         * varargs.cc: Likewise.  Include "make-unique.h".
1706         (va_list_state_machine::check_for_ended_va_list): Use make_unique
1707         when creating pending_diagnostic.
1708         (va_list_state_machine::on_leak): Likewise, converting return type
1709         to std::unique_ptr.
1710         (region_model::impl_call_va_arg): Use make_unique when creating
1711         pending_diagnostic.
1712
1713 2022-11-03  David Malcolm  <dmalcolm@redhat.com>
1714
1715         PR analyzer/107486
1716         * analyzer.cc (is_pipe_call_p): New.
1717         * analyzer.h (is_pipe_call_p): New decl.
1718         * region-model.cc (region_model::on_call_pre): Use it.
1719         (region_model::on_call_post): Likewise.
1720
1721 2022-10-26  David Malcolm  <dmalcolm@redhat.com>
1722
1723         * sm-fd.cc (fd_state_machine::on_open): Transition to "unchecked"
1724         when the mode is symbolic, rather than just on integer constants.
1725         (fd_state_machine::check_for_open_fd): Don't complain about
1726         unchecked values in the start state.
1727
1728 2022-10-26  David Malcolm  <dmalcolm@redhat.com>
1729
1730         * sm-fd.dot: New file.
1731
1732 2022-10-24  David Malcolm  <dmalcolm@redhat.com>
1733
1734         PR analyzer/107349
1735         * varargs.cc (get_va_copy_arg): Fix the non-pointer case.
1736
1737 2022-10-24  David Malcolm  <dmalcolm@redhat.com>
1738
1739         PR analyzer/107345
1740         * region-model.cc (region_model::eval_condition_without_cm):
1741         Ensure that constants are on the right-hand side before checking
1742         for them.
1743
1744 2022-10-24  David Malcolm  <dmalcolm@redhat.com>
1745
1746         * engine.cc (impl_region_model_context::get_malloc_map): Replace
1747         with...
1748         (impl_region_model_context::get_state_map_by_name): ...this.
1749         (impl_region_model_context::get_fd_map): Delete.
1750         (impl_region_model_context::get_taint_map): Delete.
1751         * exploded-graph.h (impl_region_model_context::get_fd_map):
1752         Delete.
1753         (impl_region_model_context::get_malloc_map): Delete.
1754         (impl_region_model_context::get_taint_map): Delete.
1755         (impl_region_model_context::get_state_map_by_name): New.
1756         * region-model.h (region_model_context::get_state_map_by_name):
1757         New vfunc.
1758         (region_model_context::get_fd_map): Convert from vfunc to
1759         function.
1760         (region_model_context::get_malloc_map): Likewise.
1761         (region_model_context::get_taint_map): Likewise.
1762         (noop_region_model_context::get_state_map_by_name): New.
1763         (noop_region_model_context::get_fd_map): Delete.
1764         (noop_region_model_context::get_malloc_map): Delete.
1765         (noop_region_model_context::get_taint_map): Delete.
1766         (region_model_context_decorator::get_state_map_by_name): New.
1767         (region_model_context_decorator::get_fd_map): Delete.
1768         (region_model_context_decorator::get_malloc_map): Delete.
1769         (region_model_context_decorator::get_taint_map): Delete.
1770
1771 2022-10-24  David Malcolm  <dmalcolm@redhat.com>
1772
1773         PR analyzer/106300
1774         * engine.cc (impl_region_model_context::get_fd_map): New.
1775         * exploded-graph.h (impl_region_model_context::get_fd_map): New
1776         decl.
1777         * region-model-impl-calls.cc (region_model::impl_call_pipe): New.
1778         * region-model.cc (region_model::update_for_int_cst_return): New,
1779         based on...
1780         (region_model::update_for_zero_return): ...this.  Reimplement in
1781         terms of the former.
1782         (region_model::on_call_pre): Handle "pipe" and "pipe2".
1783         (region_model::on_call_post): Likewise.
1784         * region-model.h (region_model::impl_call_pipe): New decl.
1785         (region_model::update_for_int_cst_return): New decl.
1786         (region_model::mark_as_valid_fd): New decl.
1787         (region_model_context::get_fd_map): New pure virtual fn.
1788         (noop_region_model_context::get_fd_map): New.
1789         (region_model_context_decorator::get_fd_map): New.
1790         * sm-fd.cc: Include "analyzer/program-state.h".
1791         (fd_state_machine::describe_state_change): Handle transitions from
1792         start state to valid states.
1793         (fd_state_machine::mark_as_valid_fd): New.
1794         (fd_state_machine::on_stmt): Add missing return for "creat".
1795         (region_model::mark_as_valid_fd): New.
1796
1797 2022-10-19  David Malcolm  <dmalcolm@redhat.com>
1798
1799         PR analyzer/105765
1800         * varargs.cc (get_BT_VALIST_ARG): Rename to...
1801         (get_va_copy_arg): ...this, and update logic for determining level
1802         of indirection of va_copy's argument to use type of argument,
1803         rather than looking at va_list_type_node, to correctly handle
1804         __builtin_ms_va_copy.
1805         (get_stateful_BT_VALIST_ARG): Rename to...
1806         (get_stateful_va_copy_arg): ...this.
1807         (va_list_state_machine::on_va_copy): Update for renaming.
1808         (region_model::impl_call_va_copy): Likewise.
1809
1810 2022-10-13  David Malcolm  <dmalcolm@redhat.com>
1811
1812         PR analyzer/107210
1813         * svalue.cc (constant_svalue::maybe_fold_bits_within): Only
1814         attempt to extract individual bits when tree_fits_uhwi_p.
1815
1816 2022-10-07  David Malcolm  <dmalcolm@redhat.com>
1817
1818         PR analyzer/105783
1819         * region-model.cc (selftest::get_bit): New function.
1820         (selftest::test_bits_within_svalue_folding): New.
1821         (selfftest::analyzer_region_model_cc_tests): Call it.
1822         * svalue.cc (constant_svalue::maybe_fold_bits_within): Handle the
1823         case of extracting a single bit.
1824
1825 2022-10-06  David Malcolm  <dmalcolm@redhat.com>
1826
1827         PR analyzer/107158
1828         * store.cc (store::replay_call_summary_cluster): Eliminate
1829         special-casing of RK_HEAP_ALLOCATED in favor of sharing code with
1830         RK_DECL, avoiding an ICE due to attempting to bind a
1831         compound_svalue into a binding_cluster when an svalue in the
1832         summary cluster converts to a compound_svalue in the caller.
1833
1834 2022-10-06  David Malcolm  <dmalcolm@redhat.com>
1835
1836         * call-summary.cc (call_summary_replay::dump_to_pp): Bulletproof
1837         against NULL caller regions/svalues.
1838
1839 2022-10-05  David Malcolm  <dmalcolm@redhat.com>
1840
1841         * analysis-plan.cc: Simplify includes.
1842         * analyzer-pass.cc: Likewise.
1843         * analyzer-selftests.cc: Likewise.
1844         * analyzer.cc: Likewise.
1845         * analyzer.h: Add includes of "json.h" and "tristate.h".
1846         * call-info.cc: Simplify includes.
1847         * call-string.cc: Likewise.
1848         * call-summary.cc: Likewise.
1849         * checker-path.cc: Likewise.
1850         * complexity.cc: Likewise.
1851         * constraint-manager.cc: Likewise.
1852         * diagnostic-manager.cc: Likewise.
1853         * engine.cc: Likewise.
1854         * feasible-graph.cc: Likewise.
1855         * known-function-manager.cc: Likewise.
1856         * pending-diagnostic.cc: Likewise.
1857         * program-point.cc: Likewise.
1858         * program-state.cc: Likewise.
1859         * region-model-asm.cc: Likewise.
1860         * region-model-impl-calls.cc: Likewise.
1861         * region-model-manager.cc: Likewise.
1862         * region-model-reachability.cc: Likewise.
1863         * region-model.cc: Likewise.
1864         * region-model.h: Include "selftest.h".
1865         * region.cc: Simplify includes.
1866         * sm-fd.cc: Likewise.
1867         * sm-file.cc: Likewise.
1868         * sm-malloc.cc: Likewise.
1869         * sm-pattern-test.cc: Likewise.
1870         * sm-sensitive.cc: Likewise.
1871         * sm-signal.cc: Likewise.
1872         * sm-taint.cc: Likewise.
1873         * sm.cc: Likewise.
1874         * state-purge.cc: Likewise.
1875         * store.cc: Likewise.
1876         * store.h: Likewise.
1877         * supergraph.cc: Likewise.
1878         * svalue.cc: Likewise.
1879         * svalue.h: Likewise.
1880         * trimmed-graph.cc: Likewise.
1881         * varargs.cc: Likewise.
1882
1883 2022-10-05  David Malcolm  <dmalcolm@redhat.com>
1884
1885         PR analyzer/107060
1886         * call-summary.cc
1887         (call_summary_replay::convert_svalue_from_summary_1): Handle NULL
1888         results from convert_svalue_from_summary in SK_UNARY_OP and
1889         SK_BIN_OP.
1890         * engine.cc (impl_region_model_context::on_unknown_change): Bail
1891         out on svalues that can't have associated state.
1892         * region-model-impl-calls.cc
1893         (region_model::impl_call_analyzer_get_unknown_ptr): New.
1894         * region-model.cc (region_model::on_stmt_pre): Handle
1895         "__analyzer_get_unknown_ptr".
1896         * region-model.h
1897         (region_model::impl_call_analyzer_get_unknown_ptr): New decl.
1898         * store.cc (store::replay_call_summary_cluster): Avoid trying to
1899         create binding clusters for base regions that shouldn't have them.
1900
1901 2022-10-05  Martin Liska  <mliska@suse.cz>
1902
1903         * call-summary.cc (call_summary_replay::call_summary_replay):
1904         Remove unused variable and arguments.
1905         * call-summary.h: Likewise.
1906         * engine.cc (exploded_node::on_stmt): Likewise.
1907         (exploded_node::replay_call_summaries): Likewise.
1908         (exploded_node::replay_call_summary): Likewise.
1909         * exploded-graph.h (class exploded_node): Likewise.
1910
1911 2022-10-05  David Malcolm  <dmalcolm@redhat.com>
1912
1913         PR analyzer/107072
1914         * analyzer-logging.h: Include "diagnostic-core.h".
1915         * analyzer.h: Include "function.h".
1916         (class call_summary): New forward decl.
1917         (class call_summary_replay): New forward decl.
1918         (struct per_function_data): New forward decl.
1919         (struct interesting_t): New forward decl.
1920         (custom_edge_info::update_state): New vfunc.
1921         * call-info.cc (custom_edge_info::update_state): New.
1922         * call-summary.cc: New file.
1923         * call-summary.h: New file.
1924         * constraint-manager.cc: Include "analyzer/call-summary.h".
1925         (class replay_fact_visitor): New.
1926         (constraint_manager::replay_call_summary): New.
1927         * constraint-manager.h (constraint_manager::replay_call_summary):
1928         New.
1929         * engine.cc: Include "analyzer/call-summary.h".
1930         (exploded_node::on_stmt): Handle call summaries.
1931         (class call_summary_edge_info): New.
1932         (exploded_node::replay_call_summaries): New.
1933         (exploded_node::replay_call_summary): New.
1934         (per_function_data::~per_function_data): New.
1935         (per_function_data::add_call_summary): Move here from header and
1936         reimplement.
1937         (exploded_graph::process_node): Call update_state rather than
1938         update_model when handling bifurcation
1939         (viz_callgraph_node::dump_dot): Use a regular label rather
1940         than an HTML table; add summaries to dump.
1941         * exploded-graph.h: Include "alloc-pool.h", "fibonacci_heap.h",
1942         "supergraph.h", "sbitmap.h", "shortest-paths.h", "analyzer/sm.h",
1943         "analyzer/program-state.h", and "analyzer/diagnostic-manager.h".
1944         (exploded_node::replay_call_summaries): New decl.
1945         (exploded_node::replay_call_summary): New decl.
1946         (per_function_data::~per_function_data): New decl.
1947         (per_function_data::add_call_summary): Move implemention from
1948         header.
1949         (per_function_data::m_summaries): Update type of element.
1950         * known-function-manager.h: Include "analyzer/analyzer-logging.h".
1951         * program-point.h: Include "pretty-print.h" and
1952         "analyzer/call-string.h".
1953         * program-state.cc: Include "analyzer/call-summary.h".
1954         (sm_state_map::replay_call_summary): New.
1955         (program_state::replay_call_summary): New.
1956         * program-state.h (sm_state_map::replay_call_summary): New decl.
1957         (program_state::replay_call_summary): New decl.
1958         * region-model-manager.cc
1959         (region_model_manager::get_or_create_asm_output_svalue): New
1960         overload.
1961         * region-model-manager.h
1962         (region_model_manager::get_or_create_asm_output_svalue): New
1963         overload decl.
1964         * region-model.cc: Include "analyzer/call-summary.h".
1965         (region_model::maybe_update_for_edge): Remove call to
1966         region_model::update_for_call_summary on
1967         SUPEREDGE_INTRAPROCEDURAL_CALL.
1968         (region_model::update_for_call_summary): Delete.
1969         (region_model::replay_call_summary): New.
1970         * region-model.h (region_model::replay_call_summary): New decl.
1971         (region_model::update_for_call_summary): Delete decl.
1972         * store.cc: Include "analyzer/call-summary.h".
1973         (store::replay_call_summary): New.
1974         (store::replay_call_summary_cluster): New.
1975         * store.h: Include "tristate.h".
1976         (is_a_helper <const ana::concrete_binding *>::test): New.
1977         (store::replay_call_summary): New decl.
1978         (store::replay_call_summary_cluster): New decl.
1979         * supergraph.cc (get_ultimate_function_for_cgraph_edge): Remove
1980         "static" from decl.
1981         (supergraph_call_edge): Make stmt param const.
1982         * supergraph.h: Include "ordered-hash-map.h", "cfg.h",
1983         "basic-block.h", "gimple.h", "gimple-iterator.h", and "digraph.h".
1984         (supergraph_call_edge): Make stmt param const.
1985         (get_ultimate_function_for_cgraph_edge): New decl.
1986         * svalue.cc (compound_svalue::compound_svalue): Assert that we're
1987         not nesting compound_svalues.
1988         * svalue.h: Include "json.h", "analyzer/store.h", and
1989         "analyzer/program-point.h".
1990         (asm_output_svalue::get_num_outputs): New accessor.
1991
1992 2022-10-05  David Malcolm  <dmalcolm@redhat.com>
1993
1994         * region-model.h: Include "analyzer/region-model-manager.h"
1995         (class region_model_manager): Move decl to...
1996         * region-model-manager.h: ...this new file.
1997
1998 2022-10-05  David Malcolm  <dmalcolm@redhat.com>
1999
2000         * region-model-manager.cc
2001         (region_model_manager::maybe_fold_unaryop): Fold -(-(VAL)) to VAL.
2002
2003 2022-10-05  David Malcolm  <dmalcolm@redhat.com>
2004
2005         * region-model-manager.cc
2006         (region_model_manager::get_or_create_widening_svalue): Use a
2007         function_point rather than a program_point.
2008         * region-model.cc (selftest::test_widening_constraints): Likewise.
2009         * region-model.h
2010         (region_model_manager::get_or_create_widening_svalue): Likewise.
2011         (model_merger::get_function_point): New.
2012         * svalue.cc (svalue::can_merge_p): Use a function_point rather
2013         than a program_point.
2014         (svalue::can_merge_p): Likewise.
2015         * svalue.h (widening_svalue::key_t): Likewise.
2016         (widening_svalue::widening_svalue): Likewise.
2017
2018 2022-09-12  Martin Liska  <mliska@suse.cz>
2019
2020         * region-model.cc (region_model::maybe_complain_about_infoleak):
2021         Remove unused fields.
2022
2023 2022-09-11  Tim Lange  <mail@tim-lange.me>
2024
2025         PR analyzer/106845
2026         * region-model.cc (region_model::check_region_bounds):
2027         Bail out if 0 bytes were accessed.
2028         * store.cc (byte_range::dump_to_pp):
2029         Add special case for empty ranges.
2030         (byte_range::exceeds_p): Restrict to non-empty ranges.
2031         (byte_range::falls_short_of_p): Restrict to non-empty ranges.
2032         * store.h (bit_range::empty_p): New function.
2033         (bit_range::get_last_byte_offset): Restrict to non-empty ranges.
2034         (byte_range::empty_p): New function.
2035         (byte_range::get_last_byte_offset): Restrict to non-empty ranges.
2036
2037 2022-09-09  David Malcolm  <dmalcolm@redhat.com>
2038
2039         * analyzer.opt (Wanalyzer-exposure-through-uninit-copy): New.
2040         * checker-path.cc (region_creation_event::region_creation_event):
2041         Add "capacity" and "kind" params.
2042         (region_creation_event::get_desc): Generalize to different kinds
2043         of event.
2044         (checker_path::add_region_creation_event): Convert to...
2045         (checker_path::add_region_creation_events): ...this.
2046         * checker-path.h (enum rce_kind): New.
2047         (region_creation_event::region_creation_event): Add "capacity" and
2048         "kind" params.
2049         (region_creation_event::m_capacity): New field.
2050         (region_creation_event::m_rce_kind): New field.
2051         (checker_path::add_region_creation_event): Convert to...
2052         (checker_path::add_region_creation_events): ...this.
2053         * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
2054         Update for multiple region creation events.
2055         (diagnostic_manager::add_event_on_final_node): Likewise.
2056         (diagnostic_manager::add_events_for_eedge): Likewise.
2057         * region-model-impl-calls.cc (call_details::get_logger): New.
2058         * region-model.cc: Define INCLUDE_MEMORY before including
2059         "system.h".  Include "gcc-rich-location.h".
2060         (class record_layout): New.
2061         (class exposure_through_uninit_copy): New.
2062         (contains_uninit_p): New.
2063         (region_model::maybe_complain_about_infoleak): New.
2064         * region-model.h (call_details::get_logger): New decl.
2065         (region_model::maybe_complain_about_infoleak): New decl.
2066         (region_model::mark_as_tainted): New decl.
2067         * sm-taint.cc (region_model::mark_as_tainted): New.
2068
2069 2022-09-09  David Malcolm  <dmalcolm@redhat.com>
2070
2071         * analyzer.h (class known_function_manager): New forward decl.
2072         (class known_function): New.
2073         (plugin_analyzer_init_iface::register_known_function): New.
2074         * engine.cc: Include "analyzer/known-function-manager.h".
2075         (plugin_analyzer_init_impl::plugin_analyzer_init_impl): Add
2076         known_fn_mgr param.
2077         (plugin_analyzer_init_impl::register_state_machine): Add
2078         LOC_SCOPE.
2079         (plugin_analyzer_init_impl::register_known_function): New.
2080         (plugin_analyzer_init_impl::m_known_fn_mgr): New.
2081         (impl_run_checkers): Update plugin callback invocation to use
2082         eng's known_function_manager.
2083         * known-function-manager.cc: New file.
2084         * known-function-manager.h: New file.
2085         * region-model-manager.cc
2086         (region_model_manager::region_model_manager): Pass logger to
2087         m_known_fn_mgr's ctor.
2088         * region-model.cc (region_model::update_for_zero_return): New.
2089         (region_model::update_for_nonzero_return): New.
2090         (maybe_simplify_upper_bound): New.
2091         (region_model::maybe_get_copy_bounds): New.
2092         (region_model::get_known_function): New.
2093         (region_model::on_call_pre): Handle plugin-supplied known
2094         functions.
2095         * region-model.h: Include "analyzer/known-function-manager.h".
2096         (region_model_manager::get_known_function_manager): New.
2097         (region_model_manager::m_known_fn_mgr): New.
2098         (call_details::get_model): New accessor.
2099         (region_model::maybe_get_copy_bounds): New decl.
2100         (region_model::update_for_zero_return): New decl.
2101         (region_model::update_for_nonzero_return): New decl.
2102         (region_model::get_known_function): New decl.
2103         (region_model::get_known_function_manager): New.
2104
2105 2022-09-08  Tim Lange  <mail@tim-lange.me>
2106
2107         PR analyzer/106625
2108         * analyzer.h (region_offset): Eliminate m_is_symbolic member.
2109         * region-model-impl-calls.cc (region_model::impl_call_realloc):
2110         Refine implementation to be more precise.
2111         * region-model.cc (class symbolic_past_the_end):
2112         Abstract diagnostic class to complain about accesses past the end
2113         with symbolic values.
2114         (class symbolic_buffer_overflow):
2115         Concrete diagnostic class to complain about buffer overflows with
2116         symbolic values.
2117         (class symbolic_buffer_overread):
2118         Concrete diagnostic class to complain about buffer overreads with
2119         symbolic values.
2120         (region_model::check_symbolic_bounds): New function.
2121         (maybe_get_integer_cst_tree): New helper function.
2122         (region_model::check_region_bounds):
2123         Add call to check_symbolic_bounds if offset is not concrete.
2124         (region_model::eval_condition_without_cm):
2125         Add support for EQ_EXPR and GT_EXPR with binaryop_svalues.
2126         (is_positive_svalue): New hleper function.
2127         (region_model::symbolic_greater_than):
2128         New function to handle GT_EXPR comparisons with symbolic values.
2129         (region_model::structural_equality): New function to compare
2130         whether two svalues are structured the same, i.e. evaluate to
2131         the same value.
2132         (test_struct): Reflect changes to region::calc_offset.
2133         (test_var): Likewise.
2134         (test_array_2): Likewise and add selftest with symbolic i.
2135         * region-model.h (class region_model): Add check_symbolic_bounds,
2136         symbolic_greater_than and structural_equality.
2137         * region.cc (region::get_offset):
2138         Reflect changes to region::calc_offset.
2139         (region::calc_offset):
2140         Compute the symbolic offset if the offset is not concrete.
2141         (region::get_relative_symbolic_offset): New function to return the
2142         symbolic offset in bytes relative to its parent.
2143         (field_region::get_relative_symbolic_offset): Likewise.
2144         (element_region::get_relative_symbolic_offset): Likewise.
2145         (offset_region::get_relative_symbolic_offset): Likewise.
2146         (bit_range_region::get_relative_symbolic_offset): Likewise.
2147         * region.h: Add get_relative_symbolic_offset.
2148         * store.cc (binding_key::make):
2149         Reflect changes to region::calc_offset.
2150         (binding_map::apply_ctor_val_to_range): Likewise.
2151         (binding_map::apply_ctor_pair_to_child_region): Likewise.
2152         (binding_cluster::bind_compound_sval): Likewise.
2153         (binding_cluster::get_any_binding): Likewise.
2154         (binding_cluster::maybe_get_compound_binding): Likewise.
2155
2156 2022-09-05  Tim Lange  <mail@tim-lange.me>
2157
2158         * region-model-impl-calls.cc (region_model::impl_call_strcpy):
2159         Handle the constant string case.
2160         * region-model.cc (region_model::get_string_size):
2161         New function to get the string size from a region or svalue.
2162         * region-model.h (class region_model): Add get_string_size.
2163
2164 2022-09-05  Tim Lange  <mail@tim-lange.me>
2165
2166         * region.cc (cast_region::get_relative_concrete_offset):
2167         New overloaded method.
2168         * region.h: Add cast_region::get_relative_concrete_offset.
2169
2170 2022-08-22  Martin Liska  <mliska@suse.cz>
2171
2172         * region-model.cc: Add missing final keyword.
2173
2174 2022-08-18  Tim Lange  <mail@tim-lange.me>
2175
2176         PR analyzer/106181
2177         * analyzer.opt: Add Wanalyzer-imprecise-floating-point-arithmetic.
2178         * region-model.cc (is_any_cast_p): Formatting.
2179         (region_model::check_region_size): Ensure precondition.
2180         (class imprecise_floating_point_arithmetic): New abstract
2181         diagnostic class for all floating-point related warnings.
2182         (class float_as_size_arg): Concrete diagnostic class to complain
2183         about floating-point operands inside the size argument.
2184         (class contains_floating_point_visitor):
2185         New visitor to find floating-point operands inside svalues.
2186         (region_model::check_dynamic_size_for_floats): New function.
2187         (region_model::set_dynamic_extents):
2188         Call to check_dynamic_size_for_floats.
2189         * region-model.h (class region_model):
2190         Add region_model::check_dynamic_size_for_floats.
2191
2192 2022-08-16  Martin Liska  <mliska@suse.cz>
2193
2194         * region-model.cc: Fix -Winconsistent-missing-override clang
2195         warning.
2196         * region.h: Likewise.
2197
2198 2022-08-15  David Malcolm  <dmalcolm@redhat.com>
2199
2200         PR analyzer/106626
2201         * region-model.cc (buffer_overread::emit): Fix copy&paste error in
2202         direction of the access in the note.
2203
2204 2022-08-15  David Malcolm  <dmalcolm@redhat.com>
2205
2206         PR analyzer/106573
2207         * region-model.cc (region_model::on_call_pre): Use check_call_args
2208         when ensuring that we call get_arg_svalue on all args.  Remove
2209         redundant call from handling for stdio builtins.
2210
2211 2022-08-15  Immad Mir  <mirimmad@outlook.com>
2212
2213         PR analyzer/106551
2214         * sm-fd.cc (check_for_dup): exit early if first
2215         argument is invalid for all dup functions.
2216
2217 2022-08-12  Tim Lange  <mail@tim-lange.me>
2218
2219         PR analyzer/106000
2220         * analyzer.opt: Add Wanalyzer-out-of-bounds.
2221         * region-model.cc (class out_of_bounds): Diagnostics base class
2222         for all out-of-bounds diagnostics.
2223         (class past_the_end): Base class derived from out_of_bounds for
2224         the buffer_overflow and buffer_overread diagnostics.
2225         (class buffer_overflow): Buffer overflow diagnostics.
2226         (class buffer_overread): Buffer overread diagnostics.
2227         (class buffer_underflow): Buffer underflow diagnostics.
2228         (class buffer_underread): Buffer overread diagnostics.
2229         (region_model::check_region_bounds): New function to check region
2230         bounds for out-of-bounds accesses.
2231         (region_model::check_region_access):
2232         Add call to check_region_bounds.
2233         (region_model::get_representative_tree): New function that accepts
2234         a region instead of an svalue.
2235         * region-model.h (class region_model):
2236         Add region_model::check_region_bounds.
2237         * region.cc (region::symbolic_p): New predicate.
2238         (offset_region::get_byte_size_sval): Only return the remaining
2239         byte size on offset_regions.
2240         * region.h: Add region::symbolic_p.
2241         * store.cc (byte_range::intersects_p):
2242         Add new function equivalent to bit_range::intersects_p.
2243         (byte_range::exceeds_p): New function.
2244         (byte_range::falls_short_of_p): New function.
2245         * store.h (struct byte_range): Add byte_range::intersects_p,
2246         byte_range::exceeds_p and byte_range::falls_short_of_p.
2247
2248 2022-08-12  Tim Lange  <mail@tim-lange.me>
2249
2250         PR analyzer/106539
2251         * region-model-impl-calls.cc (region_model::impl_call_realloc):
2252         Use the result of get_copied_size as the size for the
2253         sized_regions in realloc.
2254         (success_with_move::get_copied_size): New function.
2255
2256 2022-08-11  Immad Mir  <mirimmad@outlook.com>
2257
2258         PR analyzer/106551
2259         * sm-fd.cc (check_for_dup): handle the m_start
2260         state when transitioning the state of LHS
2261         of dup, dup2 and dup3 call.
2262
2263 2022-08-09  David Malcolm  <dmalcolm@redhat.com>
2264
2265         PR analyzer/106573
2266         * region-model.cc (region_model::on_call_pre): Ensure that we call
2267         get_arg_svalue on all arguments.
2268
2269 2022-08-05  David Malcolm  <dmalcolm@redhat.com>
2270
2271         PR analyzer/105947
2272         * analyzer.opt (Wanalyzer-jump-through-null): New option.
2273         * engine.cc (class jump_through_null): New.
2274         (exploded_graph::process_node): Complain about jumps through NULL
2275         function pointers.
2276
2277 2022-08-02  Immad Mir  <mirimmad@outlook.com>
2278
2279         PR analyzer/106298
2280         * sm-fd.cc (fd_state_machine::on_open): Add
2281         creat, dup, dup2 and dup3 functions.
2282         (enum dup): New.
2283         (fd_state_machine::valid_to_unchecked_state): New.
2284         (fd_state_machine::on_creat): New.
2285         (fd_state_machine::on_dup): New.
2286
2287 2022-07-28  David Malcolm  <dmalcolm@redhat.com>
2288
2289         PR analyzer/105893
2290         * analyzer.opt (Wanalyzer-putenv-of-auto-var): New.
2291         * region-model-impl-calls.cc (class putenv_of_auto_var): New.
2292         (region_model::impl_call_putenv): New.
2293         * region-model.cc (region_model::on_call_pre): Handle putenv.
2294         * region-model.h (region_model::impl_call_putenv): New decl.
2295
2296 2022-07-28  David Malcolm  <dmalcolm@redhat.com>
2297
2298         * sm-malloc.cc (free_of_non_heap::emit): Add comment about CWE.
2299         * sm-taint.cc (tainted_size::emit): Likewise.
2300
2301 2022-07-28  David Malcolm  <dmalcolm@redhat.com>
2302
2303         * region.h: Add notes to the comment describing the region
2304         class hierarchy.
2305
2306 2022-07-27  Immad Mir  <mirimmad@outlook.com>
2307
2308         PR analyzer/106286
2309         * sm-fd.cc:
2310         (fd_diagnostic::get_meaning_for_state_change): New.
2311
2312 2022-07-26  David Malcolm  <dmalcolm@redhat.com>
2313
2314         PR analyzer/106319
2315         * store.cc (store::set_value): Don't strip away casts if the
2316         region has NULL type.
2317
2318 2022-07-26  David Malcolm  <dmalcolm@redhat.com>
2319
2320         * region.h (code_region::get_element): Remove stray decl.
2321         (function_region::get_element): Likewise.
2322
2323 2022-07-25  Martin Liska  <mliska@suse.cz>
2324
2325         * sm-fd.cc: Run dos2unix and fix coding style issues.
2326
2327 2022-07-23  Immad Mir  <mirimmad@outlook.com>
2328
2329         * sm-fd.cc (fd_param_diagnostic): New diagnostic class.
2330         (fd_access_mode_mismatch): Change inheritance from fd_diagnostic
2331         to fd_param_diagnostic. Add new overloaded constructor.
2332         (fd_use_after_close): Likewise.
2333         (unchecked_use_of_fd): Likewise and also change name to fd_use_without_check.
2334         (double_close): Change name to fd_double_close.
2335         (enum access_directions): New.
2336         (fd_state_machine::on_stmt): Handle calls to function with the
2337         new three function attributes.
2338         (fd_state_machine::check_for_fd_attrs): New.
2339         (fd_state_machine::on_open): Use the new overloaded constructors
2340         of diagnostic classes.
2341
2342 2022-07-22  David Malcolm  <dmalcolm@redhat.com>
2343
2344         PR analyzer/106413
2345         * varargs.cc (region_model::impl_call_va_start): Avoid iterating
2346         through non-existant variadic arguments by initializing the
2347         impl_region to "UNKNOWN" if the va_start occurs in the top-level
2348         function to the analysis.
2349
2350 2022-07-22  David Malcolm  <dmalcolm@redhat.com>
2351
2352         PR analyzer/106401
2353         * store.cc (binding_cluster::binding_cluster): Remove overzealous
2354         assertion; we're checking for tracked_p in
2355         store::get_or_create_cluster.
2356
2357 2022-07-22  Tim Lange  <mail@tim-lange.me>
2358
2359         PR analyzer/106394
2360         * region-model.cc (capacity_compatible_with_type): Always return true
2361         if alloc_size is zero.
2362
2363 2022-07-21  David Malcolm  <dmalcolm@redhat.com>
2364
2365         PR analyzer/106383
2366         * varargs.cc (region_model::impl_call_va_arg): When determining if
2367         we're doing interprocedural analysis, use the stack depth of the
2368         frame in which va_start was called, rather than the current stack
2369         depth.
2370
2371 2022-07-21  David Malcolm  <dmalcolm@redhat.com>
2372
2373         * sm-taint.cc (tainted_array_index::emit): Bulletproof against
2374         NULL m_arg.
2375         (tainted_array_index::describe_final_event): Likewise.
2376         (tainted_size::emit): Likewise.
2377         (tainted_size::describe_final_event): Likewise.
2378
2379 2022-07-21  David Malcolm  <dmalcolm@redhat.com>
2380
2381         PR analyzer/106374
2382         * region.cc (decl_region::get_svalue_for_initializer): Bail out on
2383         untracked regions.
2384
2385 2022-07-20  David Malcolm  <dmalcolm@redhat.com>
2386
2387         PR analyzer/106373
2388         * sm-taint.cc (taint_state_machine::on_condition): Potentially
2389         update the state of the RHS as well as the LHS.
2390
2391 2022-07-20  David Malcolm  <dmalcolm@redhat.com>
2392
2393         PR analyzer/106359
2394         * region.h (string_region::tracked_p): New.
2395         * store.cc (binding_cluster::binding_cluster): Move here from
2396         store.h.  Add assertion that base_region is tracked_p.
2397         * store.h (binding_cluster::binding_cluster): Move to store.cc.
2398
2399 2022-07-19  David Malcolm  <dmalcolm@redhat.com>
2400
2401         PR analyzer/106321
2402         * constraint-manager.h (bounded_ranges::get_count): New.
2403         (bounded_ranges::get_range): New.
2404         * engine.cc (impl_region_model_context::on_bounded_ranges): New.
2405         * exploded-graph.h (impl_region_model_context::on_bounded_ranges):
2406         New decl.
2407         * region-model.cc (region_model::apply_constraints_for_gswitch):
2408         Potentially call ctxt->on_bounded_ranges.
2409         * region-model.h (region_model_context::on_bounded_ranges): New
2410         vfunc.
2411         (noop_region_model_context::on_bounded_ranges): New.
2412         (region_model_context_decorator::on_bounded_ranges): New.
2413         * sm-taint.cc: Include "analyzer/constraint-manager.h".
2414         (taint_state_machine::on_bounded_ranges): New.
2415         * sm.h (state_machine::on_bounded_ranges): New.
2416
2417 2022-07-19  David Malcolm  <dmalcolm@redhat.com>
2418
2419         * engine.cc (exploded_graph::process_node): Show any description
2420         of the out-edge when logging it for consideration.
2421
2422 2022-07-15  David Malcolm  <dmalcolm@redhat.com>
2423
2424         PR analyzer/106284
2425         * sm-taint.cc (taint_state_machine::on_condition): Handle range
2426         checks optimized by build_range_check.
2427
2428 2022-07-15  Jonathan Wakely  <jwakely@redhat.com>
2429
2430         * call-info.cc (call_info::print): Adjust to new label_text API.
2431         * checker-path.cc (checker_event::dump): Likewise.
2432         (region_creation_event::get_desc): Likewise.
2433         (state_change_event::get_desc): Likewise.
2434         (superedge_event::should_filter_p): Likewise.
2435         (start_cfg_edge_event::get_desc): Likewise.
2436         (call_event::get_desc): Likewise.
2437         (return_event::get_desc): Likewise.
2438         (warning_event::get_desc): Likewise.
2439         (checker_path::dump): Likewise.
2440         (checker_path::debug): Likewise.
2441         * diagnostic-manager.cc (diagnostic_manager::prune_for_sm_diagnostic):
2442         Likewise.
2443         (diagnostic_manager::prune_interproc_events): Likewise.
2444         * engine.cc (feasibility_state::maybe_update_for_edge):
2445         Likewise.
2446         * program-state.cc (sm_state_map::to_json): Likewise.
2447         * region-model-impl-calls.cc (region_model::impl_call_analyzer_describe): Likewise.
2448         (region_model::impl_call_analyzer_dump_capacity): Likewise.
2449         * region.cc (region::to_json): Likewise.
2450         * sm-malloc.cc (inform_nonnull_attribute): Likewise.
2451         * store.cc (binding_map::to_json): Likewise.
2452         (store::to_json): Likewise.
2453         * supergraph.cc (superedge::dump): Likewise.
2454         * svalue.cc (svalue::to_json): Likewise.
2455
2456 2022-07-07  David Malcolm  <dmalcolm@redhat.com>
2457
2458         * checker-path.cc (start_cfg_edge_event::get_desc): Update for
2459         superedge::get_description returning a label_text.
2460         * engine.cc (feasibility_state::maybe_update_for_edge): Likewise.
2461         * supergraph.cc (superedge::dump): Likewise.
2462         (superedge::get_description): Convert return type from char * to
2463         label_text.
2464         * supergraph.h (superedge::get_description): Likewise.
2465
2466 2022-07-07  David Malcolm  <dmalcolm@redhat.com>
2467
2468         * call-info.cc (call_info::print): Update for removal of
2469         label_text::maybe_free in favor of automatic memory management.
2470         * checker-path.cc (checker_event::dump): Likewise.
2471         (checker_event::prepare_for_emission): Likewise.
2472         (state_change_event::get_desc): Likewise.
2473         (superedge_event::should_filter_p): Likewise.
2474         (start_cfg_edge_event::get_desc): Likewise.
2475         (warning_event::get_desc): Likewise.
2476         (checker_path::dump): Likewise.
2477         (checker_path::debug): Likewise.
2478         * diagnostic-manager.cc
2479         (diagnostic_manager::prune_for_sm_diagnostic): Likewise.
2480         (diagnostic_manager::prune_interproc_events): Likewise.
2481         * program-state.cc (sm_state_map::to_json): Likewise.
2482         * region.cc (region::to_json): Likewise.
2483         * sm-malloc.cc (inform_nonnull_attribute): Likewise.
2484         * store.cc (binding_map::to_json): Likewise.
2485         (store::to_json): Likewise.
2486         * svalue.cc (svalue::to_json): Likewise.
2487
2488 2022-07-07  David Malcolm  <dmalcolm@redhat.com>
2489
2490         PR analyzer/106225
2491         * sm-taint.cc (taint_state_machine::on_stmt): Move handling of
2492         assignments from division to...
2493         (taint_state_machine::check_for_tainted_divisor): ...this new
2494         function.  Reject warning when the divisor is known to be non-zero.
2495         * sm.cc: Include "analyzer/program-state.h".
2496         (sm_context::get_old_region_model): New.
2497         * sm.h (sm_context::get_old_region_model): New decl.
2498
2499 2022-07-06  Immad Mir  <mirimmad@outlook.com>
2500
2501         PR analyzer/106184
2502         * sm-fd.cc (fd_state_machine): Change ordering of initialization
2503         of state m_invalid so that the order of initializers is same as
2504         the ordering of the fields in the class decl.
2505
2506 2022-07-06  Immad Mir  <mirimmad@outlook.com>
2507
2508         * sm-fd.cc (use_after_close): save the "close" event and
2509         show it where possible.
2510
2511 2022-07-06  David Malcolm  <dmalcolm@redhat.com>
2512
2513         PR analyzer/106204
2514         * region-model.cc (within_short_circuited_stmt_p): Move extraction
2515         of assign_stmt to caller.
2516         (due_to_ifn_deferred_init_p): New.
2517         (region_model::check_for_poison): Move extraction of assign_stmt
2518         from within_short_circuited_stmt_p to here.  Share logic with
2519         call to due_to_ifn_deferred_init_p.
2520
2521 2022-07-02  Tim Lange  <mail@tim-lange.me>
2522
2523         PR analyzer/105900
2524         * analyzer.opt: Added Wanalyzer-allocation-size.
2525         * checker-path.cc (region_creation_event::get_desc): Added call to new
2526         virtual function pending_diagnostic::describe_region_creation_event.
2527         * checker-path.h: Added region_creation_event::get_desc.
2528         * diagnostic-manager.cc (diagnostic_manager::add_event_on_final_node):
2529         New function.
2530         * diagnostic-manager.h:
2531         Added diagnostic_manager::add_event_on_final_node.
2532         * pending-diagnostic.h (struct region_creation): New event_desc struct.
2533         (pending_diagnostic::describe_region_creation_event): Added virtual
2534         function to overwrite description of a region creation.
2535         * region-model.cc (class dubious_allocation_size): New class.
2536         (capacity_compatible_with_type): New helper function.
2537         (class size_visitor): New class.
2538         (struct_or_union_with_inheritance_p): New helper function.
2539         (is_any_cast_p): New helper function.
2540         (region_model::check_region_size): New function.
2541         (region_model::set_value): Added call to
2542         region_model::check_region_size.
2543         * region-model.h (class region_model): New function check_region_size.
2544         * svalue.cc (region_svalue::accept): Changed to post-order traversal.
2545         (initial_svalue::accept): Likewise.
2546         (unaryop_svalue::accept): Likewise.
2547         (binop_svalue::accept): Likewise.
2548         (sub_svalue::accept): Likewise.
2549         (repeated_svalue::accept): Likewise.
2550         (bits_within_svalue::accept): Likewise.
2551         (widening_svalue::accept): Likewise.
2552         (unmergeable_svalue::accept): Likewise.
2553         (compound_svalue::accept): Likewise.
2554         (conjured_svalue::accept): Likewise.
2555         (asm_output_svalue::accept): Likewise.
2556         (const_fn_result_svalue::accept): Likewise.
2557
2558 2022-07-02  Immad Mir  <mirimmad17@gmail.com>
2559
2560         PR analyzer/106003
2561         * analyzer.opt (Wanalyzer-fd-leak): New option.
2562         (Wanalyzer-fd-access-mode-mismatch): New option.
2563         (Wanalyzer-fd-use-without-check): New option.
2564         (Wanalyzer-fd-double-close): New option.
2565         (Wanalyzer-fd-use-after-close): New option.
2566         * sm.h (make_fd_state_machine): New decl.
2567         * sm.cc (make_checkers): Call make_fd_state_machine.
2568         * sm-fd.cc: New file.
2569
2570 2022-06-24  David Malcolm  <dmalcolm@redhat.com>
2571
2572         * call-string.cc: Add includes of "analyzer/analyzer.h"
2573         and "analyzer/analyzer-logging.h".
2574         (call_string::call_string): Delete copy ctor.
2575         (call_string::operator=): Delete.
2576         (call_string::operator==): Delete.
2577         (call_string::hash): Delete.
2578         (call_string::push_call): Make const, returning the resulting
2579         call_string.
2580         (call_string::pop): Delete.
2581         (call_string::cmp_ptr_ptr): New.
2582         (call_string::validate): Assert that m_parent is non-NULL, or
2583         m_elements is empty.
2584         (call_string::call_string): Move default ctor here from
2585         call-string.h and reimplement.  Add ctor taking a parent
2586         and an element.
2587         (call_string::~call_string): New.
2588         (call_string::recursive_log): New.
2589         * call-string.h (call_string::call_string): Move default ctor's
2590         defn to call-string.cc.  Delete copy ctor.  Add ctor taking a
2591         parent and an element.
2592         (call_string::operator=): Delete.
2593         (call_string::operator==): Delete.
2594         (call_string::hash): Delete.
2595         (call_string::push_call): Make const, returning the resulting
2596         call_string.
2597         (call_string::pop): Delete decl.
2598         (call_string::get_parent): New.
2599         (call_string::cmp_ptr_ptr): New decl.
2600         (call_string::get_top_of_stack): New.
2601         (struct call_string::hashmap_traits_t): New.
2602         (class call_string): Add friend class region_model_manager.  Add
2603         DISABLE_COPY_AND_ASSIGN.
2604         (call_string::~call_string): New decl.
2605         (call_string::recursive_log): New decl.
2606         (call_string::m_parent): New field.
2607         (call_string::m_children): New field.
2608         * constraint-manager.cc (selftest::test_many_constants): Pass
2609         model manager to program_point::origin.
2610         * engine.cc (exploded_graph::exploded_graph): Likewise.
2611         (exploded_graph::add_function_entry): Likewise for
2612         program_point::from_function_entry.
2613         (add_tainted_args_callback): Likewise.
2614         (exploded_graph::maybe_process_run_of_before_supernode_enodes):
2615         Update for change to program_point.get_call_string.
2616         (exploded_graph::process_node): Likewise.
2617         (class function_call_string_cluster): Convert m_cs from a
2618         call_string to a const call_string &.
2619         (struct function_call_string): Likewise.
2620         (pod_hash_traits<function_call_string>::hash): Use pointer_hash
2621         for m_cs.
2622         (pod_hash_traits<function_call_string>::equal): Update for change
2623         to m_cs.
2624         (root_cluster::add_node): Update for change to
2625         function_call_string.
2626         (viz_callgraph_node::dump_dot): Update for change to call_string.
2627         * exploded-graph.h (per_call_string_data::m_key): Convert to a
2628         reference.
2629         (struct eg_call_string_hash_map_traits): Delete.
2630         (exploded_graph::call_string_data_map_t): Remove traits class.
2631         * program-point.cc: Move include of "analyzer/call-string.h" to
2632         after "analyzer/analyzer-logging.h".
2633         (program_point::print): Update for conversion of m_call_string to
2634         a pointer.
2635         (program_point::to_json): Likewise.
2636         (program_point::push_to_call_stack): Update for immutability of
2637         call strings.
2638         (program_point::pop_from_call_stack): Likewise.
2639         (program_point::hash): Use pointer hashing for m_call_string.
2640         (program_point::get_function_at_depth): Update for change to
2641         m_call_string.
2642         (program_point::validate): Update for changes to call_string.
2643         (program_point::on_edge): Likewise.
2644         (program_point::origin): Move here from call-string.h.  Add
2645         region_model_manager param and use it to get empty call string.
2646         (program_point::from_function_entry): Likewise.
2647         (selftest::test_function_point_ordering): Likewise.
2648         (selftest::test_function_point_ordering): Likewise.
2649         * program-point.h (program_point::program_point): Update for
2650         change to m_call_string.
2651         (program_point::get_call_string): Likewise.
2652         (program_point::get_stack_depth): Likewise.
2653         (program_point::origin): Add region_model_manager param, and move
2654         defn to call-string.cc.
2655         (program_point::from_function_entry): Likewise.
2656         (program_point::empty): Drop call_string.
2657         (program_point::deleted): Likewise.
2658         (program_point::program_point): New private ctor.
2659         (program_point::m_call_string): Convert from call_string to const
2660         call_string *.
2661         * program-state.cc (selftest::test_program_state_merging): Update
2662         for call_string changes.
2663         (selftest::test_program_state_merging_2): Likewise.
2664         * region-model-manager.cc
2665         (region_model_manager::region_model_manager): Construct
2666         m_empty_call_string.
2667         (region_model_manager::log_stats): Log the call strings.
2668         * region-model.cc (assert_region_models_merge): Pass the
2669         region_model_manager when creating program_point instances.
2670         (selftest::test_state_merging): Likewise.
2671         (selftest::test_constraint_merging): Likewise.
2672         (selftest::test_widening_constraints): Likewise.
2673         (selftest::test_iteration_1): Likewise.
2674         * region-model.h (region_model_manager::get_empty_call_string):
2675         New.
2676         (region_model_manager::m_empty_call_string): New.
2677         * sm-signal.cc (register_signal_handler::impl_transition): Update
2678         for changes to call_string.
2679
2680 2022-06-24  David Malcolm  <dmalcolm@redhat.com>
2681
2682         * call-string.cc (call_string::calc_recursion_depth): Whitespace
2683         cleanups.
2684         (call_string::cmp): Likewise.
2685         (call_string::get_caller_node): Likewise.
2686         (call_string::validate): Likewise.
2687         * engine.cc (dynamic_call_info_t::add_events_to_path): Likewise.
2688         (exploded_graph::get_per_function_data): Likewise.
2689         (exploded_graph::maybe_create_dynamic_call): Likewise.
2690         (exploded_graph::maybe_create_dynamic_call): Likewise.
2691         (exploded_graph::process_node): Likewise.
2692
2693 2022-06-16  David Malcolm  <dmalcolm@redhat.com>
2694
2695         * varargs.cc (va_arg_type_mismatch::emit): Associate the warning
2696         with CWE-686 ("Function Call With Incorrect Argument Type").
2697
2698 2022-06-16  David Malcolm  <dmalcolm@redhat.com>
2699
2700         * varargs.cc: Include "diagnostic-metadata.h".
2701         (va_list_exhausted::emit): Associate the warning with
2702         CWE-685 ("Function Call With Incorrect Number of Arguments").
2703
2704 2022-06-16  David Malcolm  <dmalcolm@redhat.com>
2705
2706         * sm-file.cc (double_fclose::emit): Associate the warning with
2707         CWE-1341 ("Multiple Releases of Same Resource or Handle").
2708
2709 2022-06-15  David Malcolm  <dmalcolm@redhat.com>
2710
2711         PR analyzer/105962
2712         * analyzer.opt (fanalyzer-undo-inlining): New option.
2713         * checker-path.cc: Include "diagnostic-core.h" and
2714         "inlining-iterator.h".
2715         (event_kind_to_string): Handle EK_INLINED_CALL.
2716         (class inlining_info): New class.
2717         (checker_event::checker_event): Move here from checker-path.h.
2718         Store original fndecl and depth, and calculate effective fndecl
2719         and depth based on inlining information.
2720         (checker_event::dump): Emit original depth as well as effective
2721         depth when they differ; likewise for fndecl.
2722         (region_creation_event::get_desc): Use m_effective_fndecl.
2723         (inlined_call_event::get_desc): New.
2724         (inlined_call_event::get_meaning): New.
2725         (checker_path::inject_any_inlined_call_events): New.
2726         * checker-path.h (enum event_kind): Add EK_INLINED_CALL.
2727         (checker_event::checker_event): Make protected, and move
2728         definition to checker-path.cc.
2729         (checker_event::get_fndecl): Use effective fndecl.
2730         (checker_event::get_stack_depth): Use effective stack depth.
2731         (checker_event::get_logical_location): Use effective stack depth.
2732         (checker_event::get_original_stack_depth): New.
2733         (checker_event::m_fndecl): Rename to...
2734         (checker_event::m_original_fndecl): ...this.
2735         (checker_event::m_depth): Rename to...
2736         (checker_event::m_original_depth): ...this.
2737         (checker_event::m_effective_fndecl): New field.
2738         (checker_event::m_effective_depth): New field.
2739         (class inlined_call_event): New checker_event subclass.
2740         (checker_path::inject_any_inlined_call_events): New decl.
2741         * diagnostic-manager.cc: Include "inlining-iterator.h".
2742         (diagnostic_manager::emit_saved_diagnostic): Call
2743         checker_path::inject_any_inlined_call_events.
2744         (diagnostic_manager::prune_for_sm_diagnostic): Handle
2745         EK_INLINED_CALL.
2746         * engine.cc (tainted_args_function_custom_event::get_desc): Use
2747         effective fndecl.
2748         * inlining-iterator.h: New file.
2749
2750 2022-06-15  David Malcolm  <dmalcolm@redhat.com>
2751
2752         * diagnostic-manager.cc (saved_diagnostic::dump_dot_id): New.
2753         (saved_diagnostic::dump_as_dot_node): New.
2754         * diagnostic-manager.h (saved_diagnostic::dump_dot_id): New decl.
2755         (saved_diagnostic::dump_as_dot_node): New decl.
2756         * engine.cc (exploded_node::dump_dot): Add nodes for saved
2757         diagnostics.
2758
2759 2022-06-02  David Malcolm  <dmalcolm@redhat.com>
2760
2761         * checker-path.cc (checker_event::get_meaning): New.
2762         (function_entry_event::get_meaning): New.
2763         (state_change_event::get_desc): Add dump of meaning of the event
2764         to the -fanalyzer-verbose-state-changes output.
2765         (state_change_event::get_meaning): New.
2766         (cfg_edge_event::get_meaning): New.
2767         (call_event::get_meaning): New.
2768         (return_event::get_meaning): New.
2769         (start_consolidated_cfg_edges_event::get_meaning): New.
2770         (warning_event::get_meaning): New.
2771         * checker-path.h: Include "tree-logical-location.h".
2772         (checker_event::checker_event): Construct m_logical_loc.
2773         (checker_event::get_logical_location): New.
2774         (checker_event::get_meaning): New decl.
2775         (checker_event::m_logical_loc): New.
2776         (function_entry_event::get_meaning): New decl.
2777         (state_change_event::get_meaning): New decl.
2778         (cfg_edge_event::get_meaning): New decl.
2779         (call_event::get_meaning): New decl.
2780         (return_event::get_meaning): New decl.
2781         (start_consolidated_cfg_edges_event::get_meaning): New.
2782         (warning_event::get_meaning): New decl.
2783         * pending-diagnostic.h: Include "diagnostic-path.h".
2784         (pending_diagnostic::get_meaning_for_state_change): New vfunc.
2785         * sm-file.cc (file_diagnostic::get_meaning_for_state_change): New
2786         vfunc impl.
2787         * sm-malloc.cc (malloc_diagnostic::get_meaning_for_state_change):
2788         Likewise.
2789         * sm-sensitive.cc
2790         (exposure_through_output_file::get_meaning_for_state_change):
2791         Likewise.
2792         * sm-taint.cc (taint_diagnostic::get_meaning_for_state_change):
2793         Likewise.
2794         * varargs.cc
2795         (va_list_sm_diagnostic::get_meaning_for_state_change): Likewise.
2796
2797 2022-05-23  David Malcolm  <dmalcolm@redhat.com>
2798
2799         * call-info.cc: Add "final" and "override" to all vfunc
2800         implementations that were missing them, as appropriate.
2801         * engine.cc: Likewise.
2802         * region-model.cc: Likewise.
2803         * sm-malloc.cc: Likewise.
2804         * supergraph.h: Likewise.
2805         * svalue.cc: Likewise.
2806         * varargs.cc: Likewise.
2807
2808 2022-05-20  David Malcolm  <dmalcolm@redhat.com>
2809
2810         * analyzer-pass.cc: Replace uses of "FINAL" and "OVERRIDE" with
2811         "final" and "override".
2812         * call-info.h: Likewise.
2813         * checker-path.h: Likewise.
2814         * constraint-manager.cc: Likewise.
2815         * diagnostic-manager.cc: Likewise.
2816         * engine.cc: Likewise.
2817         * exploded-graph.h: Likewise.
2818         * feasible-graph.h: Likewise.
2819         * pending-diagnostic.h: Likewise.
2820         * region-model-impl-calls.cc: Likewise.
2821         * region-model.cc: Likewise.
2822         * region-model.h: Likewise.
2823         * region.h: Likewise.
2824         * sm-file.cc: Likewise.
2825         * sm-malloc.cc: Likewise.
2826         * sm-pattern-test.cc: Likewise.
2827         * sm-sensitive.cc: Likewise.
2828         * sm-signal.cc: Likewise.
2829         * sm-taint.cc: Likewise.
2830         * state-purge.h: Likewise.
2831         * store.cc: Likewise.
2832         * store.h: Likewise.
2833         * supergraph.h: Likewise.
2834         * svalue.h: Likewise.
2835         * trimmed-graph.h: Likewise.
2836         * varargs.cc: Likewise.
2837
2838 2022-05-16  David Malcolm  <dmalcolm@redhat.com>
2839
2840         PR analyzer/105103
2841         * analyzer.cc (make_label_text_n): New.
2842         * analyzer.h (class var_arg_region): New forward decl.
2843         (make_label_text_n): New decl.
2844         * analyzer.opt (Wanalyzer-va-arg-type-mismatch): New option.
2845         (Wanalyzer-va-list-exhausted): New option.
2846         (Wanalyzer-va-list-leak): New option.
2847         (Wanalyzer-va-list-use-after-va-end): New option.
2848         * checker-path.cc (call_event::get_desc): Split out decl access
2849         into..
2850         (call_event::get_caller_fndecl): ...this new function and...
2851         (call_event::get_callee_fndecl): ...this new function.
2852         * checker-path.h (call_event::get_desc): Drop "FINAL".
2853         (call_event::get_caller_fndecl): New decl.
2854         (call_event::get_callee_fndecl): New decl.
2855         (class call_event): Make fields protected.
2856         * diagnostic-manager.cc (null_assignment_sm_context::warn): New
2857         overload.
2858         (null_assignment_sm_context::get_new_program_state): New.
2859         (diagnostic_manager::add_events_for_superedge): Move case
2860         SUPEREDGE_CALL to a new pending_diagnostic::add_call_event vfunc.
2861         * engine.cc (impl_sm_context::warn): Implement new override.
2862         (impl_sm_context::get_new_program_state): New.
2863         * pending-diagnostic.cc: Include "analyzer/diagnostic-manager.h",
2864         "cpplib.h", "digraph.h", "ordered-hash-map.h", "cfg.h",
2865         "basic-block.h", "gimple.h", "gimple-iterator.h", "cgraph.h"
2866         "analyzer/supergraph.h", "analyzer/program-state.h",
2867         "alloc-pool.h", "fibonacci_heap.h", "shortest-paths.h",
2868         "sbitmap.h", "analyzer/exploded-graph.h", "diagnostic-path.h",
2869         and "analyzer/checker-path.h".
2870         (ht_ident_eq): New.
2871         (fixup_location_in_macro_p): New.
2872         (pending_diagnostic::fixup_location): New.
2873         (pending_diagnostic::add_call_event): New.
2874         * pending-diagnostic.h (pending_diagnostic::fixup_location): Drop
2875         no-op inline implementation in favor of the more complex
2876         implementation above.
2877         (pending_diagnostic::add_call_event): New vfunc.
2878         * region-model-impl-calls.cc: Include "analyzer/sm.h",
2879         "diagnostic-path.h", and "analyzer/pending-diagnostic.h".
2880         * region-model-manager.cc
2881         (region_model_manager::get_var_arg_region): New.
2882         (region_model_manager::log_stats): Log m_var_arg_regions.
2883         * region-model.cc (region_model::on_call_pre): Handle IFN_VA_ARG,
2884         BUILT_IN_VA_START, and BUILT_IN_VA_COPY.
2885         (region_model::on_call_post): Handle BUILT_IN_VA_END.
2886         (region_model::get_representative_path_var_1): Handle RK_VAR_ARG.
2887         (region_model::push_frame): Push variadic arguments.
2888         * region-model.h (region_model_manager::get_var_arg_region): New
2889         decl.
2890         (region_model_manager::m_var_arg_regions): New field.
2891         (region_model::impl_call_va_start): New decl.
2892         (region_model::impl_call_va_copy): New decl.
2893         (region_model::impl_call_va_arg): New decl.
2894         (region_model::impl_call_va_end): New decl.
2895         * region.cc (alloca_region::dump_to_pp): Dump the id.
2896         (var_arg_region::dump_to_pp): New.
2897         (var_arg_region::get_frame_region): New.
2898         * region.h (enum region_kind): Add RK_VAR_ARG.
2899         (region::dyn_cast_var_arg_region): New.
2900         (class var_arg_region): New.
2901         (is_a_helper <const var_arg_region *>::test): New.
2902         (struct default_hash_traits<var_arg_region::key_t>): New.
2903         * sm.cc (make_checkers): Call make_va_list_state_machine.
2904         * sm.h (sm_context::warn): New vfunc.
2905         (sm_context::get_old_svalue): Drop unused decl.
2906         (sm_context::get_new_program_state): New vfunc.
2907         (make_va_list_state_machine): New decl.
2908         * varargs.cc: New file.
2909
2910 2022-05-16  Martin Liska  <mliska@suse.cz>
2911
2912         * engine.cc (exploded_node::get_dot_fillcolor): Use ARRAY_SIZE.
2913         * function-set.cc (test_stdio_example): Likewise.
2914         * sm-file.cc (get_file_using_fns): Likewise.
2915         * sm-malloc.cc (malloc_state_machine::unaffected_by_call_p): Likewise.
2916         * sm-signal.cc (get_async_signal_unsafe_fns): Likewise.
2917
2918 2022-05-13  Richard Biener  <rguenther@suse.de>
2919
2920         * supergraph.cc: Re-order gimple-fold.h include.
2921
2922 2022-05-11  David Malcolm  <dmalcolm@redhat.com>
2923
2924         * checker-path.cc (state_change_event::get_desc): Call maybe_free
2925         on label_text temporaries.
2926         * diagnostic-manager.cc
2927         (diagnostic_manager::prune_for_sm_diagnostic): Likewise.
2928         * engine.cc (exploded_graph::~exploded_graph): Fix leak of
2929         m_per_point_data and m_per_call_string_data values.  Simplify
2930         cleanup of m_per_function_stats and m_per_point_data values.
2931         (feasibility_state::maybe_update_for_edge): Fix leak of result of
2932         superedge::get_description.
2933         * region-model-manager.cc
2934         (region_model_manager::~region_model_manager): Move cleanup of
2935         m_setjmp_values to match the ordering of the fields within
2936         region_model_manager.  Fix leak of values within
2937         m_repeated_values_map, m_bits_within_values_map,
2938         m_asm_output_values_map, and m_const_fn_result_values_map.
2939
2940 2022-04-28  David Malcolm  <dmalcolm@redhat.com>
2941
2942         PR analyzer/105285
2943         * store.cc (binding_cluster::get_any_binding): Handle accessing
2944         sub_svalues of clusters where the base region has a symbolic
2945         binding.
2946
2947 2022-04-28  David Malcolm  <dmalcolm@redhat.com>
2948
2949         * diagnostic-manager.cc (epath_finder::process_worklist_item):
2950         Call dump_feasible_path when a path that reaches the the target
2951         enode is found.
2952         (epath_finder::dump_feasible_path): New.
2953         * engine.cc (feasibility_state::dump_to_pp): New.
2954         * exploded-graph.h (feasibility_state::dump_to_pp): New decl.
2955         * feasible-graph.cc (feasible_graph::dump_feasible_path): New.
2956         * feasible-graph.h (feasible_graph::dump_feasible_path): New
2957         decls.
2958         * program-point.cc (function_point::print): Fix missing trailing
2959         newlines.
2960         * program-point.h (program_point::print_source_line): Remove
2961         unimplemented decl.
2962
2963 2022-04-25  David Malcolm  <dmalcolm@redhat.com>
2964
2965         PR analyzer/105365
2966         PR analyzer/105366
2967         * svalue.cc
2968         (cmp_cst): Rename to...
2969         (cmp_csts_same_type): ...this.  Convert all recursive calls to
2970         calls to...
2971         (cmp_csts_and_types): ....this new function.
2972         (svalue::cmp_ptr): Update for renaming of cmp_cst
2973
2974 2022-04-14  David Malcolm  <dmalcolm@redhat.com>
2975
2976         PR analyzer/105264
2977         * region-model-reachability.cc (reachable_regions::handle_parm):
2978         Use maybe_get_deref_base_region rather than just region_svalue, to
2979         handle pointer arithmetic also.
2980         * svalue.cc (svalue::maybe_get_deref_base_region): New.
2981         * svalue.h (svalue::maybe_get_deref_base_region): New decl.
2982
2983 2022-04-14  David Malcolm  <dmalcolm@redhat.com>
2984
2985         PR analyzer/105252
2986         * svalue.cc (cmp_cst): When comparing VECTOR_CSTs, compare the
2987         types of the encoded elements before calling cmp_cst on them.
2988
2989 2022-04-09  David Malcolm  <dmalcolm@redhat.com>
2990
2991         PR analyzer/103892
2992         * region-model-manager.cc
2993         (region_model_manager::get_unknown_symbolic_region): New,
2994         extracted from...
2995         (region_model_manager::get_field_region): ...here.
2996         (region_model_manager::get_element_region): Use it here.
2997         (region_model_manager::get_offset_region): Likewise.
2998         (region_model_manager::get_sized_region): Likewise.
2999         (region_model_manager::get_cast_region): Likewise.
3000         (region_model_manager::get_bit_range): Likewise.
3001         * region-model.h
3002         (region_model_manager::get_unknown_symbolic_region): New decl.
3003         * region.cc (symbolic_region::symbolic_region): Handle sval_ptr
3004         having NULL type.
3005         (symbolic_region::dump_to_pp): Handle having NULL type.
3006
3007 2022-04-07  David Malcolm  <dmalcolm@redhat.com>
3008
3009         PR analyzer/102208
3010         * store.cc (binding_map::remove_overlapping_bindings): Add
3011         "always_overlap" param, using it to generalize to the case where
3012         we want to remove all bindings.  Update "uncertainty" logic to
3013         only record maybe-bound values for cases where there is a symbolic
3014         write involved.
3015         (binding_cluster::mark_region_as_unknown): Split param "reg" into
3016         "reg_to_bind" and "reg_for_overlap".
3017         (binding_cluster::maybe_get_compound_binding): Pass "false" to
3018         binding_map::remove_overlapping_bindings new "always_overlap" param.
3019         (binding_cluster::remove_overlapping_bindings): Determine
3020         "always_overlap" and pass it to
3021         binding_map::remove_overlapping_bindings.
3022         (store::set_value): Pass uncertainty to remove_overlapping_bindings
3023         call.  Update for new param of
3024         binding_cluster::mark_region_as_unknown, passing both the base
3025         region of the iter_cluster, and the lhs_reg.
3026         (store::mark_region_as_unknown): Update for new param of
3027         binding_cluster::mark_region_as_unknown, passing "reg" for both.
3028         (store::remove_overlapping_bindings): Add param "uncertainty", and
3029         pass it on to call to
3030         binding_cluster::remove_overlapping_bindings.
3031         * store.h (binding_map::remove_overlapping_bindings): Add
3032         "always_overlap" param.
3033         (binding_cluster::mark_region_as_unknown): Split param "reg" into
3034         "reg_to_bind" and "reg_for_overlap".
3035         (store::remove_overlapping_bindings): Add param "uncertainty".
3036
3037 2022-03-29  David Malcolm  <dmalcolm@redhat.com>
3038
3039         PR testsuite/105085
3040         * region-model-manager.cc (dump_untracked_region): Skip decls in
3041         the constant pool.
3042
3043 2022-03-29  David Malcolm  <dmalcolm@redhat.com>
3044
3045         PR analyzer/105087
3046         * analyzer.h (class conjured_purge): New forward decl.
3047         * region-model-asm.cc (region_model::on_asm_stmt): Add
3048         conjured_purge param to calls binding_cluster::on_asm and
3049         region_model_manager::get_or_create_conjured_svalue.
3050         * region-model-impl-calls.cc
3051         (call_details::get_or_create_conjured_svalue): Likewise for call
3052         to region_model_manager::get_or_create_conjured_svalue.
3053         (region_model::impl_call_fgets): Remove call to
3054         region_model::purge_state_involving, as this is now done
3055         implicitly by call_details::get_or_create_conjured_svalue.
3056         (region_model::impl_call_fread): Likewise.
3057         (region_model::impl_call_strchr): Pass conjured_purge param to
3058         call to region_model_manager::get_or_create_conjured_svalue.
3059         * region-model-manager.cc (conjured_purge::purge): New.
3060         (region_model_manager::get_or_create_conjured_svalue): Add
3061         param "p".  Use it to purge state when reusing an existing
3062         conjured_svalue.
3063         * region-model.cc (region_model::on_call_pre): Replace call to
3064         region_model::purge_state_involving with passing conjured_purge
3065         to region_model_manager::get_or_create_conjured_svalue.
3066         (region_model::handle_unrecognized_call): Pass conjured_purge to
3067         store::on_unknown_fncall.
3068         * region-model.h
3069         (region_model_manager::get_or_create_conjured_svalue): Add param
3070         "p".
3071         * store.cc (binding_cluster::on_unknown_fncall): Likewise.  Pass
3072         it on to region_model_manager::get_or_create_conjured_svalue.
3073         (binding_cluster::on_asm): Likewise.
3074         (store::on_unknown_fncall): Add param "p" and pass it on to
3075         binding_cluster::on_unknown_fncall.
3076         * store.h (binding_cluster::on_unknown_fncall): Add param p.
3077         (binding_cluster::on_asm): Likewise.
3078         (store::on_unknown_fncall): Likewise.
3079         * svalue.h (class conjured_purge): New.
3080
3081 2022-03-29  David Malcolm  <dmalcolm@redhat.com>
3082
3083         PR analyzer/105074
3084         * region.cc (ipa_ref_requires_tracking): Drop "context_fndecl",
3085         instead using the ref->referring to get the cgraph node of the
3086         caller.
3087         (symnode_requires_tracking_p): Likewise.
3088
3089 2022-03-26  David Malcolm  <dmalcolm@redhat.com>
3090
3091         PR analyzer/105057
3092         * store.cc (binding_cluster::make_unknown_relative_to): Reject
3093         attempts to create a cluster for untracked base regions.
3094         (store::set_value): Likewise.
3095         (store::fill_region): Likewise.
3096         (store::mark_region_as_unknown): Likewise.
3097
3098 2022-03-25  David Malcolm  <dmalcolm@redhat.com>
3099
3100         PR analyzer/104954
3101         * analyzer.opt (-fdump-analyzer-untracked): New option.
3102         * engine.cc (impl_run_checkers): Handle it.
3103         * region-model-asm.cc (region_model::on_asm_stmt): Don't attempt
3104         to clobber regions with !tracked_p ().
3105         * region-model-manager.cc (dump_untracked_region): New.
3106         (region_model_manager::dump_untracked_regions): New.
3107         (frame_region::dump_untracked_regions): New.
3108         * region-model.h (region_model_manager::dump_untracked_regions):
3109         New decl.
3110         * region.cc (ipa_ref_requires_tracking): New.
3111         (symnode_requires_tracking_p): New.
3112         (decl_region::calc_tracked_p): New.
3113         * region.h (region::tracked_p): New vfunc.
3114         (frame_region::dump_untracked_regions): New decl.
3115         (class decl_region): Note that this is also used fo SSA names.
3116         (decl_region::decl_region): Initialize m_tracked.
3117         (decl_region::tracked_p): New.
3118         (decl_region::calc_tracked_p): New decl.
3119         (decl_region::m_tracked): New.
3120         * store.cc (store::get_or_create_cluster): Assert that we
3121         don't try to create clusters for base regions that aren't
3122         trackable.
3123         (store::mark_as_escaped): Don't mark base regions that we're not
3124         tracking.
3125
3126 2022-03-23  David Malcolm  <dmalcolm@redhat.com>
3127
3128         PR analyzer/104979
3129         * engine.cc (impl_run_checkers): Create the engine after the
3130         supergraph, and pass the supergraph to the engine.
3131         * region-model.cc (region_model::get_lvalue_1): Pass ctxt to
3132         frame_region::get_region_for_local.
3133         (region_model::update_for_return_gcall): Pass the lvalue for the
3134         result to pop_frame as a tree, rather than as a region.
3135         (region_model::pop_frame): Update for above change, determining
3136         the destination region after the frame is popped and thus with
3137         respect to the caller frame rather than the called frame.
3138         Likewise, set the value of the region to the return value after
3139         the frame is popped.
3140         (engine::engine): Add supergraph pointer.
3141         (selftest::test_stack_frames): Set the DECL_CONTECT of PARM_DECLs.
3142         (selftest::test_get_representative_path_var): Likewise.
3143         (selftest::test_state_merging): Likewise.
3144         * region-model.h (region_model::pop_frame): Convert first param
3145         from a const region * to a tree.
3146         (engine::engine): Add param "sg".
3147         (engine::m_sg): New field.
3148         * region.cc: Include "analyzer/sm.h" and
3149         "analyzer/program-state.h".
3150         (frame_region::get_region_for_local): Add "ctxt" param.
3151         Add assertions that VAR_DECLs are locals, and that expr is for the
3152         correct function.
3153         * region.h (frame_region::get_region_for_local): Add "ctxt" param.
3154
3155 2022-03-23  David Malcolm  <dmalcolm@redhat.com>
3156
3157         PR analyzer/105017
3158         * sm-taint.cc (taint_diagnostic::subclass_equal_p): Check
3159         m_has_bounds as well as m_arg.
3160         (tainted_allocation_size::subclass_equal_p): Chain up to base
3161         class implementation.  Also check m_mem_space.
3162         (tainted_allocation_size::emit): Add note showing stack-based vs
3163         heap-based allocations.
3164
3165 2022-03-23  David Malcolm  <dmalcolm@redhat.com>
3166
3167         PR analyzer/104997
3168         * diagnostic-manager.cc (diagnostic_manager::add_diagnostic):
3169         Convert return type from "void" to "bool", reporting success vs
3170         failure to caller, for both overloads.
3171         * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
3172         Likewise.
3173         * engine.cc (impl_region_model_context::warn): Propagate return
3174         value from diagnostic_manager::add_diagnostic.
3175
3176 2022-03-18  David Malcolm  <dmalcolm@redhat.com>
3177
3178         PR analyzer/104943
3179         PR analyzer/104954
3180         PR analyzer/103533
3181         * analyzer.h (class state_purge_per_decl): New forward decl.
3182         * engine.cc (impl_run_checkers): Pass region_model_manager to
3183         state_purge_map ctor.
3184         * program-point.cc (function_point::final_stmt_p): New.
3185         (function_point::get_next): New.
3186         * program-point.h (function_point::final_stmt_p): New decl.
3187         (function_point::get_next): New decl.
3188         * program-state.cc (program_state::prune_for_point): Generalize to
3189         purge local decls as well as SSA names.
3190         (program_state::can_purge_base_region_p): New.
3191         * program-state.h (program_state::can_purge_base_region_p): New
3192         decl.
3193         * region-model.cc (struct append_ssa_names_cb_data): Rename to...
3194         (struct append_regions_cb_data): ...this.
3195         (region_model::get_ssa_name_regions_for_current_frame): Rename
3196         to...
3197         (region_model::get_regions_for_current_frame): ...this, updating
3198         for other renamings.
3199         (region_model::append_ssa_names_cb): Rename to...
3200         (region_model::append_regions_cb): ...this, and drop the requirement
3201         that the subregion be a SSA name.
3202         * region-model.h (struct append_ssa_names_cb_data): Rename decl
3203         to...
3204         (struct append_regions_cb_data): ...this.
3205         (region_model::get_ssa_name_regions_for_current_frame): Rename
3206         decl to...
3207         (region_model::get_regions_for_current_frame): ...this.
3208         (region_model::append_ssa_names_cb): Rename decl to...
3209         (region_model::append_regions_cb): ...this.
3210         * state-purge.cc: Include "tristate.h", "selftest.h",
3211         "analyzer/store.h", "analyzer/region-model.h", and
3212         "gimple-walk.h".
3213         (get_candidate_for_purging): New.
3214         (class gimple_op_visitor): New.
3215         (my_load_cb): New.
3216         (my_store_cb): New.
3217         (my_addr_cb): New.
3218         (state_purge_map::state_purge_map): Add "mgr" param.  Update for
3219         renamings.  Find uses of local variables.
3220         (state_purge_map::~state_purge_map): Update for renaming of m_map
3221         to m_ssa_map.  Clean up m_decl_map.
3222         (state_purge_map::get_or_create_data_for_decl): New.
3223         (state_purge_per_ssa_name::state_purge_per_ssa_name): Update for
3224         inheriting from state_purge_per_tree.
3225         (state_purge_per_ssa_name::add_to_worklist): Likewise.
3226         (state_purge_per_decl::state_purge_per_decl): New.
3227         (state_purge_per_decl::add_needed_at): New.
3228         (state_purge_per_decl::add_pointed_to_at): New.
3229         (state_purge_per_decl::process_worklists): New.
3230         (state_purge_per_decl::add_to_worklist): New.
3231         (same_binding_p): New.
3232         (fully_overwrites_p): New.
3233         (state_purge_per_decl::process_point_backwards): New.
3234         (state_purge_per_decl::process_point_forwards): New.
3235         (state_purge_per_decl::needed_at_point_p): New.
3236         (state_purge_annotator::print_needed): Generalize to print local
3237         decls as well as SSA names.
3238         * state-purge.h (class state_purge_map): Update leading comment.
3239         (state_purge_map::map_t): Rename to...
3240         (state_purge_map::ssa_map_t): ...this.
3241         (state_purge_map::iterator): Rename to...
3242         (state_purge_map::ssa_iterator): ...this.
3243         (state_purge_map::decl_map_t): New typedef.
3244         (state_purge_map::decl_iterator): New typedef.
3245         (state_purge_map::state_purge_map): Add "mgr" param.
3246         (state_purge_map::get_data_for_ssa_name): Update for renaming.
3247         (state_purge_map::get_any_data_for_decl): New.
3248         (state_purge_map::get_or_create_data_for_decl): New decl.
3249         (state_purge_map::begin): Rename to...
3250         (state_purge_map::begin_ssas): ...this.
3251         (state_purge_map::end): Rename to...
3252         (state_purge_map::end_ssa): ...this.
3253         (state_purge_map::begin_decls): New.
3254         (state_purge_map::end_decls): New.
3255         (state_purge_map::m_map): Rename to...
3256         (state_purge_map::m_ssa_map): ...this.
3257         (state_purge_map::m_decl_map): New field.
3258         (class state_purge_per_tree): New class.
3259         (class state_purge_per_ssa_name): Inherit from state_purge_per_tree.
3260         (state_purge_per_ssa_name::get_function): Move to base class.
3261         (state_purge_per_ssa_name::point_set_t): Likewise.
3262         (state_purge_per_ssa_name::m_fun): Likewise.
3263         (class state_purge_per_decl): New.
3264
3265 2022-03-17  David Malcolm  <dmalcolm@redhat.com>
3266
3267         * state-purge.cc (state_purge_annotator::add_node_annotations):
3268         Avoid duplicate before-supernode annotations when returning from
3269         an interprocedural call.  Show after-supernode annotations.
3270
3271 2022-03-17  David Malcolm  <dmalcolm@redhat.com>
3272
3273         * program-point.cc (program_point::get_next): Fix missing
3274         increment of index.
3275
3276 2022-03-16  David Malcolm  <dmalcolm@redhat.com>
3277
3278         PR analyzer/104955
3279         * diagnostic-manager.cc (get_emission_location): New.
3280         (diagnostic_manager::diagnostic_manager): Initialize
3281         m_num_disabled_diagnostics.
3282         (diagnostic_manager::add_diagnostic): Reject diagnostics that
3283         will eventually be rejected due to being disabled.
3284         (diagnostic_manager::emit_saved_diagnostics): Log the number
3285         of disabled diagnostics.
3286         (diagnostic_manager::emit_saved_diagnostic): Split out logic for
3287         determining emission location to get_emission_location.
3288         * diagnostic-manager.h
3289         (diagnostic_manager::m_num_disabled_diagnostics): New field.
3290         * engine.cc (stale_jmp_buf::get_controlling_option): New.
3291         (stale_jmp_buf::emit): Use it.
3292         * pending-diagnostic.h
3293         (pending_diagnostic::get_controlling_option): New vfunc.
3294         * region-model.cc
3295         (poisoned_value_diagnostic::get_controlling_option): New.
3296         (poisoned_value_diagnostic::emit): Use it.
3297         (shift_count_negative_diagnostic::get_controlling_option): New.
3298         (shift_count_negative_diagnostic::emit): Use it.
3299         (shift_count_overflow_diagnostic::get_controlling_option): New.
3300         (shift_count_overflow_diagnostic::emit): Use it.
3301         (dump_path_diagnostic::get_controlling_option): New.
3302         (dump_path_diagnostic::emit): Use it.
3303         (write_to_const_diagnostic::get_controlling_option): New.
3304         (write_to_const_diagnostic::emit): Use it.
3305         (write_to_string_literal_diagnostic::get_controlling_option): New.
3306         (write_to_string_literal_diagnostic::emit): Use it.
3307         * sm-file.cc (double_fclose::get_controlling_option): New.
3308         (double_fclose::emit): Use it.
3309         (file_leak::get_controlling_option): New.
3310         (file_leak::emit): Use it.
3311         * sm-malloc.cc (mismatching_deallocation::get_controlling_option):
3312         New.
3313         (mismatching_deallocation::emit): Use it.
3314         (double_free::get_controlling_option): New.
3315         (double_free::emit): Use it.
3316         (possible_null_deref::get_controlling_option): New.
3317         (possible_null_deref::emit): Use it.
3318         (possible_null_arg::get_controlling_option): New.
3319         (possible_null_arg::emit): Use it.
3320         (null_deref::get_controlling_option): New.
3321         (null_deref::emit): Use it.
3322         (null_arg::get_controlling_option): New.
3323         (null_arg::emit): Use it.
3324         (use_after_free::get_controlling_option): New.
3325         (use_after_free::emit): Use it.
3326         (malloc_leak::get_controlling_option): New.
3327         (malloc_leak::emit): Use it.
3328         (free_of_non_heap::get_controlling_option): New.
3329         (free_of_non_heap::emit): Use it.
3330         * sm-pattern-test.cc (pattern_match::get_controlling_option): New.
3331         (pattern_match::emit): Use it.
3332         * sm-sensitive.cc
3333         (exposure_through_output_file::get_controlling_option): New.
3334         (exposure_through_output_file::emit): Use it.
3335         * sm-signal.cc (signal_unsafe_call::get_controlling_option): New.
3336         (signal_unsafe_call::emit): Use it.
3337         * sm-taint.cc (tainted_array_index::get_controlling_option): New.
3338         (tainted_array_index::emit): Use it.
3339         (tainted_offset::get_controlling_option): New.
3340         (tainted_offset::emit): Use it.
3341         (tainted_size::get_controlling_option): New.
3342         (tainted_size::emit): Use it.
3343         (tainted_divisor::get_controlling_option): New.
3344         (tainted_divisor::emit): Use it.
3345         (tainted_allocation_size::get_controlling_option): New.
3346         (tainted_allocation_size::emit): Use it.
3347
3348 2022-03-15  David Malcolm  <dmalcolm@redhat.com>
3349
3350         * store.cc (store::store): Presize m_cluster_map.
3351
3352 2022-03-10  David Malcolm  <dmalcolm@redhat.com>
3353
3354         PR analyzer/104863
3355         * constraint-manager.cc (constraint_manager::add_constraint):
3356         Refresh the EC IDs when adding constraints implied by offsets.
3357
3358 2022-03-10  David Malcolm  <dmalcolm@redhat.com>
3359
3360         PR analyzer/104793
3361         * analyzer.h (class pending_note): New forward decl.
3362         * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
3363         Initialize m_notes.
3364         (saved_diagnostic::operator==): Compare m_notes.
3365         (saved_diagnostic::add_note): New.
3366         (saved_diagnostic::emit_any_notes): New.
3367         (diagnostic_manager::add_note): New.
3368         (diagnostic_manager::emit_saved_diagnostic): Call emit_any_notes
3369         after emitting the warning.
3370         * diagnostic-manager.h (saved_diagnostic::add_note): New decl.
3371         (saved_diagnostic::emit_any_notes): New decl.
3372         (saved_diagnostic::m_notes): New field.
3373         (diagnostic_manager::add_note): New decl.
3374         * engine.cc (impl_region_model_context::add_note): New.
3375         * exploded-graph.h (impl_region_model_context::add_note): New
3376         decl.
3377         * pending-diagnostic.h (class pending_note): New.
3378         (class pending_note_subclass): New template.
3379         * region-model.cc (class reason_attr_access): New.
3380         (check_external_function_for_access_attr): Add class
3381         annotating_ctxt and use it when checking region.
3382         (noop_region_model_context::add_note): New.
3383         * region-model.h (region_model_context::add_note): New vfunc.
3384         (noop_region_model_context::add_note): New decl.
3385         (class region_model_context_decorator): New.
3386         (class note_adding_context): New.
3387
3388 2022-03-10  David Malcolm  <dmalcolm@redhat.com>
3389
3390         PR analyzer/104793
3391         * region-model.cc
3392         (region_model::check_external_function_for_access_attr): New.
3393         (region_model::handle_unrecognized_call): Call it.
3394         * region-model.h
3395         (region_model::check_external_function_for_access_attr): New decl.
3396         (region_model::handle_unrecognized_call): New decl.
3397
3398 2022-03-10  David Malcolm  <dmalcolm@redhat.com>
3399
3400         * sm-taint.cc (taint_state_machine::check_for_tainted_size_arg):
3401         Avoid generating duplicate saved_diagnostics by only handling the
3402         rdwr_map entry for the ptrarg, not the duplicate entry for the
3403         sizarg.
3404
3405 2022-03-07  David Malcolm  <dmalcolm@redhat.com>
3406
3407         PR analyzer/101983
3408         * engine.cc (returning_from_function_p): New.
3409         (impl_region_model_context::on_state_leak): Use it when rejecting
3410         leaks at the return from "main".
3411
3412 2022-03-07  Jakub Jelinek  <jakub@redhat.com>
3413
3414         * store.cc: Fix up duplicated word issue in a comment.
3415         * analyzer.cc: Likewise.
3416         * engine.cc: Likewise.
3417         * sm-taint.cc: Likewise.
3418
3419 2022-03-04  David Malcolm  <dmalcolm@redhat.com>
3420
3421         PR analyzer/103521
3422         * analyzer.opt (-param=analyzer-max-svalue-depth=): Reduce from 13
3423         to 12.
3424
3425 2022-02-23  David Malcolm  <dmalcolm@redhat.com>
3426
3427         PR analyzer/104434
3428         * analyzer.h (class const_fn_result_svalue): New decl.
3429         * region-model-impl-calls.cc (call_details::get_manager): New.
3430         * region-model-manager.cc
3431         (region_model_manager::get_or_create_const_fn_result_svalue): New.
3432         (region_model_manager::log_stats): Log
3433         m_const_fn_result_values_map.
3434         * region-model.cc (const_fn_p): New.
3435         (maybe_get_const_fn_result): New.
3436         (region_model::on_call_pre): Handle fndecls with
3437         __attribute__((const)) by calling the above rather than making
3438         a conjured_svalue.
3439         * region-model.h (visitor::visit_const_fn_result_svalue): New.
3440         (region_model_manager::get_or_create_const_fn_result_svalue): New
3441         decl.
3442         (region_model_manager::const_fn_result_values_map_t): New typedef.
3443         (region_model_manager::m_const_fn_result_values_map): New field.
3444         (call_details::get_manager): New decl.
3445         * svalue.cc (svalue::cmp_ptr): Handle SK_CONST_FN_RESULT.
3446         (const_fn_result_svalue::dump_to_pp): New.
3447         (const_fn_result_svalue::dump_input): New.
3448         (const_fn_result_svalue::accept): New.
3449         * svalue.h (enum svalue_kind): Add SK_CONST_FN_RESULT.
3450         (svalue::dyn_cast_const_fn_result_svalue): New.
3451         (class const_fn_result_svalue): New.
3452         (is_a_helper <const const_fn_result_svalue *>::test): New.
3453         (template <> struct default_hash_traits<const_fn_result_svalue::key_t>):
3454         New.
3455
3456 2022-02-17  David Malcolm  <dmalcolm@redhat.com>
3457
3458         PR analyzer/104576
3459         * region-model.cc: Include "calls.h".
3460         (region_model::on_call_pre): Use flags_from_decl_or_type to
3461         generalize check for DECL_PURE_P to also check for ECF_CONST.
3462
3463 2022-02-16  David Malcolm  <dmalcolm@redhat.com>
3464
3465         PR analyzer/104560
3466         * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
3467         Add region creation events for globals of interest.
3468         (null_assignment_sm_context::get_old_program_state): New.
3469         (diagnostic_manager::add_events_for_eedge): Move check for
3470         changing dynamic extents from PK_BEFORE_STMT case to after the
3471         switch on the dst_point's kind so that we can emit them for the
3472         final stmt in a basic block.
3473         * engine.cc (impl_sm_context::get_old_program_state): New.
3474         * sm-malloc.cc (malloc_state_machine::get_default_state): Rewrite
3475         detection of m_non_heap to use get_memory_space.
3476         (free_of_non_heap::free_of_non_heap): Add freed_reg param.
3477         (free_of_non_heap::subclass_equal_p): Update for changes to
3478         fields.
3479         (free_of_non_heap::emit): Drop m_kind in favor of
3480         get_memory_space.
3481         (free_of_non_heap::describe_state_change): Remove logic for
3482         detecting alloca.
3483         (free_of_non_heap::mark_interesting_stuff): Add region-creation of
3484         m_freed_reg.
3485         (free_of_non_heap::get_memory_space): New.
3486         (free_of_non_heap::kind): Drop enum.
3487         (free_of_non_heap::m_freed_reg): New field.
3488         (free_of_non_heap::m_kind): Drop field.
3489         (malloc_state_machine::on_stmt): Drop transition to m_non_heap.
3490         (malloc_state_machine::handle_free_of_non_heap): New function,
3491         split out from on_deallocator_call and on_realloc_call, adding
3492         detection of the freed region.
3493         (malloc_state_machine::on_deallocator_call): Use it.
3494         (malloc_state_machine::on_realloc_call): Likewise.
3495         * sm.h (sm_context::get_old_program_state): New vfunc.
3496
3497 2022-02-15  David Malcolm  <dmalcolm@redhat.com>
3498
3499         PR analyzer/104524
3500         * region-model-manager.cc
3501         (region_model_manager::maybe_fold_sub_svalue): Only call
3502         get_or_create_cast if type is non-NULL.
3503
3504 2022-02-15  David Malcolm  <dmalcolm@redhat.com>
3505
3506         PR analyzer/102692
3507         * exploded-graph.h (impl_region_model_context::get_stmt): New.
3508         * region-model.cc: Include "gimple-ssa.h", "tree-phinodes.h",
3509         "tree-ssa-operands.h", and "ssa-iterators.h".
3510         (within_short_circuited_stmt_p): New.
3511         (region_model::check_for_poison): Don't warn about uninit values
3512         if within_short_circuited_stmt_p.
3513         * region-model.h (region_model_context::get_stmt): New vfunc.
3514         (noop_region_model_context::get_stmt): New.
3515
3516 2022-02-11  David Malcolm  <dmalcolm@redhat.com>
3517
3518         PR analyzer/104274
3519         * region-model.cc (region_model::check_for_poison): Ignore
3520         uninitialized uses of empty types.
3521
3522 2022-02-10  David Malcolm  <dmalcolm@redhat.com>
3523
3524         PR analyzer/98797
3525         * region-model-manager.cc
3526         (region_model_manager::maybe_fold_sub_svalue): Generalize getting
3527         individual chars of a STRING_CST from element_region to any
3528         subregion which is a concrete access of a single byte from its
3529         parent region.
3530         * region.cc (region::get_relative_concrete_byte_range): New.
3531         * region.h (region::get_relative_concrete_byte_range): New decl.
3532
3533 2022-02-09  David Malcolm  <dmalcolm@redhat.com>
3534
3535         PR analyzer/104452
3536         * region-model.cc (selftest::test_bit_range_regions): New.
3537         (selftest::analyzer_region_model_cc_tests): Call it.
3538         * region.h (bit_range_region::key_t::hash): Fix hashing of m_bits
3539         to avoid using uninitialized data.
3540
3541 2022-02-07  David Malcolm  <dmalcolm@redhat.com>
3542
3543         PR analyzer/104417
3544         * sm-taint.cc (tainted_allocation_size::tainted_allocation_size):
3545         Remove overzealous assertion.
3546         (tainted_allocation_size::emit): Likewise.
3547         (region_model::check_dynamic_size_for_taint): Likewise.
3548
3549 2022-02-07  David Malcolm  <dmalcolm@redhat.com>
3550
3551         PR analyzer/103872
3552         * region-model-impl-calls.cc (region_model::impl_call_memcpy):
3553         Reimplement in terms of a get_store_value followed by a set_value.
3554
3555 2022-02-03  David Malcolm  <dmalcolm@redhat.com>
3556
3557         PR analyzer/104369
3558         * engine.cc (exploded_graph::process_node): Use the node for any
3559         diagnostics, avoiding ICE if a bifurcation update adds a
3560         saved_diagnostic, such as for a tainted realloc size.
3561         * region-model-impl-calls.cc
3562         (region_model::impl_call_realloc::success_no_move::update_model):
3563         Require the old pointer to be non-NULL to be able successfully
3564         grow in place.  Use model->deref_rvalue rather than maybe_get_region
3565         to support the old pointer being symbolic.
3566         (region_model::impl_call_realloc::success_with_move::update_model):
3567         Likewise.  Add a constraint that the new pointer != the old pointer.
3568         Use a sized_region when setting the value of the new region.
3569         Handle the case where we don't know the dynamic size of the old
3570         region by marking the new region as unknown.
3571         * sm-taint.cc (tainted_allocation_size::tainted_allocation_size):
3572         Update assertion to also allow for MEMSPACE_UNKNOWN.
3573         (tainted_allocation_size::emit): Likewise.
3574         (region_model::check_dynamic_size_for_taint): Likewise.
3575
3576 2022-02-03  David Malcolm  <dmalcolm@redhat.com>
3577
3578         * region-model-impl-calls.cc (region_model::impl_call_calloc): Use
3579         a sized_region when calling zero_fill_region.
3580
3581 2022-02-02  David Malcolm  <dmalcolm@redhat.com>
3582
3583         * region-model.cc (region_model::on_return): Replace usage of
3584         copy_region with get_rvalue/set_value pair.
3585         (region_model::pop_frame): Likewise.
3586         (selftest::test_compound_assignment): Likewise.
3587         * region-model.h (region_model::copy_region): Delete decl.
3588         * region.cc (region_model::copy_region): Delete.
3589
3590 2022-02-02  David Malcolm  <dmalcolm@redhat.com>
3591
3592         * region.cc (region::calc_offset): Consolidate effectively
3593         identical cases.
3594
3595 2022-02-02  David Malcolm  <dmalcolm@redhat.com>
3596
3597         * analyzer.h (class bit_range_region): New forward decl.
3598         * region-model-manager.cc (region_model_manager::get_bit_range):
3599         New.
3600         (region_model_manager::log_stats): Handle m_bit_range_regions.
3601         * region-model.cc (region_model::get_lvalue_1): Handle
3602         BIT_FIELD_REF.
3603         * region-model.h (region_model_manager::get_bit_range): New decl.
3604         (region_model_manager::m_bit_range_regions): New field.
3605         * region.cc (region::get_base_region): Handle RK_BIT_RANGE.
3606         (region::base_region_p): Likewise.
3607         (region::calc_offset): Likewise.
3608         (bit_range_region::dump_to_pp): New.
3609         (bit_range_region::get_byte_size): New.
3610         (bit_range_region::get_bit_size): New.
3611         (bit_range_region::get_byte_size_sval): New.
3612         (bit_range_region::get_relative_concrete_offset): New.
3613         * region.h (enum region_kind): Add RK_BIT_RANGE.
3614         (region::dyn_cast_bit_range_region): New vfunc.
3615         (class bit_range_region): New.
3616         (is_a_helper <const bit_range_region *>::test): New.
3617         (default_hash_traits<bit_range_region::key_t>): New.
3618
3619 2022-02-02  David Malcolm  <dmalcolm@redhat.com>
3620
3621         PR analyzer/104270
3622         * region-model.cc (region_model::on_call_pre): Handle
3623         IFN_DEFERRED_INIT.
3624
3625 2022-01-27  David Malcolm  <dmalcolm@redhat.com>
3626
3627         * checker-path.cc (event_kind_to_string): Handle
3628         EK_REGION_CREATION.
3629         (region_creation_event::region_creation_event): New.
3630         (region_creation_event::get_desc): New.
3631         (checker_path::add_region_creation_event): New.
3632         * checker-path.h (enum event_kind): Add EK_REGION_CREATION.
3633         (class region_creation_event): New subclass.
3634         (checker_path::add_region_creation_event): New decl.
3635         * diagnostic-manager.cc
3636         (diagnostic_manager::emit_saved_diagnostic): Pass NULL for new
3637         param to add_events_for_eedge when handling trailing eedge.
3638         (diagnostic_manager::build_emission_path): Create an interesting_t
3639         instance, allow the pending diagnostic to populate it, and pass it
3640         to the calls to add_events_for_eedge.
3641         (diagnostic_manager::add_events_for_eedge): Add "interest" param.
3642         Use it to add region_creation_events for on-stack regions created
3643         within at function entry, and when pertinent dynamically-sized
3644         regions are created.
3645         (diagnostic_manager::prune_for_sm_diagnostic): Add case for
3646         EK_REGION_CREATION.
3647         * diagnostic-manager.h (diagnostic_manager::add_events_for_eedge):
3648         Add "interest" param.
3649         * pending-diagnostic.cc: Include "selftest.h", "tristate.h",
3650         "analyzer/call-string.h", "analyzer/program-point.h",
3651         "analyzer/store.h", and "analyzer/region-model.h".
3652         (interesting_t::add_region_creation): New.
3653         (interesting_t::dump_to_pp): New.
3654         * pending-diagnostic.h (struct interesting_t): New.
3655         (pending_diagnostic::mark_interesting_stuff): New vfunc.
3656         * region-model.cc
3657         (poisoned_value_diagnostic::poisoned_value_diagnostic): Add
3658         (poisoned_value_diagnostic::operator==): Compare m_pkind and
3659         m_src_region fields.
3660         (poisoned_value_diagnostic::mark_interesting_stuff): New.
3661         (poisoned_value_diagnostic::m_src_region): New.
3662         (region_model::check_for_poison): Call
3663         get_region_for_poisoned_expr for uninit values and pass the resul
3664         to the diagnostic.
3665         (region_model::get_region_for_poisoned_expr): New.
3666         (region_model::deref_rvalue): Pass NULL for
3667         poisoned_value_diagnostic's src_region.
3668         * region-model.h (region_model::get_region_for_poisoned_expr): New
3669         decl.
3670         * region.h (frame_region::get_fndecl): New.
3671
3672 2022-01-27  Martin Liska  <mliska@suse.cz>
3673
3674         PR analyzer/104247
3675         * constraint-manager.cc (bounded_ranges_manager::log_stats):
3676         Cast to long for format purpose.
3677         * region-model-manager.cc (log_uniq_map): Likewise.
3678
3679 2022-01-26  David Malcolm  <dmalcolm@redhat.com>
3680
3681         PR analyzer/104224
3682         * region-model.cc (region_model::check_call_args): New.
3683         (region_model::on_call_pre): Call it when ignoring stdio builtins.
3684         * region-model.h (region_model::check_call_args): New decl
3685
3686 2022-01-26  David Malcolm  <dmalcolm@redhat.com>
3687
3688         PR analyzer/94362
3689         * constraint-manager.cc (range::add_bound): Fix tests for
3690         discarding redundant constraints.  Perform test for rejecting
3691         unsatisfiable constraints earlier so that they don't update
3692         the object on failure.
3693         (selftest::test_range): New.
3694         (selftest::test_constant_comparisons): Add test coverage for
3695         existing constraints becoming narrower until they are
3696         unsatisfiable.
3697         (selftest::run_constraint_manager_tests): Call test_range.
3698
3699 2022-01-22  David Malcolm  <dmalcolm@redhat.com>
3700
3701         PR analyzer/104159
3702         * region-model-manager.cc
3703         (region_model_manager::get_or_create_cast): Bail out if the types
3704         are the same.  Don't attempt to handle casts involving vector
3705         types.
3706
3707 2022-01-20  David Malcolm  <dmalcolm@redhat.com>
3708
3709         PR analyzer/94362
3710         * constraint-manager.cc (bound::ensure_closed): Convert param to
3711         enum bound_kind.
3712         (range::constrained_to_single_element): Likewise.
3713         (range::add_bound): New.
3714         (constraint_manager::add_constraint): Handle SVAL + OFFSET
3715         compared to a constant.
3716         (constraint_manager::get_ec_bounds): Rewrite in terms of
3717         range::add_bound.
3718         (constraint_manager::eval_condition): Reject if range::add_bound
3719         fails.
3720         (selftest::test_constant_comparisons): Add test coverage for
3721         various impossible combinations of integer comparisons.
3722         * constraint-manager.h (enum bound_kind): New.
3723         (struct bound): Likewise.
3724         (bound::ensure_closed): Convert to param to enum bound_kind.
3725         (struct range): Convert to...
3726         (class range): ...this, making fields private.
3727         (range::add_bound): New decls.
3728         * region-model.cc (region_model::add_constraint): Fail if
3729         constraint_manager::add_constraint fails.
3730
3731 2022-01-18  David Malcolm  <dmalcolm@redhat.com>
3732
3733         PR analyzer/104089
3734         * region-model-manager.cc
3735         (region_model_manager::get_or_create_constant_svalue): Assert that
3736         we have a CONSTANT_CLASS_P.
3737         (region_model_manager::maybe_fold_unaryop): Only fold a constant
3738         when fold_unary's result is a constant or a cast of a constant.
3739
3740 2022-01-18  David Malcolm  <dmalcolm@redhat.com>
3741
3742         PR analyzer/104062
3743         * region-model-manager.cc
3744         (region_model_manager::maybe_fold_sub_svalue): Avoid casting to
3745         NULL type when folding access to repeated svalue.
3746
3747 2022-01-17  Martin Liska  <mliska@suse.cz>
3748
3749         * analyzer.cc (is_special_named_call_p): Rename .c names to .cc.
3750         (is_named_call_p): Likewise.
3751         * region-model-asm.cc (deterministic_p): Likewise.
3752         * region.cc (field_region::get_relative_concrete_offset): Likewise.
3753         * sm-malloc.cc (method_p): Likewise.
3754         * supergraph.cc (superedge::dump_dot): Likewise.
3755
3756 2022-01-14  David Malcolm  <dmalcolm@redhat.com>
3757
3758         * sm-taint.cc (taint_state_machine::combine_states): Handle combination
3759         of has_ub and has_lb.
3760
3761 2022-01-14  David Malcolm  <dmalcolm@redhat.com>
3762
3763         PR analyzer/104029
3764         * sm-taint.cc (taint_state_machine::alt_get_inherited_state):
3765         Remove gcc_unreachable from default case for unary ops.
3766
3767 2022-01-14  David Malcolm  <dmalcolm@redhat.com>
3768
3769         * engine.cc: Include "stringpool.h", "attribs.h", and
3770         "tree-dfa.h".
3771         (mark_params_as_tainted): New.
3772         (class tainted_args_function_custom_event): New.
3773         (class tainted_args_function_info): New.
3774         (exploded_graph::add_function_entry): Handle functions with
3775         "tainted_args" attribute.
3776         (class tainted_args_field_custom_event): New.
3777         (class tainted_args_callback_custom_event): New.
3778         (class tainted_args_call_info): New.
3779         (add_tainted_args_callback): New.
3780         (add_any_callbacks): New.
3781         (exploded_graph::build_initial_worklist): Likewise.
3782         (exploded_graph::build_initial_worklist): Find callbacks that are
3783         reachable from global initializers, calling add_any_callbacks on
3784         them.
3785
3786 2022-01-12  David Malcolm  <dmalcolm@redhat.com>
3787
3788         PR analyzer/103940
3789         * engine.cc (impl_sm_context::impl_sm_context): Add
3790         "unknown_side_effects" param and use it to initialize
3791         new m_unknown_side_effects field.
3792         (impl_sm_context::unknown_side_effects_p): New.
3793         (impl_sm_context::m_unknown_side_effects): New.
3794         (exploded_node::on_stmt): Pass unknown_side_effects to sm_ctxt
3795         ctor.
3796         * sm-taint.cc: Include "stringpool.h" and "attribs.h".
3797         (tainted_size::tainted_size): Drop "dir" param.
3798         (tainted_size::get_kind): Drop "FINAL".
3799         (tainted_size::emit): Likewise.
3800         (tainted_size::m_dir): Drop unused field.
3801         (class tainted_access_attrib_size): New subclass.
3802         (taint_state_machine::on_stmt): Call check_for_tainted_size_arg on
3803         external functions with unknown side effects.
3804         (taint_state_machine::check_for_tainted_size_arg): New.
3805         (region_model::check_region_for_taint): Drop "dir" param from
3806         tainted_size ctor.
3807         * sm.h (sm_context::unknown_side_effects_p): New.
3808
3809 2022-01-11  David Malcolm  <dmalcolm@redhat.com>
3810
3811         PR analyzer/102692
3812         * diagnostic-manager.cc
3813         (class auto_disable_complexity_checks): Rename to...
3814         (class auto_checking_feasibility): ...this, updating
3815         the calls accordingly.
3816         (epath_finder::explore_feasible_paths): Update for renaming.
3817         * region-model-manager.cc
3818         (region_model_manager::region_model_manager): Update for change from
3819         m_check_complexity to m_checking_feasibility.
3820         (region_model_manager::reject_if_too_complex): Likewise.
3821         (region_model_manager::get_or_create_unknown_svalue): Handle
3822         m_checking_feasibility.
3823         (region_model_manager::create_unique_svalue): New.
3824         (region_model_manager::maybe_fold_binop): Handle BIT_AND_EXPR and
3825         BIT_IOR_EXPRs on booleans where we know the result.
3826         * region-model.cc (test_binop_svalue_folding): Add test coverage
3827         for the above.
3828         * region-model.h (region_model_manager::create_unique_svalue): New
3829         decl.
3830         (region_model_manager::enable_complexity_check): Replace with...
3831         (region_model_manager::begin_checking_feasibility): ...this.
3832         (region_model_manager::disable_complexity_check): Replace with...
3833         (region_model_manager::end_checking_feasibility): ...this.
3834         (region_model_manager::m_check_complexity): Replace with...
3835         (region_model_manager::m_checking_feasibility): ...this.
3836         (region_model_manager::m_managed_dynamic_svalues): New field.
3837
3838 2022-01-08  David Malcolm  <dmalcolm@redhat.com>
3839
3840         * engine.cc (impl_run_checkers): Pass logger to engine ctor.
3841         * region-model-manager.cc
3842         (region_model_manager::region_model_manager): Add logger param and
3843         use it to initialize m_logger.
3844         * region-model.cc (engine::engine): New.
3845         * region-model.h (region_model_manager::region_model_manager):
3846         Add logger param.
3847         (region_model_manager::get_logger): New.
3848         (region_model_manager::m_logger): New field.
3849         (engine::engine): New.
3850         * store.cc (store_manager::get_logger): New.
3851         (store::set_value): Log scope.  Log when marking a cluster as
3852         unknown due to possible aliasing.
3853         * store.h (store_manager::get_logger): New decl.
3854
3855 2022-01-08  David Malcolm  <dmalcolm@redhat.com>
3856
3857         * region-model-impl-calls.cc (cmp_decls): New.
3858         (cmp_decls_ptr_ptr): New.
3859         (region_model::impl_call_analyzer_dump_escaped): New.
3860         * region-model.cc (region_model::on_stmt_pre): Handle
3861         __analyzer_dump_escaped.
3862         * region-model.h (region_model::impl_call_analyzer_dump_escaped):
3863         New decl.
3864         * store.h (binding_cluster::get_base_region): New accessor.
3865
3866 2022-01-08  David Malcolm  <dmalcolm@redhat.com>
3867
3868         * region.cc (region::is_named_decl_p): New.
3869         * region.h (region::is_named_decl_p): New decl.
3870
3871 2022-01-06  David Malcolm  <dmalcolm@redhat.com>
3872
3873         PR analyzer/103546
3874         * store.cc (store::eval_alias_1): Refactor handling of decl
3875         regions, adding a test for may_be_aliased, rejecting those for
3876         which it returns false.
3877
3878 2021-12-12  Jonathan Wakely  <jwakely@redhat.com>
3879
3880         * engine.cc: Define INCLUDE_MEMORY instead of INCLUDE_UNIQUE_PTR.
3881
3882 2021-12-06  David Malcolm  <dmalcolm@redhat.com>
3883
3884         PR analyzer/103533
3885         * constraint-manager.cc (equiv_class::contains_non_constant_p):
3886         New.
3887         (constraint_manager::canonicalize): Call it when determining
3888         redundant ECs.
3889         (selftest::test_purging): New selftest.
3890         (selftest::run_constraint_manager_tests): Likewise.
3891         * constraint-manager.h (equiv_class::contains_non_constant_p):
3892         New decl.
3893
3894 2021-12-01  David Malcolm  <dmalcolm@redhat.com>
3895
3896         PR analyzer/102471
3897         * region-model-reachability.cc (reachable_regions::handle_parm):
3898         Treat all svalues within a compound parm has reachable, and those
3899         wrapped in a cast.
3900
3901 2021-11-29  David Malcolm  <dmalcolm@redhat.com>
3902
3903         PR analyzer/103217
3904         * store.cc (binding_cluster::can_merge_p): For the "key is bound"
3905         vs "key is not bound" merger case, check that the bound svalue
3906         is mergeable before merging it to "unknown", rejecting the merger
3907         otherwise.
3908
3909 2021-11-19  David Malcolm  <dmalcolm@redhat.com>
3910
3911         PR analyzer/103217
3912         * engine.cc (exploded_graph::get_or_create_node): Pass in
3913         m_ext_state to program_state::can_merge_with_p.
3914         (exploded_graph::process_worklist): Likewise.
3915         (exploded_graph::maybe_process_run_of_before_supernode_enodes):
3916         Likewise.
3917         (exploded_graph::process_node): Add missing call to detect_leaks
3918         when handling phi nodes.
3919         * program-state.cc (program_state::can_merge_with_p): Add
3920         "ext_state" param.  Pass it and state ptrs to
3921         region_model::can_merge_with_p.
3922         (selftest::test_program_state_merging): Update for new ext_state
3923         param of program_state::can_merge_with_p.
3924         (selftest::test_program_state_merging_2): Likewise.
3925         * program-state.h (program_state::can_purge_p): Make const.
3926         (program_state::can_merge_with_p): Add "ext_state" param.
3927         * region-model.cc: Include "analyzer/program-state.h".
3928         (region_model::can_merge_with_p): Add params "ext_state",
3929         "state_a", and "state_b", use them when creating model_merger
3930         object.
3931         (model_merger::mergeable_svalue_p): New.
3932         * region-model.h (region_model::can_merge_with_p): Add params
3933         "ext_state", "state_a", and "state_b".
3934         (model_merger::model_merger) Likewise, initializing new fields.
3935         (model_merger::mergeable_svalue_p): New decl.
3936         (model_merger::m_ext_state): New field.
3937         (model_merger::m_state_a): New field.
3938         (model_merger::m_state_b): New field.
3939         * svalue.cc (svalue::can_merge_p): Call
3940         model_merger::mergeable_svalue_p on both states and reject the
3941         merger accordingly.
3942
3943 2021-11-17  David Malcolm  <dmalcolm@redhat.com>
3944
3945         PR analyzer/102695
3946         * region-model-impl-calls.cc (region_model::impl_call_strchr): New.
3947         * region-model-manager.cc
3948         (region_model_manager::maybe_fold_unaryop): Simplify cast to
3949         pointer type of an existing pointer to a region.
3950         * region-model.cc (region_model::on_call_pre): Handle
3951         BUILT_IN_STRCHR and "strchr".
3952         (write_to_const_diagnostic::emit): Add auto_diagnostic_group.  Add
3953         alternate wordings for functions and labels.
3954         (write_to_const_diagnostic::describe_final_event): Add alternate
3955         wordings for functions and labels.
3956         (region_model::check_for_writable_region): Handle RK_FUNCTION and
3957         RK_LABEL.
3958         * region-model.h (region_model::impl_call_strchr): New decl.
3959
3960 2021-11-16  David Malcolm  <dmalcolm@redhat.com>
3961
3962         PR analyzer/102662
3963         * constraint-manager.cc (bounded_range::operator==): Require the
3964         types to be the same for equality.
3965
3966 2021-11-13  David Malcolm  <dmalcolm@redhat.com>
3967
3968         * analyzer.opt (Wanalyzer-tainted-allocation-size): New.
3969         (Wanalyzer-tainted-divisor): New.
3970         (Wanalyzer-tainted-offset): New.
3971         (Wanalyzer-tainted-size): New.
3972         * engine.cc (impl_region_model_context::get_taint_map): New.
3973         * exploded-graph.h (impl_region_model_context::get_taint_map):
3974         New decl.
3975         * program-state.cc (sm_state_map::get_state): Call
3976         alt_get_inherited_state.
3977         (sm_state_map::impl_set_state): Modify states within
3978         compound svalues.
3979         (program_state::impl_call_analyzer_dump_state): Undo casts.
3980         (selftest::test_program_state_1): Update for new context param of
3981         create_region_for_heap_alloc.
3982         (selftest::test_program_state_merging): Likewise.
3983         * region-model-impl-calls.cc (region_model::impl_call_alloca):
3984         Likewise.
3985         (region_model::impl_call_calloc): Likewise.
3986         (region_model::impl_call_malloc): Likewise.
3987         (region_model::impl_call_operator_new): Likewise.
3988         (region_model::impl_call_realloc): Likewise.
3989         * region-model.cc (region_model::check_region_access): Call
3990         check_region_for_taint.
3991         (region_model::get_representative_path_var_1): Handle binops.
3992         (region_model::create_region_for_heap_alloc): Add "ctxt" param and
3993         pass it to set_dynamic_extents.
3994         (region_model::create_region_for_alloca): Likewise.
3995         (region_model::set_dynamic_extents): Add "ctxt" param and use it
3996         to call check_dynamic_size_for_taint.
3997         (selftest::test_state_merging): Update for new context param of
3998         create_region_for_heap_alloc.
3999         (selftest::test_malloc_constraints): Likewise.
4000         (selftest::test_malloc): Likewise.
4001         (selftest::test_alloca): Likewise for create_region_for_alloca.
4002         * region-model.h (region_model::create_region_for_heap_alloc): Add
4003         "ctxt" param.
4004         (region_model::create_region_for_alloca): Likewise.
4005         (region_model::set_dynamic_extents): Likewise.
4006         (region_model::check_dynamic_size_for_taint): New decl.
4007         (region_model::check_region_for_taint): New decl.
4008         (region_model_context::get_taint_map): New vfunc.
4009         (noop_region_model_context::get_taint_map): New.
4010         * sm-taint.cc: Remove include of "diagnostic-event-id.h"; add
4011         includes of "gimple-iterator.h", "tristate.h", "selftest.h",
4012         "ordered-hash-map.h", "cgraph.h", "cfg.h", "digraph.h",
4013         "analyzer/supergraph.h", "analyzer/call-string.h",
4014         "analyzer/program-point.h", "analyzer/store.h",
4015         "analyzer/region-model.h", and "analyzer/program-state.h".
4016         (enum bounds): Move to top of file.
4017         (class taint_diagnostic): New.
4018         (class tainted_array_index): Convert to subclass of taint_diagnostic.
4019         (tainted_array_index::emit): Add CWE-129.  Reword warning to use
4020         "attacker-controlled" rather than "tainted".
4021         (tainted_array_index::describe_state_change): Move to
4022         taint_diagnostic::describe_state_change.
4023         (tainted_array_index::describe_final_event): Reword to use
4024         "attacker-controlled" rather than "tainted".
4025         (class tainted_offset): New.
4026         (class tainted_size): New.
4027         (class tainted_divisor): New.
4028         (class tainted_allocation_size): New.
4029         (taint_state_machine::alt_get_inherited_state): New.
4030         (taint_state_machine::on_stmt): In assignment handling, remove
4031         ARRAY_REF handling in favor of check_region_for_taint.  Add
4032         detection of tainted divisors.
4033         (taint_state_machine::get_taint): New.
4034         (taint_state_machine::combine_states): New.
4035         (region_model::check_region_for_taint): New.
4036         (region_model::check_dynamic_size_for_taint): New.
4037         * sm.h (state_machine::alt_get_inherited_state): New.
4038
4039 2021-11-12  David Malcolm  <dmalcolm@redhat.com>
4040
4041         * engine.cc (exploded_node::on_stmt_pre): Return when handling
4042         "__analyzer_dump_state".
4043
4044 2021-11-11  Richard Biener  <rguenther@suse.de>
4045
4046         * supergraph.cc: Include bitmap.h.
4047
4048 2021-11-04  David Malcolm  <dmalcolm@redhat.com>
4049
4050         * program-state.cc (sm_state_map::dump): Use default_tree_printer
4051         as format decoder.
4052
4053 2021-09-16  Maxim Blinov  <maxim.blinov@embecosm.com>
4054
4055         PR bootstrap/102242
4056         * engine.cc (INCLUDE_UNIQUE_PTR): Define.
4057
4058 2021-09-08  David Malcolm  <dmalcolm@redhat.com>
4059
4060         PR analyzer/102225
4061         * analyzer.h (compat_types_p): New decl.
4062         * constraint-manager.cc
4063         (constraint_manager::get_or_add_equiv_class): Guard against NULL
4064         type when checking for pointer types.
4065         * region-model-impl-calls.cc (region_model::impl_call_realloc):
4066         Guard against NULL lhs type/region.  Guard against the size value
4067         not being of a compatible type for dynamic extents.
4068         * region-model.cc (compat_types_p): Make non-static.
4069
4070 2021-08-30  David Malcolm  <dmalcolm@redhat.com>
4071
4072         PR analyzer/99260
4073         * analyzer.h (class custom_edge_info): New class, adapted from
4074         exploded_edge::custom_info_t.  Make member functions const.
4075         Make update_model return bool, converting edge param from
4076         reference to a pointer, and adding a ctxt param.
4077         (class path_context): New class.
4078         * call-info.cc: New file.
4079         * call-info.h: New file.
4080         * engine.cc: Include "analyzer/call-info.h" and <memory>.
4081         (impl_region_model_context::impl_region_model_context): Update for
4082         new m_path_ctxt field.
4083         (impl_region_model_context::bifurcate): New.
4084         (impl_region_model_context::terminate_path): New.
4085         (impl_region_model_context::get_malloc_map): New.
4086         (impl_sm_context::impl_sm_context): Update for new m_path_ctxt
4087         field.
4088         (impl_sm_context::get_fndecl_for_call): Likewise.
4089         (impl_sm_context::set_next_state): Likewise.
4090         (impl_sm_context::warn): Likewise.
4091         (impl_sm_context::is_zero_assignment): Likewise.
4092         (impl_sm_context::get_path_context): New.
4093         (impl_sm_context::m_path_ctxt): New.
4094         (impl_region_model_context::on_condition): Update for new
4095         path_ctxt param.  Handle m_enode_for_diag being NULL.
4096         (impl_region_model_context::on_phi): Update for new path_ctxt
4097         param.
4098         (exploded_node::on_stmt): Add path_ctxt param, updating ctor calls
4099         to use it as necessary.  Use it to bail out after sm-handling,
4100         if needed.
4101         (exploded_node::detect_leaks): Update for new path_ctxt param.
4102         (dynamic_call_info_t::update_model): Update for conversion of
4103         exploded_edge::custom_info_t to custom_edge_info.
4104         (dynamic_call_info_t::add_events_to_path): Likewise.
4105         (rewind_info_t::update_model): Likewise.
4106         (rewind_info_t::add_events_to_path): Likewise.
4107         (exploded_edge::exploded_edge): Likewise.
4108         (exploded_graph::add_edge): Likewise.
4109         (exploded_graph::maybe_process_run_of_before_supernode_enodes):
4110         Update for new path_ctxt param.
4111         (class impl_path_context): New.
4112         (exploded_graph::process_node): Update for new path_ctxt param.
4113         Create an impl_path_context and pass it to exploded_node::on_stmt.
4114         Use it to terminate iterating stmts if terminate_path is called
4115         on it.  After processing a run of stmts, query path_ctxt to
4116         potentially terminate the analysis path, and/or to "bifurcate" the
4117         analysis into multiple additional paths.
4118         (feasibility_state::maybe_update_for_edge): Update for new
4119         update_model ctxt param.
4120         * exploded-graph.h
4121         (impl_region_model_context::impl_region_model_context): Add
4122         path_ctxt param.
4123         (impl_region_model_context::bifurcate): New.
4124         (impl_region_model_context::terminate_path): New
4125         (impl_region_model_context::get_ext_state): New.
4126         (impl_region_model_context::get_malloc_map): New.
4127         (impl_region_model_context::m_path_ctxt): New field.
4128         (exploded_node::on_stmt): Add path_ctxt param.
4129         (class exploded_edge::custom_info_t): Move to analyzer.h, renaming
4130         to custom_edge_info, and making the changes as noted in analyzer.h
4131         above.
4132         (exploded_edge::exploded_edge): Update for these changes to
4133         exploded_edge::custom_info_t.
4134         (exploded_edge::m_custom_info): Likewise.
4135         (class dynamic_call_info_t): Likewise.
4136         (class rewind_info_t): Likewise.
4137         (exploded_graph::add_edge): Likewise.
4138         * program-state.cc (program_state::on_edge): Update for new
4139         path_ctxt param.
4140         (program_state::push_call): Likewise.
4141         (program_state::returning_call): Likewise.
4142         (program_state::prune_for_point): Likewise.
4143         * region-model-impl-calls.cc: Include "analyzer/call-info.h".
4144         (call_details::get_fndecl_for_call): New.
4145         (region_model::impl_call_realloc): Reimplement.
4146         * region-model.cc (region_model::on_call_pre): Move call to
4147         impl_call_realloc to...
4148         (region_model::on_call_post): ...here.  Consolidate creation
4149         of call_details instance.
4150         (noop_region_model_context::bifurcate): New.
4151         (noop_region_model_context::terminate_path): New.
4152         * region-model.h (call_details::get_call_stmt): New.
4153         (call_details::get_fndecl_for_call): New.
4154         (region_model::on_realloc_with_move): New.
4155         (region_model_context::bifurcate): New.
4156         (region_model_context::terminate_path): New.
4157         (region_model_context::get_ext_state): New.
4158         (region_model_context::get_malloc_map): New.
4159         (noop_region_model_context::bifurcate): New.
4160         (noop_region_model_context::terminate_path): New.
4161         (noop_region_model_context::get_ext_state): New.
4162         (noop_region_model_context::get_malloc_map): New.
4163         * sm-malloc.cc: Include "analyzer/program-state.h".
4164         (malloc_state_machine::on_realloc_call): Reimplement.
4165         (malloc_state_machine::on_realloc_with_move): New.
4166         (region_model::on_realloc_with_move): New.
4167         * sm-signal.cc (class signal_delivery_edge_info_t): Update for
4168         conversion from exploded_edge::custom_info_t to custom_edge_info.
4169         * sm.h (sm_context::get_path_context): New.
4170         * svalue.cc (svalue::maybe_get_constant): Call
4171         unwrap_any_unmergeable.
4172
4173 2021-08-25  Ankur Saini  <arsenic@sourceware.org>
4174
4175         PR analyzer/101980
4176         * engine.cc (exploded_graph::maybe_create_dynamic_call): Don't create
4177         calls if max recursion limit is reached.
4178
4179 2021-08-23  David Malcolm  <dmalcolm@redhat.com>
4180
4181         * analyzer.h (struct rejected_constraint): Convert to...
4182         (class rejected_constraint): ...this.
4183         (class bounded_ranges): New forward decl.
4184         (class bounded_ranges_manager): New forward decl.
4185         * constraint-manager.cc: Include "analyzer/analyzer-logging.h" and
4186         "tree-pretty-print.h".
4187         (can_plus_one_p): New.
4188         (plus_one): New.
4189         (can_minus_one_p): New.
4190         (minus_one): New.
4191         (bounded_range::bounded_range): New.
4192         (dump_cst): New.
4193         (bounded_range::dump_to_pp): New.
4194         (bounded_range::dump): New.
4195         (bounded_range::to_json): New.
4196         (bounded_range::set_json_attr): New.
4197         (bounded_range::contains_p): New.
4198         (bounded_range::intersects_p): New.
4199         (bounded_range::operator==): New.
4200         (bounded_range::cmp): New.
4201         (bounded_ranges::bounded_ranges): New.
4202         (bounded_ranges::bounded_ranges): New.
4203         (bounded_ranges::bounded_ranges): New.
4204         (bounded_ranges::canonicalize): New.
4205         (bounded_ranges::validate): New.
4206         (bounded_ranges::operator==): New.
4207         (bounded_ranges::dump_to_pp): New.
4208         (bounded_ranges::dump): New.
4209         (bounded_ranges::to_json): New.
4210         (bounded_ranges::eval_condition): New.
4211         (bounded_ranges::contain_p): New.
4212         (bounded_ranges::cmp): New.
4213         (bounded_ranges_manager::~bounded_ranges_manager): New.
4214         (bounded_ranges_manager::get_or_create_empty): New.
4215         (bounded_ranges_manager::get_or_create_point): New.
4216         (bounded_ranges_manager::get_or_create_range): New.
4217         (bounded_ranges_manager::get_or_create_union): New.
4218         (bounded_ranges_manager::get_or_create_intersection): New.
4219         (bounded_ranges_manager::get_or_create_inverse): New.
4220         (bounded_ranges_manager::consolidate): New.
4221         (bounded_ranges_manager::get_or_create_ranges_for_switch): New.
4222         (bounded_ranges_manager::create_ranges_for_switch): New.
4223         (bounded_ranges_manager::make_case_label_ranges): New.
4224         (bounded_ranges_manager::log_stats): New.
4225         (bounded_ranges_constraint::print): New.
4226         (bounded_ranges_constraint::to_json): New.
4227         (bounded_ranges_constraint::operator==): New.
4228         (bounded_ranges_constraint::add_to_hash): New.
4229         (constraint_manager::constraint_manager): Update for new field
4230         m_bounded_ranges_constraints.
4231         (constraint_manager::operator=): Likewise.
4232         (constraint_manager::hash): Likewise.
4233         (constraint_manager::operator==): Likewise.
4234         (constraint_manager::print): Likewise.
4235         (constraint_manager::dump_to_pp): Likewise.
4236         (constraint_manager::to_json): Likewise.
4237         (constraint_manager::add_unknown_constraint): Update the lhs_ec_id
4238         if necessary in existing constraints when combining equivalence
4239         classes.  Add similar code for handling
4240         m_bounded_ranges_constraints.
4241         (constraint_manager::add_constraint_internal): Add comment.
4242         (constraint_manager::add_bounded_ranges): New.
4243         (constraint_manager::eval_condition): Use new field
4244         m_bounded_ranges_constraints.
4245         (constraint_manager::purge): Update bounded_ranges_constraint
4246         instances.
4247         (constraint_manager::canonicalize): Update for new field.
4248         (merger_fact_visitor::on_ranges): New.
4249         (constraint_manager::for_each_fact): Use new field
4250         m_bounded_ranges_constraints.
4251         (constraint_manager::validate):  Fix off-by-one error needed due
4252         to bug fixed above in add_unknown_constraint.  Validate the EC IDs
4253         in m_bounded_ranges_constraints.
4254         (constraint_manager::get_range_manager): New.
4255         (selftest::assert_dump_bounded_range_eq): New.
4256         (ASSERT_DUMP_BOUNDED_RANGE_EQ): New.
4257         (selftest::test_bounded_range): New.
4258         (selftest::assert_dump_bounded_ranges_eq): New.
4259         (ASSERT_DUMP_BOUNDED_RANGES_EQ): New.
4260         (selftest::test_bounded_ranges): New.
4261         (selftest::run_constraint_manager_tests): Call the new selftests.
4262         * constraint-manager.h (struct bounded_range): New.
4263         (struct bounded_ranges): New.
4264         (template <> struct default_hash_traits<bounded_ranges::key_t>): New.
4265         (class bounded_ranges_manager): New.
4266         (fact_visitor::on_ranges): New pure virtual function.
4267         (class bounded_ranges_constraint): New.
4268         (constraint_manager::add_bounded_ranges): New decl.
4269         (constraint_manager::get_range_manager): New decl.
4270         (constraint_manager::m_bounded_ranges_constraints): New field.
4271         * diagnostic-manager.cc (epath_finder::process_worklist_item):
4272         Transfer ownership of rc to add_feasibility_problem.
4273         * engine.cc (feasibility_problem::dump_to_pp): Use get_model.
4274         * feasible-graph.cc (infeasible_node::dump_dot): Update for
4275         conversion of m_rc to a pointer.
4276         (feasible_graph::add_feasibility_problem): Pass RC by pointer and
4277         take ownership.
4278         * feasible-graph.h (infeasible_node::infeasible_node): Pass RC by
4279         pointer and take ownership.
4280         (infeasible_node::~infeasible_node): New.
4281         (infeasible_node::m_rc): Convert to a pointer.
4282         (feasible_graph::add_feasibility_problem): Pass RC by pointer and
4283         take ownership.
4284         * region-model-manager.cc: Include
4285         "analyzer/constraint-manager.h".
4286         (region_model_manager::region_model_manager): Initializer new
4287         field m_range_mgr.
4288         (region_model_manager::~region_model_manager): Delete it.
4289         (region_model_manager::log_stats): Call log_stats on it.
4290         * region-model.cc (region_model::add_constraint): Use new subclass
4291         rejected_op_constraint.
4292         (region_model::apply_constraints_for_gswitch): Reimplement using
4293         bounded_ranges_manager.
4294         (rejected_constraint::dump_to_pp): Convert to...
4295         (rejected_op_constraint::dump_to_pp): ...this.
4296         (rejected_ranges_constraint::dump_to_pp): New.
4297         * region-model.h (struct purge_stats): Add field
4298         m_num_bounded_ranges_constraints.
4299         (region_model_manager::get_range_manager): New.
4300         (region_model_manager::m_range_mgr): New.
4301         (region_model::get_range_manager): New.
4302         (struct rejected_constraint): Split into...
4303         (class rejected_constraint):...this new abstract base class,
4304         and...
4305         (class rejected_op_constraint): ...this new concrete subclass.
4306         (class rejected_ranges_constraint): New.
4307         * supergraph.cc: Include "tree-cfg.h".
4308         (supergraph::supergraph): Drop idx param from add_cfg_edge.
4309         (supergraph::add_cfg_edge): Drop idx param.
4310         (switch_cfg_superedge::switch_cfg_superedge): Move here from
4311         header.  Populate m_case_labels with all cases which go to DST.
4312         (switch_cfg_superedge::dump_label_to_pp): Reimplement to use
4313         m_case_labels.
4314         (switch_cfg_superedge::get_case_label): Delete.
4315         * supergraph.h (supergraphadd_cfg_edge): Drop "idx" param.
4316         (switch_cfg_superedge::switch_cfg_superedge): Drop idx param and
4317         move implementation to supergraph.cc.
4318         (switch_cfg_superedge::get_case_label): Delete.
4319         (switch_cfg_superedge::get_case_labels): New.
4320         (switch_cfg_superedge::m_idx): Delete.
4321         (switch_cfg_superedge::m_case_labels): New field.
4322
4323 2021-08-23  David Malcolm  <dmalcolm@redhat.com>
4324
4325         PR analyzer/101875
4326         * sm-file.cc (file_diagnostic::describe_state_change): Handle
4327         change.m_expr being NULL.
4328
4329 2021-08-23  David Malcolm  <dmalcolm@redhat.com>
4330
4331         PR analyzer/101837
4332         * analyzer.cc (maybe_reconstruct_from_def_stmt): Bail if fn is
4333         NULL, and assert that it's non-NULL before passing it to
4334         build_call_array_loc.
4335
4336 2021-08-23  David Malcolm  <dmalcolm@redhat.com>
4337
4338         PR analyzer/101962
4339         * region-model.cc (region_model::eval_condition_without_cm):
4340         Refactor comparison against zero, adding a check for
4341         POINTER_PLUS_EXPR of non-NULL.
4342
4343 2021-08-23  David Malcolm  <dmalcolm@redhat.com>
4344
4345         * store.cc (bit_range::intersects_p): New overload.
4346         (bit_range::operator-): New.
4347         (binding_cluster::maybe_get_compound_binding): Handle the partial
4348         overlap case.
4349         (selftest::test_bit_range_intersects_p): Add test coverage for
4350         new overload of bit_range::intersects_p.
4351         * store.h (bit_range::intersects_p): New overload.
4352         (bit_range::operator-): New.
4353
4354 2021-08-23  Ankur Saini  <arsenic@sourceware.org>
4355
4356         PR analyzer/102020
4357         * diagnostic-manager.cc
4358         (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Fix typo.
4359
4360 2021-08-21  Ankur Saini  <arsenic@sourceware.org>
4361
4362         PR analyzer/101980
4363         * diagnostic-manager.cc
4364         (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Use
4365         caller_model only when the supergraph_edge doesn't exixt.
4366         (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
4367         Likewise.
4368         * engine.cc (exploded_graph::create_dynamic_call): Rename to...
4369         (exploded_graph::maybe_create_dynamic_call): ...this, return call
4370         creation status.
4371         (exploded_graph::process_node): Handle calls which were not dynamically
4372         discovered.
4373         * exploded-graph.h (exploded_graph::create_dynamic_call): Rename to...
4374         (exploded_graph::maybe_create_dynamic_call): ...this.
4375         * region-model.cc (region_model::update_for_gcall): New param, use it
4376         to push call to frame.
4377         (region_model::update_for_call_superedge): Pass callee function to
4378         update_for_gcall.
4379         * region-model.h (region_model::update_for_gcall): New param.
4380
4381 2021-08-18  Ankur Saini  <arsenic@sourceware.org>
4382
4383         PR analyzer/97114
4384         * region-model.cc (region_model::get_rvalue_1): Add case for
4385         OBJ_TYPE_REF.
4386
4387 2021-08-18  Ankur Saini  <arsenic@sourceware.org>
4388
4389         PR analyzer/100546
4390         * analysis-plan.cc (analysis_plan::use_summary_p): Don't use call
4391         summaries if there is no callgraph edge
4392         * checker-path.cc (call_event::call_event): Handle calls events that
4393         are not represented by a supergraph call edge
4394         (return_event::return_event): Likewise.
4395         (call_event::get_desc): Work with new call_event structure.
4396         (return_event::get_desc): Likeise.
4397         * checker-path.h (call_event::m_src_snode): New field.
4398         (call_event::m_dest_snode): New field.
4399         (return_event::m_src_snode): New field.
4400         (return_event::m_dest_snode): New field.
4401         * diagnostic-manager.cc
4402         (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>:
4403         Refactor to work with edges without callgraph edge.
4404         (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
4405         Likewise.
4406         * engine.cc (dynamic_call_info_t::update_model): New function.
4407         (dynamic_call_info_t::add_events_to_path): New function.
4408         (exploded_graph::create_dynamic_call): New function.
4409         (exploded_graph::process_node): Work with dynamically discovered calls.
4410         * exploded-graph.h (class dynamic_call_info_t): New class.
4411         (exploded_graph::create_dynamic_call): New decl.
4412         * program-point.cc (program_point::push_to_call_stack): New function.
4413         (program_point::pop_from_call_stack): New function.
4414         * program-point.h (program_point::push_to_call_stack): New decl.
4415         (program_point::pop_from_call_stack): New decl.
4416         * program-state.cc (program_state::push_call): New function.
4417         (program_state::returning_call): New function.
4418         * program-state.h (program_state::push_call): New decl.
4419         (program_state::returning_call): New decl.
4420         * region-model.cc (region_model::update_for_gcall) New function.
4421         (region_model::update_for_return_gcall): New function.
4422         (egion_model::update_for_call_superedge): Get the underlying gcall and
4423         update for gcall.
4424         (region_model::update_for_return_superedge): Likewise.
4425         * region-model.h (region_model::update_for_gcall): New decl.
4426         (region_model::update_for_return_gcall): New decl.
4427         * state-purge.cc (state_purge_per_ssa_name::process_point): Update to
4428         work with calls without underlying cgraph edge.
4429         * supergraph.cc (supergraph::supergraph) Split snodes at every callsite.
4430         * supergraph.h (supernode::get_returning_call) New accessor.
4431
4432 2021-08-04  David Malcolm  <dmalcolm@redhat.com>
4433
4434         PR analyzer/101570
4435         * analyzer.cc (maybe_reconstruct_from_def_stmt): Add GIMPLE_ASM
4436         case.
4437         * analyzer.h (class asm_output_svalue): New forward decl.
4438         (class reachable_regions): New forward decl.
4439         * complexity.cc (complexity::from_vec_svalue): New.
4440         * complexity.h (complexity::from_vec_svalue): New decl.
4441         * engine.cc (feasibility_state::maybe_update_for_edge): Handle
4442         asm stmts by calling on_asm_stmt.
4443         * region-model-asm.cc: New file.
4444         * region-model-manager.cc
4445         (region_model_manager::maybe_fold_asm_output_svalue): New.
4446         (region_model_manager::get_or_create_asm_output_svalue): New.
4447         (region_model_manager::log_stats): Log m_asm_output_values_map.
4448         * region-model.cc (region_model::on_stmt_pre): Handle GIMPLE_ASM.
4449         * region-model.h (visitor::visit_asm_output_svalue): New.
4450         (region_model_manager::get_or_create_asm_output_svalue): New decl.
4451         (region_model_manager::maybe_fold_asm_output_svalue): New decl.
4452         (region_model_manager::asm_output_values_map_t): New typedef.
4453         (region_model_manager::m_asm_output_values_map): New field.
4454         (region_model::on_asm_stmt): New.
4455         * store.cc (binding_cluster::on_asm): New.
4456         * store.h (binding_cluster::on_asm): New decl.
4457         * svalue.cc (svalue::cmp_ptr): Handle SK_ASM_OUTPUT.
4458         (asm_output_svalue::dump_to_pp): New.
4459         (asm_output_svalue::dump_input): New.
4460         (asm_output_svalue::input_idx_to_asm_idx): New.
4461         (asm_output_svalue::accept): New.
4462         * svalue.h (enum svalue_kind): Add SK_ASM_OUTPUT.
4463         (svalue::dyn_cast_asm_output_svalue): New.
4464         (class asm_output_svalue): New.
4465         (is_a_helper <const asm_output_svalue *>::test): New.
4466         (struct default_hash_traits<asm_output_svalue::key_t>): New.
4467
4468 2021-08-03  Jakub Jelinek  <jakub@redhat.com>
4469
4470         PR analyzer/101721
4471         * sm-malloc.cc (known_allocator_p): Only check DECL_FUNCTION_CODE on
4472         BUILT_IN_NORMAL builtins.
4473
4474 2021-07-29  Ankur Saini  <arsenic@sourceware.org>
4475
4476         * call-string.cc (call_string::element_t::operator==): New operator.
4477         (call_String::element_t::operator!=): New operator.
4478         (call_string::element_t::get_caller_function): New function.
4479         (call_string::element_t::get_callee_function): New function.
4480         (call_string::call_string): Refactor to Initialise m_elements.
4481         (call_string::operator=): Refactor to work with m_elements.
4482         (call_string::operator==): Likewise.
4483         (call_string::to_json): Likewise.
4484         (call_string::hash): Refactor to hash e.m_caller.
4485         (call_string::push_call): Refactor to work with m_elements.
4486         (call_string::push_call): New overload to push call via supernodes.
4487         (call_string::pop): Refactor to work with m_elements.
4488         (call_string::calc_recursion_depth): Likewise.
4489         (call_string::cmp): Likewise.
4490         (call_string::validate): Likewise.
4491         (call_string::operator[]): Likewise.
4492         * call-string.h (class supernode): New forward decl.
4493         (struct call_string::element_t): New struct.
4494         (call_string::call_string): Refactor to initialise m_elements.
4495         (call_string::bool empty_p): Refactor to work with m_elements.
4496         (call_string::get_callee_node): New decl.
4497         (call_string::get_caller_node): New decl.
4498         (m_elements): Replaces m_return_edges.
4499         * program-point.cc (program_point::get_function_at_depth): Refactor to
4500         work with new call-string format.
4501         (program_point::validate): Likewise.
4502         (program_point::on_edge): Likewise.
4503
4504 2021-07-28  David Malcolm  <dmalcolm@redhat.com>
4505
4506         * region-model.cc (region_model::on_call_pre): Treat
4507         IFN_UBSAN_BOUNDS, BUILT_IN_STACK_SAVE, and BUILT_IN_STACK_RESTORE
4508         as no-ops, rather than handling them as unknown functions.
4509
4510 2021-07-28  David Malcolm  <dmalcolm@redhat.com>
4511
4512         * region-model-impl-calls.cc (region_model::impl_call_alloca):
4513         Drop redundant return value.
4514         (region_model::impl_call_builtin_expect): Likewise.
4515         (region_model::impl_call_calloc): Likewise.
4516         (region_model::impl_call_malloc): Likewise.
4517         (region_model::impl_call_memset): Likewise.
4518         (region_model::impl_call_operator_new): Likewise.
4519         (region_model::impl_call_operator_delete): Likewise.
4520         (region_model::impl_call_strlen): Likewise.
4521         * region-model.cc (region_model::on_call_pre): Fix return value of
4522         known functions that don't have unknown side-effects.
4523         * region-model.h (region_model::impl_call_alloca): Drop redundant
4524         return value.
4525         (region_model::impl_call_builtin_expect): Likewise.
4526         (region_model::impl_call_calloc): Likewise.
4527         (region_model::impl_call_malloc): Likewise.
4528         (region_model::impl_call_memset): Likewise.
4529         (region_model::impl_call_strlen): Likewise.
4530         (region_model::impl_call_operator_new): Likewise.
4531         (region_model::impl_call_operator_delete): Likewise.
4532
4533 2021-07-28  Siddhesh Poyarekar  <siddhesh@gotplt.org>
4534
4535         * analyzer.cc (is_named_call_p, is_std_named_call_p): Make
4536         first argument a const_tree.
4537         * analyzer.h (is_named_call_p, -s_std_named_call_p): Likewise.
4538         * sm-malloc.cc (known_allocator_p): New function.
4539         (malloc_state_machine::on_stmt): Use it.
4540
4541 2021-07-28  Siddhesh Poyarekar  <siddhesh@gotplt.org>
4542
4543         * sm-malloc.cc
4544         (malloc_state_machine::get_or_create_deallocator): Recognize
4545         __builtin_free.
4546
4547 2021-07-26  David Malcolm  <dmalcolm@redhat.com>
4548
4549         * region-model.cc (region_model::on_call_pre): Always set conjured
4550         LHS, not just for SSA names.
4551
4552 2021-07-23  David Malcolm  <dmalcolm@redhat.com>
4553
4554         * diagnostic-manager.cc
4555         (class auto_disable_complexity_checks): New.
4556         (epath_finder::explore_feasible_paths): Use it to disable
4557         complexity checks whilst processing the worklist.
4558         * region-model-manager.cc
4559         (region_model_manager::region_model_manager): Initialize
4560         m_check_complexity.
4561         (region_model_manager::reject_if_too_complex): Bail if
4562         m_check_complexity is false.
4563         * region-model.h
4564         (region_model_manager::enable_complexity_check): New.
4565         (region_model_manager::disable_complexity_check): New.
4566         (region_model_manager::m_check_complexity): New.
4567
4568 2021-07-21  David Malcolm  <dmalcolm@redhat.com>
4569
4570         PR analyzer/101547
4571         * sm-file.cc (file_leak::emit): Handle m_arg being NULL.
4572         (file_leak::describe_final_event): Handle ev.m_expr being NULL.
4573
4574 2021-07-21  David Malcolm  <dmalcolm@redhat.com>
4575
4576         PR analyzer/101522
4577         * store.cc (binding_cluster::purge_state_involving): Don't change
4578         m_map whilst iterating through it.
4579
4580 2021-07-21  David Malcolm  <dmalcolm@redhat.com>
4581
4582         * region-model.cc (region_model::handle_phi): Add "old_state"
4583         param and use it.
4584         (region_model::update_for_phis): Update so that all of the phi
4585         stmts are effectively handled simultaneously, rather than in
4586         order.
4587         * region-model.h (region_model::handle_phi): Add "old_state"
4588         param.
4589         * state-purge.cc (self_referential_phi_p): Replace with...
4590         (name_used_by_phis_p): ...this new function.
4591         (state_purge_per_ssa_name::process_point): Update to use the
4592         above, so that all phi stmts at a basic block are effectively
4593         considered simultaneously, and only consider the phi arguments for
4594         the pertinent in-edge.
4595         * supergraph.cc (cfg_superedge::get_phi_arg_idx): New.
4596         (cfg_superedge::get_phi_arg): Use the above.
4597         * supergraph.h (cfg_superedge::get_phi_arg_idx): New decl.
4598
4599 2021-07-21  David Malcolm  <dmalcolm@redhat.com>
4600
4601         * state-purge.cc (state_purge_annotator::add_node_annotations):
4602         Rather than erroneously always using the NULL in-edge, determine
4603         each relevant in-edge, and print the appropriate data for each
4604         in-edge.  Use print_needed to print the data as comma-separated
4605         lists of SSA names.
4606         (print_vec_of_names): Add "within_table" param and use it.
4607         (state_purge_annotator::add_stmt_annotations): Factor out
4608         collation and printing code into...
4609         (state_purge_annotator::print_needed): ...this new function.
4610         * state-purge.h (state_purge_annotator::print_needed): New decl.
4611
4612 2021-07-21  David Malcolm  <dmalcolm@redhat.com>
4613
4614         * program-point.cc (function_point::print): Show src BB index at
4615         BEFORE_SUPERNODE.
4616
4617 2021-07-21  David Malcolm  <dmalcolm@redhat.com>
4618
4619         * svalue.cc (infix_p): New.
4620         (binop_svalue::dump_to_pp): Use it to print MIN_EXPR and MAX_EXPR
4621         in prefix form, rather than infix.
4622
4623 2021-07-19  David Malcolm  <dmalcolm@redhat.com>
4624
4625         PR analyzer/101503
4626         * constraint-manager.cc (constraint_manager::add_constraint): Use
4627         can_have_associated_state_p rather than testing for unknown.
4628         (constraint_manager::get_or_add_equiv_class): Likewise.
4629         * program-state.cc (sm_state_map::set_state): Likewise.
4630         (sm_state_map::impl_set_state): Add assertion.
4631         * region-model-manager.cc
4632         (region_model_manager::maybe_fold_unaryop): Handle poisoned
4633         values.
4634         (region_model_manager::maybe_fold_binop): Move handling of unknown
4635         values...
4636         (region_model_manager::get_or_create_binop): ...to here, and
4637         generalize to use can_have_associated_state_p.
4638         (region_model_manager::maybe_fold_sub_svalue): Use
4639         can_have_associated_state_p rather than testing for unknown.
4640         (region_model_manager::maybe_fold_repeated_svalue): Use unknown
4641         when the size or repeated value is "unknown"/"poisoned".
4642         * region-model.cc (region_model::purge_state_involving): Reject
4643         attempts to purge unknown/poisoned svalues, as these svalues
4644         should not have state associated with them.
4645         * svalue.cc (sub_svalue::sub_svalue): Assert that we're building
4646         on top of an svalue with can_have_associated_state_p.
4647         (repeated_svalue::repeated_svalue): Likewise.
4648         (bits_within_svalue::bits_within_svalue): Likewise.
4649         * svalue.h (svalue::can_have_associated_state_p): New.
4650         (unknown_svalue::can_have_associated_state_p): New.
4651         (poisoned_svalue::can_have_associated_state_p): New.
4652         (unaryop_svalue::unaryop_svalue): Assert that we're building on
4653         top of an svalue with can_have_associated_state_p.
4654         (binop_svalue::binop_svalue): Likewise.
4655         (widening_svalue::widening_svalue): Likewise.
4656
4657 2021-07-16  David Malcolm  <dmalcolm@redhat.com>
4658
4659         * analyzer.h (enum access_direction): New.
4660         * engine.cc (exploded_node::on_longjmp): Update for new param of
4661         get_store_value.
4662         * program-state.cc (program_state::prune_for_point): Likewise.
4663         * region-model-impl-calls.cc (region_model::impl_call_memcpy):
4664         Replace call to check_for_writable_region with call to
4665         check_region_for_write.
4666         (region_model::impl_call_memset): Likewise.
4667         (region_model::impl_call_strcpy): Likewise.
4668         * region-model-reachability.cc (reachable_regions::add): Update
4669         for new param of get_store_value.
4670         * region-model.cc (region_model::get_rvalue_1): Likewise, also for
4671         get_rvalue_for_bits.
4672         (region_model::get_store_value): Add ctxt param and use it to call
4673         check_region_for_read.
4674         (region_model::get_rvalue_for_bits): Add ctxt param and use it to
4675         call get_store_value.
4676         (region_model::check_region_access): New.
4677         (region_model::check_region_for_write): New.
4678         (region_model::check_region_for_read): New.
4679         (region_model::set_value): Update comment.  Replace call to
4680         check_for_writable_region with call to check_region_for_write.
4681         * region-model.h (region_model::get_rvalue_for_bits): Add ctxt
4682         param.
4683         (region_model::get_store_value): Add ctxt param.
4684         (region_model::check_region_access): New decl.
4685         (region_model::check_region_for_write): New decl.
4686         (region_model::check_region_for_read): New decl.
4687         * region.cc (region_model::copy_region): Update call to
4688         get_store_value.
4689         * svalue.cc (initial_svalue::implicitly_live_p): Likewise.
4690
4691 2021-07-16  David Malcolm  <dmalcolm@redhat.com>
4692
4693         * engine.cc (exploded_node::on_stmt_pre): Handle
4694         __analyzer_dump_state.
4695         * program-state.cc (extrinsic_state::get_sm_idx_by_name): New.
4696         (program_state::impl_call_analyzer_dump_state): New.
4697         * program-state.h (extrinsic_state::get_sm_idx_by_name): New decl.
4698         (program_state::impl_call_analyzer_dump_state): New decl.
4699         * region-model-impl-calls.cc
4700         (call_details::get_arg_string_literal): New.
4701         * region-model.h (call_details::get_arg_string_literal): New decl.
4702
4703 2021-07-16  David Malcolm  <dmalcolm@redhat.com>
4704
4705         * program-state.cc (program_state::detect_leaks): Simplify using
4706         svalue::maybe_get_region.
4707         * region-model-impl-calls.cc (region_model::impl_call_fgets): Likewise.
4708         (region_model::impl_call_fread): Likewise.
4709         (region_model::impl_call_free): Likewise.
4710         (region_model::impl_call_operator_delete): Likewise.
4711         * region-model.cc (selftest::test_stack_frames): Likewise.
4712         (selftest::test_state_merging): Likewise.
4713         * svalue.cc (svalue::maybe_get_region): New.
4714         * svalue.h (svalue::maybe_get_region): New decl.
4715
4716 2021-07-15  David Malcolm  <dmalcolm@redhat.com>
4717
4718         * svalue.h (is_a_helper <placeholder_svalue *>::test): Make
4719         param and template param const.
4720         (is_a_helper <widening_svalue *>::test): Likewise.
4721         (is_a_helper <compound_svalue *>::test): Likewise.
4722         (is_a_helper <conjured_svalue *>::test): Likewise.
4723
4724 2021-07-15  David Malcolm  <dmalcolm@redhat.com>
4725
4726         PR analyzer/95006
4727         PR analyzer/94713
4728         PR analyzer/94714
4729         * analyzer.cc (maybe_reconstruct_from_def_stmt): Split out
4730         GIMPLE_ASSIGN case into...
4731         (get_diagnostic_tree_for_gassign_1): New.
4732         (get_diagnostic_tree_for_gassign): New.
4733         * analyzer.h (get_diagnostic_tree_for_gassign): New decl.
4734         * analyzer.opt (Wanalyzer-write-to-string-literal): New.
4735         * constraint-manager.cc (class svalue_purger): New.
4736         (constraint_manager::purge_state_involving): New.
4737         * constraint-manager.h
4738         (constraint_manager::purge_state_involving): New.
4739         * diagnostic-manager.cc (saved_diagnostic::supercedes_p): New.
4740         (dedupe_winners::handle_interactions): New.
4741         (diagnostic_manager::emit_saved_diagnostics): Call it.
4742         * diagnostic-manager.h (saved_diagnostic::supercedes_p): New decl.
4743         * engine.cc (impl_region_model_context::warn): Convert return type
4744         to bool.  Return false if the diagnostic isn't saved.
4745         (impl_region_model_context::purge_state_involving): New.
4746         (impl_sm_context::get_state): Use NULL ctxt when querying old
4747         rvalue.
4748         (impl_sm_context::set_next_state): Use new sval when querying old
4749         state.
4750         (class dump_path_diagnostic): Move to region-model.cc
4751         (exploded_node::on_stmt): Move to on_stmt_pre and on_stmt_post.
4752         Remove call to purge_state_involving.
4753         (exploded_node::on_stmt_pre): New, based on the above.  Move most
4754         of it to region_model::on_stmt_pre.
4755         (exploded_node::on_stmt_post): Likewise, moving to
4756         region_model::on_stmt_post.
4757         (class stale_jmp_buf): Fix parent class to use curiously recurring
4758         template pattern.
4759         (feasibility_state::maybe_update_for_edge): Call on_call_pre and
4760         on_call_post on gcalls.
4761         * exploded-graph.h (impl_region_model_context::warn): Return bool.
4762         (impl_region_model_context::purge_state_involving): New decl.
4763         (exploded_node::on_stmt_pre): New decl.
4764         (exploded_node::on_stmt_post): New decl.
4765         * pending-diagnostic.h (pending_diagnostic::use_of_uninit_p): New.
4766         (pending_diagnostic::supercedes_p): New.
4767         * program-state.cc (sm_state_map::get_state): Inherit state for
4768         conjured_svalue as well as initial_svalue.
4769         (sm_state_map::purge_state_involving): Also support SK_CONJURED.
4770         * region-model-impl-calls.cc (call_details::get_uncertainty):
4771         Handle m_ctxt being NULL.
4772         (call_details::get_or_create_conjured_svalue): New.
4773         (region_model::impl_call_fgets): New.
4774         (region_model::impl_call_fread): New.
4775         * region-model-manager.cc
4776         (region_model_manager::get_or_create_initial_value): Return an
4777         uninitialized poisoned value for regions that can't have initial
4778         values.
4779         * region-model-reachability.cc
4780         (reachable_regions::mark_escaped_clusters): Handle ctxt being
4781         NULL.
4782         * region-model.cc (region_to_value_map::purge_state_involving): New.
4783         (poisoned_value_diagnostic::use_of_uninit_p): New.
4784         (poisoned_value_diagnostic::emit): Handle POISON_KIND_UNINIT.
4785         (poisoned_value_diagnostic::describe_final_event): Likewise.
4786         (region_model::check_for_poison): New.
4787         (region_model::on_assignment): Call it.
4788         (class dump_path_diagnostic): Move here from engine.cc.
4789         (region_model::on_stmt_pre): New, based on exploded_node::on_stmt.
4790         (region_model::on_call_pre): Move the setting of the LHS to a
4791         conjured svalue to before the checks for specific functions.
4792         Handle "fgets", "fgets_unlocked", and "fread".
4793         (region_model::purge_state_involving): New.
4794         (region_model::handle_unrecognized_call): Handle ctxt being NULL.
4795         (region_model::get_rvalue): Call check_for_poison.
4796         (selftest::test_stack_frames): Use NULL for context when getting
4797         uninitialized rvalue.
4798         (selftest::test_alloca): Likewise.
4799         * region-model.h (region_to_value_map::purge_state_involving): New
4800         decl.
4801         (call_details::get_or_create_conjured_svalue): New decl.
4802         (region_model::on_stmt_pre): New decl.
4803         (region_model::purge_state_involving): New decl.
4804         (region_model::impl_call_fgets): New decl.
4805         (region_model::impl_call_fread): New decl.
4806         (region_model::check_for_poison): New decl.
4807         (region_model_context::warn): Return bool.
4808         (region_model_context::purge_state_involving): New.
4809         (noop_region_model_context::warn): Return bool.
4810         (noop_region_model_context::purge_state_involving): New.
4811         (test_region_model_context:: warn): Return bool.
4812         * region.cc (region::get_memory_space): New.
4813         (region::can_have_initial_svalue_p): New.
4814         (region::involves_p): New.
4815         * region.h (enum memory_space): New.
4816         (region::get_memory_space): New decl.
4817         (region::can_have_initial_svalue_p): New decl.
4818         (region::involves_p): New decl.
4819         * sm-malloc.cc (use_after_free::supercedes_p): New.
4820         * store.cc (binding_cluster::purge_state_involving): New.
4821         (store::purge_state_involving): New.
4822         * store.h (class symbolic_binding): New forward decl.
4823         (binding_key::dyn_cast_symbolic_binding): New.
4824         (symbolic_binding::dyn_cast_symbolic_binding): New.
4825         (binding_cluster::purge_state_involving): New.
4826         (store::purge_state_involving): New.
4827         * svalue.cc (svalue::can_merge_p): Reject attempts to merge
4828         poisoned svalues with other svalues, so that we identify
4829         paths in which a variable is conditionally uninitialized.
4830         (involvement_visitor::visit_conjured_svalue): New.
4831         (svalue::involves_p): Also handle SK_CONJURED.
4832         (poison_kind_to_str): Handle POISON_KIND_UNINIT.
4833         (poisoned_svalue::maybe_fold_bits_within): New.
4834         * svalue.h (enum poison_kind): Add POISON_KIND_UNINIT.
4835         (poisoned_svalue::maybe_fold_bits_within): New decl.
4836
4837 2021-07-15  David Malcolm  <dmalcolm@redhat.com>
4838
4839         * analyzer.opt (fdump-analyzer-exploded-paths): New.
4840         * diagnostic-manager.cc
4841         (diagnostic_manager::emit_saved_diagnostic): Implement it.
4842         * engine.cc (exploded_path::dump_to_pp): Add ext_state param and
4843         use it to dump states if non-NULL.
4844         (exploded_path::dump): Likewise.
4845         (exploded_path::dump_to_file): New.
4846         * exploded-graph.h (exploded_path::dump_to_pp): Add ext_state
4847         param.
4848         (exploded_path::dump): Likewise.
4849         (exploded_path::dump): Likewise.
4850         (exploded_path::dump_to_file): New.
4851
4852 2021-07-15  David Malcolm  <dmalcolm@redhat.com>
4853
4854         * analyzer.cc (fixup_tree_for_diagnostic_1): Use DECL_DEBUG_EXPR
4855         if it's available.
4856         * engine.cc (readability): Likewise.
4857
4858 2021-07-15  David Malcolm  <dmalcolm@redhat.com>
4859
4860         * state-purge.cc (self_referential_phi_p): New.
4861         (state_purge_per_ssa_name::process_point): Don't purge an SSA name
4862         at its def-stmt if the def-stmt is self-referential.
4863
4864 2021-07-07  David Malcolm  <dmalcolm@redhat.com>
4865
4866         * diagnostic-manager.cc (null_assignment_sm_context::get_state):
4867         New overload.
4868         (null_assignment_sm_context::set_next_state): New overload.
4869         (null_assignment_sm_context::get_diagnostic_tree): New.
4870         * engine.cc (impl_sm_context::get_state): New overload.
4871         (impl_sm_context::set_next_state): New overload.
4872         (impl_sm_context::get_diagnostic_tree): New overload.
4873         (impl_region_model_context::on_condition): Convert params from
4874         tree to const svalue *.
4875         * exploded-graph.h (impl_region_model_context::on_condition):
4876         Likewise.
4877         * region-model.cc (region_model::on_call_pre): Move handling of
4878         internal calls to before checking for get_fndecl_for_call.
4879         (region_model::add_constraints_from_binop): New.
4880         (region_model::add_constraint): Split out into a new overload
4881         working on const svalue * rather than tree.  Call
4882         add_constraints_from_binop.  Drop call to
4883         add_any_constraints_from_ssa_def_stmt.
4884         (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
4885         (region_model::add_any_constraints_from_gassign): Delete.
4886         (region_model::add_any_constraints_from_gcall): Delete.
4887         * region-model.h
4888         (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
4889         (region_model::add_any_constraints_from_gassign): Delete.
4890         (region_model::add_any_constraints_from_gcall): Delete.
4891         (region_model::add_constraint): Add overload decl.
4892         (region_model::add_constraints_from_binop): New decl.
4893         (region_model_context::on_condition): Convert params from tree to
4894         const svalue *.
4895         (noop_region_model_context::on_condition): Likewise.
4896         * sm-file.cc (fileptr_state_machine::condition): Likewise.
4897         * sm-malloc.cc (malloc_state_machine::on_condition): Likewise.
4898         * sm-pattern-test.cc: Include tristate.h, selftest.h,
4899         analyzer/call-string.h, analyzer/program-point.h,
4900         analyzer/store.h, and analyzer/region-model.h.
4901         (pattern_test_state_machine::on_condition): Convert params from tree to
4902         const svalue *.
4903         * sm-sensitive.cc (sensitive_state_machine::on_condition): Delete.
4904         * sm-signal.cc (signal_state_machine::on_condition): Delete.
4905         * sm-taint.cc (taint_state_machine::on_condition): Convert params
4906         from tree to const svalue *.
4907         * sm.cc: Include tristate.h, selftest.h, analyzer/call-string.h,
4908         analyzer/program-point.h, analyzer/store.h, and
4909         analyzer/region-model.h.
4910         (any_pointer_p): Add overload taking const svalue *sval.
4911         * sm.h (any_pointer_p): Add overload taking const svalue *sval.
4912         (state_machine::on_condition): Convert params from tree to
4913         const svalue *.  Provide no-op default implementation.
4914         (sm_context::get_state): Add overload taking const svalue *sval.
4915         (sm_context::set_next_state): Likewise.
4916         (sm_context::on_transition): Likewise.
4917         (sm_context::get_diagnostic_tree): Likewise.
4918         * svalue.cc (svalue::all_zeroes_p): New.
4919         (constant_svalue::all_zeroes_p): New.
4920         (repeated_svalue::all_zeroes_p): Convert to vfunc.
4921         * svalue.h (svalue::all_zeroes_p): New decl.
4922         (constant_svalue::all_zeroes_p): New decl.
4923         (repeated_svalue::all_zeroes_p): Convert decl to vfunc.
4924
4925 2021-06-30  David Malcolm  <dmalcolm@redhat.com>
4926
4927         PR analyzer/95006
4928         * analyzer.h (class repeated_svalue): New forward decl.
4929         (class bits_within_svalue): New forward decl.
4930         (class sized_region): New forward decl.
4931         (get_field_at_bit_offset): New forward decl.
4932         * engine.cc (exploded_graph::get_or_create_node): Validate the
4933         merged state.
4934         (exploded_graph::maybe_process_run_of_before_supernode_enodes):
4935         Validate the states at each stage.
4936         * program-state.cc (program_state::validate): Validate
4937         m_region_model.
4938         * region-model-impl-calls.cc (region_model::impl_call_memset):
4939         Replace special-case logic for handling constant sizes with
4940         a call to fill_region of a sized_region with the given fill value.
4941         * region-model-manager.cc (maybe_undo_optimize_bit_field_compare):
4942         Drop DK_direct.
4943         (region_model_manager::maybe_fold_sub_svalue):  Fold element-based
4944         subregions of an initial value into initial values of an element.
4945         Fold subvalues of repeated svalues.
4946         (region_model_manager::maybe_fold_repeated_svalue): New.
4947         (region_model_manager::get_or_create_repeated_svalue): New.
4948         (get_bit_range_for_field): New.
4949         (get_byte_range_for_field): New.
4950         (get_field_at_byte_range): New.
4951         (region_model_manager::maybe_fold_bits_within_svalue): New.
4952         (region_model_manager::get_or_create_bits_within): New.
4953         (region_model_manager::get_sized_region): New.
4954         (region_model_manager::log_stats): Update for addition of
4955         m_repeated_values_map, m_bits_within_values_map, and
4956         m_sized_regions.
4957         * region-model.cc (region_model::validate): New.
4958         (region_model::on_assignment): Drop enum binding_kind.
4959         (region_model::get_initial_value_for_global): Likewise.
4960         (region_model::get_rvalue_for_bits): Replace body with call to
4961         get_or_create_bits_within.
4962         (region_model::get_capacity): Handle RK_SIZED.
4963         (region_model::set_value): Drop enum binding_kind.
4964         (region_model::fill_region): New.
4965         (region_model::get_representative_path_var_1): Handle RK_SIZED.
4966         * region-model.h (visitor::visit_repeated_svalue): New.
4967         (visitor::visit_bits_within_svalue): New.
4968         (region_model_manager::get_or_create_repeated_svalue): New decl.
4969         (region_model_manager::get_or_create_bits_within): New decl.
4970         (region_model_manager::get_sized_region): New decl.
4971         (region_model_manager::maybe_fold_repeated_svalue): New decl.
4972         (region_model_manager::maybe_fold_bits_within_svalue): New decl.
4973         (region_model_manager::repeated_values_map_t): New typedef.
4974         (region_model_manager::m_repeated_values_map): New field.
4975         (region_model_manager::bits_within_values_map_t): New typedef.
4976         (region_model_manager::m_bits_within_values_map): New field.
4977         (region_model_manager::m_sized_regions): New field.
4978         (region_model::fill_region): New decl.
4979         * region.cc (region::get_base_region): Handle RK_SIZED.
4980         (region::base_region_p): Likewise.
4981         (region::get_byte_size_sval): New.
4982         (get_field_at_bit_offset): Make non-static.
4983         (region::calc_offset): Move implementation of cases to
4984         get_relative_concrete_offset vfunc implementations.  Handle
4985         RK_SIZED.
4986         (region::get_relative_concrete_offset): New.
4987         (decl_region::get_svalue_for_initializer): Drop enum binding_kind.
4988         (field_region::get_relative_concrete_offset): New, from
4989         region::calc_offset.
4990         (element_region::get_relative_concrete_offset): Likewise.
4991         (offset_region::get_relative_concrete_offset): Likewise.
4992         (sized_region::accept): New.
4993         (sized_region::dump_to_pp): New.
4994         (sized_region::get_byte_size): New.
4995         (sized_region::get_bit_size): New.
4996         * region.h (enum region_kind): Add RK_SIZED.
4997         (region::dyn_cast_sized_region): New.
4998         (region::get_byte_size): Make virtual.
4999         (region::get_bit_size): Likewise.
5000         (region::get_byte_size_sval): New decl.
5001         (region::get_relative_concrete_offset): New decl.
5002         (field_region::get_relative_concrete_offset): New decl.
5003         (element_region::get_relative_concrete_offset): Likewise.
5004         (offset_region::get_relative_concrete_offset): Likewise.
5005         (class sized_region): New.
5006         * store.cc (binding_kind_to_string): Delete.
5007         (binding_key::make): Drop enum binding_kind.
5008         (binding_key::dump_to_pp): Delete.
5009         (binding_key::cmp_ptrs): Drop enum binding_kind.
5010         (bit_range::contains_p): New.
5011         (byte_range::dump): New.
5012         (byte_range::contains_p): New.
5013         (byte_range::cmp): New.
5014         (concrete_binding::dump_to_pp): Drop enum binding_kind.
5015         (concrete_binding::cmp_ptr_ptr): Likewise.
5016         (symbolic_binding::dump_to_pp): Likewise.
5017         (symbolic_binding::cmp_ptr_ptr): Likewise.
5018         (binding_map::apply_ctor_val_to_range): Likewise.
5019         (binding_map::apply_ctor_pair_to_child_region): Likewise.
5020         (binding_map::get_overlapping_bindings): New.
5021         (binding_map::remove_overlapping_bindings): New.
5022         (binding_cluster::validate): New.
5023         (binding_cluster::bind): Drop enum binding_kind.
5024         (binding_cluster::bind_compound_sval): Likewise.
5025         (binding_cluster::purge_region): Likewise.
5026         (binding_cluster::zero_fill_region): Reimplement in terms of...
5027         (binding_cluster::fill_region): New.
5028         (binding_cluster::mark_region_as_unknown): Drop enum binding_kind.
5029         (binding_cluster::get_binding): Likewise.
5030         (binding_cluster::get_binding_recursive): Likewise.
5031         (binding_cluster::get_any_binding): Likewise.
5032         (binding_cluster::maybe_get_compound_binding): Reimplement.
5033         (binding_cluster::get_overlapping_bindings): Delete.
5034         (binding_cluster::remove_overlapping_bindings): Reimplement in
5035         terms of binding_map::remove_overlapping_bindings.
5036         (binding_cluster::can_merge_p): Update for removal of
5037         enum binding_kind.
5038         (binding_cluster::on_unknown_fncall): Drop enum binding_kind.
5039         (binding_cluster::maybe_get_simple_value): Likewise.
5040         (store_manager::get_concrete_binding): Likewise.
5041         (store_manager::get_symbolic_binding): Likewise.
5042         (store::validate): New.
5043         (store::set_value): Drop enum binding_kind.
5044         (store::zero_fill_region): Reimplement in terms of...
5045         (store::fill_region): New.
5046         (selftest::test_binding_key_overlap): Drop enum binding_kind.
5047         * store.h (enum binding_kind): Delete.
5048         (binding_kind_to_string): Delete decl.
5049         (binding_key::make): Drop enum binding_kind.
5050         (binding_key::dump_to_pp): Make pure virtual.
5051         (binding_key::get_kind): Delete.
5052         (binding_key::mark_deleted): Delete.
5053         (binding_key::mark_empty): Delete.
5054         (binding_key::is_deleted): Delete.
5055         (binding_key::is_empty): Delete.
5056         (binding_key::binding_key): Delete.
5057         (binding_key::impl_hash): Delete.
5058         (binding_key::impl_eq): Delete.
5059         (binding_key::m_kind): Delete.
5060         (bit_range::get_last_bit_offset): New.
5061         (bit_range::contains_p): New.
5062         (byte_range::contains_p): New.
5063         (byte_range::operator==): New.
5064         (byte_range::get_start_byte_offset): New.
5065         (byte_range::get_next_byte_offset): New.
5066         (byte_range::get_last_byte_offset): New.
5067         (byte_range::as_bit_range): New.
5068         (byte_range::cmp): New.
5069         (concrete_binding::concrete_binding): Drop enum binding_kind.
5070         (concrete_binding::hash): Likewise.
5071         (concrete_binding::operator==): Likewise.
5072         (concrete_binding::mark_deleted): New.
5073         (concrete_binding::mark_empty): New.
5074         (concrete_binding::is_deleted): New.
5075         (concrete_binding::is_empty): New.
5076         (default_hash_traits<ana::concrete_binding>::empty_zero_p): Make false.
5077         (symbolic_binding::symbolic_binding): Drop enum binding_kind.
5078         (symbolic_binding::hash): Likewise.
5079         (symbolic_binding::operator==): Likewise.
5080         (symbolic_binding::mark_deleted): New.
5081         (symbolic_binding::mark_empty): New.
5082         (symbolic_binding::is_deleted): New.
5083         (symbolic_binding::is_empty): New.
5084         (binding_map::remove_overlapping_bindings): New decl.
5085         (binding_map::get_overlapping_bindings): New decl.
5086         (binding_cluster::validate): New decl.
5087         (binding_cluster::bind): Drop enum binding_kind.
5088         (binding_cluster::fill_region): New decl.
5089         (binding_cluster::get_binding): Drop enum binding_kind.
5090         (binding_cluster::get_binding_recursive): Likewise.
5091         (binding_cluster::get_overlapping_bindings): Delete.
5092         (store::validate): New decl.
5093         (store::set_value): Drop enum binding_kind.
5094         (store::fill_region): New decl.
5095         (store_manager::get_concrete_binding): Drop enum binding_kind.
5096         (store_manager::get_symbolic_binding): Likewise.
5097         * svalue.cc (svalue::cmp_ptr): Handle SK_REPEATED and
5098         SK_BITS_WITHIN.
5099         (svalue::extract_bit_range): New.
5100         (svalue::maybe_fold_bits_within): New.
5101         (constant_svalue::maybe_fold_bits_within): New.
5102         (unknown_svalue::maybe_fold_bits_within): New.
5103         (unaryop_svalue::maybe_fold_bits_within): New.
5104         (repeated_svalue::repeated_svalue): New.
5105         (repeated_svalue::dump_to_pp): New.
5106         (repeated_svalue::accept): New.
5107         (repeated_svalue::all_zeroes_p): New.
5108         (repeated_svalue::maybe_fold_bits_within): New.
5109         (bits_within_svalue::bits_within_svalue): New.
5110         (bits_within_svalue::dump_to_pp): New.
5111         (bits_within_svalue::maybe_fold_bits_within): New.
5112         (bits_within_svalue::accept): New.
5113         (bits_within_svalue::implicitly_live_p): New.
5114         (compound_svalue::maybe_fold_bits_within): New.
5115         * svalue.h (enum svalue_kind): Add SK_REPEATED and SK_BITS_WITHIN.
5116         (svalue::dyn_cast_repeated_svalue): New.
5117         (svalue::dyn_cast_bits_within_svalue): New.
5118         (svalue::extract_bit_range): New decl.
5119         (svalue::maybe_fold_bits_within): New vfunc decl.
5120         (region_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
5121         (region_svalue::key_t::is_empty): Likewise.
5122         (default_hash_traits<region_svalue::key_t>::empty_zero_p): Make false.
5123         (constant_svalue::maybe_fold_bits_within): New.
5124         (unknown_svalue::maybe_fold_bits_within): New.
5125         (poisoned_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
5126         (poisoned_svalue::key_t::is_empty): Likewise.
5127         (default_hash_traits<poisoned_svalue::key_t>::empty_zero_p): Make
5128         false.
5129         (setjmp_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
5130         (setjmp_svalue::key_t::is_empty): Likewise.
5131         (default_hash_traits<setjmp_svalue::key_t>::empty_zero_p): Make
5132         false.
5133         (unaryop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
5134         (unaryop_svalue::key_t::is_empty): Likewise.
5135         (unaryop_svalue::maybe_fold_bits_within): New.
5136         (default_hash_traits<unaryop_svalue::key_t>::empty_zero_p): Make
5137         false.
5138         (binop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
5139         (binop_svalue::key_t::is_empty): Likewise.
5140         (default_hash_traits<binop_svalue::key_t>::empty_zero_p): Make
5141         false.
5142         (sub_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
5143         (sub_svalue::key_t::is_empty): Likewise.
5144         (default_hash_traits<sub_svalue::key_t>::empty_zero_p): Make
5145         false.
5146         (class repeated_svalue): New.
5147         (is_a_helper <const repeated_svalue *>::test): New.
5148         (struct default_hash_traits<repeated_svalue::key_t>): New.
5149         (class bits_within_svalue): New.
5150         (is_a_helper <const bits_within_svalue *>::test): New.
5151         (struct default_hash_traits<bits_within_svalue::key_t>): New.
5152         (widening_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
5153         (widening_svalue::key_t::is_empty): Likewise.
5154         (default_hash_traits<widening_svalue::key_t>::empty_zero_p): Make
5155         false.
5156         (compound_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
5157         (compound_svalue::key_t::is_empty): Likewise.
5158         (compound_svalue::maybe_fold_bits_within): New.
5159         (default_hash_traits<compound_svalue::key_t>::empty_zero_p): Make
5160         false.
5161
5162 2021-06-28  David Malcolm  <dmalcolm@redhat.com>
5163
5164         * analyzer.h (byte_offset_t): New typedef.
5165         * store.cc (bit_range::dump_to_pp): Dump as a byte range if
5166         possible.
5167         (bit_range::as_byte_range): New.
5168         (byte_range::dump_to_pp): New.
5169         * store.h (class byte_range): New forward decl.
5170         (struct bit_range): Add comment.
5171         (bit_range::as_byte_range): New decl.
5172         (struct byte_range): New.
5173
5174 2021-06-22  David Malcolm  <dmalcolm@redhat.com>
5175
5176         PR analyzer/101143
5177         * region-model.cc (compat_types_p): New function.
5178         (region_model::create_region_for_heap_alloc): Convert assertion to
5179         an error check.
5180         (region_model::create_region_for_alloca): Likewise.
5181
5182 2021-06-18  David Malcolm  <dmalcolm@redhat.com>
5183
5184         * store.cc (binding_cluster::get_any_binding): Make symbolic reads
5185         from a cluster with concrete bindings return unknown.
5186
5187 2021-06-18  David Malcolm  <dmalcolm@redhat.com>
5188
5189         * region-model-manager.cc
5190         (region_model_manager::get_or_create_int_cst): New.
5191         (region_model_manager::maybe_undo_optimize_bit_field_compare): Use
5192         it to simplify away a local tree.
5193         * region-model.cc (region_model::on_setjmp): Likewise.
5194         (region_model::on_longjmp): Likewise.
5195         * region-model.h (region_model_manager::get_or_create_int_cst):
5196         New decl.
5197         * store.cc (binding_cluster::zero_fill_region): Use it to simplify
5198         away a local tree.
5199
5200 2021-06-18  David Malcolm  <dmalcolm@redhat.com>
5201
5202         * checker-path.cc (class custom_event): Make abstract to allow for
5203         custom vfuncs, splitting existing implementation into...
5204         (class precanned_custom_event): New subclass.
5205         (custom_event::get_desc): Move to...
5206         (precanned_custom_event::get_desc): ...subclass.
5207         * checker-path.h (class custom_event): Make abstract to allow for
5208         custom vfuncs, splitting existing implementation into...
5209         (class precanned_custom_event): New subclass.
5210         * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
5211         Use precanned_custom_event.
5212         * engine.cc
5213         (stale_jmp_buf::maybe_add_custom_events_for_superedge): Likewise.
5214         * sm-signal.cc (signal_delivery_edge_info_t::add_events_to_path):
5215         Likewise.
5216
5217 2021-06-15  David Malcolm  <dmalcolm@redhat.com>
5218
5219         PR analyzer/99212
5220         PR analyzer/101082
5221         * engine.cc: Include "target.h".
5222         (impl_run_checkers): Log BITS_BIG_ENDIAN, BYTES_BIG_ENDIAN, and
5223         WORDS_BIG_ENDIAN.
5224         * region-model-manager.cc
5225         (region_model_manager::maybe_fold_binop): Move support for masking
5226         via ARG0 & CST into...
5227         (region_model_manager::maybe_undo_optimize_bit_field_compare):
5228         ...this new function.  Flatten by converting from nested
5229         conditionals to a series of early return statements to reject
5230         failures.  Reject if type is not unsigned_char_type_node.
5231         Handle BYTES_BIG_ENDIAN when determining which bits are bound
5232         in the binding_map.
5233         * region-model.h
5234         (region_model_manager::maybe_undo_optimize_bit_field_compare):
5235         New decl.
5236         * store.cc (bit_range::dump): New function.
5237         * store.h (bit_range::dump): New decl.
5238
5239 2021-06-15  David Malcolm  <dmalcolm@redhat.com>
5240
5241         * engine.cc (exploded_node::on_stmt): Handle __analyzer_dump_capacity.
5242         (exploded_node::on_stmt): Drop m_sm_changes from on_stmt_flags.
5243         (state_change_requires_new_enode_p): New function...
5244         (exploded_graph::process_node): Call it, rather than querying
5245         flags.m_sm_changes, so that dynamic-extent differences can also
5246         trigger the splitting of nodes.
5247         * exploded-graph.h (struct on_stmt_flags): Drop field m_sm_changes.
5248         * program-state.cc (program_state::detect_leaks): Purge dead
5249         heap-allocated regions from dynamic extents.
5250         (selftest::test_program_state_1): Fix type of "size_in_bytes".
5251         (selftest::test_program_state_merging): Likewise.
5252         * region-model-impl-calls.cc
5253         (region_model::impl_call_analyzer_dump_capacity): New.
5254         (region_model::impl_call_free): Remove dynamic extents from the
5255         freed region.
5256         * region-model-reachability.h
5257         (reachable_regions::begin_mutable_base_regs): New.
5258         (reachable_regions::end_mutable_base_regs): New.
5259         * region-model.cc: Include "tree-object-size.h".
5260         (region_model::region_model): Support new field m_dynamic_extents.
5261         (region_model::operator=): Likewise.
5262         (region_model::operator==): Likewise.
5263         (region_model::dump_to_pp): Dump sizes of dynamic regions.
5264         (region_model::handle_unrecognized_call): Purge dynamic extents
5265         from any regions that have escaped mutably:.
5266         (region_model::get_capacity): New function.
5267         (region_model::add_constraint): Unset dynamic extents when a
5268         heap-allocated region's address is NULL.
5269         (region_model::unbind_region_and_descendents): Purge dynamic
5270         extents of unbound regions.
5271         (region_model::can_merge_with_p): Call
5272         m_dynamic_extents.can_merge_with_p.
5273         (region_model::create_region_for_heap_alloc): Assert that
5274         size_in_bytes's type is compatible with size_type_node.  Update
5275         for renaming of record_dynamic_extents to set_dynamic_extents.
5276         (region_model::create_region_for_alloca): Likewise.
5277         (region_model::record_dynamic_extents): Rename to...
5278         (region_model::set_dynamic_extents): ...this.  Assert that
5279         size_in_bytes's type is compatible with size_type_node.  Add it
5280         to the m_dynamic_extents map.
5281         (region_model::get_dynamic_extents): New.
5282         (region_model::unset_dynamic_extents): New.
5283         (selftest::test_state_merging): Fix type of "size".
5284         (selftest::test_malloc_constraints): Likewise.
5285         (selftest::test_malloc): Verify dynamic extents.
5286         (selftest::test_alloca): Likewise.
5287         * region-model.h (region_to_value_map::is_empty): New.
5288         (region_model::dynamic_extents_t): New typedef.
5289         (region_model::impl_call_analyzer_dump_capacity): New decl.
5290         (region_model::get_dynamic_extents): New function.
5291         (region_model::get_dynamic_extents): New decl.
5292         (region_model::set_dynamic_extents): New decl.
5293         (region_model::unset_dynamic_extents): New decl.
5294         (region_model::get_capacity): New decl.
5295         (region_model::record_dynamic_extents): Rename to set_dynamic_extents.
5296         (region_model::m_dynamic_extents): New field.
5297
5298 2021-06-15  David Malcolm  <dmalcolm@redhat.com>
5299
5300         * region-model.cc (region_to_value_map::operator=): New.
5301         (region_to_value_map::operator==): New.
5302         (region_to_value_map::dump_to_pp): New.
5303         (region_to_value_map::dump): New.
5304         (region_to_value_map::can_merge_with_p): New.
5305         * region-model.h (class region_to_value_map): New class.
5306
5307 2021-06-13  Trevor Saunders  <tbsaunde@tbsaunde.org>
5308
5309         * call-string.cc (call_string::call_string): Use range based for
5310         to iterate over vec<>.
5311         (call_string::to_json): Likewise.
5312         (call_string::hash): Likewise.
5313         (call_string::calc_recursion_depth): Likewise.
5314         * checker-path.cc (checker_path::fixup_locations): Likewise.
5315         * constraint-manager.cc (equiv_class::equiv_class): Likewise.
5316         (equiv_class::to_json): Likewise.
5317         (equiv_class::hash): Likewise.
5318         (constraint_manager::to_json): Likewise.
5319         * engine.cc (impl_region_model_context::on_svalue_leak):
5320         Likewise.
5321         (on_liveness_change): Likewise.
5322         (impl_region_model_context::on_unknown_change): Likewise.
5323         * program-state.cc (sm_state_map::set_state): Likewise.
5324         * region-model.cc (test_canonicalization_4): Likewise.
5325
5326 2021-06-11  David Malcolm  <dmalcolm@redhat.com>
5327
5328         * engine.cc (worklist::key_t::cmp): Move sort by call_string to
5329         before SCC.
5330
5331 2021-06-09  David Malcolm  <dmalcolm@redhat.com>
5332
5333         * region-model.cc (region_model::get_lvalue_1): Make const.
5334         (region_model::get_lvalue): Likewise.
5335         (region_model::get_rvalue_1): Likewise.
5336         (region_model::get_rvalue): Likewise.
5337         (region_model::deref_rvalue): Likewise.
5338         (region_model::get_rvalue_for_bits): Likewise.
5339         * region-model.h (region_model::get_lvalue): Likewise.
5340         (region_model::get_rvalue): Likewise.
5341         (region_model::deref_rvalue): Likewise.
5342         (region_model::get_rvalue_for_bits): Likewise.
5343         (region_model::get_lvalue_1): Likewise.
5344         (region_model::get_rvalue_1): Likewise.
5345
5346 2021-06-08  David Malcolm  <dmalcolm@redhat.com>
5347
5348         PR analyzer/99212
5349         * region-model-manager.cc
5350         (region_model_manager::maybe_fold_binop): Add support for folding
5351         BIT_AND_EXPR of compound_svalue and a mask constant.
5352         * region-model.cc (region_model::get_rvalue_1): Implement
5353         BIT_FIELD_REF in terms of...
5354         (region_model::get_rvalue_for_bits): New function.
5355         * region-model.h (region_model::get_rvalue_for_bits): New decl.
5356         * store.cc (bit_range::from_mask): New function.
5357         (selftest::test_bit_range_intersects_p): New selftest.
5358         (selftest::assert_bit_range_from_mask_eq): New.
5359         (ASSERT_BIT_RANGE_FROM_MASK_EQ): New macro.
5360         (selftest::assert_no_bit_range_from_mask_eq): New.
5361         (ASSERT_NO_BIT_RANGE_FROM_MASK): New macro.
5362         (selftest::test_bit_range_from_mask): New selftest.
5363         (selftest::analyzer_store_cc_tests): Call the new selftests.
5364         * store.h (bit_range::intersects_p): New.
5365         (bit_range::from_mask): New decl.
5366         (concrete_binding::get_bit_range): New accessor.
5367         (store_manager::get_concrete_binding): New overload taking
5368         const bit_range &.
5369
5370 2021-06-08  David Malcolm  <dmalcolm@redhat.com>
5371
5372         * analyzer.h (int_size_in_bits): New decl.
5373         * region.cc (int_size_in_bits): New function.
5374         (region::get_bit_size): Reimplement in terms of the above.
5375
5376 2021-06-08  David Malcolm  <dmalcolm@redhat.com>
5377
5378         * store.cc (concrete_binding::dump_to_pp): Move bulk of
5379         implementation to...
5380         (bit_range::dump_to_pp): ...this new function.
5381         (bit_range::cmp): New.
5382         (concrete_binding::overlaps_p): Update for use of bit_range.
5383         (concrete_binding::cmp_ptr_ptr): Likewise.
5384         * store.h (struct bit_range): New.
5385         (class concrete_binding): Replace fields m_start_bit_offset and
5386         m_size_in_bits with new field m_bit_range.
5387
5388 2021-06-08  David Malcolm  <dmalcolm@redhat.com>
5389
5390         * svalue.h (conjured_svalue::iterator_t): Delete.
5391
5392 2021-06-03  David Malcolm  <dmalcolm@redhat.com>
5393
5394         * store.h (store::get_direct_binding): Remove unused decl.
5395         (store::get_default_binding): Likewise.
5396
5397 2021-06-03  David Malcolm  <dmalcolm@redhat.com>
5398
5399         * svalue.cc (poisoned_svalue::dump_to_pp): Dump type.
5400         (compound_svalue::dump_to_pp): Dump any type.
5401
5402 2021-05-18  David Malcolm  <dmalcolm@redhat.com>
5403
5404         PR analyzer/100615
5405         * sm-malloc.cc: Include "analyzer/function-set.h".
5406         (malloc_state_machine::on_stmt): Call unaffected_by_call_p and
5407         bail on the functions it recognizes.
5408         (malloc_state_machine::unaffected_by_call_p): New.
5409
5410 2021-05-10  Martin Liska  <mliska@suse.cz>
5411
5412         * sm-file.cc (is_file_using_fn_p): Use startswith
5413         function instead of strncmp.
5414
5415 2021-05-10  Martin Liska  <mliska@suse.cz>
5416
5417         * program-state.cc (program_state::operator=): Remove
5418         __cplusplus >= 201103.
5419         (program_state::program_state): Likewise.
5420         * program-state.h: Likewise.
5421         * region-model.h (class region_model): Remove dead code.
5422
5423 2021-04-24  David Malcolm  <dmalcolm@redhat.com>
5424
5425         PR analyzer/100244
5426         * sm-malloc.cc (free_of_non_heap::describe_state_change):
5427         Bulletproof against change.m_expr being NULL.
5428
5429 2021-04-13  David Malcolm  <dmalcolm@redhat.com>
5430
5431         PR analyzer/98599
5432         * supergraph.cc (saved_uids::make_uid_unique): New.
5433         (saved_uids::restore_uids): New.
5434         (supergraph::supergraph): Replace assignments to stmt->uid with
5435         calls to m_stmt_uids.make_uid_unique.
5436         (supergraph::~supergraph): New.
5437         * supergraph.h (class saved_uids): New.
5438         (supergraph::~supergraph): New decl.
5439         (supergraph::m_stmt_uids): New field.
5440
5441 2021-04-10  David Malcolm  <dmalcolm@redhat.com>
5442
5443         PR analyzer/100011
5444         * region-model.cc (region_model::on_assignment): Avoid NULL
5445         dereference if ctxt is NULL when assigning from a STRING_CST.
5446
5447 2021-04-08  David Malcolm  <dmalcolm@redhat.com>
5448
5449         PR analyzer/99042
5450         PR analyzer/99774
5451         * engine.cc
5452         (impl_region_model_context::impl_region_model_context): Add
5453         uncertainty param and use it to initialize m_uncertainty.
5454         (impl_region_model_context::get_uncertainty): New.
5455         (impl_sm_context::get_fndecl_for_call): Add NULL for new
5456         uncertainty param when constructing impl_region_model_context.
5457         (impl_sm_context::get_state): Likewise.
5458         (impl_sm_context::set_next_state): Likewise.
5459         (impl_sm_context::warn): Likewise.
5460         (exploded_node::on_stmt): Add uncertainty param
5461         and use it when constructing impl_region_model_context.
5462         (exploded_node::on_edge): Add uncertainty param and pass
5463         to on_edge call.
5464         (exploded_node::detect_leaks): Create uncertainty_t and pass to
5465         impl_region_model_context.
5466         (exploded_graph::get_or_create_node): Create uncertainty_t and
5467         pass to prune_for_point.
5468         (maybe_process_run_of_before_supernode_enodes): Create
5469         uncertainty_t and pass to impl_region_model_context.
5470         (exploded_graph::process_node): Create uncertainty_t instances and
5471         pass around as needed.
5472         * exploded-graph.h
5473         (impl_region_model_context::impl_region_model_context): Add
5474         uncertainty param.
5475         (impl_region_model_context::get_uncertainty): New decl.
5476         (impl_region_model_context::m_uncertainty): New field.
5477         (exploded_node::on_stmt): Add uncertainty param.
5478         (exploded_node::on_edge): Likewise.
5479         * program-state.cc (sm_state_map::on_liveness_change): Get
5480         uncertainty from context and use it to unset sm-state from
5481         svalues as appropriate.
5482         (program_state::on_edge): Add uncertainty param and use it when
5483         constructing impl_region_model_context.  Fix indentation.
5484         (program_state::prune_for_point): Add uncertainty param and use it
5485         when constructing impl_region_model_context.
5486         (program_state::detect_leaks): Get any uncertainty from ctxt and
5487         use it to get maybe-live svalues for dest_state, rather than
5488         definitely-live ones; use this when determining which svalues
5489         have leaked.
5490         (selftest::test_program_state_merging): Create uncertainty_t and
5491         pass to impl_region_model_context.
5492         * program-state.h (program_state::on_edge): Add uncertainty param.
5493         (program_state::prune_for_point): Likewise.
5494         * region-model-impl-calls.cc (call_details::get_uncertainty): New.
5495         (region_model::impl_call_memcpy): Pass uncertainty to
5496         mark_region_as_unknown call.
5497         (region_model::impl_call_memset): Likewise.
5498         (region_model::impl_call_strcpy): Likewise.
5499         * region-model-reachability.cc (reachable_regions::handle_sval):
5500         Also add sval to m_mutable_svals.
5501         * region-model.cc (region_model::on_assignment): Pass any
5502         uncertainty from ctxt to the store::set_value call.
5503         (region_model::handle_unrecognized_call): Get any uncertainty from
5504         ctxt and use it to record mutable svalues at the unknown call.
5505         (region_model::get_reachable_svalues): Add uncertainty param and
5506         use it to mark any maybe-bound svalues as being reachable.
5507         (region_model::set_value): Pass any uncertainty from ctxt to the
5508         store::set_value call.
5509         (region_model::mark_region_as_unknown): Add uncertainty param and
5510         pass it on to the store::mark_region_as_unknown call.
5511         (region_model::update_for_call_summary): Add uncertainty param and
5512         pass it on to the region_model::mark_region_as_unknown call.
5513         * region-model.h (call_details::get_uncertainty): New decl.
5514         (region_model::get_reachable_svalues): Add uncertainty param.
5515         (region_model::mark_region_as_unknown): Add uncertainty param.
5516         (region_model_context::get_uncertainty): New vfunc.
5517         (noop_region_model_context::get_uncertainty): New vfunc
5518         implementation.
5519         * store.cc (dump_svalue_set): New.
5520         (uncertainty_t::dump_to_pp): New.
5521         (uncertainty_t::dump): New.
5522         (binding_cluster::clobber_region): Pass NULL for uncertainty to
5523         remove_overlapping_bindings.
5524         (binding_cluster::mark_region_as_unknown): Add uncertainty param
5525         and pass it to remove_overlapping_bindings.
5526         (binding_cluster::remove_overlapping_bindings): Add uncertainty param.
5527         Use it to record any svalues that were in clobbered bindings.
5528         (store::set_value): Add uncertainty param.  Pass it to
5529         binding_cluster::mark_region_as_unknown when handling symbolic
5530         regions.
5531         (store::mark_region_as_unknown): Add uncertainty param and pass it
5532         to binding_cluster::mark_region_as_unknown.
5533         (store::remove_overlapping_bindings): Add uncertainty param and
5534         pass it to binding_cluster::remove_overlapping_bindings.
5535         * store.h (binding_cluster::mark_region_as_unknown): Add
5536         uncertainty param.
5537         (binding_cluster::remove_overlapping_bindings): Likewise.
5538         (store::set_value): Likewise.
5539         (store::mark_region_as_unknown): Likewise.
5540
5541 2021-04-05  David Malcolm  <dmalcolm@redhat.com>
5542
5543         PR analyzer/99906
5544         * analyzer.cc (maybe_reconstruct_from_def_stmt): Fix NULL
5545         dereference on calls with zero arguments.
5546         * sm-malloc.cc (malloc_state_machine::on_stmt): When handling
5547         __attribute__((nonnull)), only call get_diagnostic_tree if the
5548         result will be used.
5549
5550 2021-04-05  David Malcolm  <dmalcolm@redhat.com>
5551
5552         PR analyzer/99886
5553         * diagnostic-manager.cc
5554         (diagnostic_manager::prune_interproc_events): Use signed integers
5555         when subtracting one from path->num_events ().
5556         (diagnostic_manager::consolidate_conditions): Likewise.  Convert
5557         next_idx to a signed int.
5558
5559 2021-04-01  David Malcolm  <dmalcolm@redhat.com>
5560
5561         * diagnostic-manager.cc (diagnostic_manager::add_diagnostic): Make
5562         enode param non-constant, and call add_diagnostic on it.  Add
5563         enode index to log message.
5564         (diagnostic_manager::add_diagnostic): Make enode param
5565         non-constant.
5566         * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
5567         Likewise for both decls.
5568         * engine.cc
5569         (impl_region_model_context::impl_region_model_context): Likewise
5570         for enode_for_diag.
5571         (impl_sm_context::impl_sm_context): Likewise.
5572         (impl_sm_context::m_enode_for_diag): Likewise.
5573         (exploded_node::dump_dot): Don't pass the diagnostic manager
5574         to dump_saved_diagnostics.
5575         (exploded_node::dump_saved_diagnostics): Drop param.  Iterate
5576         directly through all saved diagnostics for the enode, rather
5577         than all saved diagnostics in the diagnostic_manager and
5578         filtering.
5579         (exploded_node::on_stmt): Make non-const.
5580         (exploded_node::on_edge): Likewise.
5581         (exploded_node::on_longjmp): Likewise.
5582         (exploded_node::detect_leaks): Likewise.
5583         (exploded_graph::get_or_create_node): Make enode_for_diag param
5584         non-const.
5585         (exploded_graph_annotator::print_enode): Iterate
5586         directly through all saved diagnostics for the enode, rather
5587         than all saved diagnostics in the diagnostic_manager and
5588         filtering.
5589         * exploded-graph.h
5590         (impl_region_model_context::impl_region_model_context): Make
5591         enode_for_diag param non-constant.
5592         (impl_region_model_context::m_enode_for_diag): Likewise.
5593         (exploded_node::dump_saved_diagnostics): Drop param.
5594         (exploded_node::on_stmt): Make non-const.
5595         (exploded_node::on_edge): Likewise.
5596         (exploded_node::on_longjmp): Likewise.
5597         (exploded_node::detect_leaks): Likewise.
5598         (exploded_node::add_diagnostic): New.
5599         (exploded_node::get_num_diagnostics): New.
5600         (exploded_node::get_saved_diagnostic): New.
5601         (exploded_node::m_saved_diagnostics): New.
5602         (exploded_graph::get_or_create_node): Make enode_for_diag param
5603         non-constant.
5604         * feasible-graph.cc (feasible_node::dump_dot): Drop
5605         diagnostic_manager from call to dump_saved_diagnostics.
5606         * program-state.cc (program_state::on_edge): Convert enode param
5607         to non-const pointer.
5608         (program_state::prune_for_point): Likewise for enode_for_diag
5609         param.
5610         * program-state.h (program_state::on_edge): Convert enode param
5611         to non-const pointer.
5612         (program_state::prune_for_point): Likewise for enode_for_diag
5613         param.
5614
5615 2021-03-31  David Malcolm  <dmalcolm@redhat.com>
5616
5617         PR analyzer/99771
5618         * analyzer.cc (maybe_reconstruct_from_def_stmt): New.
5619         (fixup_tree_for_diagnostic_1): New.
5620         (fixup_tree_for_diagnostic): New.
5621         * analyzer.h (fixup_tree_for_diagnostic): New decl.
5622         * checker-path.cc (call_event::get_desc): Call
5623         fixup_tree_for_diagnostic and use it for the call_with_state call.
5624         (warning_event::get_desc): Likewise for the final_event and
5625         make_label_text calls.
5626         * engine.cc (impl_region_model_context::on_state_leak): Likewise
5627         for the on_leak and add_diagnostic calls.
5628         * region-model.cc (region_model::get_representative_tree):
5629         Likewise for the result.
5630
5631 2021-03-30  David Malcolm  <dmalcolm@redhat.com>
5632
5633         * region.h (region::dump_to_pp): Remove old decl.
5634
5635 2021-03-30  David Malcolm  <dmalcolm@redhat.com>
5636
5637         * sm-file.cc (fileptr_state_machine::on_stmt): Only call
5638         get_diagnostic_tree if the result will be used.
5639         * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
5640         (malloc_state_machine::on_deallocator_call): Likewise.
5641         (malloc_state_machine::on_realloc_call): Likewise.
5642         (malloc_state_machine::on_realloc_call): Likewise.
5643         * sm-sensitive.cc
5644         (sensitive_state_machine::warn_for_any_exposure): Likewise.
5645         * sm-taint.cc (taint_state_machine::on_stmt): Likewise.
5646
5647 2021-03-25  David Malcolm  <dmalcolm@redhat.com>
5648
5649         PR analyzer/93695
5650         PR analyzer/99044
5651         PR analyzer/99716
5652         * engine.cc (exploded_node::on_stmt): Clear sm-state involving
5653         an SSA name at the def-stmt of that SSA name.
5654         * program-state.cc (sm_state_map::purge_state_involving): New.
5655         * program-state.h (sm_state_map::purge_state_involving): New decl.
5656         * region-model.cc (selftest::test_involves_p): New.
5657         (selftest::analyzer_region_model_cc_tests): Call it.
5658         * svalue.cc (class involvement_visitor): New class
5659         (svalue::involves_p): New.
5660         * svalue.h (svalue::involves_p): New decl.
5661
5662 2021-03-19  David Malcolm  <dmalcolm@redhat.com>
5663
5664         PR analyzer/99614
5665         * diagnostic-manager.cc (class epath_finder): Add
5666         DISABLE_COPY_AND_ASSIGN.
5667
5668 2021-03-15  Martin Liska  <mliska@suse.cz>
5669
5670         * sm-file.cc (get_file_using_fns): Add missing comma in initializer.
5671
5672 2021-03-11  David Malcolm  <dmalcolm@redhat.com>
5673
5674         PR analyzer/96374
5675         * analyzer.opt (-param=analyzer-max-infeasible-edges=): New param.
5676         (fdump-analyzer-feasibility): New flag.
5677         * diagnostic-manager.cc: Include "analyzer/trimmed-graph.h" and
5678         "analyzer/feasible-graph.h".
5679         (epath_finder::epath_finder): Convert m_sep to a pointer and
5680         only create it if !flag_analyzer_feasibility.
5681         (epath_finder::~epath_finder): New.
5682         (epath_finder::m_sep): Convert to a pointer.
5683         (epath_finder::get_best_epath): Add param "diag_idx" and use it
5684         when logging.  Rather than finding the shortest path and then
5685         checking feasibility, instead use explore_feasible_paths unless
5686         !flag_analyzer_feasibility, in which case simply use the shortest
5687         path, and note if it is infeasible.  Update for m_sep becoming a
5688         pointer.
5689         (class feasible_worklist): New.
5690         (epath_finder::explore_feasible_paths): New.
5691         (epath_finder::process_worklist_item): New.
5692         (class dump_eg_with_shortest_path): New.
5693         (epath_finder::dump_trimmed_graph): New.
5694         (epath_finder::dump_feasible_graph): New.
5695         (saved_diagnostic::saved_diagnostic): Add "idx" param, using it
5696         on new field m_idx.
5697         (saved_diagnostic::to_json): Dump m_idx.
5698         (saved_diagnostic::calc_best_epath): Pass m_idx to get_best_epath.
5699         Remove assertion that m_problem was set when m_best_epath is NULL.
5700         (diagnostic_manager::add_diagnostic): Pass an index when created
5701         saved_diagnostic instances.
5702         * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add
5703         "idx" param.
5704         (saved_diagnostic::get_index): New accessor.
5705         (saved_diagnostic::m_idx): New field.
5706         * engine.cc (exploded_node::dump_dot): Call args.dump_extra_info.
5707         Move code to...
5708         (exploded_node::dump_processed_stmts): ...this new function and...
5709         (exploded_node::dump_saved_diagnostics): ...this new function.
5710         Add index of each diagnostic.
5711         (exploded_edge::dump_dot):  Move bulk of code to...
5712         (exploded_edge::dump_dot_label): ...this new function.
5713         * exploded-graph.h (eg_traits::dump_args_t::dump_extra_info): New
5714         vfunc.
5715         (exploded_node::dump_processed_stmts): New decl.
5716         (exploded_node::dump_saved_diagnostics): New decl.
5717         (exploded_edge::dump_dot_label): New decl.
5718         * feasible-graph.cc: New file.
5719         * feasible-graph.h: New file.
5720         * trimmed-graph.cc: New file.
5721         * trimmed-graph.h: New file.
5722
5723 2021-03-11  David Malcolm  <dmalcolm@redhat.com>
5724
5725         * diagnostic-manager.cc (epath_finder::epath_finder):
5726         Update shortest_paths init for new param.
5727
5728 2021-03-10  David Malcolm  <dmalcolm@redhat.com>
5729
5730         PR analyzer/96374
5731         * engine.cc (exploded_path::feasible_p): Move "snodes_visited" and
5732         "model" locals into a new class feasibility_state.  Move heart
5733         of per-edge processing into
5734         feasibility_state::maybe_update_for_edge.
5735         (feasibility_state::feasibility_state): New.
5736         (feasibility_state::maybe_update_for_edge): New, based on loop
5737         body in exploded_path::feasible_p.
5738         * exploded-graph.h (class feasibility_state): New.
5739
5740 2021-03-10  David Malcolm  <dmalcolm@redhat.com>
5741
5742         * supergraph.h
5743         (callgraph_superedge::dyn_cast_callgraph_superedge): New.
5744         (call_superedge::dyn_cast_callgraph_superedge): Delete.
5745         (return_superedge::dyn_cast_callgraph_superedge): Delete.
5746
5747 2021-03-02  Martin Liska  <mliska@suse.cz>
5748
5749         * diagnostic-manager.cc (diagnostic_manager::emit_saved_diagnostics):
5750         Do not pass engine.
5751
5752 2021-02-26  David Malcolm  <dmalcolm@redhat.com>
5753
5754         * engine.cc (exploded_path::exploded_path): New copy-ctor.
5755         * exploded-graph.h (exploded_path::operator=): Drop decl.
5756
5757 2021-02-26  David Malcolm  <dmalcolm@redhat.com>
5758
5759         PR analyzer/96374
5760         * diagnostic-manager.cc (class epath_finder): New.
5761         (epath_finder::get_best_epath): New.
5762         (saved_diagnostic::saved_diagnostic): Update for replacement of
5763         m_state and m_epath_length with m_best_epath.
5764         (saved_diagnostic::~saved_diagnostic): Delete m_best_epath.
5765         (saved_diagnostic::to_json): Update "path_length" to be optional.
5766         (saved_diagnostic::calc_best_epath): New, based on
5767         dedupe_winners::add and parts of dedupe_key::dedupe_key.
5768         (saved_diagnostic::get_epath_length): New.
5769         (saved_diagnostic::add_duplicate): New.
5770         (dedupe_key::dedupe_key): Drop epath param.  Move invocation of
5771         stmt_finder to saved_diagnostic::calc_best_epath.
5772         (class dedupe_candidate): Delete.
5773         (class dedupe_hash_map_traits): Update to use saved_diagnotic *
5774         rather than dedupe_candidate * as the value_type/compare_type.
5775         (dedupe_winners::~dedupe_winners): Don't delete the values.
5776         (dedupe_winners::add): Convert param from shortest_exploded_paths to
5777         epath_finder.  Drop "eg" param.  Drop dedupe_candidate, moving
5778         path generation and feasiblity checking to
5779         epath_finder::get_best_epath.  Update winner-selection for move
5780         of epaths from dedupe_candidate to saved_diagnostic.
5781         (dedupe_winners::emit_best):  Update for removal of class
5782         dedupe_candidate.
5783         (dedupe_winners::map_t): Update to use saved_diagnotic * rather
5784         than dedupe_candidate * as the value_type/compare_type.
5785         (diagnostic_manager::emit_saved_diagnostics): Move
5786         shortest_exploded_paths instance into epath_finder and pass that
5787         around instead.
5788         (diagnostic_manager::emit_saved_diagnostic): Drop epath, stmt
5789         and num_dupes params, instead getting these from the
5790         saved_diagnostic.  Use correct location in inform_n call.
5791         * diagnostic-manager.h (class epath_finder): New forward decl.
5792         (saved_diagnostic::status): Drop enum.
5793         (saved_diagnostic::set_feasible): Drop.
5794         (saved_diagnostic::set_infeasible): Drop.
5795         (saved_diagnostic::get_status): Drop.
5796         (saved_diagnostic::calc_best_epath): New decl.
5797         (saved_diagnostic::get_best_epath): New decl.
5798         (saved_diagnostic::get_epath_length): New decl.
5799         (saved_diagnostic::set_epath_length): Drop.
5800         (saved_diagnostic::get_epath_length): Drop inline implementation.
5801         (saved_diagnostic::add_duplicate): New.
5802         (saved_diagnostic::get_num_dupes): New.
5803         (saved_diagnostic::m_d): Document ownership.
5804         (saved_diagnostic::m_trailing_eedge): Make const.
5805         (saved_diagnostic::m_status): Drop field.
5806         (saved_diagnostic::m_epath_length): Drop field.
5807         (saved_diagnostic::m_best_epath): New field.
5808         (saved_diagnostic::m_problem): Document ownership.
5809         (saved_diagnostic::m_duplicates): New field.
5810         (diagnostic_manager::emit_saved_diagnostic): Drop params epath,
5811         stmt, and num_dupes.
5812         * engine.cc (exploded_graph_annotator::print_saved_diagnostic):
5813         Update for changes to saved_diagnostic class.
5814         * exploded-graph.h (exploded_path::feasible_p): Drop unused
5815         overloaded decl.
5816
5817 2021-02-25  David Malcolm  <dmalcolm@redhat.com>
5818
5819         PR analyzer/99193
5820         * region-model-impl-calls.cc (region_model::impl_call_realloc): New.
5821         * region-model.cc (region_model::on_call_pre): Call it.
5822         * region-model.h (region_model::impl_call_realloc): New decl.
5823         * sm-malloc.cc (enum wording): Add WORDING_REALLOCATED.
5824         (malloc_state_machine::m_realloc): New field.
5825         (use_after_free::describe_state_change): Add case for
5826         WORDING_REALLOCATED.
5827         (use_after_free::describe_final_event): Likewise.
5828         (malloc_state_machine::malloc_state_machine): Initialize
5829         m_realloc.
5830         (malloc_state_machine::on_stmt): Handle realloc by calling...
5831         (malloc_state_machine::on_realloc_call): New.
5832
5833 2021-02-22  David Malcolm  <dmalcolm@redhat.com>
5834
5835         PR analyzer/99196
5836         * engine.cc (exploded_node::on_stmt): Provide terminate_path
5837         flag as a way for on_call_pre to terminate the current analysis
5838         path.
5839         * region-model-impl-calls.cc (call_details::num_args): New.
5840         (region_model::impl_call_error): New.
5841         * region-model.cc (region_model::on_call_pre): Add param
5842         "out_terminate_path".  Handle "error" and "error_at_line".
5843         * region-model.h (call_details::num_args): New decl.
5844         (region_model::on_call_pre): Add param "out_terminate_path".
5845         (region_model::impl_call_error): New decl.
5846
5847 2021-02-17  David Malcolm  <dmalcolm@redhat.com>
5848
5849         PR analyzer/98969
5850         * constraint-manager.cc (dead_svalue_purger::should_purge_p):
5851         Update for change to svalue::live_p.
5852         * program-state.cc (sm_state_map::on_liveness_change): Likewise.
5853         (program_state::detect_leaks): Likewise.
5854         * region-model-reachability.cc (reachable_regions::init_cluster):
5855         When dealing with a symbolic region, if the underlying pointer is
5856         implicitly live, add the region to the reachable regions.
5857         * region-model.cc (region_model::compare_initial_and_pointer):
5858         Move logic for detecting initial values of params to
5859         initial_svalue::initial_value_of_param_p.
5860         * svalue.cc (svalue::live_p): Convert "live_svalues" from a
5861         reference to a pointer; support it being NULL.
5862         (svalue::implicitly_live_p): Convert first param from a
5863         refererence to a pointer.
5864         (region_svalue::implicitly_live_p): Likewise.
5865         (constant_svalue::implicitly_live_p): Likewise.
5866         (initial_svalue::implicitly_live_p): Likewise.  Treat the initial
5867         values of params for the top level frame as still live.
5868         (initial_svalue::initial_value_of_param_p): New function, taken
5869         from a test in region_model::compare_initial_and_pointer.
5870         (unaryop_svalue::implicitly_live_p): Convert first param from a
5871         refererence to a pointer.
5872         (binop_svalue::implicitly_live_p): Likewise.
5873         (sub_svalue::implicitly_live_p): Likewise.
5874         (unmergeable_svalue::implicitly_live_p): Likewise.
5875         * svalue.h (svalue::live_p): Likewise.
5876         (svalue::implicitly_live_p): Likewise.
5877         (region_svalue::implicitly_live_p): Likewise.
5878         (constant_svalue::implicitly_live_p): Likewise.
5879         (initial_svalue::implicitly_live_p): Likewise.
5880         (initial_svalue::initial_value_of_param_p): New decl.
5881         (unaryop_svalue::implicitly_live_p): Convert first param from a
5882         refererence to a pointer.
5883         (binop_svalue::implicitly_live_p): Likewise.
5884         (sub_svalue::implicitly_live_p): Likewise.
5885         (unmergeable_svalue::implicitly_live_p): Likewise.
5886
5887 2021-02-12  David Malcolm  <dmalcolm@redhat.com>
5888
5889         PR analyzer/98969
5890         * engine.cc (readability): Add names for the various arbitrary
5891         values.  Handle NOP_EXPR and INTEGER_CST.
5892         (readability_comparator): Combine the readability tests for
5893         tree and stack depth, rather than performing them sequentially.
5894         (impl_region_model_context::on_state_leak): Strip off top-level
5895         casts.
5896         * region-model.cc (region_model::get_representative_path_var): Add
5897         type-checking, moving the bulk of the implementation to...
5898         (region_model::get_representative_path_var_1): ...here.  Respect
5899         types in casts by recursing and re-adding the cast, rather than
5900         merely stripping them off.  Use the correct type when handling
5901         region_svalue.
5902         (region_model::get_representative_tree): Strip off any top-level
5903         cast.
5904         (region_model::get_representative_path_var): Add type-checking,
5905         moving the bulk of the implementation to...
5906         (region_model::get_representative_path_var_1): ...here.
5907         * region-model.h (region_model::get_representative_path_var_1):
5908         New decl
5909         (region_model::get_representative_path_var_1): New decl.
5910         * store.cc (append_pathvar_with_type): New.
5911         (binding_cluster::get_representative_path_vars): Cast path_vars
5912         to the correct type when adding them to *OUT_PVS.
5913
5914 2021-02-09  David Malcolm  <dmalcolm@redhat.com>
5915
5916         PR analyzer/98575
5917         * sm-file.cc (is_file_using_fn_p): Support "_IO_"-prefixed
5918         variants.
5919
5920 2021-02-09  David Malcolm  <dmalcolm@redhat.com>
5921
5922         PR analyzer/98575
5923         * store.cc (store::set_value): Treat a pointer written to *UNKNOWN
5924         as having escaped.
5925
5926 2021-02-02  David Malcolm  <dmalcolm@redhat.com>
5927
5928         PR analyzer/93355
5929         PR analyzer/96374
5930         * engine.cc (toplevel_function_p): Simplify so that
5931         we only reject functions with a "__analyzer_" prefix.
5932         (add_any_callbacks): Delete.
5933         (exploded_graph::build_initial_worklist): Update for
5934         dropped param of toplevel_function_p.
5935         (exploded_graph::build_initial_worklist): Don't bother
5936         looking for callbacks that are reachable from global
5937         initializers.
5938
5939 2021-02-01  David Malcolm  <dmalcolm@redhat.com>
5940
5941         PR analyzer/98918
5942         * region-model-manager.cc
5943         (region_model_manager::get_or_create_initial_value):
5944         Fold the initial value of *UNKNOWN_PTR to an UNKNOWN value.
5945         (region_model_manager::get_field_region): Fold the value
5946         of UNKNOWN_PTR->FIELD to *UNKNOWN_PTR_OF_&FIELD_TYPE.
5947
5948 2021-01-29  David Malcolm  <dmalcolm@redhat.com>
5949
5950         * checker-path.cc (event_kind_to_string): Handle
5951         EK_START_CONSOLIDATED_CFG_EDGES and
5952         EK_END_CONSOLIDATED_CFG_EDGES.
5953         (start_consolidated_cfg_edges_event::get_desc): New.
5954         (checker_path::cfg_edge_pair_at_p): New.
5955         * checker-path.h (enum event_kind): Add
5956         EK_START_CONSOLIDATED_CFG_EDGES and
5957         EK_END_CONSOLIDATED_CFG_EDGES.
5958         (class start_consolidated_cfg_edges_event): New class.
5959         (class end_consolidated_cfg_edges_event): New class.
5960         (checker_path::delete_events): New.
5961         (checker_path::replace_event): New.
5962         (checker_path::cfg_edge_pair_at_p): New decl.
5963         * diagnostic-manager.cc (diagnostic_manager::prune_path): Call
5964         consolidate_conditions.
5965         (same_line_as_p): New.
5966         (diagnostic_manager::consolidate_conditions): New.
5967         * diagnostic-manager.h
5968         (diagnostic_manager::consolidate_conditions): New decl.
5969
5970 2021-01-18  David Malcolm  <dmalcolm@redhat.com>
5971
5972         * analyzer.h (is_std_named_call_p): New decl.
5973         * diagnostic-manager.cc (path_builder::get_sm): New.
5974         (state_change_event_creator::state_change_event_creator): Add "pb"
5975         param.
5976         (state_change_event_creator::on_global_state_change): Don't consider
5977         state changes affecting other state_machines.
5978         (state_change_event_creator::on_state_change): Likewise.
5979         (state_change_event_creator::m_pb): New field.
5980         (diagnostic_manager::add_events_for_eedge): Pass pb to visitor
5981         ctor.
5982         * region-model-impl-calls.cc
5983         (region_model::impl_deallocation_call): New.
5984         * region-model.cc: Include "attribs.h".
5985         (region_model::on_call_post): Handle fndecls referenced by
5986         __attribute__((deallocated_by(FOO))).
5987         * region-model.h (region_model::impl_deallocation_call): New decl.
5988         * sm-malloc.cc: Include "stringpool.h" and "attribs.h".  Add
5989         leading comment.
5990         (class api): Delete.
5991         (enum resource_state): Update comment for change from api to
5992         deallocator and deallocator_set.
5993         (allocation_state::allocation_state): Drop api param.  Add
5994         "deallocators" and "deallocator".
5995         (allocation_state::m_api): Drop field in favor of...
5996         (allocation_state::m_deallocators): New field.
5997         (allocation_state::m_deallocator): New field.
5998         (enum wording): Add WORDING_DEALLOCATED.
5999         (struct deallocator): New.
6000         (struct standard_deallocator): New.
6001         (struct custom_deallocator): New.
6002         (struct deallocator_set): New.
6003         (struct custom_deallocator_set): New.
6004         (struct standard_deallocator_set): New.
6005         (struct deallocator_set_map_traits): New.
6006         (malloc_state_machine::m_malloc): Drop field
6007         (malloc_state_machine::m_scalar_new): Likewise.
6008         (malloc_state_machine::m_vector_new): Likewise.
6009         (malloc_state_machine::m_free): New field
6010         (malloc_state_machine::m_scalar_delete): Likewise.
6011         (malloc_state_machine::m_vector_delete): Likewise.
6012         (malloc_state_machine::deallocator_map_t): New typedef.
6013         (malloc_state_machine::m_deallocator_map): New field.
6014         (malloc_state_machine::deallocator_set_cache_t): New typedef.
6015         (malloc_state_machine::m_custom_deallocator_set_cache): New field.
6016         (malloc_state_machine::custom_deallocator_set_map_t): New typedef.
6017         (malloc_state_machine::m_custom_deallocator_set_map): New field.
6018         (malloc_state_machine::m_dynamic_sets): New field.
6019         (malloc_state_machine::m_dynamic_deallocators): New field.
6020         (api::api): Delete.
6021         (deallocator::deallocator): New ctor.
6022         (deallocator::hash): New.
6023         (deallocator::dump_to_pp): New.
6024         (deallocator::cmp): New.
6025         (deallocator::cmp_ptr_ptr): New.
6026         (standard_deallocator::standard_deallocator): New ctor.
6027         (deallocator_set::deallocator_set): New ctor.
6028         (deallocator_set::dump): New.
6029         (custom_deallocator_set::custom_deallocator_set): New ctor.
6030         (custom_deallocator_set::contains_p): New.
6031         (custom_deallocator_set::maybe_get_single): New.
6032         (custom_deallocator_set::dump_to_pp): New.
6033         (standard_deallocator_set::standard_deallocator_set): New ctor.
6034         (standard_deallocator_set::contains_p): New.
6035         (standard_deallocator_set::maybe_get_single): New.
6036         (standard_deallocator_set::dump_to_pp): New.
6037         (start_p): New.
6038         (class mismatching_deallocation): Update for conversion from api
6039         to deallocator_set and deallocator.
6040         (double_free::emit): Use %qs.
6041         (class use_after_free): Update for conversion from api to
6042         deallocator_set and deallocator.
6043         (malloc_leak::describe_state_change): Only emit "allocated here" on
6044         a start->nonnull transition, rather than on other transitions to
6045         nonnull.
6046         (allocation_state::dump_to_pp): Update for conversion from api to
6047         deallocator_set.
6048         (allocation_state::get_nonnull): Likewise.
6049         (malloc_state_machine::malloc_state_machine): Likewise.
6050         (malloc_state_machine::~malloc_state_machine): New.
6051         (malloc_state_machine::add_state): Update for conversion from api
6052         to deallocator_set.
6053         (malloc_state_machine::get_or_create_custom_deallocator_set): New.
6054         (malloc_state_machine::maybe_create_custom_deallocator_set): New.
6055         (malloc_state_machine::get_or_create_deallocator): New.
6056         (malloc_state_machine::on_stmt): Update for conversion from api
6057         to deallocator_set.  Handle "__attribute__((malloc(FOO)))", and
6058         the special attribute set on FOO.
6059         (malloc_state_machine::on_allocator_call): Update for conversion
6060         from api to deallocator_set.  Add "returns_nonnull" param and use
6061         it to affect which state to transition to.
6062         (malloc_state_machine::on_deallocator_call): Update for conversion
6063         from api to deallocator_set.
6064
6065 2021-01-14  David Malcolm  <dmalcolm@redhat.com>
6066
6067         * engine.cc (strongly_connected_components::to_json): New.
6068         (worklist::to_json): New.
6069         (exploded_graph::to_json): JSON-ify the worklist.
6070         * exploded-graph.h (strongly_connected_components::to_json): New
6071         decl.
6072         (worklist::to_json): New decl.
6073         * store.cc (store::to_json): Fix comment.
6074         * supergraph.cc (supernode::to_json): Fix reference to
6075         "returning_call" in comment.  Add optional "fun" to JSON.
6076         (edge_kind_to_string): New.
6077         (superedge::to_json): Add "kind" to JSON.
6078
6079 2021-01-14  David Malcolm  <dmalcolm@redhat.com>
6080
6081         PR analyzer/98679
6082         * analyzer.h (region_offset::operator==): Make const.
6083         * pending-diagnostic.h (pending_diagnostic::equal_p): Likewise.
6084         * store.h (binding_cluster::for_each_value): Likewise.
6085         (binding_cluster::for_each_binding): Likewise.
6086
6087 2021-01-12  David Malcolm  <dmalcolm@redhat.com>
6088
6089         PR analyzer/98628
6090         * store.cc (binding_cluster::make_unknown_relative_to): Don't mark
6091         dereferenced unknown pointers as having escaped.
6092
6093 2021-01-07  David Malcolm  <dmalcolm@redhat.com>
6094
6095         PR analyzer/98580
6096         * region.cc (decl_region::get_svalue_for_initializer): Gracefully
6097         handle when LTO writes out DECL_INITIAL as error_mark_node.
6098
6099 2021-01-07  David Malcolm  <dmalcolm@redhat.com>
6100
6101         PR analyzer/97074
6102         * store.cc (binding_cluster::can_merge_p): Add "out_store" param
6103         and pass to calls to binding_cluster::make_unknown_relative_to.
6104         (binding_cluster::make_unknown_relative_to): Add "out_store"
6105         param.  Use it to mark base regions that are pointed to by
6106         pointers that become unknown as having escaped.
6107         (store::can_merge_p): Pass out_store to
6108         binding_cluster::can_merge_p.
6109         * store.h (binding_cluster::can_merge_p): Add "out_store" param.
6110         (binding_cluster::make_unknown_relative_to): Likewise.
6111         * svalue.cc (region_svalue::implicitly_live_p): New vfunc.
6112         * svalue.h (region_svalue::implicitly_live_p): New vfunc decl.
6113
6114 2021-01-07  David Malcolm  <dmalcolm@redhat.com>
6115
6116         PR analyzer/98564
6117         * engine.cc (exploded_path::feasible_p): Add missing call to
6118         bitmap_clear.
6119
6120 2021-01-06  David Malcolm  <dmalcolm@redhat.com>
6121
6122         PR analyzer/97072
6123         * region-model-reachability.cc (reachable_regions::init_cluster):
6124         Convert symbolic region handling to a switch statement.  Add cases
6125         to handle SK_UNKNOWN and SK_CONJURED.
6126
6127 2021-01-05  David Malcolm  <dmalcolm@redhat.com>
6128
6129         PR analyzer/98293
6130         * store.cc (binding_map::apply_ctor_to_region): When "index" is
6131         NULL, iterate through the fields for RECORD_TYPEs, rather than
6132         creating an INTEGER_CST index.
6133
6134 2020-11-30  David Malcolm  <dmalcolm@redhat.com>
6135
6136         * analyzer-pass.cc: Include "analyzer/analyzer.h" for the
6137         declaration of sorry_no_analyzer; include "tree.h" and
6138         "function.h" as these are needed by it.
6139
6140 2020-11-30  David Malcolm  <dmalcolm@redhat.com>
6141
6142         * analyzer-pass.cc (pass_analyzer::execute): Move sorry call to...
6143         (sorry_no_analyzer): New.
6144         * analyzer.h (class state_machine): New forward decl.
6145         (class logger): New forward decl.
6146         (class plugin_analyzer_init_iface): New.
6147         (sorry_no_analyzer): New decl.
6148         * checker-path.cc (checker_path::fixup_locations): New.
6149         * checker-path.h (checker_event::set_location): New.
6150         (checker_path::fixup_locations): New decl.
6151         * diagnostic-manager.cc
6152         (diagnostic_manager::emit_saved_diagnostic): Call
6153         checker_path::fixup_locations, and call fixup_location
6154         on the primary location.
6155         * engine.cc: Include "plugin.h".
6156         (class plugin_analyzer_init_impl): New.
6157         (impl_run_checkers): Invoke PLUGIN_ANALYZER_INIT callbacks.
6158         * pending-diagnostic.h (pending_diagnostic::fixup_location): New
6159         vfunc.
6160
6161 2020-11-18  David Malcolm  <dmalcolm@redhat.com>
6162
6163         PR analyzer/97893
6164         * sm-malloc.cc (null_deref::emit): Use CWE-476 rather than
6165         CWE-690, as this isn't due to an unchecked return value.
6166         (null_arg::emit): Likewise.
6167
6168 2020-11-12  David Malcolm  <dmalcolm@redhat.com>
6169
6170         * checker-path.h (checker_event::get_id_ptr): New.
6171         * diagnostic-manager.cc (path_builder::path_builder): Add "sd"
6172         param and use it to initialize new field "m_sd".
6173         (path_builder::get_pending_diagnostic): New.
6174         (path_builder::m_sd): New field.
6175         (diagnostic_manager::emit_saved_diagnostic): Pass sd to
6176         path_builder ctor.
6177         (diagnostic_manager::add_events_for_superedge): Call new
6178         maybe_add_custom_events_for_superedge vfunc.
6179         * engine.cc (stale_jmp_buf::stale_jmp_buf): Add "setjmp_point"
6180         param and use it to initialize new field "m_setjmp_point".
6181         Initialize new field "m_stack_pop_event".
6182         (stale_jmp_buf::maybe_add_custom_events_for_superedge): New vfunc
6183         implementation.
6184         (stale_jmp_buf::describe_final_event): New vfunc implementation.
6185         (stale_jmp_buf::m_setjmp_point): New field.
6186         (stale_jmp_buf::m_stack_pop_event): New field.
6187         (exploded_node::on_longjmp): Pass setjmp_point to stale_jmp_buf
6188         ctor.
6189         * pending-diagnostic.h
6190         (pending_diagnostic::maybe_add_custom_events_for_superedge): New
6191         vfunc.
6192
6193 2020-11-12  David Malcolm  <dmalcolm@redhat.com>
6194
6195         PR tree-optimization/97424
6196         * analyzer.opt (Wanalyzer-shift-count-negative): New.
6197         (Wanalyzer-shift-count-overflow): New.
6198         * region-model.cc (class shift_count_negative_diagnostic): New.
6199         (class shift_count_overflow_diagnostic): New.
6200         (region_model::get_gassign_result): Complain about shift counts that
6201         are negative or are >= the operand's type's width.
6202
6203 2020-11-10  Martin Liska  <mliska@suse.cz>
6204
6205         * constraint-manager.cc (constraint_manager::merge): Remove
6206         unused code.
6207         * constraint-manager.h: Likewise.
6208         * program-state.cc (sm_state_map::sm_state_map): Likewise.
6209         (program_state::program_state): Likewise.
6210         (test_sm_state_map): Likewise.
6211         * program-state.h: Likewise.
6212         * region-model-reachability.cc (reachable_regions::reachable_regions): Likewise.
6213         * region-model-reachability.h: Likewise.
6214         * region-model.cc (region_model::handle_unrecognized_call): Likewise.
6215         (region_model::get_reachable_svalues): Likewise.
6216         (region_model::can_merge_with_p): Likewise.
6217
6218 2020-11-05  David Malcolm  <dmalcolm@redhat.com>
6219
6220         PR analyzer/97668
6221         * svalue.cc (cmp_cst): Handle COMPLEX_CST.
6222
6223 2020-10-29  David Malcolm  <dmalcolm@redhat.com>
6224
6225         * program-state.cc (sm_state_map::on_liveness_change): Sort the
6226         leaking svalues before calling on_state_leak.
6227         (program_state::detect_leaks): Likewise when calling
6228         on_svalue_leak.
6229         * region-model-reachability.cc
6230         (reachable_regions::mark_escaped_clusters): Likewise when
6231         calling on_escaped_function.
6232
6233 2020-10-29  David Malcolm  <dmalcolm@redhat.com>
6234
6235         PR analyzer/97608
6236         * region-model-reachability.cc (reachable_regions::handle_sval):
6237         Operands of reachable reversible operations are reachable.
6238
6239 2020-10-29  David Malcolm  <dmalcolm@redhat.com>
6240
6241         * analyzer.h (class state_machine): New forward decl.
6242         (class logger): Likewise.
6243         (class visitor): Likewise.
6244         * complexity.cc: New file, taken from svalue.cc.
6245         * complexity.h: New file, taken from region-model.h.
6246         * region-model.h: Include "analyzer/svalue.h" and
6247         "analyzer/region.h".  Move struct complexity to complexity.h.
6248         Move svalue, its subclasses and supporting decls to svalue.h.
6249         Move region, its subclasses and supporting decls to region.h.
6250         * region.cc: Include "analyzer/region.h".
6251         (symbolic_region::symbolic_region): Move here from region-model.h.
6252         * region.h: New file, based on material from region-model.h.
6253         * svalue.cc: Include "analyzer/svalue.h".
6254         (complexity::complexity): Move to complexity.cc.
6255         (complexity::from_pair): Likewise.
6256         * svalue.h: New file, based on material from region-model.h.
6257
6258 2020-10-29  David Malcolm  <dmalcolm@redhat.com>
6259
6260         * program-state.cc (sm_state_map::print): Guard the printing of
6261         the origin pointer with !flag_dump_noaddr.
6262         * region.cc (string_region::dump_to_pp): Likewise for
6263         m_string_cst.
6264
6265 2020-10-27  David Malcolm  <dmalcolm@redhat.com>
6266
6267         PR analyzer/97568
6268         * region-model.cc (region_model::get_initial_value_for_global):
6269         Move check that !DECL_EXTERNAL from here to...
6270         * region.cc (decl_region::get_svalue_for_initializer): ...here,
6271         using it to reject zero initialization.
6272
6273 2020-10-27  Markus Böck  <markus.boeck02@gmail.com>
6274
6275         PR analyzer/96608
6276         * store.h (hash): Cast to intptr_t instead of long
6277
6278 2020-10-27  David Malcolm  <dmalcolm@redhat.com>
6279
6280         * constraint-manager.cc (svalue_cmp_by_ptr): Delete.
6281         (equiv_class::canonicalize): Use svalue::cmp_ptr_ptr instead.
6282         (equiv_class_cmp): Eliminate pointer comparison.
6283         * diagnostic-manager.cc (dedupe_key::comparator): If they are at
6284         the same location, also compare epath ength and pending_diagnostic
6285         kind.
6286         * engine.cc (readability_comparator): If two path_vars have the
6287         same readability, then impose an arbitrary ordering on them.
6288         (worklist::key_t::cmp): If two points have the same plan ordering,
6289         continue the comparison.  Call sm_state_map::cmp rather than
6290         comparing hash values.
6291         * program-state.cc (sm_state_map::entry_t::cmp): New.
6292         (sm_state_map::cmp): New.
6293         * program-state.h (sm_state_map::entry_t::cmp): New decl.
6294         (sm_state_map::elements): New.
6295         (sm_state_map::cmp): New.
6296
6297 2020-10-27  David Malcolm  <dmalcolm@redhat.com>
6298
6299         * engine.cc (setjmp_record::cmp): New.
6300         (supernode_cluster::dump_dot): Avoid embedding pointer in cluster
6301         name.
6302         (supernode_cluster::cmp_ptr_ptr): New.
6303         (function_call_string_cluster::dump_dot): Avoid embedding pointer
6304         in cluster name.  Sort m_map when dumping child clusters.
6305         (function_call_string_cluster::cmp_ptr_ptr): New.
6306         (root_cluster::dump_dot): Sort m_map when dumping child clusters.
6307         * program-point.cc (function_point::cmp): New.
6308         (function_point::cmp_ptr): New.
6309         * program-point.h (function_point::cmp): New decl.
6310         (function_point::cmp_ptr): New decl.
6311         * program-state.cc (sm_state_map::print): Sort the values.  Guard
6312         the printing of pointers with !flag_dump_noaddr.
6313         (program_state::prune_for_point): Sort the regions.
6314         (log_set_of_svalues): Sort the values.  Guard the printing of
6315         pointers with !flag_dump_noaddr.
6316         * region-model-manager.cc (log_uniq_map): Sort the values.
6317         * region-model-reachability.cc (dump_set): New function template.
6318         (reachable_regions::dump_to_pp): Use it.
6319         * region-model.h (svalue::cmp_ptr): New decl.
6320         (svalue::cmp_ptr_ptr): New decl.
6321         (setjmp_record::cmp): New decl.
6322         (placeholder_svalue::get_name): New accessor.
6323         (widening_svalue::get_point): New accessor.
6324         (compound_svalue::get_map): New accessor.
6325         (conjured_svalue::get_stmt): New accessor.
6326         (conjured_svalue::get_id_region): New accessor.
6327         (region::cmp_ptrs): Rename to...
6328         (region::cmp_ptr_ptr): ...this.
6329         * region.cc (region::cmp_ptrs): Rename to...
6330         (region::cmp_ptr_ptr): ...this.
6331         * state-purge.cc
6332         (state_purge_per_ssa_name::state_purge_per_ssa_name): Sort
6333         m_points_needing_name when dumping.
6334         * store.cc (concrete_binding::cmp_ptr_ptr): New.
6335         (symbolic_binding::cmp_ptr_ptr): New.
6336         (binding_map::cmp): New.
6337         (get_sorted_parent_regions): Update for renaming of
6338         region::cmp_ptrs to region::cmp_ptr_ptr.
6339         (store::dump_to_pp): Likewise.
6340         (store::to_json): Likewise.
6341         (store::can_merge_p): Sort the base regions before considering
6342         them.
6343         * store.h (concrete_binding::cmp_ptr_ptr): New decl.
6344         (symbolic_binding::cmp_ptr_ptr): New decl.
6345         (binding_map::cmp): New decl.
6346         * supergraph.cc (supergraph::supergraph): Assign UIDs to the
6347         gimple stmts.
6348         * svalue.cc (cmp_cst): New.
6349         (svalue::cmp_ptr): New.
6350         (svalue::cmp_ptr_ptr): New.
6351
6352 2020-10-27  David Malcolm  <dmalcolm@redhat.com>
6353
6354         * engine.cc (exploded_graph::get_or_create_node): Fix off-by-one
6355         when imposing param_analyzer_max_enodes_per_program_point limit.
6356
6357 2020-10-27  David Malcolm  <dmalcolm@redhat.com>
6358
6359         * region-model.cc (region_model::get_representative_path_var):
6360         Implement case RK_LABEL.
6361         * region-model.h (label_region::get_label): New accessor.
6362
6363 2020-10-22  David Malcolm  <dmalcolm@redhat.com>
6364
6365         PR analyzer/97514
6366         * engine.cc (exploded_graph::add_function_entry): Handle failure
6367         to create an enode, rather than asserting.
6368
6369 2020-10-22  David Malcolm  <dmalcolm@redhat.com>
6370
6371         PR analyzer/97489
6372         * engine.cc (exploded_graph::add_function_entry): Assert that we
6373         have a function body.
6374         (exploded_graph::on_escaped_function): Reject fndecls that don't
6375         have a function body.
6376
6377 2020-10-14  David Malcolm  <dmalcolm@redhat.com>
6378
6379         PR analyzer/93388
6380         * region-model.cc (region_model::get_initial_value_for_global):
6381         Fall back to returning an initial_svalue if
6382         decl_region::get_svalue_for_initializer fails.
6383         * region.cc (decl_region::get_svalue_for_initializer): Don't
6384         attempt to create a compound_svalue if the region has an unknown
6385         size.
6386
6387 2020-10-14  David Malcolm  <dmalcolm@redhat.com>
6388
6389         PR analyzer/93723
6390         * store.cc (binding_map::apply_ctor_to_region): Remove redundant
6391         assertion.
6392
6393 2020-10-12  David Malcolm  <dmalcolm@redhat.com>
6394
6395         PR analyzer/97258
6396         * engine.cc (impl_region_model_context::on_escaped_function): New
6397         vfunc.
6398         (exploded_graph::add_function_entry): Use m_functions_with_enodes
6399         to implement idempotency.
6400         (add_any_callbacks): New.
6401         (exploded_graph::build_initial_worklist): Use the above to find
6402         callbacks that are reachable from global initializers.
6403         (exploded_graph::on_escaped_function): New.
6404         * exploded-graph.h
6405         (impl_region_model_context::on_escaped_function): New decl.
6406         (exploded_graph::on_escaped_function): New decl.
6407         (exploded_graph::m_functions_with_enodes): New field.
6408         * region-model-reachability.cc
6409         (reachable_regions::reachable_regions): Replace "store" param with
6410         "model" param; use it to initialize m_model.
6411         (reachable_regions::add): When getting the svalue for the region,
6412         call get_store_value on the model rather than using an initial
6413         value.
6414         (reachable_regions::mark_escaped_clusters): Add ctxt param and
6415         use it to call on_escaped_function when a function_region escapes.
6416         * region-model-reachability.h
6417         (reachable_regions::reachable_regions): Replace "store" param with
6418         "model" param.
6419         (reachable_regions::mark_escaped_clusters): Add ctxt param.
6420         (reachable_regions::m_model): New field.
6421         * region-model.cc (region_model::handle_unrecognized_call): Update
6422         for change in reachable_regions ctor.
6423         (region_model::handle_unrecognized_call): Pass ctxt to
6424         mark_escaped_clusters.
6425         (region_model::get_reachable_svalues): Update for change in
6426         reachable_regions ctor.
6427         (region_model::get_initial_value_for_global): Read-only variables
6428         keep their initial values.
6429         * region-model.h (region_model_context::on_escaped_function): New
6430         vfunc.
6431         (noop_region_model_context::on_escaped_function): New.
6432
6433 2020-10-12  David Malcolm  <dmalcolm@redhat.com>
6434
6435         * analyzer.opt (Wanalyzer-write-to-const): New.
6436         (Wanalyzer-write-to-string-literal): New.
6437         * region-model-impl-calls.cc (region_model::impl_call_memcpy):
6438         Call check_for_writable_region.
6439         (region_model::impl_call_memset): Likewise.
6440         (region_model::impl_call_strcpy): Likewise.
6441         * region-model.cc (class write_to_const_diagnostic): New.
6442         (class write_to_string_literal_diagnostic): New.
6443         (region_model::check_for_writable_region): New.
6444         (region_model::set_value): Call check_for_writable_region.
6445         * region-model.h (region_model::check_for_writable_region): New
6446         decl.
6447
6448 2020-10-07  David Malcolm  <dmalcolm@redhat.com>
6449
6450         PR analyzer/97116
6451         * sm-malloc.cc (method_p): New.
6452         (describe_argument_index): New.
6453         (inform_nonnull_attribute): Use describe_argument_index.
6454         (possible_null_arg::describe_final_event): Likewise.
6455         (null_arg::describe_final_event): Likewise.
6456
6457 2020-09-29  David Malcolm  <dmalcolm@redhat.com>
6458
6459         PR analyzer/95188
6460         * engine.cc (stmt_requires_new_enode_p): Split enodes before
6461         "signal" calls.
6462
6463 2020-09-29  David Malcolm  <dmalcolm@redhat.com>
6464
6465         * constraint-manager.cc
6466         (constraint_manager::add_constraint_internal): Whitespace fixes.
6467         Silence -Wsign-compare warning.
6468         * engine.cc (maybe_process_run_of_before_supernode_enodes):
6469         Silence -Wsign-compare warning.
6470
6471 2020-09-28  David Malcolm  <dmalcolm@redhat.com>
6472
6473         * region-model.h (binop_svalue::dyn_cast_binop_svalue): Remove
6474         redundant "virtual".  Add FINAL OVERRIDE.
6475         (widening_svalue::dyn_cast_widening_svalue): Add FINAL OVERRIDE.
6476         (compound_svalue::dyn_cast_compound_svalue): Likewise.
6477         (conjured_svalue::dyn_cast_conjured_svalue): Likewise.
6478
6479 2020-09-28  David Malcolm  <dmalcolm@redhat.com>
6480
6481         * diagnostic-manager.cc (null_assignment_sm_context::m_visitor):
6482         Remove unused field.
6483
6484 2020-09-28  David Malcolm  <dmalcolm@redhat.com>
6485
6486         PR analyzer/97233
6487         * analyzer.cc (is_longjmp_call_p): Require the initial argument
6488         to be a pointer.
6489         * engine.cc (exploded_node::on_longjmp): Likewise.
6490
6491 2020-09-28  David Malcolm  <dmalcolm@redhat.com>
6492
6493         * program-state.cc (sm_state_map::print): Update check
6494         for m_global_state being the start state.
6495
6496 2020-09-26  David Malcolm  <dmalcolm@redhat.com>
6497
6498         PR analyzer/96646
6499         PR analyzer/96841
6500         * region-model.cc (region_model::get_representative_path_var):
6501         When handling offset_region, wrap the MEM_REF's first argument in
6502         an ADDR_EXPR of pointer type, rather than simply using the tree
6503         for the parent region.  Require the MEM_REF's second argument to
6504         be an integer constant.
6505
6506 2020-09-24  David Malcolm  <dmalcolm@redhat.com>
6507
6508         * analyzer.h (struct rejected_constraint): New decl.
6509         * analyzer.opt (fanalyzer-feasibility): New option.
6510         * diagnostic-manager.cc (path_builder::path_builder): Add
6511         "problem" param and use it to initialize new field.
6512         (path_builder::get_feasibility_problem): New accessor.
6513         (path_builder::m_feasibility_problem): New field.
6514         (dedupe_winners::add): Remove inversion of logic in "if" clause,
6515         swapping if/else suites.  In the !feasible_p suite, inspect
6516         flag_analyzer_feasibility and add code to handle when this
6517         is off, accepting the infeasible path, but recording the
6518         feasibility_problem.
6519         (diagnostic_manager::emit_saved_diagnostic): Pass the
6520         feasibility_problem to the path_builder.
6521         (diagnostic_manager::add_events_for_eedge): If we have
6522         a feasibility_problem at this edge, use it to add a custom event.
6523         * engine.cc (exploded_path::feasible_p): Pass a
6524         rejected_constraint ** to model.maybe_update_for_edge and transfer
6525         ownership of any created instance to any feasibility_problem.
6526         (feasibility_problem::dump_to_pp): New.
6527         * exploded-graph.h (feasibility_problem::feasibility_problem):
6528         Drop "model" param; add rejected_constraint * param.
6529         (feasibility_problem::~feasibility_problem): New.
6530         (feasibility_problem::dump_to_pp): New decl.
6531         (feasibility_problem::m_model): Drop field.
6532         (feasibility_problem::m_rc): New field.
6533         * program-point.cc (function_point::get_location): Handle
6534         PK_BEFORE_SUPERNODE and PK_AFTER_SUPERNODE.
6535         * program-state.cc (program_state::on_edge): Pass NULL to new
6536         param of region_model::maybe_update_for_edge.
6537         * region-model.cc (region_model::add_constraint): New overload
6538         adding a rejected_constraint ** param.
6539         (region_model::maybe_update_for_edge): Add rejected_constraint **
6540         param and pass it to the various apply_constraints_for_ calls.
6541         (region_model::apply_constraints_for_gcond): Add
6542         rejected_constraint ** param and pass it to add_constraint calls.
6543         (region_model::apply_constraints_for_gswitch): Likewise.
6544         (region_model::apply_constraints_for_exception): Likewise.
6545         (rejected_constraint::dump_to_pp): New.
6546         * region-model.h (region_model::maybe_update_for_edge):
6547         Add rejected_constraint ** param.
6548         (region_model::add_constraint): New overload adding a
6549         rejected_constraint ** param.
6550         (region_model::apply_constraints_for_gcond): Add
6551         rejected_constraint ** param.
6552         (region_model::apply_constraints_for_gswitch): Likewise.
6553         (region_model::apply_constraints_for_exception): Likewise.
6554         (struct rejected_constraint): New.
6555
6556 2020-09-23  David Malcolm  <dmalcolm@redhat.com>
6557
6558         PR analyzer/97178
6559         * engine.cc (impl_run_checkers): Update for change to ext_state
6560         ctor.
6561         * program-state.cc (selftest::test_sm_state_map): Pass an engine
6562         instance to ext_state ctor.
6563         (selftest::test_program_state_1): Likewise.
6564         (selftest::test_program_state_2): Likewise.
6565         (selftest::test_program_state_merging): Likewise.
6566         (selftest::test_program_state_merging_2): Likewise.
6567         * program-state.h (extrinsic_state::extrinsic_state): Remove NULL
6568         default value for "eng" param.
6569
6570 2020-09-23  Tobias Burnus  <tobias@codesourcery.com>
6571
6572         * analyzer-logging.cc: Guard '#pragma ... ignored "-Wformat-diag"'
6573         by '#if __GNUC__ >= 10'
6574         * analyzer.h: Likewise.
6575         * call-string.cc: Likewise.
6576
6577 2020-09-23  David Malcolm  <dmalcolm@redhat.com>
6578
6579         * engine.cc (exploded_node::on_stmt): Replace sequence of dyn_cast
6580         with switch.
6581
6582 2020-09-22  David Malcolm  <dmalcolm@redhat.com>
6583
6584         * analysis-plan.cc: Include "json.h".
6585         * analyzer.opt (fdump-analyzer-json): New.
6586         * call-string.cc: Include "json.h".
6587         (call_string::to_json): New.
6588         * call-string.h (call_string::to_json): New decl.
6589         * checker-path.cc: Include "json.h".
6590         * constraint-manager.cc: Include "json.h".
6591         (equiv_class::to_json): New.
6592         (constraint::to_json): New.
6593         (constraint_manager::to_json): New.
6594         * constraint-manager.h (equiv_class::to_json): New decl.
6595         (constraint::to_json): New decl.
6596         (constraint_manager::to_json): New decl.
6597         * diagnostic-manager.cc: Include "json.h".
6598         (saved_diagnostic::to_json): New.
6599         (diagnostic_manager::to_json): New.
6600         * diagnostic-manager.h (saved_diagnostic::to_json): New decl.
6601         (diagnostic_manager::to_json): New decl.
6602         * engine.cc: Include "json.h", <zlib.h>.
6603         (exploded_node::status_to_str): New.
6604         (exploded_node::to_json): New.
6605         (exploded_edge::to_json): New.
6606         (exploded_graph::to_json): New.
6607         (dump_analyzer_json): New.
6608         (impl_run_checkers): Call it.
6609         * exploded-graph.h (exploded_node::status_to_str): New decl.
6610         (exploded_node::to_json): New.
6611         (exploded_edge::to_json): New.
6612         (exploded_graph::to_json): New.
6613         * pending-diagnostic.cc: Include "json.h".
6614         * program-point.cc: Include "json.h".
6615         (program_point::to_json): New.
6616         * program-point.h (program_point::to_json): New decl.
6617         * program-state.cc: Include "json.h".
6618         (extrinsic_state::to_json): New.
6619         (sm_state_map::to_json): New.
6620         (program_state::to_json): New.
6621         * program-state.h (extrinsic_state::to_json): New decl.
6622         (sm_state_map::to_json): New decl.
6623         (program_state::to_json): New decl.
6624         * region-model-impl-calls.cc: Include "json.h".
6625         * region-model-manager.cc: Include "json.h".
6626         * region-model-reachability.cc: Include "json.h".
6627         * region-model.cc: Include "json.h".
6628         * region-model.h (svalue::to_json): New decl.
6629         (region::to_json): New decl.
6630         * region.cc: Include "json.h".
6631         (region::to_json: New.
6632         * sm-file.cc: Include "json.h".
6633         * sm-malloc.cc: Include "json.h".
6634         * sm-pattern-test.cc: Include "json.h".
6635         * sm-sensitive.cc: Include "json.h".
6636         * sm-signal.cc: Include "json.h".
6637         (signal_delivery_edge_info_t::to_json): New.
6638         * sm-taint.cc: Include "json.h".
6639         * sm.cc: Include "diagnostic.h", "tree-diagnostic.h", and
6640         "json.h".
6641         (state_machine::state::to_json): New.
6642         (state_machine::to_json): New.
6643         * sm.h (state_machine::state::to_json): New.
6644         (state_machine::to_json): New.
6645         * state-purge.cc: Include "json.h".
6646         * store.cc: Include "json.h".
6647         (binding_key::get_desc): New.
6648         (binding_map::to_json): New.
6649         (binding_cluster::to_json): New.
6650         (store::to_json): New.
6651         * store.h (binding_key::get_desc): New decl.
6652         (binding_map::to_json): New decl.
6653         (binding_cluster::to_json): New decl.
6654         (store::to_json): New decl.
6655         * supergraph.cc: Include "json.h".
6656         (supergraph::to_json): New.
6657         (supernode::to_json): New.
6658         (superedge::to_json): New.
6659         * supergraph.h (supergraph::to_json): New decl.
6660         (supernode::to_json): New decl.
6661         (superedge::to_json): New decl.
6662         * svalue.cc: Include "json.h".
6663         (svalue::to_json): New.
6664
6665 2020-09-21  David Malcolm  <dmalcolm@redhat.com>
6666
6667         PR analyzer/97130
6668         * region-model-impl-calls.cc (call_details::get_arg_type): New.
6669         * region-model.cc (region_model::on_call_pre): Check that the
6670         initial arg is a pointer before calling impl_call_memset and
6671         impl_call_strlen.
6672         * region-model.h (call_details::get_arg_type): New decl.
6673
6674 2020-09-21  David Malcolm  <dmalcolm@redhat.com>
6675
6676         PR analyzer/93355
6677         * sm-malloc.cc (malloc_state_machine::get_default_state): Look at
6678         the base region when considering pointers.  Treat pointers to
6679         decls as being non-heap.
6680
6681 2020-09-18  David Malcolm  <dmalcolm@redhat.com>
6682
6683         * checker-path.cc (warning_event::get_desc): Handle global state
6684         changes.
6685
6686 2020-09-18  David Malcolm  <dmalcolm@redhat.com>
6687
6688         * sm-malloc.cc (malloc_state_machine::on_stmt): Handle strdup and
6689         strndup as being malloc-like allocators.
6690
6691 2020-09-16  David Malcolm  <dmalcolm@redhat.com>
6692
6693         * engine.cc (strongly_connected_components::strong_connect): Only
6694         consider intraprocedural edges when creating SCCs.
6695         (worklist::key_t::cmp): Add comment.  Treat call_string
6696         differences as more important than differences of program_point
6697         within a supernode.
6698
6699 2020-09-16  David Malcolm  <dmalcolm@redhat.com>
6700
6701         * engine.cc (supernode_cluster::dump_dot): Show the SCC id
6702         in the per-supernode clusters in FILENAME.eg.dot output.
6703         (exploded_graph_annotator::add_node_annotations):
6704         Show the SCC of the supernode in FILENAME.supernode.eg.dot output.
6705         * exploded-graph.h (worklist::scc_id): New.
6706         (exploded_graph::get_scc_id): New.
6707
6708 2020-09-16  David Malcolm  <dmalcolm@redhat.com>
6709
6710         * engine.cc (exploded_node::dump_dot): Show STATUS_BULK_MERGED.
6711         (exploded_graph::process_worklist): Call
6712         maybe_process_run_of_before_supernode_enodes.
6713         (exploded_graph::maybe_process_run_of_before_supernode_enodes):
6714         New.
6715         (exploded_graph_annotator::print_enode): Show STATUS_BULK_MERGED.
6716         * exploded-graph.h (enum exploded_node::status): Add
6717         STATUS_BULK_MERGED.
6718
6719 2020-09-16  David Malcolm  <dmalcolm@redhat.com>
6720
6721         * engine.cc
6722         (exploded_graph::process_node) <case PK_BEFORE_SUPERNODE>:
6723         Simplify by using program_point::get_next.
6724         * program-point.cc (program_point::get_next): New.
6725         * program-point.h (program_point::get_next): New decl.
6726
6727 2020-09-16  David Malcolm  <dmalcolm@redhat.com>
6728
6729         * engine.cc (exploded_graph::get_or_create_node): Show the
6730         program point when issuing -Wanalyzer-too-complex due to hitting
6731         the per-program-point limit.
6732
6733 2020-09-16  David Malcolm  <dmalcolm@redhat.com>
6734
6735         * region-model.cc (region_model::on_call_pre): Treat getchar as
6736         having no side-effects.
6737
6738 2020-09-15  David Malcolm  <dmalcolm@redhat.com>
6739
6740         PR analyzer/96650
6741         * constraint-manager.cc (merger_fact_visitor::on_fact): Replace
6742         assertion that add_constraint succeeded with an assertion that
6743         if it fails, -fanalyzer-transitivity is off.
6744
6745 2020-09-14  David Malcolm  <dmalcolm@redhat.com>
6746
6747         * analyzer.opt (-param=analyzer-max-constraints=): New param.
6748         * constraint-manager.cc
6749         (constraint_manager::add_constraint_internal): Silently reject
6750         attempts to add constraints when the above limit is reached.
6751
6752 2020-09-14  David Malcolm  <dmalcolm@redhat.com>
6753
6754         PR analyzer/96653
6755         * constraint-manager.cc
6756         (constraint_manager::get_or_add_equiv_class): Don't accumulate
6757         transitive closure of all constraints on constants.
6758
6759 2020-09-14  David Malcolm  <dmalcolm@redhat.com>
6760
6761         PR analyzer/97029
6762         * analyzer.cc (is_setjmp_call_p): Require the initial arg to be a
6763         pointer.
6764         * region-model.cc (region_model::deref_rvalue): Assert that the
6765         svalue is of pointer type.
6766
6767 2020-09-11  David Malcolm  <dmalcolm@redhat.com>
6768
6769         PR analyzer/96798
6770         * region-model-impl-calls.cc (region_model::impl_call_memcpy):
6771         New.
6772         (region_model::impl_call_strcpy): New.
6773         * region-model.cc (region_model::on_call_pre): Flag unhandled
6774         builtins that are non-pure as having unknown side-effects.
6775         Implement BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_STRCPY,
6776         BUILT_IN_STRCPY_CHK, BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED,
6777         BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_FPUTC,
6778         BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
6779         BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
6780         BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR,
6781         BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED,
6782         BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF.
6783         * region-model.h (region_model::impl_call_memcpy): New decl.
6784         (region_model::impl_call_strcpy): New decl.
6785
6786 2020-09-09  David Malcolm  <dmalcolm@redhat.com>
6787
6788         PR analyzer/94355
6789         * analyzer.opt (Wanalyzer-mismatching-deallocation): New warning.
6790         * region-model-impl-calls.cc
6791         (region_model::impl_call_operator_new): New.
6792         (region_model::impl_call_operator_delete): New.
6793         * region-model.cc (region_model::on_call_pre): Detect operator new
6794         and operator delete.
6795         (region_model::on_call_post): Likewise.
6796         (region_model::maybe_update_for_edge): Detect EH edges and call...
6797         (region_model::apply_constraints_for_exception): New function.
6798         * region-model.h (region_model::impl_call_operator_new): New decl.
6799         (region_model::impl_call_operator_delete): New decl.
6800         (region_model::apply_constraints_for_exception): New decl.
6801         * sm-malloc.cc (enum resource_state): New.
6802         (struct allocation_state): New state subclass.
6803         (enum wording): New.
6804         (struct api): New.
6805         (malloc_state_machine::custom_data_t): New typedef.
6806         (malloc_state_machine::add_state): New decl.
6807         (malloc_state_machine::m_unchecked)
6808         (malloc_state_machine::m_nonnull)
6809         (malloc_state_machine::m_freed): Delete these states in favor
6810         of...
6811         (malloc_state_machine::m_malloc)
6812         (malloc_state_machine::m_scalar_new)
6813         (malloc_state_machine::m_vector_new): ...this new api instances,
6814         which own their own versions of these states.
6815         (malloc_state_machine::on_allocator_call): New decl.
6816         (malloc_state_machine::on_deallocator_call): New decl.
6817         (api::api): New ctor.
6818         (dyn_cast_allocation_state): New.
6819         (as_a_allocation_state): New.
6820         (get_rs): New.
6821         (unchecked_p): New.
6822         (nonnull_p): New.
6823         (freed_p): New.
6824         (malloc_diagnostic::describe_state_change): Use unchecked_p and
6825         nonnull_p.
6826         (class mismatching_deallocation): New.
6827         (double_free::double_free): Add funcname param for initializing
6828         m_funcname.
6829         (double_free::emit): Use m_funcname in warning message rather
6830         than hardcoding "free".
6831         (double_free::describe_state_change): Likewise.  Use freed_p.
6832         (double_free::describe_call_with_state): Use freed_p.
6833         (double_free::describe_final_event): Use m_funcname in message
6834         rather than hardcoding "free".
6835         (double_free::m_funcname): New field.
6836         (possible_null::describe_state_change): Use unchecked_p.
6837         (possible_null::describe_return_of_state): Likewise.
6838         (use_after_free::use_after_free): Add param for initializing m_api.
6839         (use_after_free::emit): Use m_api->m_dealloc_funcname in message
6840         rather than hardcoding "free".
6841         (use_after_free::describe_state_change): Use freed_p.  Change the
6842         wording of the message based on the API.
6843         (use_after_free::describe_final_event): Use
6844         m_api->m_dealloc_funcname in message rather than hardcoding
6845         "free".  Change the wording of the message based on the API.
6846         (use_after_free::m_api): New field.
6847         (malloc_leak::describe_state_change): Use unchecked_p.  Update
6848         for renaming of m_malloc_event to m_alloc_event.
6849         (malloc_leak::describe_final_event): Update for renaming of
6850         m_malloc_event to m_alloc_event.
6851         (malloc_leak::m_malloc_event): Rename...
6852         (malloc_leak::m_alloc_event): ...to this.
6853         (free_of_non_heap::free_of_non_heap): Add param for initializing
6854         m_funcname.
6855         (free_of_non_heap::emit): Use m_funcname in message rather than
6856         hardcoding "free".
6857         (free_of_non_heap::describe_final_event): Likewise.
6858         (free_of_non_heap::m_funcname): New field.
6859         (allocation_state::dump_to_pp): New.
6860         (allocation_state::get_nonnull): New.
6861         (malloc_state_machine::malloc_state_machine): Update for changes
6862         to state fields and new api fields.
6863         (malloc_state_machine::add_state): New.
6864         (malloc_state_machine::on_stmt): Move malloc/calloc handling to
6865         on_allocator_call and call it, passing in the API pointer.
6866         Likewise for free, moving it to on_deallocator_call.  Handle calls
6867         to operator new and delete in an analogous way.  Use unchecked_p
6868         when testing for possibly-null-arg and possibly-null-deref, and
6869         transition to the non-null for the correct API.  Remove redundant
6870         node param from call to on_zero_assignment.  Use freed_p for
6871         use-after-free check, and pass in API.
6872         (malloc_state_machine::on_allocator_call): New, based on code in
6873         on_stmt.
6874         (malloc_state_machine::on_deallocator_call): Likewise.
6875         (malloc_state_machine::on_phi): Mark node param with
6876         ATTRIBUTE_UNUSED; don't pass it to on_zero_assignment.
6877         (malloc_state_machine::on_condition): Mark node param with
6878         ATTRIBUTE_UNUSED.  Replace on_transition calls with get_state and
6879         set_next_state pairs, transitioning to the non-null state for the
6880         appropriate API.
6881         (malloc_state_machine::can_purge_p): Port to new state approach.
6882         (malloc_state_machine::on_zero_assignment): Replace on_transition
6883         calls with get_state and set_next_state pairs.  Drop redundant
6884         node param.
6885         * sm.h (state_machine::add_custom_state): New.
6886
6887 2020-09-09  David Malcolm  <dmalcolm@redhat.com>
6888
6889         * diagnostic-manager.cc
6890         (null_assignment_sm_context::warn_for_state): Replace with...
6891         (null_assignment_sm_context::warn): ...this.
6892         * engine.cc (impl_sm_context::warn_for_state): Replace with...
6893         (impl_sm_context::warn): ...this.
6894         * sm-file.cc (fileptr_state_machine::on_stmt): Replace
6895         warn_for_state and on_transition calls with a get_state
6896         test guarding warn and set_next_state calls.
6897         * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
6898         * sm-pattern-test.cc (pattern_test_state_machine::on_condition):
6899         Replace warn_for_state call with warn call.
6900         * sm-sensitive.cc
6901         (sensitive_state_machine::warn_for_any_exposure): Replace
6902         warn_for_state call with a get_state test guarding a warn call.
6903         * sm-signal.cc (signal_state_machine::on_stmt): Likewise.
6904         * sm-taint.cc (taint_state_machine::on_stmt):  Replace
6905         warn_for_state and on_transition calls with a get_state
6906         test guarding warn and set_next_state calls.
6907         * sm.h (sm_context::warn_for_state): Replace with...
6908         (sm_context::warn): ...this.
6909
6910 2020-09-09  David Malcolm  <dmalcolm@redhat.com>
6911
6912         * diagnostic-manager.cc
6913         (null_assignment_sm_context::null_assignment_sm_context): Add old_state
6914         and ext_state params, initializing m_old_state and m_ext_state.
6915         (null_assignment_sm_context::on_transition): Split into...
6916         (null_assignment_sm_context::get_state): ...this new vfunc
6917         implementation and...
6918         (null_assignment_sm_context::set_next_state): ...this new vfunc
6919         implementation.
6920         (null_assignment_sm_context::m_old_state): New field.
6921         (null_assignment_sm_context::m_ext_state): New field.
6922         (diagnostic_manager::add_events_for_eedge): Pass in old state and
6923         ext_state when creating sm_ctxt.
6924         * engine.cc (impl_sm_context::on_transition): Split into...
6925         (impl_sm_context::get_state): ...this new vfunc
6926         implementation and...
6927         (impl_sm_context::set_next_state): ...this new vfunc
6928         implementation.
6929         * sm.h (sm_context::get_state): New pure virtual function.
6930         (sm_context::set_next_state): Likewise.
6931         (sm_context::on_transition): Convert from a pure virtual function
6932         to a regular function implemented in terms of get_state and
6933         set_next_state.
6934
6935 2020-09-09  David Malcolm  <dmalcolm@redhat.com>
6936
6937         * checker-path.cc (state_change_event::get_desc): Update
6938         state_machine::get_state_name calls to state::get_name.
6939         (warning_event::get_desc): Likewise.
6940         * diagnostic-manager.cc
6941         (null_assignment_sm_context::on_transition): Update comparison
6942         against 0 with comparison with m_sm.get_start_state.
6943         (diagnostic_manager::prune_for_sm_diagnostic): Update
6944         state_machine::get_state_name calls to state::get_name.
6945         * engine.cc (impl_sm_context::on_transition): Likewise.
6946         (exploded_node::get_dot_fillcolor): Use get_id when summing
6947         the sm states.
6948         * program-state.cc (sm_state_map::sm_state_map): Don't hardcode
6949         0 as the start state when initializing m_global_state.
6950         (sm_state_map::print): Use dump_to_pp rather than get_state_name
6951         when dumping states.
6952         (sm_state_map::is_empty_p): Don't hardcode 0 as the start state
6953         when examining m_global_state.
6954         (sm_state_map::hash): Use get_id when hashing states.
6955         (selftest::test_sm_state_map): Use state objects rather than
6956         arbitrary hardcoded integers.
6957         (selftest::test_program_state_merging): Likewise.
6958         (selftest::test_program_state_merging_2): Likewise.
6959         * sm-file.cc (fileptr_state_machine::m_start): Move to base class.
6960         (file_diagnostic::describe_state_change): Use get_start_state.
6961         (fileptr_state_machine::fileptr_state_machine): Drop m_start
6962         initialization.
6963         * sm-malloc.cc (malloc_state_machine::m_start): Move to base
6964         class.
6965         (malloc_diagnostic::describe_state_change): Use get_start_state.
6966         (possible_null::describe_state_change): Likewise.
6967         (malloc_state_machine::malloc_state_machine): Drop m_start
6968         initialization.
6969         * sm-pattern-test.cc (pattern_test_state_machine::m_start): Move
6970         to base class.
6971         (pattern_test_state_machine::pattern_test_state_machine): Drop
6972         m_start initialization.
6973         * sm-sensitive.cc (sensitive_state_machine::m_start): Move to base
6974         class.
6975         (sensitive_state_machine::sensitive_state_machine): Drop m_start
6976         initialization.
6977         * sm-signal.cc (signal_state_machine::m_start): Move to base
6978         class.
6979         (signal_state_machine::signal_state_machine): Drop m_start
6980         initialization.
6981         * sm-taint.cc (taint_state_machine::m_start): Move to base class.
6982         (taint_state_machine::taint_state_machine): Drop m_start
6983         initialization.
6984         * sm.cc (state_machine::state::dump_to_pp): New.
6985         (state_machine::state_machine): Move here from sm.h.  Initialize
6986         m_next_state_id and m_start.
6987         (state_machine::add_state): Reimplement in terms of state objects.
6988         (state_machine::get_state_name): Delete.
6989         (state_machine::get_state_by_name): Reimplement in terms of state
6990         objects.  Make const.
6991         (state_machine::validate): Delete.
6992         (state_machine::dump_to_pp): Reimplement in terms of state
6993         objects.
6994         * sm.h (state_machine::state): New class.
6995         (state_machine::state_t): Convert typedef from "unsigned" to
6996         "const state_machine::state *".
6997         (state_machine::state_machine): Move to sm.cc.
6998         (state_machine::get_default_state): Use m_start rather than
6999         hardcoding 0.
7000         (state_machine::get_state_name): Delete.
7001         (state_machine::get_state_by_name): Make const.
7002         (state_machine::get_start_state): New accessor.
7003         (state_machine::alloc_state_id): New.
7004         (state_machine::m_state_names): Drop in favor of...
7005         (state_machine::m_states): New field
7006         (state_machine::m_start): New field
7007         (start_start_p): Delete.
7008
7009 2020-09-08  David Malcolm  <dmalcolm@redhat.com>
7010
7011         PR analyzer/96949
7012         * store.cc (binding_map::apply_ctor_val_to_range): Add
7013         error-handling for the cases where we have symbolic offsets.
7014
7015 2020-09-08  David Malcolm  <dmalcolm@redhat.com>
7016
7017         PR analyzer/96950
7018         * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
7019         where min_index == max_index.
7020         (binding_map::apply_ctor_val_to_range): Replace assertion that we
7021         don't have a CONSTRUCTOR value with error-handling.
7022
7023 2020-09-08  David Malcolm  <dmalcolm@redhat.com>
7024
7025         PR analyzer/96962
7026         * region-model.cc (region_model::on_call_pre): Fix guard on switch
7027         on built-ins to only consider BUILT_IN_NORMAL, rather than other
7028         kinds of build-ins.
7029
7030 2020-09-01  David Malcolm  <dmalcolm@redhat.com>
7031
7032         PR analyzer/96792
7033         * region-model.cc (region_model::deref_rvalue): Add the constraint
7034         that PTR_SVAL is non-NULL.
7035
7036 2020-08-31  David Malcolm  <dmalcolm@redhat.com>
7037
7038         PR analyzer/96798
7039         * region-model.cc (region_model::on_call_pre): Handle
7040         BUILT_IN_MEMSET_CHK.
7041
7042 2020-08-31  David Malcolm  <dmalcolm@redhat.com>
7043
7044         * region-model.cc (region_model::on_call_pre): Gather handling of
7045         builtins and of internal fns into switch statements.  Handle
7046         "alloca" and BUILT_IN_ALLOCA_WITH_ALIGN.
7047
7048 2020-08-31  David Malcolm  <dmalcolm@redhat.com>
7049
7050         PR analyzer/96860
7051         * region.cc (decl_region::get_svalue_for_constructor): Support
7052         apply_ctor_to_region failing.
7053         * store.cc (binding_map::apply_ctor_to_region): Add failure
7054         handling.
7055         (binding_map::apply_ctor_val_to_range): Likewise.
7056         (binding_map::apply_ctor_pair_to_child_region): Likewise.  Replace
7057         assertion that child_base_offset is not symbolic with error
7058         handling.
7059         * store.h (binding_map::apply_ctor_to_region): Convert return type
7060         from void to bool.
7061         (binding_map::apply_ctor_val_to_range): Likewise.
7062         (binding_map::apply_ctor_pair_to_child_region): Likewise.
7063
7064 2020-08-31  David Malcolm  <dmalcolm@redhat.com>
7065
7066         PR analyzer/96763
7067         * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
7068         by calling a new binding_map::apply_ctor_val_to_range subroutine.
7069         Split out the existing non-CONSTRUCTOR-handling code to a new
7070         apply_ctor_pair_to_child_region subroutine.
7071         (binding_map::apply_ctor_val_to_range): New.
7072         (binding_map::apply_ctor_pair_to_child_region): New, split out
7073         from binding_map::apply_ctor_to_region as noted above.
7074         * store.h (binding_map::apply_ctor_val_to_range): New decl.
7075         (binding_map::apply_ctor_pair_to_child_region): New decl.
7076
7077 2020-08-31  David Malcolm  <dmalcolm@redhat.com>
7078
7079         PR analyzer/96764
7080         * region-model-manager.cc
7081         (region_model_manager::maybe_fold_unaryop): Handle VIEW_CONVERT_EXPR.
7082         (region_model_manager::get_or_create_cast): Move logic for
7083         real->integer casting to...
7084         (get_code_for_cast): ...this new function, and add logic for
7085         real->non-integer casts.
7086         (region_model_manager::maybe_fold_sub_svalue): Handle
7087         VIEW_CONVERT_EXPR.
7088         * region-model.cc
7089         (region_model::add_any_constraints_from_gassign): Likewise.
7090         * svalue.cc (svalue::maybe_undo_cast): Likewise.
7091         (unaryop_svalue::dump_to_pp): Likewise.
7092
7093 2020-08-26  David Malcolm  <dmalcolm@redhat.com>
7094
7095         PR analyzer/94858
7096         * region-model-manager.cc
7097         (region_model_manager::get_or_create_widening_svalue): Assert that
7098         neither of the inputs are themselves widenings.
7099         * store.cc (store::eval_alias_1): The initial value of a pointer
7100         can't point to a region that was allocated on the heap after the
7101         beginning of the path.  A widened pointer value can't alias anything
7102         that the initial pointer value can't alias.
7103         * svalue.cc (svalue::can_merge_p): Merge BINOP (X, OP, CST) with X
7104         to a widening svalue.  Merge
7105         BINOP(WIDENING(BASE, BINOP(BASE, X)), X) and BINOP(BASE, X) to
7106         to the LHS of the first BINOP.
7107
7108 2020-08-26  David Malcolm  <dmalcolm@redhat.com>
7109
7110         PR analyzer/96777
7111         * region-model.h (class compound_svalue): Document that all keys
7112         must be concrete.
7113         (compound_svalue::compound_svalue): Move definition to svalue.cc.
7114         * store.cc (binding_map::apply_ctor_to_region): Handle
7115         initializers for trailing arrays with incomplete size.
7116         * svalue.cc (compound_svalue::compound_svalue): Move definition
7117         here from region-model.h.  Add assertion that all keys are
7118         concrete.
7119
7120 2020-08-22  David Malcolm  <dmalcolm@redhat.com>
7121
7122         PR analyzer/94851
7123         * region-model-manager.cc
7124         (region_model_manager::maybe_fold_binop): Fold bitwise "& 0" to 0.
7125
7126 2020-08-22  David Malcolm  <dmalcolm@redhat.com>
7127
7128         * store.cc (store::eval_alias): Make const.  Split out 2nd half
7129         into store::eval_alias_1 and call it twice for symmetry, avoiding
7130         test duplication.
7131         (store::eval_alias_1): New function, split out from the above.
7132         * store.h (store::eval_alias): Make const.
7133         (store::eval_alias_1): New decl.
7134
7135 2020-08-22  David Malcolm  <dmalcolm@redhat.com>
7136
7137         * region-model.cc (region_model::push_frame): Bind the default
7138         SSA name for each parm if it exists, falling back to the parm
7139         itself otherwise, rather than doing both.
7140
7141 2020-08-20  David Malcolm  <dmalcolm@redhat.com>
7142
7143         PR analyzer/96723
7144         * region-model-manager.cc
7145         (region_model_manager::get_field_region): Assert that field is a
7146         FIELD_DECL.
7147         * region.cc (region::get_subregions_for_binding): In
7148         union-handling, filter the TYPE_FIELDS traversal to just FIELD_DECLs.
7149
7150 2020-08-20  David Malcolm  <dmalcolm@redhat.com>
7151
7152         PR analyzer/96713
7153         * region-model.cc (region_model::get_gassign_result): For
7154         comparisons, only use eval_condition when the lhs has boolean
7155         type, and use get_or_create_constant_svalue on the boolean
7156         constants directly rather than via get_rvalue.
7157
7158 2020-08-19  David Malcolm  <dmalcolm@redhat.com>
7159
7160         PR analyzer/96643
7161         * region-model.cc (region_model::deref_rvalue): Rather than
7162         attempting to handle all svalue kinds in the switch, only cover
7163         the special cases, and move symbolic-region handling to after
7164         the switch, thus implicitly handling the missing case SK_COMPOUND.
7165
7166 2020-08-19  David Malcolm  <dmalcolm@redhat.com>
7167
7168         PR analyzer/96705
7169         * region-model-manager.cc
7170         (region_model_manager::maybe_fold_binop): Check that we have an
7171         integral type before calling build_int_cst.
7172
7173 2020-08-19  David Malcolm  <dmalcolm@redhat.com>
7174
7175         PR analyzer/96699
7176         * region-model-manager.cc
7177         (region_model_manager::get_or_create_cast): Use FIX_TRUNC_EXPR for
7178         casting from REAL_TYPE to INTEGER_TYPE.
7179
7180 2020-08-19  David Malcolm  <dmalcolm@redhat.com>
7181
7182         PR analyzer/96651
7183         * region-model.cc (region_model::called_from_main_p): New.
7184         (region_model::get_store_value): Move handling for globals into...
7185         (region_model::get_initial_value_for_global): ...this new
7186         function, and add logic for extracting values from decl
7187         initializers.
7188         * region-model.h (decl_region::get_svalue_for_constructor): New
7189         decl.
7190         (decl_region::get_svalue_for_initializer): New decl.
7191         (region_model::called_from_main_p): New decl.
7192         (region_model::get_initial_value_for_global): New.
7193         * region.cc (decl_region::maybe_get_constant_value): Move logic
7194         for getting an svalue from a CONSTRUCTOR node to...
7195         (decl_region::get_svalue_for_constructor): ...this new function.
7196         (decl_region::get_svalue_for_initializer): New.
7197         * store.cc (get_svalue_for_ctor_val): Rewrite in terms of
7198         region_model::get_rvalue.
7199         * store.h (binding_cluster::get_map): New accessor.
7200
7201 2020-08-19  David Malcolm  <dmalcolm@redhat.com>
7202
7203         PR analyzer/96648
7204         * region.cc (get_field_at_bit_offset): Gracefully handle negative
7205         values for bit_offset.
7206
7207 2020-08-18  David Malcolm  <dmalcolm@redhat.com>
7208
7209         * region-model.cc (region_model::get_rvalue_1): Fix name of local.
7210
7211 2020-08-18  David Malcolm  <dmalcolm@redhat.com>
7212
7213         PR analyzer/96641
7214         * region-model.cc (region_model::get_rvalue_1): Handle
7215         unrecognized tree codes by returning "UNKNOWN.
7216
7217 2020-08-18  David Malcolm  <dmalcolm@redhat.com>
7218
7219         PR analyzer/96640
7220         * region-model.cc (region_model::get_gassign_result): Handle various
7221         VEC_* tree codes by returning UNKNOWN.
7222         (region_model::on_assignment): Handle unrecognized tree codes by
7223         setting lhs to an unknown value, rather than issuing a "sorry" and
7224         asserting.
7225
7226 2020-08-17  David Malcolm  <dmalcolm@redhat.com>
7227
7228         PR analyzer/96644
7229         * region-model-manager.cc (get_region_for_unexpected_tree_code):
7230         Handle ctxt being NULL.
7231
7232 2020-08-17  David Malcolm  <dmalcolm@redhat.com>
7233
7234         PR analyzer/96639
7235         * region.cc (region::get_subregions_for_binding): Check for "type"
7236         being NULL.
7237
7238 2020-08-17  David Malcolm  <dmalcolm@redhat.com>
7239
7240         PR analyzer/96642
7241         * store.cc (get_svalue_for_ctor_val): New.
7242         (binding_map::apply_ctor_to_region): Call it.
7243
7244 2020-08-14  David Malcolm  <dmalcolm@redhat.com>
7245
7246         PR testsuite/96609
7247         PR analyzer/96616
7248         * region-model.cc (region_model::get_store_value): Call
7249         maybe_get_constant_value on decl_regions first.
7250         * region-model.h (decl_region::maybe_get_constant_value): New decl.
7251         * region.cc (decl_region::get_stack_depth): Likewise.
7252         (decl_region::maybe_get_constant_value): New.
7253         * store.cc (get_subregion_within_ctor): New.
7254         (binding_map::apply_ctor_to_region): New.
7255         * store.h (binding_map::apply_ctor_to_region): New decl.
7256
7257 2020-08-14  David Malcolm  <dmalcolm@redhat.com>
7258
7259         PR analyzer/96611
7260         * store.cc (store::mark_as_escaped): Reject attempts to
7261         get a cluster for an unknown pointer.
7262
7263 2020-08-13  David Malcolm  <dmalcolm@redhat.com>
7264
7265         PR analyzer/93032
7266         PR analyzer/93938
7267         PR analyzer/94011
7268         PR analyzer/94099
7269         PR analyzer/94399
7270         PR analyzer/94458
7271         PR analyzer/94503
7272         PR analyzer/94640
7273         PR analyzer/94688
7274         PR analyzer/94689
7275         PR analyzer/94839
7276         PR analyzer/95026
7277         PR analyzer/95042
7278         PR analyzer/95240
7279         * analyzer-logging.cc: Ignore "-Wformat-diag".
7280         (logger::enter_scope): Use inc_indent in both overloads.
7281         (logger::exit_scope): Use dec_indent.
7282         * analyzer-logging.h (logger::inc_indent): New.
7283         (logger::dec_indent): New.
7284         * analyzer-selftests.cc (run_analyzer_selftests): Call
7285         analyzer_store_cc_tests.
7286         * analyzer-selftests.h (analyzer_store_cc_tests): New decl.
7287         * analyzer.cc (get_stmt_location): New function.
7288         * analyzer.h (class initial_svalue): New forward decl.
7289         (class unaryop_svalue): New forward decl.
7290         (class binop_svalue): New forward decl.
7291         (class sub_svalue): New forward decl.
7292         (class unmergeable_svalue): New forward decl.
7293         (class placeholder_svalue): New forward decl.
7294         (class widening_svalue): New forward decl.
7295         (class compound_svalue): New forward decl.
7296         (class conjured_svalue): New forward decl.
7297         (svalue_set): New typedef.
7298         (class map_region): Delete.
7299         (class array_region): Delete.
7300         (class frame_region): New forward decl.
7301         (class function_region): New forward decl.
7302         (class label_region): New forward decl.
7303         (class decl_region): New forward decl.
7304         (class element_region): New forward decl.
7305         (class offset_region): New forward decl.
7306         (class cast_region): New forward decl.
7307         (class field_region): New forward decl.
7308         (class string_region): New forward decl.
7309         (class region_model_manager): New forward decl.
7310         (class store_manager): New forward decl.
7311         (class store): New forward decl.
7312         (class call_details): New forward decl.
7313         (struct svalue_id_merger_mapping): Delete.
7314         (struct canonicalization): Delete.
7315         (class function_point): New forward decl.
7316         (class engine): New forward decl.
7317         (dump_tree): New function decl.
7318         (print_quoted_type): New function decl.
7319         (readability_comparator): New function decl.
7320         (tree_cmp): New function decl.
7321         (class path_var): Move here from region-model.h
7322         (bit_offset_t, bit_size_t, byte_size_t): New typedefs.
7323         (class region_offset): New class.
7324         (get_stmt_location): New decl.
7325         (struct member_function_hash_traits): New struct.
7326         (class consolidation_map): New class.
7327         Ignore "-Wformat-diag".
7328         * analyzer.opt (-param=analyzer-max-svalue-depth=): New param.
7329         (-param=analyzer-max-enodes-for-full-dump=): New param.
7330         * call-string.cc: Ignore -Wformat-diag.
7331         * checker-path.cc: Move includes of "analyzer/call-string.h" and
7332         "analyzer/program-point.h" to before "analyzer/region-model.h",
7333         and also include "analyzer/store.h" before it.
7334         (state_change_event::state_change_event): Replace "tree var" param
7335         with "const svalue *sval".  Convert "origin" param from tree to
7336         "const svalue *".
7337         (state_change_event::get_desc): Call get_representative_tree to
7338         convert the var and origin from const svalue * to tree.  Use
7339         svalue::get_desc rather than %qE when describing state changes.
7340         (checker_path::add_final_event): Use get_stmt_location.
7341         * checker-path.h (state_change_event::state_change_event): Port
7342         from tree to const svalue *.
7343         (state_change_event::get_lvalue): Delete.
7344         (state_change_event::get_dest_function): New.
7345         (state_change_event::m_var): Replace with...
7346         (state_change_event::m_sval): ...this.
7347         (state_change_event::m_origin): Convert from tree to
7348         const svalue *.
7349         * constraint-manager.cc: Include "analyzer/call-string.h",
7350         "analyzer/program-point.h", and "analyzer/store.h" before
7351         "analyzer/region-model.h".
7352         (struct bound, struct range): Move to constraint-manager.h.
7353         (compare_constants): New function.
7354         (range::dump): Rename to...
7355         (range::dump_to_pp): ...this.  Support NULL constants.
7356         (range::dump): Reintroduce for dumping to stderr.
7357         (range::constrained_to_single_element): Return result, rather than
7358         writing to *OUT.
7359         (range::eval_condition): New.
7360         (range::below_lower_bound): New.
7361         (range::above_upper_bound): New.
7362         (equiv_class::equiv_class): Port from svalue_id to const svalue *.
7363         (equiv_class::print): Likewise.
7364         (equiv_class::hash): Likewise.
7365         (equiv_class::operator==): Port from svalue_id to const svalue *.
7366         (equiv_class::add): Port from svalue_id to const svalue *. Drop
7367         "cm" param.
7368         (equiv_class::del): Port from svalue_id to const svalue *.
7369         (equiv_class::get_representative): Likewise.
7370         (equiv_class::remap_svalue_ids): Delete.
7371         (svalue_id_cmp_by_id): Rename to...
7372         (svalue_cmp_by_ptr): ...this, porting from svalue_id to
7373         const svalue *.
7374         (equiv_class::canonicalize): Update qsort comparator.
7375         (constraint::implied_by): New.
7376         (constraint_manager::constraint_manager): Copy m_mgr in copy ctor.
7377         (constraint_manager::dump_to_pp): Add "multiline" param
7378         (constraint_manager::dump): Pass "true" for "multiline".
7379         (constraint_manager::add_constraint): Port from svalue_id to
7380         const svalue *.  Split out second part into...
7381         (constraint_manager::add_unknown_constraint): ...this new
7382         function.  Remove self-constraints when merging equivalence
7383         classes.
7384         (constraint_manager::add_constraint_internal): Remove constraints
7385         that would be implied by the new constraint.  Port from svalue_id
7386         to const svalue *.
7387         (constraint_manager::get_equiv_class_by_sid): Rename to...
7388         (constraint_manager::get_equiv_class_by_svalue): ...this, porting
7389         from svalue_id to const svalue *.
7390         (constraint_manager::get_or_add_equiv_class): Port from svalue_id
7391         to const svalue *.
7392         (constraint_manager::eval_condition): Make const.  Call
7393         compare_constants and return early if it provides a known result.
7394         (constraint_manager::get_ec_bounds): New.
7395         (constraint_manager::eval_condition): New overloads.  Make
7396         existing one const, and use compare_constants.
7397         (constraint_manager::purge): Convert "p" param to a template
7398         rather that an abstract base class.  Port from svalue_id to
7399         const svalue *.
7400         (class dead_svalue_purger): New class.
7401         (constraint_manager::remap_svalue_ids): Delete.
7402         (constraint_manager::on_liveness_change): New.
7403         (equiv_class_cmp): Port from svalue_id to const svalue *.
7404         (constraint_manager::canonicalize): Likewise.  Combine with
7405         purging of redundant equivalence classes and constraints.
7406         (class cleaned_constraint_manager): Delete.
7407         (class merger_fact_visitor): Make "m_cm_b" const.  Add "m_merger"
7408         field.
7409         (merger_fact_visitor::fact): Port from svalue_id to const svalue *.
7410         Add special case for widening.
7411         (constraint_manager::merge): Port from svalue_id to const svalue *.
7412         (constraint_manager::clean_merger_input): Delete.
7413         (constraint_manager::for_each_fact): Port from svalue_id to
7414         const svalue *.
7415         (constraint_manager::validate): Likewise.
7416         (selftest::test_constraint_conditions): Provide a
7417         region_model_manager when creating region_model instances.
7418         Add test for self-equality not creating equivalence classes.
7419         (selftest::test_transitivity): Provide a region_model_manager when
7420         creating region_model instances.  Verify that EC-merging happens
7421         when constraints are implied.
7422         (selftest::test_constant_comparisons):  Provide a
7423         region_model_manager when creating region_model instances.
7424         (selftest::test_constraint_impl): Likewise.  Remove over-specified
7425         assertions.
7426         (selftest::test_equality): Provide a region_model_manager when
7427         creating region_model instances.
7428         (selftest::test_many_constants): Likewise.  Provide a
7429         program_point when testing merging.
7430         (selftest::run_constraint_manager_tests): Move call to
7431         test_constant_comparisons to outside the transitivity guard.
7432         * constraint-manager.h (struct bound): Move here from
7433         constraint-manager.cc.
7434         (struct range): Likewise.
7435         (struct::eval_condition): New decl.
7436         (struct::below_lower_bound): New decl.
7437         (struct::above_upper_bound): New decl.
7438         (equiv_class::add): Port from svalue_id to const svalue *.
7439         (equiv_class::del): Likewise.
7440         (equiv_class::get_representative): Likewise.
7441         (equiv_class::remap_svalue_ids): Drop.
7442         (equiv_class::m_cst_sid): Convert to..
7443         (equiv_class::m_cst_sval): ...this.
7444         (equiv_class::m_vars): Port from svalue_id to const svalue *.
7445         (constraint::bool implied_by): New decl.
7446         (fact_visitor::on_fact): Port from svalue_id to const svalue *.
7447         (constraint_manager::constraint_manager): Add mgr param.
7448         (constraint_manager::clone): Delete.
7449         (constraint_manager::maybe_get_constant): Delete.
7450         (constraint_manager::get_sid_for_constant): Delete.
7451         (constraint_manager::get_num_svalues): Delete.
7452         (constraint_manager::dump_to_pp): Add "multiline" param.
7453         (constraint_manager::get_equiv_class): Port from svalue_id to
7454         const svalue *.
7455         (constraint_manager::add_constraint):  Likewise.
7456         (constraint_manager::get_equiv_class_by_sid): Rename to...
7457         (constraint_manager::get_equiv_class_by_svalue): ...this, porting
7458         from svalue_id to const svalue *.
7459         (constraint_manager::add_unknown_constraint): New decl.
7460         (constraint_manager::get_or_add_equiv_class): Port from svalue_id
7461         to const svalue *.
7462         (constraint_manager::eval_condition): Likewise.  Add overloads.
7463         (constraint_manager::get_ec_bounds): New decl.
7464         (constraint_manager::purge): Convert to template.
7465         (constraint_manager::remap_svalue_ids): Delete.
7466         (constraint_manager::on_liveness_change): New decl.
7467         (constraint_manager::canonicalize): Drop param.
7468         (constraint_manager::clean_merger_input): Delete.
7469         (constraint_manager::m_mgr): New field.
7470         * diagnostic-manager.cc: Move includes of
7471         "analyzer/call-string.h" and "analyzer/program-point.h" to before
7472         "analyzer/region-model.h", and also include "analyzer/store.h"
7473         before it.
7474         (saved_diagnostic::saved_diagnostic): Add "sval" param.
7475         (diagnostic_manager::diagnostic_manager): Add engine param.
7476         (diagnostic_manager::add_diagnostic): Add "sval" param, passing it
7477         to saved_diagnostic ctor.  Update overload to pass NULL for it.
7478         (dedupe_winners::dedupe_winners): Add engine param.
7479         (dedupe_winners::add): Add "eg" param.  Pass m_engine to
7480         feasible_p.
7481         (dedupe_winner::m_engine): New field.
7482         (diagnostic_manager::emit_saved_diagnostics): Pass engine to
7483         dedupe_winners.  Pass &eg when adding candidates.  Pass svalue
7484         rather than tree to prune_path.  Use get_stmt_location to get
7485         primary location of diagnostic.
7486         (diagnostic_manager::emit_saved_diagnostic): Likewise.
7487         (get_any_origin): Drop.
7488         (state_change_event_creator::on_global_state_change): Pass NULL
7489         const svalue * rather than NULL_TREE trees to state_change_event
7490         ctor.
7491         (state_change_event_creator::on_state_change): Port from tree and
7492         svalue_id to const svalue *.
7493         (for_each_state_change): Port from svalue_id to const svalue *.
7494         (struct null_assignment_sm_context): New.
7495         (diagnostic_manager::add_events_for_eedge):  Add state change
7496         events for assignment to NULL.
7497         (diagnostic_manager::prune_path): Update param from tree to
7498         const svalue *.
7499         (diagnostic_manager::prune_for_sm_diagnostic): Port from tracking
7500         by tree to by const svalue *.
7501         * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add sval
7502         param.
7503         (saved_diagnostic::m_sval): New field.
7504         (diagnostic_manager::diagnostic_manager): Add engine param.
7505         (diagnostic_manager::get_engine): New.
7506         (diagnostic_manager::add_diagnostic): Add "sval" param.
7507         (diagnostic_manager::prune_path): Likewise.
7508         (diagnostic_manager::prune_for_sm_diagnostic): New overload.
7509         (diagnostic_manager::m_eng): New field.
7510         * engine.cc: Move includes of "analyzer/call-string.h" and
7511         "analyzer/program-point.h" to before "analyzer/region-model.h",
7512         and also include "analyzer/store.h" before it.
7513         (impl_region_model_context::impl_region_model_context): Update for
7514         removal of m_change field.
7515         (impl_region_model_context::remap_svalue_ids): Delete.
7516         (impl_region_model_context::on_svalue_leak): New.
7517         (impl_region_model_context::on_svalue_purge): Delete.
7518         (impl_region_model_context::on_liveness_change): New.
7519         (impl_region_model_context::on_unknown_change): Update param
7520         from svalue_id to const svalue *.  Add is_mutable param.
7521         (setjmp_svalue::compare_fields): Delete.
7522         (setjmp_svalue::accept): New.
7523         (setjmp_svalue::add_to_hash): Delete.
7524         (setjmp_svalue::dump_to_pp): New.
7525         (setjmp_svalue::print_details): Delete.
7526         (impl_sm_context::impl_sm_context): Drop "change" param.
7527         (impl_sm_context::get_fndecl_for_call): Drop "m_change".
7528         (impl_sm_context::on_transition): Drop ATTRIBUTE_UNUSED from
7529         "stmt" param.  Drop m_change.  Port from svalue_id to
7530         const svalue *.
7531         (impl_sm_context::warn_for_state): Drop m_change.  Port from
7532         svalue_id to const svalue *.
7533         (impl_sm_context::get_readable_tree): Rename to...
7534         (impl_sm_context::get_diagnostic_tree): ...this.  Port from
7535         svalue_id to const svalue *.
7536         (impl_sm_context::is_zero_assignment): New.
7537         (impl_sm_context::m_change): Delete field.
7538         (leak_stmt_finder::find_stmt): Handle m_var being NULL.
7539         (readability):  Increase penalty for MEM_REF.  For SSA_NAMEs,
7540         slightly favor the underlying var over the SSA name.  Heavily
7541         penalize temporaries.  Handle RESULT_DECL.
7542         (readability_comparator): Make non-static.  Consider stack depths.
7543         (impl_region_model_context::on_state_leak): Convert from svalue_id
7544         to const svalue *, updating for region_model changes.  Use
7545         id_equal.
7546         (impl_region_model_context::on_inherited_svalue): Delete.
7547         (impl_region_model_context::on_cast): Delete.
7548         (impl_region_model_context::on_condition):  Drop m_change.
7549         (impl_region_model_context::on_phi): Likewise.
7550         (impl_region_model_context::on_unexpected_tree_code): Handle t
7551         being NULL.
7552         (point_and_state::validate): Update stack checking for
7553         region_model changes.
7554         (eg_traits::dump_args_t::show_enode_details_p): New.
7555         (exploded_node::exploded_node): Initialize m_num_processed_stmts.
7556         (exploded_node::get_processed_stmt): New function.
7557         (exploded_node::get_dot_fillcolor): Add more colors.
7558         (exploded_node::dump_dot): Guard the printing of the point and
7559         state with show_enode_details_p.  Print the processed stmts for
7560         this enode after the initial state.
7561         (exploded_node::dump_to_pp): Pass true for new multiline param
7562         of program_state::dump_to_pp.
7563         (exploded_node::on_stmt): Drop "change" param.  Log the stmt.
7564         Set input_location.  Implement __analyzer_describe.  Update
7565         implementation of __analyzer_dump and __analyzer_eval.
7566         Remove purging of sm-state for unknown fncalls from here.
7567         (exploded_node::on_edge): Drop "change" param.
7568         (exploded_node::on_longjmp): Port from region_id/svalue_id to
7569         const region */const svalue *.  Call program_state::detect_leaks.
7570         Drop state_change.
7571         (exploded_node::detect_leaks): Update for changes to region_model.
7572         Call program_state::detect_leaks.
7573         (exploded_edge::exploded_edge): Drop ext_state and change params.
7574         (exploded_edge::dump_dot): "args" is no longer used.  Drop dumping
7575         of m_change.
7576         (exploded_graph::exploded_graph): Pass engine to
7577         m_diagnostic_manager ctor.  Use program_point::origin.
7578         (exploded_graph::add_function_entry):  Drop ctxt.  Use
7579         program_state::push_frame.  Drop state_change.
7580         (exploded_graph::get_or_create_node): Drop "change" param.  Add
7581         "enode_for_diag" param.  Update dumping calls for API changes.
7582         Pass point to can_merge_with_p.  Show enode indices
7583         within -Wanalyzer-too-complex diagnostic for hitting the per-point
7584         limit.
7585         (exploded_graph::add_edge): Drop "change" param.  Log which nodes
7586         are being connected.  Update for changes to exploded_edge ctor.
7587         (exploded_graph::get_per_program_point_data): New.
7588         (exploded_graph::process_worklist): Pass point to
7589         can_merge_with_p.  Drop state_change.  Update dumping call for API
7590         change.
7591         (exploded_graph::process_node):  Drop state_change.  Split the
7592         node in-place if an sm-state-change occurs.  Update
7593         m_num_processed_stmts.  Update dumping calls for API change.
7594         (exploded_graph::log_stats): Call engine::log_stats.
7595         (exploded_graph::dump_states_for_supernode): Update dumping
7596         call.
7597         (exploded_path::feasible_p): Add "eng" and "eg" params.
7598         Rename "i" to "end_idx".  Pass the manager to the region_model
7599         ctor.  Update for every processed stmt in the enode, not just the
7600         first.  Keep track of which snodes have been visited, and call
7601         loop_replay_fixup when revisiting one.
7602         (enode_label::get_text): Update dump call for new param.
7603         (exploded_graph::dump_exploded_nodes): Likewise.
7604         (exploded_graph::get_node_by_index): New.
7605         (impl_run_checkers): Create engine instance and pass its address
7606         to extrinsic_state ctor.
7607         * exploded-graph.h
7608         (impl_region_model_context::impl_region_model_context): Drop
7609         "change" params.
7610         (impl_region_model_context::void remap_svalue_ids): Delete.
7611         (impl_region_model_context::on_svalue_purge): Delete.
7612         (impl_region_model_context::on_svalue_leak): New.
7613         (impl_region_model_context::on_liveness_change): New.
7614         (impl_region_model_context::on_state_leak): Update signature.
7615         (impl_region_model_context::on_inherited_svalue): Delete.
7616         (impl_region_model_context::on_cast): Delete.
7617         (impl_region_model_context::on_unknown_change): Update signature.
7618         (impl_region_model_context::m_change): Delete.
7619         (eg_traits::dump_args_t::show_enode_details_p): New.
7620         (exploded_node::on_stmt): Drop "change" param.
7621         (exploded_node::on_edge): Likewise.
7622         (exploded_node::get_processed_stmt): New decl.
7623         (exploded_node::m_num_processed_stmts): New field.
7624         (exploded_edge::exploded_edge): Drop ext_state and change params.
7625         (exploded_edge::m_change): Delete.
7626         (exploded_graph::get_engine): New accessor.
7627         (exploded_graph::get_or_create_node): Drop "change" param.  Add
7628         "enode_for_diag" param.
7629         (exploded_graph::add_edge): Drop "change" param.
7630         (exploded_graph::get_per_program_point_data): New decl.
7631         (exploded_graph::get_node_by_index): New decl.
7632         (exploded_path::feasible_p): Add "eng" and "eg" params.
7633         * program-point.cc: Include "analyzer/store.h" before including
7634         "analyzer/region-model.h".
7635         (function_point::function_point): Move here from
7636         program-point.h.
7637         (function_point::get_function): Likewise.
7638         (function_point::from_function_entry): Likewise.
7639         (function_point::before_supernode): Likewise.
7640         (function_point::next_stmt): New function.
7641         * program-point.h (function_point::function_point): Move
7642         implementation from here to program-point.cc.
7643         (function_point::get_function): Likewise.
7644         (function_point::from_function_entry): Likewise.
7645         (function_point::before_supernode): Likewise.
7646         (function_point::next_stmt): New decl.
7647         (program_point::operator!=): New.
7648         (program_point::origin): New.
7649         (program_point::next_stmt): New.
7650         (program_point::m_function_point): Make non-const.
7651         * program-state.cc: Move includes of "analyzer/call-string.h" and
7652         "analyzer/program-point.h" to before "analyzer/region-model.h",
7653         and also include "analyzer/store.h" before it.
7654         (extrinsic_state::get_model_manager): New.
7655         (sm_state_map::sm_state_map): Pass in sm and sm_idx to ctor,
7656         rather than pass the around.
7657         (sm_state_map::clone_with_remapping): Delete.
7658         (sm_state_map::print): Remove "sm" param in favor of "m_sm".  Add
7659         "simple" and "multiline" params and support multiline vs single
7660         line dumping.
7661         (sm_state_map::dump): Remove "sm" param in favor of "m_sm".  Add
7662         "simple" param.
7663         (sm_state_map::hash): Port from svalue_id to const svalue *.
7664         (sm_state_map::operator==): Likewise.
7665         (sm_state_map::get_state): Likewise.  Call canonicalize_svalue on
7666         input.  Handle inheritance of sm-state.  Call get_default_state.
7667         (sm_state_map::get_origin): Port from svalue_id to const svalue *.
7668         (sm_state_map::set_state): Likewise.  Pass in ext_state.  Reject
7669         attempts to set state on UNKNOWN.
7670         (sm_state_map::impl_set_state): Port from svalue_id to
7671         const svalue *.  Pass in ext_state.  Call canonicalize_svalue on
7672         input.
7673         (sm_state_map::purge_for_unknown_fncall): Delete.
7674         (sm_state_map::on_svalue_leak): New.
7675         (sm_state_map::remap_svalue_ids): Delete.
7676         (sm_state_map::on_liveness_change): New.
7677         (sm_state_map::on_unknown_change): Reimplement.
7678         (sm_state_map::on_svalue_purge): Delete.
7679         (sm_state_map::on_inherited_svalue): Delete.
7680         (sm_state_map::on_cast): Delete.
7681         (sm_state_map::validate): Delete.
7682         (sm_state_map::canonicalize_svalue): New.
7683         (program_state::program_state): Update to pass manager to
7684         region_model's ctor.  Constify num_states and pass state machine
7685         and index to sm_state_map ctor.
7686         (program_state::print): Update for changes to dump API.
7687         (program_state::dump_to_pp): Ignore the summarize param.  Add
7688         "multiline" param.
7689         (program_state::dump_to_file): Add "multiline" param.
7690         (program_state::dump): Pass "true" for new "multiline" param.
7691         (program_state::push_frame): New.
7692         (program_state::on_edge): Drop "change" param.  Call
7693         program_state::detect_leaks.
7694         (program_state::prune_for_point): Add enode_for_diag param.
7695         Reimplement based on store class.  Call detect_leaks
7696         (program_state::remap_svalue_ids): Delete.
7697         (program_state::get_representative_tree): Port from svalue_id to
7698         const svalue *.
7699         (program_state::can_merge_with_p): Add "point" param.  Add early
7700         reject for sm-differences.  Drop id remapping.
7701         (program_state::validate): Drop region model and sm_state_map
7702         validation.
7703         (state_change::sm_change::dump): Delete.
7704         (state_change::sm_change::remap_svalue_ids): Delete.
7705         (state_change::sm_change::on_svalue_purge): Delete.
7706         (log_set_of_svalues): New.
7707         (state_change::sm_change::validate): Delete.
7708         (state_change::state_change): Delete.
7709         (state_change::add_sm_change): Delete.
7710         (state_change::affects_p): Delete.
7711         (state_change::dump): Delete.
7712         (state_change::remap_svalue_ids): Delete.
7713         (state_change::on_svalue_purge): Delete.
7714         (state_change::validate): Delete.
7715         (selftest::assert_dump_eq): Delete.
7716         (ASSERT_DUMP_EQ): Delete.
7717         (selftest::test_sm_state_map): Update for changes to region_model
7718         and sm_state_map, porting from svalue_id to const svalue *.
7719         (selftest::test_program_state_dumping): Likewise.  Drop test of
7720         dumping, renaming to...
7721         (selftest::test_program_state_1): ...this.
7722         (selftest::test_program_state_dumping_2): Likewise, renaming to...
7723         (selftest::test_program_state_2): ...this.
7724         (selftest::test_program_state_merging): Update for changes to
7725         region_model.
7726         (selftest::test_program_state_merging_2): Likewise.
7727         (selftest::analyzer_program_state_cc_tests): Update for renamed
7728         tests.
7729         * program-state.h (extrinsic_state::extrinsic_state): Add logger
7730         and engine params.
7731         (extrinsic_state::get_logger): New accessor.
7732         (extrinsic_state::get_engine): New accessor.
7733         (extrinsic_state::get_model_manager): New accessor.
7734         (extrinsic_state::m_logger): New field.
7735         (extrinsic_state::m_engine): New field.
7736         (struct default_hash_traits<svalue_id>): Delete.
7737         (pod_hash_traits<svalue_id>::hash): Delete.
7738         (pod_hash_traits<svalue_id>::equal): Delete.
7739         (pod_hash_traits<svalue_id>::mark_deleted): Delete.
7740         (pod_hash_traits<svalue_id>::mark_empty): Delete.
7741         (pod_hash_traits<svalue_id>::is_deleted): Delete.
7742         (pod_hash_traits<svalue_id>::is_empty): Delete.
7743         (sm_state_map::entry_t::entry_t): Port from svalue_id to
7744         const svalue *.
7745         (sm_state_map::entry_t::m_origin): Likewise.
7746         (sm_state_map::map_t): Likewise.
7747         (sm_state_map::sm_state_map): Add state_machine and index params.
7748         (sm_state_map::clone_with_remapping): Delete.
7749         (sm_state_map::print):  Drop sm param; add simple and multiline
7750         params.
7751         (sm_state_map::dump): Drop sm param; add simple param.
7752         (sm_state_map::get_state): Port from svalue_id to const svalue *.
7753         Add ext_state param.
7754         (sm_state_map::get_origin): Likewise.
7755         (sm_state_map::set_state): Likewise.
7756         (sm_state_map::impl_set_state): Likewise.
7757         (sm_state_map::purge_for_unknown_fncall): Delete.
7758         (sm_state_map::remap_svalue_ids): Delete.
7759         (sm_state_map::on_svalue_purge): Delete.
7760         (sm_state_map::on_svalue_leak): New.
7761         (sm_state_map::on_liveness_change): New.
7762         (sm_state_map::on_inherited_svalue): Delete.
7763         (sm_state_map::on_cast): Delete.
7764         (sm_state_map::validate): Delete.
7765         (sm_state_map::on_unknown_change): Port from svalue_id to
7766         const svalue *.  Add is_mutable and ext_state params.
7767         (sm_state_map::canonicalize_svalue): New.
7768         (sm_state_map::m_sm): New field.
7769         (sm_state_map::m_sm_idx): New field.
7770         (program_state::operator=): Delete.
7771         (program_state::dump_to_pp): Drop "summarize" param, adding
7772         "simple" and "multiline".
7773         (program_state::dump_to_file): Likewise.
7774         (program_state::dump): Rename "summarize" to "simple".
7775         (program_state::push_frame): New.
7776         (program_state::get_current_function): New.
7777         (program_state::on_edge): Drop "change" param.
7778         (program_state::prune_for_point): Likewise.  Add enode_for_diag
7779         param.
7780         (program_state::remap_svalue_ids): Delete.
7781         (program_state::get_representative_tree): Port from svalue_id to
7782         const svalue *.
7783         (program_state::can_purge_p): Likewise.  Pass ext_state to get_state.
7784         (program_state::can_merge_with_p): Add point param.
7785         (program_state::detect_leaks): New.
7786         (state_change_visitor::on_state_change): Port from tree and
7787         svalue_id to a pair of const svalue *.
7788         (class state_change): Delete.
7789         * region.cc: New file.
7790         * region-model-impl-calls.cc: New file.
7791         * region-model-manager.cc: New file.
7792         * region-model-reachability.cc: New file.
7793         * region-model-reachability.h: New file.
7794         * region-model.cc: Include "analyzer/call-string.h",
7795         "analyzer/program-point.h", and "analyzer/store.h" before
7796         "analyzer/region-model.h".  Include
7797         "analyzer/region-model-reachability.h".
7798         (dump_tree): Make non-static.
7799         (dump_quoted_tree): Make non-static.
7800         (print_quoted_type): Make non-static.
7801         (path_var::dump): Delete.
7802         (dump_separator): Delete.
7803         (class impl_constraint_manager): Delete.
7804         (svalue_id::print): Delete.
7805         (svalue_id::dump_node_name_to_pp): Delete.
7806         (svalue_id::validate): Delete.
7807         (region_id::print): Delete.
7808         (region_id::dump_node_name_to_pp): Delete.
7809         (region_id::validate): Delete.
7810         (region_id_set::region_id_set): Delete.
7811         (svalue_id_set::svalue_id_set): Delete.
7812         (svalue::operator==): Delete.
7813         (svalue::hash): Delete.
7814         (svalue::print): Delete.
7815         (svalue::dump_dot_to_pp): Delete.
7816         (svalue::remap_region_ids): Delete.
7817         (svalue::walk_for_canonicalization): Delete.
7818         (svalue::get_child_sid): Delete.
7819         (svalue::maybe_get_constant): Delete.
7820         (region_svalue::compare_fields): Delete.
7821         (region_svalue::add_to_hash): Delete.
7822         (region_svalue::print_details): Delete.
7823         (region_svalue::dump_dot_to_pp): Delete.
7824         (region_svalue::remap_region_ids): Delete.
7825         (region_svalue::merge_values): Delete.
7826         (region_svalue::walk_for_canonicalization): Delete.
7827         (region_svalue::eval_condition): Delete.
7828         (constant_svalue::compare_fields): Delete.
7829         (constant_svalue::add_to_hash): Delete.
7830         (constant_svalue::merge_values): Delete.
7831         (constant_svalue::eval_condition): Move to svalue.cc.
7832         (constant_svalue::print_details): Delete.
7833         (constant_svalue::get_child_sid): Delete.
7834         (unknown_svalue::compare_fields): Delete.
7835         (unknown_svalue::add_to_hash): Delete.
7836         (unknown_svalue::print_details): Delete.
7837         (poison_kind_to_str): Move to svalue.cc.
7838         (poisoned_svalue::compare_fields): Delete.
7839         (poisoned_svalue::add_to_hash): Delete.
7840         (poisoned_svalue::print_details): Delete.
7841         (region_kind_to_str): Move to region.cc and reimplement.
7842         (region::operator==): Delete.
7843         (region::get_parent_region): Delete.
7844         (region::set_value): Delete.
7845         (region::become_active_view): Delete.
7846         (region::deactivate_any_active_view): Delete.
7847         (region::deactivate_view): Delete.
7848         (region::get_value): Delete.
7849         (region::get_inherited_child_sid): Delete.
7850         (region_model::copy_region): Delete.
7851         (region_model::copy_struct_region): Delete.
7852         (region_model::copy_union_region): Delete.
7853         (region_model::copy_array_region): Delete.
7854         (region::hash): Delete.
7855         (region::print): Delete.
7856         (region::dump_dot_to_pp): Delete.
7857         (region::dump_to_pp): Delete.
7858         (region::dump_child_label): Delete.
7859         (region::validate): Delete.
7860         (region::remap_svalue_ids): Delete.
7861         (region::remap_region_ids): Delete.
7862         (region::add_view): Delete.
7863         (region::get_view): Delete.
7864         (region::region): Move to region.cc.
7865         (region::add_to_hash): Delete.
7866         (region::print_fields): Delete.
7867         (region::non_null_p): Delete.
7868         (primitive_region::clone): Delete.
7869         (primitive_region::walk_for_canonicalization): Delete.
7870         (map_region::map_region): Delete.
7871         (map_region::compare_fields): Delete.
7872         (map_region::print_fields): Delete.
7873         (map_region::validate): Delete.
7874         (map_region::dump_dot_to_pp): Delete.
7875         (map_region::dump_child_label): Delete.
7876         (map_region::get_or_create): Delete.
7877         (map_region::get): Delete.
7878         (map_region::add_to_hash): Delete.
7879         (map_region::remap_region_ids): Delete.
7880         (map_region::unbind): Delete.
7881         (map_region::get_tree_for_child_region): Delete.
7882         (map_region::get_tree_for_child_region): Delete.
7883         (tree_cmp): Move to region.cc.
7884         (map_region::can_merge_p): Delete.
7885         (map_region::walk_for_canonicalization): Delete.
7886         (map_region::get_value_by_name): Delete.
7887         (struct_or_union_region::valid_key_p): Delete.
7888         (struct_or_union_region::compare_fields): Delete.
7889         (struct_region::clone): Delete.
7890         (struct_region::compare_fields): Delete.
7891         (union_region::clone): Delete.
7892         (union_region::compare_fields): Delete.
7893         (frame_region::compare_fields): Delete.
7894         (frame_region::clone): Delete.
7895         (frame_region::valid_key_p): Delete.
7896         (frame_region::print_fields): Delete.
7897         (frame_region::add_to_hash): Delete.
7898         (globals_region::compare_fields): Delete.
7899         (globals_region::clone): Delete.
7900         (globals_region::valid_key_p): Delete.
7901         (code_region::compare_fields): Delete.
7902         (code_region::clone): Delete.
7903         (code_region::valid_key_p): Delete.
7904         (array_region::array_region): Delete.
7905         (array_region::get_element): Delete.
7906         (array_region::clone): Delete.
7907         (array_region::compare_fields): Delete.
7908         (array_region::print_fields): Delete.
7909         (array_region::validate): Delete.
7910         (array_region::dump_dot_to_pp): Delete.
7911         (array_region::dump_child_label): Delete.
7912         (array_region::get_or_create): Delete.
7913         (array_region::get): Delete.
7914         (array_region::add_to_hash): Delete.
7915         (array_region::remap_region_ids): Delete.
7916         (array_region::get_key_for_child_region): Delete.
7917         (array_region::key_cmp): Delete.
7918         (array_region::walk_for_canonicalization): Delete.
7919         (array_region::key_from_constant): Delete.
7920         (array_region::constant_from_key): Delete.
7921         (function_region::compare_fields): Delete.
7922         (function_region::clone): Delete.
7923         (function_region::valid_key_p): Delete.
7924         (stack_region::stack_region): Delete.
7925         (stack_region::compare_fields): Delete.
7926         (stack_region::clone): Delete.
7927         (stack_region::print_fields): Delete.
7928         (stack_region::dump_child_label): Delete.
7929         (stack_region::validate): Delete.
7930         (stack_region::push_frame): Delete.
7931         (stack_region::get_current_frame_id): Delete.
7932         (stack_region::pop_frame): Delete.
7933         (stack_region::add_to_hash): Delete.
7934         (stack_region::remap_region_ids): Delete.
7935         (stack_region::can_merge_p): Delete.
7936         (stack_region::walk_for_canonicalization): Delete.
7937         (stack_region::get_value_by_name): Delete.
7938         (heap_region::heap_region): Delete.
7939         (heap_region::compare_fields): Delete.
7940         (heap_region::clone): Delete.
7941         (heap_region::walk_for_canonicalization): Delete.
7942         (root_region::root_region): Delete.
7943         (root_region::compare_fields): Delete.
7944         (root_region::clone): Delete.
7945         (root_region::print_fields): Delete.
7946         (root_region::validate): Delete.
7947         (root_region::dump_child_label): Delete.
7948         (root_region::push_frame): Delete.
7949         (root_region::get_current_frame_id): Delete.
7950         (root_region::pop_frame): Delete.
7951         (root_region::ensure_stack_region): Delete.
7952         (root_region::get_stack_region): Delete.
7953         (root_region::ensure_globals_region): Delete.
7954         (root_region::get_code_region): Delete.
7955         (root_region::ensure_code_region): Delete.
7956         (root_region::get_globals_region): Delete.
7957         (root_region::ensure_heap_region): Delete.
7958         (root_region::get_heap_region): Delete.
7959         (root_region::remap_region_ids): Delete.
7960         (root_region::can_merge_p): Delete.
7961         (root_region::add_to_hash): Delete.
7962         (root_region::walk_for_canonicalization): Delete.
7963         (root_region::get_value_by_name): Delete.
7964         (symbolic_region::symbolic_region): Delete.
7965         (symbolic_region::compare_fields): Delete.
7966         (symbolic_region::clone): Delete.
7967         (symbolic_region::walk_for_canonicalization): Delete.
7968         (symbolic_region::print_fields): Delete.
7969         (region_model::region_model): Add region_model_manager * param.
7970         Reimplement in terms of store, dropping impl_constraint_manager
7971         subclass.
7972         (region_model::operator=): Reimplement in terms of store
7973         (region_model::operator==): Likewise.
7974         (region_model::hash): Likewise.
7975         (region_model::print): Delete.
7976         (region_model::print_svalue): Delete.
7977         (region_model::dump_dot_to_pp): Delete.
7978         (region_model::dump_dot_to_file): Delete.
7979         (region_model::dump_dot): Delete.
7980         (region_model::dump_to_pp): Replace "summarize" param with
7981         "simple" and "multiline".  Port to store-based implementation.
7982         (region_model::dump): Replace "summarize" param with "simple" and
7983         "multiline".
7984         (dump_vec_of_tree): Delete.
7985         (region_model::dump_summary_of_rep_path_vars): Delete.
7986         (region_model::validate): Delete.
7987         (svalue_id_cmp_by_constant_svalue_model): Delete.
7988         (svalue_id_cmp_by_constant_svalue): Delete.
7989         (region_model::canonicalize): Drop "ctxt" param.  Reimplement in
7990         terms of store and constraints.
7991         (region_model::canonicalized_p): Remove NULL arg to canonicalize.
7992         (region_model::loop_replay_fixup): New.
7993         (poisoned_value_diagnostic::emit): Tweak wording of warnings.
7994         (region_model::check_for_poison): Delete.
7995         (region_model::get_gassign_result): New.
7996         (region_model::on_assignment): Port to store-based implementation.
7997         (region_model::on_call_pre): Delete calls to check_for_poison.
7998         Move implementations to region-model-impl-calls.c and port to
7999         store-based implementation.
8000         (region_model::on_call_post): Likewise.
8001         (class reachable_regions): Move to region-model-reachability.h/cc
8002         and port to store-based implementation.
8003         (region_model::handle_unrecognized_call): Port to store-based
8004         implementation.
8005         (region_model::get_reachable_svalues): New.
8006         (region_model::on_setjmp): Port to store-based implementation.
8007         (region_model::on_longjmp): Likewise.
8008         (region_model::handle_phi): Drop is_back_edge param and the logic
8009         using it.
8010         (region_model::get_lvalue_1): Port from region_id to const region *.
8011         (region_model::make_region_for_unexpected_tree_code): Delete.
8012         (assert_compat_types): If the check fails, use internal_error to
8013         show the types.
8014         (region_model::get_lvalue): Port from region_id to const region *.
8015         (region_model::get_rvalue_1): Port from svalue_id to const svalue *.
8016         (region_model::get_rvalue): Likewise.
8017         (region_model::get_or_create_ptr_svalue): Delete.
8018         (region_model::get_or_create_constant_svalue): Delete.
8019         (region_model::get_svalue_for_fndecl): Delete.
8020         (region_model::get_region_for_fndecl): Delete.
8021         (region_model::get_svalue_for_label): Delete.
8022         (region_model::get_region_for_label): Delete.
8023         (build_cast): Delete.
8024         (region_model::maybe_cast_1): Delete.
8025         (region_model::maybe_cast): Delete.
8026         (region_model::get_field_region): Delete.
8027         (region_model::get_store_value): New.
8028         (region_model::region_exists_p): New.
8029         (region_model::deref_rvalue): Port from svalue_id to const svalue *.
8030         (region_model::set_value): Likewise.
8031         (region_model::clobber_region): New.
8032         (region_model::purge_region): New.
8033         (region_model::zero_fill_region): New.
8034         (region_model::mark_region_as_unknown): New.
8035         (region_model::eval_condition): Port from svalue_id to
8036         const svalue *.
8037         (region_model::eval_condition_without_cm): Likewise.
8038         (region_model::compare_initial_and_pointer): New.
8039         (region_model::add_constraint): Port from svalue_id to
8040         const svalue *.
8041         (region_model::maybe_get_constant): Delete.
8042         (region_model::get_representative_path_var): New.
8043         (region_model::add_new_malloc_region): Delete.
8044         (region_model::get_representative_tree): Port to const svalue *.
8045         (region_model::get_representative_path_var): Port to
8046         const region *.
8047         (region_model::get_path_vars_for_svalue): Delete.
8048         (region_model::set_to_new_unknown_value): Delete.
8049         (region_model::update_for_phis): Don't pass is_back_edge to handle_phi.
8050         (region_model::update_for_call_superedge): Port from svalue_id to
8051         const svalue *.
8052         (region_model::update_for_return_superedge): Port to store-based
8053         implementation.
8054         (region_model::update_for_call_summary): Replace
8055         set_to_new_unknown_value with mark_region_as_unknown.
8056         (region_model::get_root_region): Delete.
8057         (region_model::get_stack_region_id): Delete.
8058         (region_model::push_frame): Delete.
8059         (region_model::get_current_frame_id): Delete.
8060         (region_model::get_current_function): Delete.
8061         (region_model::pop_frame): Delete.
8062         (region_model::on_top_level_param): New.
8063         (region_model::get_stack_depth): Delete.
8064         (region_model::get_function_at_depth): Delete.
8065         (region_model::get_globals_region_id): Delete.
8066         (region_model::add_svalue): Delete.
8067         (region_model::replace_svalue): Delete.
8068         (region_model::add_region): Delete.
8069         (region_model::get_svalue): Delete.
8070         (region_model::get_region): Delete.
8071         (make_region_for_type): Delete.
8072         (region_model::add_region_for_type): Delete.
8073         (region_model::on_top_level_param): New.
8074         (class restrict_to_used_svalues): Delete.
8075         (region_model::purge_unused_svalues): Delete.
8076         (region_model::push_frame): New.
8077         (region_model::remap_svalue_ids): Delete.
8078         (region_model::remap_region_ids): Delete.
8079         (region_model::purge_regions): Delete.
8080         (region_model::get_descendents): Delete.
8081         (region_model::delete_region_and_descendents): Delete.
8082         (region_model::poison_any_pointers_to_bad_regions): Delete.
8083         (region_model::can_merge_with_p): Delete.
8084         (region_model::get_current_function): New.
8085         (region_model::get_value_by_name): Delete.
8086         (region_model::convert_byte_offset_to_array_index): Delete.
8087         (region_model::pop_frame): New.
8088         (region_model::get_or_create_mem_ref): Delete.
8089         (region_model::get_stack_depth): New.
8090         (region_model::get_frame_at_index): New.
8091         (region_model::unbind_region_and_descendents): New.
8092         (struct bad_pointer_finder): New.
8093         (region_model::get_or_create_pointer_plus_expr): Delete.
8094         (region_model::poison_any_pointers_to_descendents): New.
8095         (region_model::get_or_create_view): Delete.
8096         (region_model::can_merge_with_p): New.
8097         (region_model::get_fndecl_for_call):  Port from svalue_id to
8098         const svalue *.
8099         (struct append_ssa_names_cb_data): New.
8100         (get_ssa_name_regions_for_current_frame): New.
8101         (region_model::append_ssa_names_cb): New.
8102         (model_merger::dump_to_pp): Add "simple" param.  Drop dumping of
8103         remappings.
8104         (model_merger::dump): Add "simple" param to both overloads.
8105         (model_merger::can_merge_values_p): Delete.
8106         (model_merger::record_regions): Delete.
8107         (model_merger::record_svalues): Delete.
8108         (svalue_id_merger_mapping::svalue_id_merger_mapping): Delete.
8109         (svalue_id_merger_mapping::dump_to_pp): Delete.
8110         (svalue_id_merger_mapping::dump): Delete.
8111         (region_model::create_region_for_heap_alloc): New.
8112         (region_model::create_region_for_alloca): New.
8113         (region_model::record_dynamic_extents): New.
8114         (canonicalization::canonicalization): Delete.
8115         (canonicalization::walk_rid): Delete.
8116         (canonicalization::walk_sid): Delete.
8117         (canonicalization::dump_to_pp): Delete.
8118         (canonicalization::dump): Delete.
8119         (inchash::add): Delete overloads for svalue_id and region_id.
8120         (engine::log_stats): New.
8121         (assert_condition): Add overload comparing svalues.
8122         (assert_dump_eq): Pass "true" for multiline.
8123         (selftest::test_dump): Update for rewrite of region_model.
8124         (selftest::test_dump_2): Rename to...
8125         (selftest::test_struct): ...this.  Provide a region_model_manager
8126         when creating region_model instance.  Remove dump test.  Add
8127         checks for get_offset.
8128         (selftest::test_dump_3): Rename to...
8129         (selftest::test_array_1): ...this.  Provide a region_model_manager
8130         when creating region_model instance.  Remove dump test.
8131         (selftest::test_get_representative_tree): Port from svalue_id to
8132         new API.  Add test coverage for various expressions.
8133         (selftest::test_unique_constants): Provide a region_model_manager
8134         for the region_model.  Add test coverage for comparing const vs
8135         non-const.
8136         (selftest::test_svalue_equality): Delete.
8137         (selftest::test_region_equality): Delete.
8138         (selftest::test_unique_unknowns): New.
8139         (class purge_all_svalue_ids): Delete.
8140         (class purge_one_svalue_id): Delete.
8141         (selftest::test_purging_by_criteria): Delete.
8142         (selftest::test_initial_svalue_folding): New.
8143         (selftest::test_unaryop_svalue_folding): New.
8144         (selftest::test_binop_svalue_folding): New.
8145         (selftest::test_sub_svalue_folding): New.
8146         (selftest::test_purge_unused_svalues): Delete.
8147         (selftest::test_descendent_of_p): New.
8148         (selftest::test_assignment): Provide a region_model_manager for
8149         the region_model.  Drop the dump test.
8150         (selftest::test_compound_assignment): Likewise.
8151         (selftest::test_stack_frames): Port to new implementation.
8152         (selftest::test_get_representative_path_var): Likewise.
8153         (selftest::test_canonicalization_1): Rename to...
8154         (selftest::test_equality_1): ...this.  Port to new API, and add
8155         (selftest::test_canonicalization_2): Provide a
8156         region_model_manager when creating region_model instances.
8157         Remove redundant canicalization.
8158         (selftest::test_canonicalization_3): Provide a
8159         region_model_manager when creating region_model instances.
8160         Remove param from calls to region_model::canonicalize.
8161         (selftest::test_canonicalization_4): Likewise.
8162         (selftest::assert_region_models_merge): Constify
8163         out_merged_svalue.  Port to new API.
8164         (selftest::test_state_merging): Provide a
8165         region_model_manager when creating region_model instances.
8166         Provide a program_point point when merging them.  Replace
8167         set_to_new_unknown_value with usage of placeholder_svalues.
8168         Drop get_value_by_name.  Port from svalue_id to const svalue *.
8169         Add test of heap allocation.
8170         (selftest::test_constraint_merging):  Provide a
8171         region_model_manager when creating region_model instances.
8172         Provide a program_point point when merging them.  Eliminate use
8173         of set_to_new_unknown_value.
8174         (selftest::test_widening_constraints): New.
8175         (selftest::test_iteration_1): New.
8176         (selftest::test_malloc_constraints): Port to store-based
8177         implementation.
8178         (selftest::test_var): New test.
8179         (selftest::test_array_2): New test.
8180         (selftest::test_mem_ref): New test.
8181         (selftest::test_POINTER_PLUS_EXPR_then_MEM_REF): New.
8182         (selftest::test_malloc): New.
8183         (selftest::test_alloca): New.
8184         (selftest::analyzer_region_model_cc_tests): Update for renamings.
8185         Call new functions.
8186         * region-model.h (class path_var): Move to analyzer.h.
8187         (class svalue_id): Delete.
8188         (class region_id): Delete.
8189         (class id_map): Delete.
8190         (svalue_id_map): Delete.
8191         (region_id_map): Delete.
8192         (id_map<T>::id_map): Delete.
8193         (id_map<T>::put): Delete.
8194         (id_map<T>::get_dst_for_src): Delete.
8195         (id_map<T>::get_src_for_dst): Delete.
8196         (id_map<T>::dump_to_pp): Delete.
8197         (id_map<T>::dump): Delete.
8198         (id_map<T>::update): Delete.
8199         (one_way_svalue_id_map): Delete.
8200         (one_way_region_id_map): Delete.
8201         (class region_id_set): Delete.
8202         (class svalue_id_set): Delete.
8203         (struct complexity): New.
8204         (class visitor): New.
8205         (enum svalue_kind): Add SK_SETJMP, SK_INITIAL, SK_UNARYOP,
8206         SK_BINOP, SK_SUB,SK_UNMERGEABLE, SK_PLACEHOLDER, SK_WIDENING,
8207         SK_COMPOUND, and SK_CONJURED.
8208         (svalue::operator==): Delete.
8209         (svalue::operator!=): Delete.
8210         (svalue::clone): Delete.
8211         (svalue::hash): Delete.
8212         (svalue::dump_dot_to_pp): Delete.
8213         (svalue::dump_to_pp): New.
8214         (svalue::dump): New.
8215         (svalue::get_desc): New.
8216         (svalue::dyn_cast_initial_svalue): New.
8217         (svalue::dyn_cast_unaryop_svalue): New.
8218         (svalue::dyn_cast_binop_svalue): New.
8219         (svalue::dyn_cast_sub_svalue): New.
8220         (svalue::dyn_cast_unmergeable_svalue): New.
8221         (svalue::dyn_cast_widening_svalue): New.
8222         (svalue::dyn_cast_compound_svalue): New.
8223         (svalue::dyn_cast_conjured_svalue): New.
8224         (svalue::maybe_undo_cast): New.
8225         (svalue::unwrap_any_unmergeable): New.
8226         (svalue::remap_region_ids): Delete
8227         (svalue::can_merge_p): New.
8228         (svalue::walk_for_canonicalization): Delete
8229         (svalue::get_complexity): New.
8230         (svalue::get_child_sid): Delete
8231         (svalue::accept): New.
8232         (svalue::live_p): New.
8233         (svalue::implicitly_live_p): New.
8234         (svalue::svalue): Add complexity param.
8235         (svalue::add_to_hash): Delete
8236         (svalue::print_details): Delete
8237         (svalue::m_complexity): New field.
8238         (region_svalue::key_t): New struct.
8239         (region_svalue::region_svalue): Port from region_id to
8240         const region_id *.  Add complexity.
8241         (region_svalue::compare_fields): Delete.
8242         (region_svalue::clone): Delete.
8243         (region_svalue::dump_dot_to_pp): Delete.
8244         (region_svalue::get_pointee): Port from region_id to
8245         const region_id *.
8246         (region_svalue::remap_region_ids): Delete.
8247         (region_svalue::merge_values): Delete.
8248         (region_svalue::dump_to_pp): New.
8249         (region_svalue::accept): New.
8250         (region_svalue::walk_for_canonicalization): Delete.
8251         (region_svalue::eval_condition): Make params const.
8252         (region_svalue::add_to_hash): Delete.
8253         (region_svalue::print_details): Delete.
8254         (region_svalue::m_rid): Replace with...
8255         (region_svalue::m_reg): ...this.
8256         (is_a_helper <region_svalue *>::test): Convert to...
8257         (is_a_helper <const region_svalue *>::test): ...this.
8258         (template <> struct default_hash_traits<region_svalue::key_t>):
8259         New.
8260         (constant_svalue::constant_svalue): Add complexity.
8261         (constant_svalue::compare_fields): Delete.
8262         (constant_svalue::clone): Delete.
8263         (constant_svalue::add_to_hash): Delete.
8264         (constant_svalue::dump_to_pp): New.
8265         (constant_svalue::accept): New.
8266         (constant_svalue::implicitly_live_p): New.
8267         (constant_svalue::merge_values): Delete.
8268         (constant_svalue::eval_condition): Make params const.
8269         (constant_svalue::get_child_sid): Delete.
8270         (constant_svalue::print_details): Delete.
8271         (is_a_helper <constant_svalue *>::test): Convert to...
8272         (is_a_helper <const constant_svalue *>::test): ...this.
8273         (class unknown_svalue): Update leading comment.
8274         (unknown_svalue::unknown_svalue): Add complexity.
8275         (unknown_svalue::compare_fields): Delete.
8276         (unknown_svalue::add_to_hash): Delete.
8277         (unknown_svalue::dyn_cast_unknown_svalue): Delete.
8278         (unknown_svalue::print_details): Delete.
8279         (unknown_svalue::dump_to_pp): New.
8280         (unknown_svalue::accept): New.
8281         (poisoned_svalue::key_t): New struct.
8282         (poisoned_svalue::poisoned_svalue): Add complexity.
8283         (poisoned_svalue::compare_fields): Delete.
8284         (poisoned_svalue::clone): Delete.
8285         (poisoned_svalue::add_to_hash): Delete.
8286         (poisoned_svalue::dump_to_pp): New.
8287         (poisoned_svalue::accept): New.
8288         (poisoned_svalue::print_details): Delete.
8289         (is_a_helper <poisoned_svalue *>::test): Convert to...
8290         (is_a_helper <const poisoned_svalue *>::test): ...this.
8291         (template <> struct default_hash_traits<poisoned_svalue::key_t>):
8292         New.
8293         (setjmp_record::add_to_hash): New.
8294         (setjmp_svalue::key_t): New struct.
8295         (setjmp_svalue::compare_fields): Delete.
8296         (setjmp_svalue::clone): Delete.
8297         (setjmp_svalue::add_to_hash): Delete.
8298         (setjmp_svalue::setjmp_svalue): Add complexity.
8299         (setjmp_svalue::dump_to_pp): New.
8300         (setjmp_svalue::accept): New.
8301         (setjmp_svalue::void print_details): Delete.
8302         (is_a_helper <const setjmp_svalue *>::test): New.
8303         (template <> struct default_hash_traits<setjmp_svalue::key_t>): New.
8304         (class initial_svalue : public svalue): New.
8305         (is_a_helper <const initial_svalue *>::test): New.
8306         (class unaryop_svalue): New.
8307         (is_a_helper <const unaryop_svalue *>::test): New.
8308         (template <> struct default_hash_traits<unaryop_svalue::key_t>): New.
8309         (class binop_svalue): New.
8310         (is_a_helper <const binop_svalue *>::test): New.
8311         (template <> struct default_hash_traits<binop_svalue::key_t>): New.
8312         (class sub_svalue): New.
8313         (is_a_helper <const sub_svalue *>::test): New.
8314         (template <> struct default_hash_traits<sub_svalue::key_t>): New.
8315         (class unmergeable_svalue): New.
8316         (is_a_helper <const unmergeable_svalue *>::test): New.
8317         (class placeholder_svalue): New.
8318         (is_a_helper <placeholder_svalue *>::test): New.
8319         (class widening_svalue): New.
8320         (is_a_helper <widening_svalue *>::test): New.
8321         (template <> struct default_hash_traits<widening_svalue::key_t>): New.
8322         (class compound_svalue): New.
8323         (is_a_helper <compound_svalue *>::test): New.
8324         (template <> struct default_hash_traits<compound_svalue::key_t>): New.
8325         (class conjured_svalue): New.
8326         (is_a_helper <conjured_svalue *>::test): New.
8327         (template <> struct default_hash_traits<conjured_svalue::key_t>): New.
8328         (enum region_kind): Delete RK_PRIMITIVE, RK_STRUCT, RK_UNION, and
8329         RK_ARRAY.  Add RK_LABEL, RK_DECL, RK_FIELD, RK_ELEMENT, RK_OFFSET,
8330         RK_CAST, RK_HEAP_ALLOCATED, RK_ALLOCA, RK_STRING, and RK_UNKNOWN.
8331         (region_kind_to_str): Delete.
8332         (region::~region): Move implementation to region.cc.
8333         (region::operator==): Delete.
8334         (region::operator!=): Delete.
8335         (region::clone): Delete.
8336         (region::get_id): New.
8337         (region::cmp_ids): New.
8338         (region::dyn_cast_map_region): Delete.
8339         (region::dyn_cast_array_region): Delete.
8340         (region::region_id get_parent): Delete.
8341         (region::get_parent_region): Convert to a simple accessor.
8342         (region::void set_value): Delete.
8343         (region::svalue_id get_value): Delete.
8344         (region::svalue_id get_value_direct): Delete.
8345         (region::svalue_id get_inherited_child_sid): Delete.
8346         (region::dyn_cast_frame_region): New.
8347         (region::dyn_cast_function_region): New.
8348         (region::dyn_cast_decl_region): New.
8349         (region::dyn_cast_field_region): New.
8350         (region::dyn_cast_element_region): New.
8351         (region::dyn_cast_offset_region): New.
8352         (region::dyn_cast_cast_region): New.
8353         (region::dyn_cast_string_region): New.
8354         (region::accept): New.
8355         (region::get_base_region): New.
8356         (region::base_region_p): New.
8357         (region::descendent_of_p): New.
8358         (region::maybe_get_frame_region): New.
8359         (region::maybe_get_decl): New.
8360         (region::hash): Delete.
8361         (region::rint): Delete.
8362         (region::dump_dot_to_pp): Delete.
8363         (region::get_desc): New.
8364         (region::dump_to_pp): Convert to vfunc, changing signature.
8365         (region::dump_child_label): Delete.
8366         (region::remap_svalue_ids): Delete.
8367         (region::remap_region_ids): Delete.
8368         (region::dump): New.
8369         (region::walk_for_canonicalization): Delete.
8370         (region::non_null_p): Drop region_model param.
8371         (region::add_view): Delete.
8372         (region::get_view): Delete.
8373         (region::get_active_view): Delete.
8374         (region::is_view_p): Delete.
8375         (region::cmp_ptrs): New.
8376         (region::validate): Delete.
8377         (region::get_offset): New.
8378         (region::get_byte_size): New.
8379         (region::get_bit_size): New.
8380         (region::get_subregions_for_binding): New.
8381         (region::region): Add complexity param.  Convert parent from
8382         region_id to const region *.  Drop svalue_id.  Drop copy ctor.
8383         (region::symbolic_for_unknown_ptr_p): New.
8384         (region::add_to_hash): Delete.
8385         (region::print_fields): Delete.
8386         (region::get_complexity): New accessor.
8387         (region::become_active_view): Delete.
8388         (region::deactivate_any_active_view): Delete.
8389         (region::deactivate_view): Delete.
8390         (region::calc_offset): New.
8391         (region::m_parent_rid): Delete.
8392         (region::m_sval_id): Delete.
8393         (region::m_complexity): New.
8394         (region::m_id): New.
8395         (region::m_parent): New.
8396         (region::m_view_rids): Delete.
8397         (region::m_is_view): Delete.
8398         (region::m_active_view_rid): Delete.
8399         (region::m_cached_offset): New.
8400         (is_a_helper <region *>::test): Convert to...
8401         (is_a_helper <const region *>::test): ... this.
8402         (class primitive_region): Delete.
8403         (class space_region): New.
8404         (class map_region): Delete.
8405         (is_a_helper <map_region *>::test): Delete.
8406         (class frame_region): Reimplement.
8407         (template <> struct default_hash_traits<frame_region::key_t>):
8408         New.
8409         (class globals_region): Reimplement.
8410         (is_a_helper <globals_region *>::test): Convert to...
8411         (is_a_helper <const globals_region *>::test): ...this.
8412         (class struct_or_union_region): Delete.
8413         (is_a_helper <struct_or_union_region *>::test): Delete.
8414         (class code_region): Reimplement.
8415         (is_a_helper <const code_region *>::test): New.
8416         (class struct_region): Delete.
8417         (is_a_helper <struct_region *>::test): Delete.
8418         (class function_region): Reimplement.
8419         (is_a_helper <function_region *>::test): Convert to...
8420         (is_a_helper <const function_region *>::test): ...this.
8421         (class union_region): Delete.
8422         (is_a_helper <union_region *>::test): Delete.
8423         (class label_region): New.
8424         (is_a_helper <const label_region *>::test): New.
8425         (class scope_region): Delete.
8426         (class stack_region): Reimplement.
8427         (is_a_helper <stack_region *>::test): Convert to...
8428         (is_a_helper <const stack_region *>::test): ...this.
8429         (class heap_region): Reimplement.
8430         (is_a_helper <heap_region *>::test): Convert to...
8431         (is_a_helper <const heap_region *>::test): ...this.
8432         (class root_region): Reimplement.
8433         (is_a_helper <root_region *>::test): Convert to...
8434         (is_a_helper <const root_region *>::test): ...this.
8435         (class symbolic_region): Reimplement.
8436         (is_a_helper <const symbolic_region *>::test): New.
8437         (template <> struct default_hash_traits<symbolic_region::key_t>):
8438         New.
8439         (class decl_region): New.
8440         (is_a_helper <const decl_region *>::test): New.
8441         (class field_region): New.
8442         (template <> struct default_hash_traits<field_region::key_t>): New.
8443         (class array_region): Delete.
8444         (class element_region): New.
8445         (is_a_helper <array_region *>::test): Delete.
8446         (is_a_helper <const element_region *>::test): New.
8447         (template <> struct default_hash_traits<element_region::key_t>):
8448         New.
8449         (class offset_region): New.
8450         (is_a_helper <const offset_region *>::test): New.
8451         (template <> struct default_hash_traits<offset_region::key_t>):
8452         New.
8453         (class cast_region): New.
8454         (is_a_helper <const cast_region *>::test): New.
8455         (template <> struct default_hash_traits<cast_region::key_t>): New.
8456         (class heap_allocated_region): New.
8457         (class alloca_region): New.
8458         (class string_region): New.
8459         (is_a_helper <const string_region *>::test): New.
8460         (class unknown_region): New.
8461         (class region_model_manager): New.
8462         (struct append_ssa_names_cb_data): New.
8463         (class call_details): New.
8464         (region_model::region_model): Add region_model_manager param.
8465         (region_model::print_svalue): Delete.
8466         (region_model::dump_dot_to_pp): Delete.
8467         (region_model::dump_dot_to_file): Delete.
8468         (region_model::dump_dot): Delete.
8469         (region_model::dump_to_pp): Drop summarize param in favor of
8470         simple and multiline.
8471         (region_model::dump): Likewise.
8472         (region_model::summarize_to_pp): Delete.
8473         (region_model::summarize): Delete.
8474         (region_model::void canonicalize): Drop ctxt param.
8475         (region_model::void check_for_poison): Delete.
8476         (region_model::get_gassign_result): New.
8477         (region_model::impl_call_alloca): New.
8478         (region_model::impl_call_analyzer_describe): New.
8479         (region_model::impl_call_analyzer_eval): New.
8480         (region_model::impl_call_builtin_expect): New.
8481         (region_model::impl_call_calloc): New.
8482         (region_model::impl_call_free): New.
8483         (region_model::impl_call_malloc): New.
8484         (region_model::impl_call_memset): New.
8485         (region_model::impl_call_strlen): New.
8486         (region_model::get_reachable_svalues): New.
8487         (region_model::handle_phi): Drop is_back_edge param.
8488         (region_model::region_id get_root_rid): Delete.
8489         (region_model::root_region *get_root_region): Delete.
8490         (region_model::region_id get_stack_region_id): Delete.
8491         (region_model::push_frame): Convert from region_id and svalue_id
8492         to const region * and const svalue *.
8493         (region_model::get_current_frame_id): Replace with...
8494         (region_model::get_current_frame): ...this.
8495         (region_model::pop_frame): Convert from region_id to
8496         const region *.  Drop purge and stats param.  Add out_result.
8497         (region_model::function *get_function_at_depth): Delete.
8498         (region_model::get_globals_region_id): Delete.
8499         (region_model::add_svalue): Delete.
8500         (region_model::replace_svalue): Delete.
8501         (region_model::add_region): Delete.
8502         (region_model::add_region_for_type): Delete.
8503         (region_model::get_svalue): Delete.
8504         (region_model::get_region): Delete.
8505         (region_model::get_lvalue): Convert from region_id to
8506         const region *.
8507         (region_model::get_rvalue): Convert from svalue_id to
8508         const svalue *.
8509         (region_model::get_or_create_ptr_svalue): Delete.
8510         (region_model::get_or_create_constant_svalue): Delete.
8511         (region_model::get_svalue_for_fndecl): Delete.
8512         (region_model::get_svalue_for_label): Delete.
8513         (region_model::get_region_for_fndecl): Delete.
8514         (region_model::get_region_for_label): Delete.
8515         (region_model::get_frame_at_index (int index) const;): New.
8516         (region_model::maybe_cast): Delete.
8517         (region_model::maybe_cast_1): Delete.
8518         (region_model::get_field_region): Delete.
8519         (region_model::id deref_rvalue): Convert from region_id and
8520         svalue_id to const region * and const svalue *.  Drop overload,
8521         passing in both a tree and an svalue.
8522         (region_model::set_value): Convert from region_id and svalue_id to
8523         const region * and const svalue *.
8524         (region_model::set_to_new_unknown_value): Delete.
8525         (region_model::clobber_region (const region *reg);): New.
8526         (region_model::purge_region (const region *reg);): New.
8527         (region_model::zero_fill_region (const region *reg);): New.
8528         (region_model::mark_region_as_unknown (const region *reg);): New.
8529         (region_model::copy_region): Convert from region_id to
8530         const region *.
8531         (region_model::eval_condition): Convert from svalue_id to
8532         const svalue *.
8533         (region_model::eval_condition_without_cm): Likewise.
8534         (region_model::compare_initial_and_pointer): New.
8535         (region_model:maybe_get_constant): Delete.
8536         (region_model::add_new_malloc_region): Delete.
8537         (region_model::get_representative_tree): Convert from svalue_id to
8538         const svalue *.
8539         (region_model::get_representative_path_var): Delete decl taking a
8540         region_id in favor of two decls, for svalue vs region, with an
8541         svalue_set to ensure termination.
8542         (region_model::get_path_vars_for_svalue): Delete.
8543         (region_model::create_region_for_heap_alloc): New.
8544         (region_model::create_region_for_alloca): New.
8545         (region_model::purge_unused_svalues): Delete.
8546         (region_model::remap_svalue_ids): Delete.
8547         (region_model::remap_region_ids): Delete.
8548         (region_model::purge_regions): Delete.
8549         (region_model::get_num_svalues): Delete.
8550         (region_model::get_num_regions): Delete.
8551         (region_model::get_descendents): Delete.
8552         (region_model::get_store): New.
8553         (region_model::delete_region_and_descendents): Delete.
8554         (region_model::get_manager): New.
8555         (region_model::unbind_region_and_descendents): New.
8556         (region_model::can_merge_with_p): Add point param.  Drop
8557         svalue_id_merger_mapping.
8558         (region_model::get_value_by_name): Delete.
8559         (region_model::convert_byte_offset_to_array_index): Delete.
8560         (region_model::get_or_create_mem_ref): Delete.
8561         (region_model::get_or_create_pointer_plus_expr): Delete.
8562         (region_model::get_or_create_view): Delete.
8563         (region_model::get_lvalue_1): Convert from region_id to
8564         const region *.
8565         (region_model::get_rvalue_1): Convert from svalue_id to
8566         const svalue *.
8567         (region_model::get_ssa_name_regions_for_current_frame): New.
8568         (region_model::append_ssa_names_cb): New.
8569         (region_model::get_store_value): New.
8570         (region_model::copy_struct_region): Delete.
8571         (region_model::copy_union_region): Delete.
8572         (region_model::copy_array_region): Delete.
8573         (region_model::region_exists_p): New.
8574         (region_model::make_region_for_unexpected_tree_code): Delete.
8575         (region_model::loop_replay_fixup): New.
8576         (region_model::poison_any_pointers_to_bad_regions): Delete.
8577         (region_model::poison_any_pointers_to_descendents): New.
8578         (region_model::dump_summary_of_rep_path_vars): Delete.
8579         (region_model::on_top_level_param): New.
8580         (region_model::record_dynamic_extents): New.
8581         (region_model::m_mgr;): New.
8582         (region_model::m_store;): New.
8583         (region_model::m_svalues;): Delete.
8584         (region_model::m_regions;): Delete.
8585         (region_model::m_root_rid;): Delete.
8586         (region_model::m_current_frame;): New.
8587         (region_model_context::remap_svalue_ids): Delete.
8588         (region_model_context::can_purge_p): Delete.
8589         (region_model_context::on_svalue_leak): New.
8590         (region_model_context::on_svalue_purge): Delete.
8591         (region_model_context::on_liveness_change): New.
8592         (region_model_context::on_inherited_svalue): Delete.
8593         (region_model_context::on_cast): Delete.
8594         (region_model_context::on_unknown_change): Convert from svalue_id to
8595         const svalue * and add is_mutable.
8596         (class noop_region_model_context): Update for region_model_context
8597         changes.
8598         (model_merger::model_merger): Add program_point.  Drop
8599         svalue_id_merger_mapping.
8600         (model_merger::dump_to_pp): Add "simple" param.
8601         (model_merger::dump): Likewise.
8602         (model_merger::get_region_a): Delete.
8603         (model_merger::get_region_b): Delete.
8604         (model_merger::can_merge_values_p): Delete.
8605         (model_merger::record_regions): Delete.
8606         (model_merger::record_svalues): Delete.
8607         (model_merger::m_point): New field.
8608         (model_merger::m_map_regions_from_a_to_m): Delete.
8609         (model_merger::m_map_regions_from_b_to_m): Delete.
8610         (model_merger::m_sid_mapping): Delete.
8611         (struct svalue_id_merger_mapping): Delete.
8612         (class engine): New.
8613         (struct canonicalization): Delete.
8614         (inchash::add): Delete decls for hashing svalue_id and region_id.
8615         (test_region_model_context::on_unexpected_tree_code): Require t to
8616         be non-NULL.
8617         (selftest::assert_condition): Add overload comparing a pair of
8618         const svalue *.
8619         * sm-file.cc: Include "tristate.h", "selftest.h",
8620         "analyzer/call-string.h", "analyzer/program-point.h",
8621         "analyzer/store.h", and "analyzer/region-model.h".
8622         (fileptr_state_machine::get_default_state): New.
8623         (fileptr_state_machine::on_stmt): Remove calls to
8624         get_readable_tree in favor of get_diagnostic_tree.
8625         * sm-malloc.cc: Include "tristate.h", "selftest.h",
8626         "analyzer/call-string.h", "analyzer/program-point.h",
8627         "analyzer/store.h", and "analyzer/region-model.h".
8628         (malloc_state_machine::get_default_state): New.
8629         (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New.
8630         (malloc_diagnostic::describe_state_change): Handle change.m_expr
8631         being NULL.
8632         (null_arg::emit): Avoid printing "NULL '0'".
8633         (null_arg::describe_final_event): Avoid printing "(0) NULL".
8634         (malloc_leak::emit): Handle m_arg being NULL.
8635         (malloc_leak::describe_final_event): Handle ev.m_expr being NULL.
8636         (malloc_state_machine::on_stmt): Don't call get_readable_tree.
8637         Call get_diagnostic_tree when creating pending diagnostics.
8638         Update for is_zero_assignment becoming a member function of
8639         sm_ctxt.
8640         Don't transition to m_non_heap for ADDR_EXPR(MEM_REF()).
8641         (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New
8642         vfunc implementation.
8643         * sm-sensitive.cc (sensitive_state_machine::warn_for_any_exposure): Call
8644         get_diagnostic_tree and pass the result to warn_for_state.
8645         * sm-signal.cc: Move includes of "analyzer/call-string.h" and
8646         "analyzer/program-point.h" to before "analyzer/region-model.h",
8647         and also include "analyzer/store.h" before it.
8648         (signal_unsafe_call::describe_state_change): Use
8649         get_dest_function to get handler.
8650         (update_model_for_signal_handler): Pass manager to region_model
8651         ctor.
8652         (register_signal_handler::impl_transition): Update for changes to
8653         get_or_create_node and add_edge.
8654         * sm-taint.cc (taint_state_machine::on_stmt): Remove calls to
8655         get_readable_tree, replacing them when calling warn_for_state with
8656         calls to get_diagnostic_tree.
8657         * sm.cc (is_zero_assignment): Delete.
8658         (any_pointer_p): Move to within namespace ana.
8659         * sm.h (is_zero_assignment): Remove decl.
8660         (any_pointer_p): Move decl to within namespace ana.
8661         (state_machine::get_default_state): New vfunc.
8662         (state_machine::reset_when_passed_to_unknown_fn_p): New vfunc.
8663         (sm_context::get_readable_tree): Rename to...
8664         (sm_context::get_diagnostic_tree): ...this.
8665         (sm_context::is_zero_assignment): New vfunc.
8666         * store.cc: New file.
8667         * store.h: New file.
8668         * svalue.cc: New file.
8669
8670 2020-05-22  Mark Wielaard  <mark@klomp.org>
8671
8672         * sm-signal.cc(signal_unsafe_call::emit): Possibly add
8673         gcc_rich_location note for replacement.
8674         (signal_unsafe_call::get_replacement_fn): New private function.
8675         (get_async_signal_unsafe_fns): Add "exit".
8676
8677 2020-04-28  David Malcolm  <dmalcolm@redhat.com>
8678
8679         PR analyzer/94816
8680         * engine.cc (impl_region_model_context::on_unexpected_tree_code):
8681         Handle NULL tree.
8682         * region-model.cc (region_model::add_region_for_type): Handle
8683         NULL type.
8684         * region-model.h
8685         (test_region_model_context::on_unexpected_tree_code): Handle NULL
8686         tree.
8687
8688 2020-04-28  David Malcolm  <dmalcolm@redhat.com>
8689
8690         PR analyzer/94447
8691         PR analyzer/94639
8692         PR analyzer/94732
8693         PR analyzer/94754
8694         * analyzer.opt (Wanalyzer-use-of-uninitialized-value): Delete.
8695         * program-state.cc (selftest::test_program_state_dumping): Update
8696         expected dump result for removal of "uninit".
8697         * region-model.cc (poison_kind_to_str): Delete POISON_KIND_UNINIT
8698         case.
8699         (root_region::ensure_stack_region): Initialize stack with null
8700         svalue_id rather than with a typeless POISON_KIND_UNINIT value.
8701         (root_region::ensure_heap_region): Likewise for the heap.
8702         (region_model::dump_summary_of_rep_path_vars): Remove
8703         summarization of uninit values.
8704         (region_model::validate): Remove check that the stack has a
8705         POISON_KIND_UNINIT value.
8706         (poisoned_value_diagnostic::emit): Remove POISON_KIND_UNINIT
8707         case.
8708         (poisoned_value_diagnostic::describe_final_event): Likewise.
8709         (selftest::test_dump): Update expected dump result for removal of
8710         "uninit".
8711         (selftest::test_svalue_equality): Remove "uninit" and "freed".
8712         * region-model.h (enum poison_kind): Remove POISON_KIND_UNINIT.
8713
8714 2020-04-01  David Malcolm  <dmalcolm@redhat.com>
8715
8716         PR analyzer/94378
8717         * checker-path.cc: Include "bitmap.h".
8718         * constraint-manager.cc: Likewise.
8719         * diagnostic-manager.cc: Likewise.
8720         * engine.cc: Likewise.
8721         (exploded_node::detect_leaks): Pass null region_id to pop_frame.
8722         * program-point.cc: Include "bitmap.h".
8723         * program-state.cc: Likewise.
8724         * region-model.cc (id_set<region_id>::id_set): Convert to...
8725         (region_id_set::region_id_set): ...this.
8726         (svalue_id_set::svalue_id_set): New ctor.
8727         (region_model::copy_region): New function.
8728         (region_model::copy_struct_region): New function.
8729         (region_model::copy_union_region): New function.
8730         (region_model::copy_array_region): New function.
8731         (stack_region::pop_frame): Drop return value.  Add
8732         "result_dst_rid" param; if it is non-null, use copy_region to copy
8733         the result to it.  Rather than capture and pass a single "known
8734         used" return value to be used by purge_unused_values, instead
8735         gather and pass a set of known used return values.
8736         (root_region::pop_frame): Drop return value.  Add "result_dst_rid"
8737         param.
8738         (region_model::on_assignment): Use copy_region.
8739         (region_model::on_return): Likewise for the result.
8740         (region_model::on_longjmp): Pass null for pop_frame's
8741         result_dst_rid.
8742         (region_model::update_for_return_superedge): Pass the region for the
8743         return value of the call, if any, to pop_frame, rather than setting
8744         the lvalue for the lhs of the result.
8745         (region_model::pop_frame): Drop return value.  Add
8746         "result_dst_rid" param.
8747         (region_model::purge_unused_svalues): Convert third param from an
8748         svalue_id * to an svalue_id_set *, updating the initial populating
8749         of the "used" bitmap accordingly.  Don't remap it when done.
8750         (struct selftest::coord_test): New selftest fixture, extracted from...
8751         (selftest::test_dump_2): ...here.
8752         (selftest::test_compound_assignment): New selftest.
8753         (selftest::test_stack_frames): Pass null to new param of pop_frame.
8754         (selftest::analyzer_region_model_cc_tests): Call the new selftest.
8755         * region-model.h (class id_set): Delete template.
8756         (class region_id_set): Reimplement, using old id_set implementation.
8757         (class svalue_id_set): Likewise.  Convert from auto_sbitmap to
8758         auto_bitmap.
8759         (region::get_active_view): New accessor.
8760         (stack_region::pop_frame): Drop return value.  Add
8761         "result_dst_rid" param.
8762         (root_region::pop_frame): Likewise.
8763         (region_model::pop_frame): Likewise.
8764         (region_model::copy_region): New decl.
8765         (region_model::purge_unused_svalues): Convert third param from an
8766         svalue_id * to an svalue_id_set *.
8767         (region_model::copy_struct_region): New decl.
8768         (region_model::copy_union_region): New decl.
8769         (region_model::copy_array_region): New decl.
8770
8771 2020-03-27  David Malcolm  <dmalcolm@redhat.com>
8772
8773         * program-state.cc (selftest::test_program_state_dumping): Update
8774         expected dump to include symbolic_region's possibly_null field.
8775         * region-model.cc (symbolic_region::print_fields): New vfunc
8776         implementation.
8777         (region_model::add_constraint): Clear m_possibly_null from
8778         symbolic_regions now known to be non-NULL.
8779         (selftest::test_malloc_constraints): New selftest.
8780         (selftest::analyzer_region_model_cc_tests): Call it.
8781         * region-model.h (region::dyn_cast_symbolic_region): Add non-const
8782         overload.
8783         (symbolic_region::dyn_cast_symbolic_region): Implement it.
8784         (symbolic_region::print_fields): New vfunc override decl.
8785
8786 2020-03-27  David Malcolm  <dmalcolm@redhat.com>
8787
8788         * analyzer.h (class feasibility_problem): New forward decl.
8789         * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
8790         Initialize new fields m_status, m_epath_length, and m_problem.
8791         (saved_diagnostic::~saved_diagnostic): Delete m_problem.
8792         (dedupe_candidate::dedupe_candidate): Convert "sd" param from a
8793         const ref to a mutable ptr.
8794         (dedupe_winners::add): Convert "sd" param from a const ref to a
8795         mutable ptr.  Record the length of the exploded_path.  Record the
8796         feasibility/infeasibility of sd into sd, capturing a
8797         feasibility_problem when feasible_p fails, and storing it in sd.
8798         (diagnostic_manager::emit_saved_diagnostics): Update for pass by
8799         ptr rather than by const ref.
8800         * diagnostic-manager.h (class saved_diagnostic): Add new enum
8801         status.  Add fields m_status, m_epath_length and m_problem.
8802         (saved_diagnostic::set_feasible): New member function.
8803         (saved_diagnostic::set_infeasible): New member function.
8804         (saved_diagnostic::get_feasibility_problem): New accessor.
8805         (saved_diagnostic::get_status): New accessor.
8806         (saved_diagnostic::set_epath_length): New member function.
8807         (saved_diagnostic::get_epath_length): New accessor.
8808         * engine.cc: Include "gimple-pretty-print.h".
8809         (exploded_path::feasible_p): Add OUT param and, if non-NULL, write
8810         a new feasibility_problem to it on failure.
8811         (viz_callgraph_node::dump_dot): Convert begin_tr calls to
8812         begin_trtd.  Convert end_tr calls to end_tdtr.
8813         (class exploded_graph_annotator): New subclass of dot_annotator.
8814         (impl_run_checkers): Add a second -fdump-analyzer-supergraph dump
8815         after the analysis runs, using exploded_graph_annotator. dumping
8816         to DUMP_BASE_NAME.supergraph-eg.dot.
8817         * exploded-graph.h (exploded_node::get_dot_fillcolor): Make
8818         public.
8819         (exploded_path::feasible_p): Add OUT param.
8820         (class feasibility_problem): New class.
8821         * state-purge.cc (state_purge_annotator::add_node_annotations):
8822         Return a bool, add a "within_table" param.
8823         (print_vec_of_names): Convert begin_tr calls to begin_trtd.
8824         Convert end_tr calls to end_tdtr.
8825         (state_purge_annotator::add_stmt_annotations): Add "within_row"
8826         param.
8827         * state-purge.h ((state_purge_annotator::add_node_annotations):
8828         Return a bool, add a "within_table" param.
8829         (state_purge_annotator::add_stmt_annotations): Add "within_row"
8830         param.
8831         * supergraph.cc (supernode::dump_dot): Call add_node_annotations
8832         twice: as before, passing false for "within_table", then again
8833         with true when within the TABLE element.  Convert some begin_tr
8834         calls to begin_trtd, and some end_tr calls to end_tdtr.
8835         Repeat each add_stmt_annotations call, distinguishing between
8836         calls that add TRs and those that add TDs to an existing TR.
8837         Add a call to add_after_node_annotations.
8838         * supergraph.h (dot_annotator::add_node_annotations): Add a
8839         "within_table" param.
8840         (dot_annotator::add_stmt_annotations): Add a "within_row" param.
8841         (dot_annotator::add_after_node_annotations): New vfunc.
8842
8843 2020-03-27  David Malcolm  <dmalcolm@redhat.com>
8844
8845         * diagnostic-manager.cc (dedupe_winners::add): Show the
8846         exploded_node index in the log messages.
8847         (diagnostic_manager::emit_saved_diagnostics): Log a summary of
8848         m_saved_diagnostics at entry.
8849
8850 2020-03-27  David Malcolm  <dmalcolm@redhat.com>
8851
8852         * supergraph.cc (superedge::dump): Add space before description;
8853         move newline to non-pretty_printer overload.
8854
8855 2020-03-18  David Malcolm  <dmalcolm@redhat.com>
8856
8857         * region-model.cc: Include "stor-layout.h".
8858         (region_model::dump_to_pp): Rather than calling
8859         dump_summary_of_map on each of the current frame and the globals,
8860         instead get a vec of representative path_vars for all regions,
8861         and then dump a summary of all of them.
8862         (region_model::dump_summary_of_map): Delete, rewriting into...
8863         (region_model::dump_summary_of_rep_path_vars): ...this new
8864         function, working on a vec of path_vars.
8865         (region_model::set_value): New overload.
8866         (region_model::get_representative_path_var): Rename
8867         "parent_region" local to "parent_reg" and consolidate with other
8868         local.  Guard test for grandparent being stack on parent_reg being
8869         non-NULL.  Move handling for parent being an array_region to
8870         within guard for parent_reg being non-NULL.
8871         (selftest::make_test_compound_type): New function.
8872         (selftest::test_dump_2): New selftest.
8873         (selftest::test_dump_3): New selftest.
8874         (selftest::test_stack_frames): Update expected output from
8875         simplified dump to show "a" and "b" from parent frame and "y" in
8876         child frame.
8877         (selftest::analyzer_region_model_cc_tests): Call test_dump_2 and
8878         test_dump_3.
8879         * region-model.h (region_model::set_value): New overload decl.
8880         (region_model::dump_summary_of_map): Delete.
8881         (region_model::dump_summary_of_rep_path_vars): New.
8882
8883 2020-03-18  David Malcolm  <dmalcolm@redhat.com>
8884
8885         * region-model.h (class noop_region_model_context): New subclass
8886         of region_model_context.
8887         (class tentative_region_model_context): Inherit from
8888         noop_region_model_context rather than from region_model_context;
8889         drop redundant vfunc implementations.
8890         (class test_region_model_context): Likewise.
8891
8892 2020-03-18  David Malcolm  <dmalcolm@redhat.com>
8893
8894         * engine.cc (exploded_node::exploded_node): Move implementation
8895         here from header; accept point_and_state by const reference rather
8896         than by value.
8897         * exploded-graph.h (exploded_node::exploded_node): Pass
8898         point_and_state by const reference rather than by value.  Move
8899         body to engine.cc.
8900
8901 2020-03-18  Jakub Jelinek  <jakub@redhat.com>
8902
8903         * sm-malloc.cc (malloc_state_machine::on_stmt): Fix up duplicated word
8904         issue in a comment.
8905         * region-model.cc (region_model::make_region_for_unexpected_tree_code,
8906         region_model::delete_region_and_descendents): Likewise.
8907         * engine.cc (class exploded_cluster): Likewise.
8908         * diagnostic-manager.cc (class path_builder): Likewise.
8909
8910 2020-03-13  David Malcolm  <dmalcolm@redhat.com>
8911
8912         PR analyzer/94099
8913         PR analyzer/94105
8914         * diagnostic-manager.cc (for_each_state_change): Bulletproof
8915         against errors in get_rvalue by passing a
8916         tentative_region_model_context and rejecting if there's an error.
8917         * region-model.cc (region_model::get_lvalue_1): When handling
8918         ARRAY_REF, handle results of error-handling.  Handle NOP_EXPR.
8919
8920 2020-03-06  David Malcolm  <dmalcolm@redhat.com>
8921
8922         * analyzer.h (class array_region): New forward decl.
8923         * program-state.cc (selftest::test_program_state_dumping_2): New.
8924         (selftest::analyzer_program_state_cc_tests): Call it.
8925         * region-model.cc (array_region::constant_from_key): New.
8926         (region_model::get_representative_tree): Handle region_svalue by
8927         generating an ADDR_EXPR.
8928         (region_model::get_representative_path_var): In view handling,
8929         remove erroneous TREE_TYPE when determining the type of the tree.
8930         Handle array regions and STRING_CST.
8931         (selftest::assert_dump_tree_eq): New.
8932         (ASSERT_DUMP_TREE_EQ): New macro.
8933         (selftest::test_get_representative_tree): New selftest.
8934         (selftest::analyzer_region_model_cc_tests): Call it.
8935         * region-model.h (region::dyn_cast_array_region): New vfunc.
8936         (array_region::dyn_cast_array_region): New vfunc implementation.
8937         (array_region::constant_from_key): New decl.
8938
8939 2020-03-06  David Malcolm  <dmalcolm@redhat.com>
8940
8941         * analyzer.h (dump_quoted_tree): New decl.
8942         * engine.cc (exploded_node::dump_dot): Pass region model to
8943         sm_state_map::print.
8944         * program-state.cc: Include diagnostic-core.h.
8945         (sm_state_map::print): Add "model" param and use it to print
8946         representative trees.  Only print origin information if non-null.
8947         (sm_state_map::dump): Pass NULL for model to print call.
8948         (program_state::print): Pass region model to sm_state_map::print.
8949         (program_state::dump_to_pp): Use spaces rather than newlines when
8950         summarizing.  Pass region_model to sm_state_map::print.
8951         (ana::selftest::assert_dump_eq): New function.
8952         (ASSERT_DUMP_EQ): New macro.
8953         (ana::selftest::test_program_state_dumping): New function.
8954         (ana::selftest::analyzer_program_state_cc_tests): Call it.
8955         * program-state.h (program_state::print): Add model param.
8956         * region-model.cc (dump_quoted_tree): New function.
8957         (map_region::print_fields): Use dump_quoted_tree rather than
8958         %qE to avoid lang-dependent output.
8959         (map_region::dump_child_label): Likewise.
8960         (region_model::dump_summary_of_map): For SK_REGION, when
8961         get_representative_path_var fails, print the region id rather than
8962         erroneously printing NULL.
8963         * sm.cc (state_machine::get_state_by_name): New function.
8964         * sm.h (state_machine::get_state_by_name): New decl.
8965
8966 2020-03-04  David Malcolm  <dmalcolm@redhat.com>
8967
8968         * region-model.cc (region::validate): Convert model param from ptr
8969         to reference.  Update comment to reflect that it's now a vfunc.
8970         (map_region::validate): New vfunc implementation.
8971         (array_region::validate): New vfunc implementation.
8972         (stack_region::validate): New vfunc implementation.
8973         (root_region::validate): New vfunc implementation.
8974         (region_model::validate): Pass a reference rather than a pointer
8975         to the region::validate vfunc.
8976         * region-model.h (region::validate): Make virtual.  Convert model
8977         param from ptr to reference.
8978         (map_region::validate): New vfunc decl.
8979         (array_region::validate): New vfunc decl.
8980         (stack_region::validate): New vfunc decl.
8981         (root_region::validate): New vfunc decl.
8982
8983 2020-03-04  David Malcolm  <dmalcolm@redhat.com>
8984
8985         PR analyzer/93993
8986         * region-model.cc (region_model::on_call_pre): Handle
8987         BUILT_IN_EXPECT and its variants.
8988         (region_model::add_any_constraints_from_ssa_def_stmt): Split out
8989         gassign handling into add_any_constraints_from_gassign; add gcall
8990         handling.
8991         (region_model::add_any_constraints_from_gassign): New function,
8992         based on the above.  Add handling for NOP_EXPR.
8993         (region_model::add_any_constraints_from_gcall): New function.
8994         (region_model::get_representative_path_var): Handle views.
8995         * region-model.h
8996         (region_model::add_any_constraints_from_ssa_def_stmt): New decl.
8997         (region_model::add_any_constraints_from_gassign): New decl.
8998
8999 2020-03-04  David Malcolm  <dmalcolm@redhat.com>
9000
9001         PR analyzer/93993
9002         * checker-path.h (state_change_event::get_lvalue): Add ctxt param
9003         and pass it to region_model::get_value call.
9004         * diagnostic-manager.cc (get_any_origin): Pass a
9005         tentative_region_model_context to the calls to get_lvalue and reject
9006         the comparison if errors occur.
9007         (can_be_expr_of_interest_p): New function.
9008         (diagnostic_manager::prune_for_sm_diagnostic): Replace checks for
9009         CONSTANT_CLASS_P with calls to update_for_unsuitable_sm_exprs.
9010         Pass a tentative_region_model_context to the calls to
9011         state_change_event::get_lvalue and reject the comparison if errors
9012         occur.
9013         (diagnostic_manager::update_for_unsuitable_sm_exprs): New.
9014         * diagnostic-manager.h
9015         (diagnostic_manager::update_for_unsuitable_sm_exprs): New decl.
9016         * region-model.h (class tentative_region_model_context): New class.
9017
9018 2020-03-04  David Malcolm  <dmalcolm@redhat.com>
9019
9020         * engine.cc (worklist::worklist): Remove unused field m_eg.
9021         (class viz_callgraph_edge): Remove unused field m_call_sedge.
9022         (class viz_callgraph): Remove unused field m_sg.
9023         * exploded-graph.h (worklist::::m_eg): Remove unused field.
9024
9025 2020-03-02  David Malcolm  <dmalcolm@redhat.com>
9026
9027         * analyzer.opt (fanalyzer-show-duplicate-count): New option.
9028         * diagnostic-manager.cc
9029         (diagnostic_manager::emit_saved_diagnostic): Use the above to
9030         guard the printing of the duplicate count.
9031
9032 2020-03-02  David Malcolm  <dmalcolm@redhat.com>
9033
9034         PR analyzer/93959
9035         * analyzer.cc (is_std_function_p): New function.
9036         (is_std_named_call_p): New functions.
9037         * analyzer.h (is_std_named_call_p): New decl.
9038         * sm-malloc.cc (malloc_state_machine::on_stmt): Check for "std::"
9039         variants when checking for malloc, calloc and free.
9040
9041 2020-02-26  David Malcolm  <dmalcolm@redhat.com>
9042
9043         PR analyzer/93950
9044         * diagnostic-manager.cc
9045         (diagnostic_manager::prune_for_sm_diagnostic): Assert that var is
9046         either NULL or not a constant.  When updating var, bulletproof
9047         against constant values.
9048
9049 2020-02-26  David Malcolm  <dmalcolm@redhat.com>
9050
9051         PR analyzer/93947
9052         * region-model.cc (region_model::get_fndecl_for_call): Gracefully
9053         fail for fn_decls that don't have a cgraph_node.
9054
9055 2020-02-26  David Malcolm  <dmalcolm@redhat.com>
9056
9057         * bar-chart.cc: New file.
9058         * bar-chart.h: New file.
9059         * engine.cc: Include "analyzer/bar-chart.h".
9060         (stats::log): Only log the m_num_nodes kinds that are non-zero.
9061         (stats::dump): Likewise when dumping.
9062         (stats::get_total_enodes): New.
9063         (exploded_graph::get_or_create_node): Increment the per-point-data
9064         m_excess_enodes when hitting the per-program-point limit on
9065         enodes.
9066         (exploded_graph::print_bar_charts): New.
9067         (exploded_graph::log_stats): Log the number of unprocessed enodes
9068         in the worklist.  Call print_bar_charts.
9069         (exploded_graph::dump_stats): Print the number of unprocessed
9070         enodes in the worklist.
9071         * exploded-graph.h (stats::get_total_enodes): New decl.
9072         (struct per_program_point_data): Add field m_excess_enodes.
9073         (exploded_graph::print_bar_charts): New decl.
9074         * supergraph.cc (superedge::dump): New.
9075         (superedge::dump): New.
9076         * supergraph.h (supernode::get_function): New.
9077         (superedge::dump): New decl.
9078         (superedge::dump): New decl.
9079
9080 2020-02-24  David Malcolm  <dmalcolm@redhat.com>
9081
9082         * engine.cc (exploded_graph::get_or_create_node): Dump the
9083         program_state to the pp, rather than to stderr.
9084
9085 2020-02-24  David Malcolm  <dmalcolm@redhat.com>
9086
9087         PR analyzer/93032
9088         * sm.cc (make_checkers): Require the "taint" checker to be
9089         explicitly enabled.
9090
9091 2020-02-24  David Malcolm  <dmalcolm@redhat.com>
9092
9093         PR analyzer/93899
9094         * engine.cc
9095         (impl_region_model_context::impl_region_model_context): Add logger
9096         param.
9097         * engine.cc (exploded_graph::add_function_entry): Create an
9098         impl_region_model_context and pass it to the push_frame call.
9099         Bail if the resulting state is invalid.
9100         (exploded_graph::build_initial_worklist): Likewise.
9101         (exploded_graph::build_initial_worklist): Handle the case where
9102         add_function_entry fails.
9103         * exploded-graph.h
9104         (impl_region_model_context::impl_region_model_context): Add logger
9105         param.
9106         * region-model.cc (map_region::get_or_create): Add ctxt param and
9107         pass it to add_region_for_type.
9108         (map_region::can_merge_p): Pass NULL as a ctxt to call to
9109         get_or_create.
9110         (array_region::get_element): Pass ctxt to call to get_or_create.
9111         (array_region::get_or_create): Add ctxt param and pass it to
9112         add_region_for_type.
9113         (root_region::push_frame): Pass ctxt to get_or_create calls.
9114         (region_model::get_lvalue_1): Likewise.
9115         (region_model::make_region_for_unexpected_tree_code): Assert that
9116         ctxt is non-NULL.
9117         (region_model::get_rvalue_1): Pass ctxt to get_svalue_for_fndecl
9118         and get_svalue_for_label calls.
9119         (region_model::get_svalue_for_fndecl): Add ctxt param and pass it
9120         to get_region_for_fndecl.
9121         (region_model::get_region_for_fndecl): Add ctxt param and pass it
9122         to get_or_create.
9123         (region_model::get_svalue_for_label): Add ctxt param and pass it
9124         to get_region_for_label.
9125         (region_model::get_region_for_label): Add ctxt param and pass it
9126         to get_region_for_fndecl and get_or_create.
9127         (region_model::get_field_region): Add ctxt param and pass it to
9128         get_or_create_view and get_or_create.
9129         (make_region_for_type): Replace gcc_unreachable with return NULL.
9130         (region_model::add_region_for_type): Add ctxt param.  Handle a
9131         return of NULL from make_region_for_type by calling
9132         make_region_for_unexpected_tree_code.
9133         (region_model::get_or_create_mem_ref): Pass ctxt to calls to
9134         get_or_create_view.
9135         (region_model::get_or_create_view): Add ctxt param and pass it to
9136         add_region_for_type.
9137         (selftest::test_state_merging): Pass ctxt to get_or_create_view.
9138         * region-model.h (region_model::get_or_create): Add ctxt param.
9139         (region_model::add_region_for_type): Likewise.
9140         (region_model::get_svalue_for_fndecl): Likewise.
9141         (region_model::get_svalue_for_label): Likewise.
9142         (region_model::get_region_for_fndecl): Likewise.
9143         (region_model::get_region_for_label): Likewise.
9144         (region_model::get_field_region): Likewise.
9145         (region_model::get_or_create_view): Likewise.
9146
9147 2020-02-24  David Malcolm  <dmalcolm@redhat.com>
9148
9149         * checker-path.cc (superedge_event::should_filter_p): Update
9150         filter for empty descriptions to cover verbosity level 3 as well
9151         as 2.
9152         * diagnostic-manager.cc: Include "analyzer/reachability.h".
9153         (class path_builder): New class.
9154         (diagnostic_manager::emit_saved_diagnostic): Create a path_builder
9155         and pass it to build_emission_path, rather passing eg; similarly
9156         for add_events_for_eedge and ext_state.
9157         (diagnostic_manager::build_emission_path): Replace "eg" param
9158         with a path_builder, pass it to add_events_for_eedge.
9159         (diagnostic_manager::add_events_for_eedge): Replace ext_state
9160         param with path_builder; pass it to add_events_for_superedge.
9161         (diagnostic_manager::significant_edge_p): New.
9162         (diagnostic_manager::add_events_for_superedge): Add path_builder
9163         param.  Reject insignificant edges at verbosity levels below 3.
9164         (diagnostic_manager::prune_for_sm_diagnostic): Update highest
9165         verbosity level to 4.
9166         * diagnostic-manager.h (class path_builder): New forward decl.
9167         (diagnostic_manager::build_emission_path): Replace "eg" param
9168         with a path_builder.
9169         (diagnostic_manager::add_events_for_eedge): Replace ext_state
9170         param with path_builder.
9171         (diagnostic_manager::significant_edge_p): New.
9172         (diagnostic_manager::add_events_for_superedge): Add path_builder
9173         param.
9174         * reachability.h: New file.
9175
9176 2020-02-18  David Malcolm  <dmalcolm@redhat.com>
9177
9178         PR analyzer/93692
9179         * analyzer.opt (fdump-analyzer-callgraph): Rewrite description.
9180
9181 2020-02-18  David Malcolm  <dmalcolm@redhat.com>
9182
9183         PR analyzer/93777
9184         * region-model.cc (region_model::maybe_cast_1): Replace assertion
9185         that build_cast returns non-NULL with a conditional, falling
9186         through to the logic which returns a new unknown value of the
9187         desired type if it fails.
9188
9189 2020-02-18  David Malcolm  <dmalcolm@redhat.com>
9190
9191         PR analyzer/93778
9192         * engine.cc (impl_region_model_context::on_unknown_tree_code):
9193         Rename to...
9194         (impl_region_model_context::on_unexpected_tree_code): ...this and
9195         convert first argument from path_var to tree.
9196         (exploded_node::on_stmt): Pass ctxt to purge_for_unknown_fncall.
9197         * exploded-graph.h (region_model_context::on_unknown_tree_code):
9198         Rename to...
9199         (region_model_context::on_unexpected_tree_code): ...this and
9200         convert first argument from path_var to tree.
9201         * program-state.cc (sm_state_map::purge_for_unknown_fncall): Add
9202         ctxt param and pass on to calls to get_rvalue.
9203         * program-state.h (sm_state_map::purge_for_unknown_fncall): Add
9204         ctxt param.
9205         * region-model.cc (region_model::handle_unrecognized_call): Pass
9206         ctxt on to call to get_rvalue.
9207         (region_model::get_lvalue_1): Move body of default case to
9208         region_model::make_region_for_unexpected_tree_code and call it.
9209         Within COMPONENT_REF case, reject attempts to handle types other
9210         than RECORD_TYPE and UNION_TYPE.
9211         (region_model::make_region_for_unexpected_tree_code): New
9212         function, based on default case of region_model::get_lvalue_1.
9213         * region-model.h
9214         (region_model::make_region_for_unexpected_tree_code): New decl.
9215         (region_model::on_unknown_tree_code): Rename to...
9216         (region_model::on_unexpected_tree_code): ...this and convert first
9217         argument from path_var to tree.
9218         (class test_region_model_context): Update vfunc implementation for
9219         above change.
9220
9221 2020-02-18  David Malcolm  <dmalcolm@redhat.com>
9222
9223         PR analyzer/93774
9224         * region-model.cc
9225         (region_model::convert_byte_offset_to_array_index): Use
9226         int_size_in_bytes before calling size_in_bytes, to gracefully fail
9227         on incomplete types.
9228
9229 2020-02-17  David Malcolm  <dmalcolm@redhat.com>
9230
9231         PR analyzer/93775
9232         * region-model.cc (region_model::get_fndecl_for_call): Handle the
9233         case where the code_region's get_tree_for_child_region returns
9234         NULL.
9235
9236 2020-02-17  David Malcolm  <dmalcolm@redhat.com>
9237
9238         PR analyzer/93388
9239         * engine.cc (impl_region_model_context::on_unknown_tree_code):
9240         New.
9241         (exploded_graph::get_or_create_node): Reject invalid states.
9242         * exploded-graph.h
9243         (impl_region_model_context::on_unknown_tree_code): New decl.
9244         (point_and_state::point_and_state): Assert that the state is
9245         valid.
9246         * program-state.cc (program_state::program_state): Initialize
9247         m_valid to true.
9248         (program_state::operator=): Copy m_valid.
9249         (program_state::program_state): Likewise for move constructor.
9250         (program_state::print): Print m_valid.
9251         (program_state::dump_to_pp): Likewise.
9252         * program-state.h (program_state::m_valid): New field.
9253         * region-model.cc (region_model::get_lvalue_1): Implement the
9254         default case by returning a new symbolic region and calling
9255         the context's on_unknown_tree_code, rather than issuing an
9256         internal_error.  Implement VIEW_CONVERT_EXPR.
9257         * region-model.h (region_model_context::on_unknown_tree_code): New
9258         vfunc.
9259         (test_region_model_context::on_unknown_tree_code): New.
9260
9261 2020-02-17  David Malcolm  <dmalcolm@redhat.com>
9262
9263         * sm-malloc.cc (malloc_diagnostic::describe_state_change): For
9264         transition to the "null" state, only say "assuming" when
9265         transitioning from the "unchecked" state.
9266
9267 2020-02-17  David Malcolm  <dmalcolm@redhat.com>
9268
9269         * diagnostic-manager.h (diagnostic_manager::get_saved_diagnostic):
9270         Add const overload.
9271         * engine.cc (exploded_node::dump_dot): Dump saved_diagnostics.
9272         * exploded-graph.h (exploded_graph::get_diagnostic_manager): Add
9273         const overload.
9274
9275 2020-02-11  David Malcolm  <dmalcolm@redhat.com>
9276
9277         PR analyzer/93288
9278         * analysis-plan.cc (analysis_plan::use_summary_p): Look through
9279         the ultimate_alias_target when getting the called function.
9280         * engine.cc (exploded_node::on_stmt): Rename second "ctxt" to
9281         "sm_ctxt".  Use the region_model's get_fndecl_for_call rather than
9282         gimple_call_fndecl.
9283         * region-model.cc (region_model::get_fndecl_for_call): Use
9284         ultimate_alias_target on fndecl.
9285         * supergraph.cc (get_ultimate_function_for_cgraph_edge): New
9286         function.
9287         (supergraph_call_edge): Use it when rejecting edges without
9288         functions.
9289         (supergraph::supergraph): Use it to get the function for the
9290         cgraph_edge when building interprocedural superedges.
9291         (callgraph_superedge::get_callee_function):  Use it.
9292         * supergraph.h (supergraph::get_num_snodes): Make param const.
9293         (supergraph::function_to_num_snodes_t): Make first type param
9294         const.
9295
9296 2020-02-11  David Malcolm  <dmalcolm@redhat.com>
9297
9298         PR analyzer/93374
9299         * engine.cc (exploded_edge::exploded_edge): Add ext_state param
9300         and pass it to change.validate.
9301         (exploded_graph::get_or_create_node): Move purging of change
9302         svalues to also cover the case of reusing an existing enode.
9303         (exploded_graph::add_edge): Pass m_ext_state to exploded_edge's
9304         ctor.
9305         * exploded-graph.h (exploded_edge::exploded_edge): Add ext_state
9306         param.
9307         * program-state.cc (state_change::sm_change::validate): Likewise.
9308         Assert that m_sm_idx is sane.  Use ext_state to validate
9309         m_old_state and m_new_state.
9310         (state_change::validate): Add ext_state param and pass it to
9311         the sm_change validate calls.
9312         * program-state.h (state_change::sm_change::validate): Add
9313         ext_state param.
9314         (state_change::validate): Likewise.
9315
9316 2020-02-11  David Malcolm  <dmalcolm@redhat.com>
9317
9318         PR analyzer/93669
9319         * engine.cc (exploded_graph::dump_exploded_nodes): Handle missing
9320         case of STATUS_WORKLIST in implementation of
9321         "__analyzer_dump_exploded_nodes".
9322
9323 2020-02-11  David Malcolm  <dmalcolm@redhat.com>
9324
9325         PR analyzer/93649
9326         * constraint-manager.cc (constraint_manager::add_constraint): When
9327         merging equivalence classes and updating m_constant, also update
9328         m_cst_sid.
9329         (constraint_manager::validate): If m_constant is non-NULL assert
9330         that m_cst_sid is non-null and is valid.
9331
9332 2020-02-11  David Malcolm  <dmalcolm@redhat.com>
9333
9334         PR analyzer/93657
9335         * analyzer.opt (fdump-analyzer): Reword description.
9336         (fdump-analyzer-stderr): Likewise.
9337
9338 2020-02-11  David Malcolm  <dmalcolm@redhat.com>
9339
9340         * region-model.cc (print_quoted_type): New function.
9341         (svalue::print): Use it to replace %qT.
9342         (region::dump_to_pp): Likewise.
9343         (region::dump_child_label): Likewise.
9344         (region::print_fields): Likewise.
9345
9346 2020-02-10  David Malcolm  <dmalcolm@redhat.com>
9347
9348         PR analyzer/93659
9349         * analyzer.opt (-param=analyzer-max-recursion-depth=): Fix "tha"
9350         -> "that" typo.
9351         (Wanalyzer-use-of-uninitialized-value): Fix "initialized" ->
9352         "uninitialized" typo.
9353
9354 2020-02-10  David Malcolm  <dmalcolm@redhat.com>
9355
9356         PR analyzer/93350
9357         * region-model.cc (region_model::get_lvalue_1):
9358         Handle BIT_FIELD_REF.
9359         (make_region_for_type): Handle VECTOR_TYPE.
9360
9361 2020-02-10  David Malcolm  <dmalcolm@redhat.com>
9362
9363         PR analyzer/93647
9364         * diagnostic-manager.cc
9365         (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof against
9366         VAR being constant.
9367         * region-model.cc (region_model::get_lvalue_1): Provide a better
9368         error message when encountering an unhandled tree code.
9369
9370 2020-02-10  David Malcolm  <dmalcolm@redhat.com>
9371
9372         PR analyzer/93405
9373         * region-model.cc (region_model::get_lvalue_1): Implement
9374         CONST_DECL.
9375
9376 2020-02-06  David Malcolm  <dmalcolm@redhat.com>
9377
9378         * region-model.cc (region_model::maybe_cast_1): Attempt to provide
9379         a region_svalue if either type is a pointer, rather than if both
9380         types are pointers.
9381
9382 2020-02-05  David Malcolm  <dmalcolm@redhat.com>
9383
9384         * engine.cc (exploded_node::dump_dot): Show merger enodes.
9385         (worklist::add_node): Assert that the node's m_status is
9386         STATUS_WORKLIST.
9387         (exploded_graph::process_worklist): Likewise for nodes from the
9388         worklist.  Set status of merged nodes to STATUS_MERGER.
9389         (exploded_graph::process_node): Set status of node to
9390         STATUS_PROCESSED.
9391         (exploded_graph::dump_exploded_nodes): Rework handling of
9392         "__analyzer_dump_exploded_nodes", splitting enodes by status into
9393         "processed" and "merger", showing the count of just the processed
9394         enodes at the call, rather than the count of all enodes.
9395         * exploded-graph.h (exploded_node::status): New enum.
9396         (exploded_node::exploded_node): Initialize m_status to
9397         STATUS_WORKLIST.
9398         (exploded_node::get_status): New getter.
9399         (exploded_node::set_status): New setter.
9400
9401 2020-02-04  David Malcolm  <dmalcolm@redhat.com>
9402
9403         PR analyzer/93543
9404         * engine.cc (pod_hash_traits<function_call_string>::mark_empty):
9405         Eliminate reinterpret_cast.
9406         (pod_hash_traits<function_call_string>::is_empty): Likewise.
9407
9408 2020-02-03  David Malcolm  <dmalcolm@redhat.com>
9409
9410         * constraint-manager.cc (range::constrained_to_single_element):
9411         Replace fold_build2 with fold_binary.  Remove unnecessary newline.
9412         (constraint_manager::get_or_add_equiv_class): Replace fold_build2
9413         with fold_binary in two places, and remove out-of-date comment.
9414         (constraint_manager::eval_condition): Replace fold_build2 with
9415         fold_binary.
9416         * region-model.cc (constant_svalue::eval_condition): Likewise.
9417         (region_model::on_assignment): Likewise.
9418
9419 2020-02-03  David Malcolm  <dmalcolm@redhat.com>
9420
9421         PR analyzer/93544
9422         * diagnostic-manager.cc
9423         (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof
9424         against bad choices due to bad paths.
9425         * engine.cc (impl_region_model_context::on_phi): New.
9426         * exploded-graph.h (impl_region_model_context::on_phi): New decl.
9427         * region-model.cc (region_model::on_longjmp): Likewise.
9428         (region_model::handle_phi): Add phi param.  Call the ctxt's on_phi
9429         vfunc.
9430         (region_model::update_for_phis): Pass phi to handle_phi.
9431         * region-model.h (region_model::handle_phi): Add phi param.
9432         (region_model_context::on_phi): New vfunc.
9433         (test_region_model_context::on_phi): New.
9434         * sm-malloc.cc (malloc_state_machine::on_phi): New.
9435         (malloc_state_machine::on_zero_assignment): New.
9436         * sm.h (state_machine::on_phi): New vfunc.
9437
9438 2020-02-03  David Malcolm  <dmalcolm@redhat.com>
9439
9440         * engine.cc (supernode_cluster::dump_dot): Show BB index as
9441         well as SN index.
9442         * supergraph.cc (supernode::dump_dot): Likewise.
9443
9444 2020-02-03  David Malcolm  <dmalcolm@redhat.com>
9445
9446         PR analyzer/93546
9447         * region-model.cc (region_model::on_call_pre): Update for new
9448         param of symbolic_region ctor.
9449         (region_model::deref_rvalue): Likewise.
9450         (region_model::add_new_malloc_region): Likewise.
9451         (make_region_for_type): Likewise, preserving type.
9452         * region-model.h (symbolic_region::symbolic_region): Add "type"
9453         param and pass it to base class ctor.
9454
9455 2020-02-03  David Malcolm  <dmalcolm@redhat.com>
9456
9457         PR analyzer/93547
9458         * constraint-manager.cc
9459         (constraint_manager::get_or_add_equiv_class): Ensure types are
9460         compatible before comparing constants.
9461
9462 2020-01-31  David Malcolm  <dmalcolm@redhat.com>
9463
9464         PR analyzer/93457
9465         * region-model.cc (make_region_for_type): Use VOID_TYPE_P rather
9466         than checking against void_type_node.
9467
9468 2020-01-31  David Malcolm  <dmalcolm@redhat.com>
9469
9470         PR analyzer/93373
9471         * region-model.cc (ASSERT_COMPAT_TYPES): Convert to...
9472         (assert_compat_types): ...this, and bail when either type is NULL,
9473         or when VOID_TYPE_P (dst_type).
9474         (region_model::get_lvalue): Update for above conversion.
9475         (region_model::get_rvalue): Likewise.
9476
9477 2020-01-31  David Malcolm  <dmalcolm@redhat.com>
9478
9479         PR analyzer/93379
9480         * region-model.cc (region_model::update_for_return_superedge):
9481         Move check for null result so that it also guards setting the
9482         lhs.
9483
9484 2020-01-31  David Malcolm  <dmalcolm@redhat.com>
9485
9486         PR analyzer/93438
9487         * region-model.cc (stack_region::can_merge_p): Split into a two
9488         pass approach, creating all stack regions first, then populating
9489         them.
9490         (selftest::test_state_merging): Add test coverage for (a) the case
9491         of self-merging a model in which a local in an older stack frame
9492         points to a local in a more recent stack frame (which previously
9493         would ICE), and (b) the case of self-merging a model in which a
9494         local points to a global (which previously worked OK).
9495
9496 2020-01-31  David Malcolm  <dmalcolm@redhat.com>
9497
9498         * analyzer.cc (is_named_call_p): Replace tests for fndecl being
9499         extern at file scope and having a non-NULL DECL_NAME with a call
9500         to maybe_special_function_p.
9501         * function-set.cc (function_set::contains_decl_p): Add call to
9502         maybe_special_function_p.
9503
9504 2020-01-31  David Malcolm  <dmalcolm@redhat.com>
9505
9506         PR analyzer/93450
9507         * constraint-manager.cc
9508         (constraint_manager::get_or_add_equiv_class): Only compare constants
9509         if their types are compatible.
9510         * region-model.cc (constant_svalue::eval_condition): Replace check
9511         for identical types with call to types_compatible_p.
9512
9513 2020-01-30  David Malcolm  <dmalcolm@redhat.com>
9514
9515         * program-state.cc (extrinsic_state::dump_to_pp): New.
9516         (extrinsic_state::dump_to_file): New.
9517         (extrinsic_state::dump): New.
9518         * program-state.h (extrinsic_state::dump_to_pp): New decl.
9519         (extrinsic_state::dump_to_file): New decl.
9520         (extrinsic_state::dump): New decl.
9521         * sm.cc: Include "pretty-print.h".
9522         (state_machine::dump_to_pp): New.
9523         * sm.h (state_machine::dump_to_pp): New decl.
9524
9525 2020-01-30  David Malcolm  <dmalcolm@redhat.com>
9526
9527         * diagnostic-manager.cc (for_each_state_change): Use
9528         extrinsic_state::get_num_checkers rather than accessing m_checkers
9529         directly.
9530         * program-state.cc (program_state::program_state): Likewise.
9531         * program-state.h (extrinsic_state::m_checkers): Make private.
9532
9533 2020-01-30  David Malcolm  <dmalcolm@redhat.com>
9534
9535         PR analyzer/93356
9536         * region-model.cc (region_model::eval_condition): In both
9537         overloads, bail out immediately on floating-point types.
9538         (region_model::eval_condition_without_cm): Likewise.
9539         (region_model::add_constraint): Likewise.
9540
9541 2020-01-30  David Malcolm  <dmalcolm@redhat.com>
9542
9543         PR analyzer/93450
9544         * program-state.cc (sm_state_map::set_state): For the overload
9545         taking an svalue_id, bail out if the set_state on the ec does
9546         nothing.  Convert the latter's return type from void to bool,
9547         returning true if anything changed.
9548         (sm_state_map::impl_set_state): Convert the return type from void
9549         to bool, returning true if the state changed.
9550         * program-state.h (sm_state_map::set_state): Convert return type
9551         from void to bool.
9552         (sm_state_map::impl_set_state): Likewise.
9553         * region-model.cc (constant_svalue::eval_condition): Only call
9554         fold_build2 if the types are the same.
9555
9556 2020-01-29  Jakub Jelinek  <jakub@redhat.com>
9557
9558         * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Remove.
9559         * constraint-manager.cc: Include diagnostic-core.h before graphviz.h.
9560         (range::dump, equiv_class::print): Don't use PUSH_IGNORE_WFORMAT or
9561         POP_IGNORE_WFORMAT.
9562         * state-purge.cc: Include diagnostic-core.h before
9563         gimple-pretty-print.h.
9564         (state_purge_annotator::add_node_annotations, print_vec_of_names):
9565         Don't use PUSH_IGNORE_WFORMAT or POP_IGNORE_WFORMAT.
9566         * region-model.cc: Move diagnostic-core.h include before graphviz.h.
9567         (path_var::dump, svalue::print, constant_svalue::print_details,
9568         region::dump_to_pp, region::dump_child_label, region::print_fields,
9569         map_region::print_fields, map_region::dump_dot_to_pp,
9570         map_region::dump_child_label, array_region::print_fields,
9571         array_region::dump_dot_to_pp): Don't use PUSH_IGNORE_WFORMAT or
9572         POP_IGNORE_WFORMAT.
9573
9574 2020-01-28  David Malcolm  <dmalcolm@redhat.com>
9575
9576         PR analyzer/93316
9577         * engine.cc (rewind_info_t::update_model): Get the longjmp call
9578         stmt via get_longjmp_call () rather than assuming it is the last
9579         stmt in the longjmp's supernode.
9580         (rewind_info_t::add_events_to_path): Get the location_t for the
9581         rewind_from_longjmp_event via get_longjmp_call () rather than from
9582         the supernode's get_end_location ().
9583
9584 2020-01-28  David Malcolm  <dmalcolm@redhat.com>
9585
9586         * region-model.cc (poisoned_value_diagnostic::emit): Update for
9587         renaming of warning_at overload to warning_meta.
9588         * sm-file.cc (file_leak::emit): Likewise.
9589         * sm-malloc.cc (double_free::emit): Likewise.
9590         (possible_null_deref::emit): Likewise.
9591         (possible_null_arg::emit): Likewise.
9592         (null_deref::emit): Likewise.
9593         (null_arg::emit): Likewise.
9594         (use_after_free::emit): Likewise.
9595         (malloc_leak::emit): Likewise.
9596         (free_of_non_heap::emit): Likewise.
9597         * sm-sensitive.cc (exposure_through_output_file::emit): Likewise.
9598         * sm-signal.cc (signal_unsafe_call::emit): Likewise.
9599         * sm-taint.cc (tainted_array_index::emit): Likewise.
9600
9601 2020-01-27  David Malcolm  <dmalcolm@redhat.com>
9602
9603         PR analyzer/93451
9604         * region-model.cc (tree_cmp): For the REAL_CST case, impose an
9605         arbitrary order on NaNs relative to other NaNs and to non-NaNs;
9606         const-correctness tweak.
9607         (ana::selftests::build_real_cst_from_string): New function.
9608         (ana::selftests::append_interesting_constants): New function.
9609         (ana::selftests::test_tree_cmp_on_constants): New test.
9610         (ana::selftests::test_canonicalization_4): New test.
9611         (ana::selftests::analyzer_region_model_cc_tests): Call the new
9612         tests.
9613
9614 2020-01-27  David Malcolm  <dmalcolm@redhat.com>
9615
9616         PR analyzer/93349
9617         * engine.cc (run_checkers): Save and restore input_location.
9618
9619 2020-01-27  David Malcolm  <dmalcolm@redhat.com>
9620
9621         * call-string.cc (call_string::cmp_1): Delete, moving body to...
9622         (call_string::cmp): ...here.
9623         * call-string.h (call_string::cmp_1): Delete decl.
9624         * engine.cc (worklist::key_t::cmp_1): Delete, moving body to...
9625         (worklist::key_t::cmp): ...here.  Implement hash comparisons
9626         via comparison rather than subtraction to avoid overflow issues.
9627         * exploded-graph.h (worklist::key_t::cmp_1): Delete decl.
9628         * region-model.cc (tree_cmp): Eliminate buggy checking for
9629         symmetry.
9630
9631 2020-01-27  David Malcolm  <dmalcolm@redhat.com>
9632
9633         * analyzer.cc  (is_named_call_p): Check that fndecl is "extern"
9634         and at file scope.  Potentially disregard prefix _ or __ in
9635         fndecl's name.  Bail if the identifier is NULL.
9636         (is_setjmp_call_p): Expect a gcall rather than plain gimple.
9637         Remove special-case check for leading prefix, and also check for
9638         sigsetjmp.
9639         (is_longjmp_call_p): Also check for siglongjmp.
9640         (get_user_facing_name): New function.
9641         * analyzer.h (is_setjmp_call_p): Expect a gcall rather than plain
9642         gimple.
9643         (get_user_facing_name): New decl.
9644         * checker-path.cc (setjmp_event::get_desc): Use
9645         get_user_facing_name to avoid hardcoding the function name.
9646         (rewind_event::rewind_event): Add rewind_info param, using it to
9647         initialize new m_rewind_info field, and strengthen the assertion.
9648         (rewind_from_longjmp_event::get_desc): Use get_user_facing_name to
9649         avoid hardcoding the function name.
9650         (rewind_to_setjmp_event::get_desc): Likewise.
9651         * checker-path.h (setjmp_event::setjmp_event): Add setjmp_call
9652         param and use it to initialize...
9653         (setjmp_event::m_setjmp_call): New field.
9654         (rewind_event::rewind_event): Add rewind_info param.
9655         (rewind_event::m_rewind_info): New protected field.
9656         (rewind_from_longjmp_event::rewind_from_longjmp_event): Add
9657         rewind_info param.
9658         (class rewind_to_setjmp_event): Move rewind_info field to parent
9659         class.
9660         * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
9661         Update setjmp-handling for is_setjmp_call_p requiring a gcall;
9662         pass the call to the new setjmp_event.
9663         * engine.cc (exploded_node::on_stmt): Update for is_setjmp_call_p
9664         requiring a gcall.
9665         (stale_jmp_buf::emit): Use get_user_facing_name to avoid
9666         hardcoding the function names.
9667         (exploded_node::on_longjmp): Pass the longjmp_call when
9668         constructing rewind_info.
9669         (rewind_info_t::add_events_to_path): Pass the rewind_info_t to the
9670         rewind_from_longjmp_event's ctor.
9671         * exploded-graph.h (rewind_info_t::rewind_info_t): Add
9672         longjmp_call param.
9673         (rewind_info_t::get_longjmp_call): New.
9674         (rewind_info_t::m_longjmp_call): New.
9675         * region-model.cc (region_model::on_setjmp): Update comment to
9676         indicate this is also for sigsetjmp.
9677         * region-model.h (struct setjmp_record): Likewise.
9678         (class setjmp_svalue): Likewise.
9679
9680 2020-01-27  David Malcolm  <dmalcolm@redhat.com>
9681
9682         PR analyzer/93276
9683         * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Guard these
9684         macros with GCC_VERSION >= 4006, making them no-op otherwise.
9685         * engine.cc (exploded_edge::exploded_edge): Specify template for
9686         base class initializer.
9687         (exploded_graph::add_edge): Specify template when chaining up to
9688         base class add_edge implementation.
9689         (viz_callgraph_node::dump_dot): Drop redundant "typename".
9690         (viz_callgraph_edge::viz_callgraph_edge): Specify template for
9691         base class initializer.
9692         * program-state.cc (sm_state_map::clone_with_remapping): Drop
9693         redundant "typename".
9694         (sm_state_map::print): Likewise.
9695         (sm_state_map::hash): Likewise.
9696         (sm_state_map::operator==): Likewise.
9697         (sm_state_map::remap_svalue_ids): Likewise.
9698         (sm_state_map::on_svalue_purge): Likewise.
9699         (sm_state_map::validate): Likewise.
9700         * program-state.h (sm_state_map::iterator_t): Likewise.
9701         * supergraph.h (superedge::superedge): Specify template for base
9702         class initializer.
9703
9704 2020-01-23  David Malcolm  <dmalcolm@redhat.com>
9705
9706         PR analyzer/93375
9707         * supergraph.cc (callgraph_superedge::get_arg_for_parm): Fail
9708         gracefully is the number of parameters at the callee exceeds the
9709         number of arguments at the call stmt.
9710         (callgraph_superedge::get_parm_for_arg): Likewise.
9711
9712 2020-01-22  David Malcolm  <dmalcolm@redhat.com>
9713
9714         PR analyzer/93382
9715         * program-state.cc (sm_state_map::on_svalue_purge): If the
9716         entry survives, but the origin is being purged, then reset the
9717         origin to null.
9718
9719 2020-01-22  David Malcolm  <dmalcolm@redhat.com>
9720
9721         * sm-signal.cc: Fix nesting of CHECKING_P and namespace ana.
9722
9723 2020-01-22  David Malcolm  <dmalcolm@redhat.com>
9724
9725         PR analyzer/93378
9726         * engine.cc (setjmp_svalue::compare_fields): Update for
9727         replacement of m_enode with m_setjmp_record.
9728         (setjmp_svalue::add_to_hash): Likewise.
9729         (setjmp_svalue::get_index): Rename...
9730         (setjmp_svalue::get_enode_index): ...to this.
9731         (setjmp_svalue::print_details): Update for replacement of m_enode
9732         with m_setjmp_record.
9733         (exploded_node::on_longjmp): Likewise.
9734         * exploded-graph.h (rewind_info_t::m_enode_origin): Replace...
9735         (rewind_info_t::m_setjmp_record): ...with this.
9736         (rewind_info_t::rewind_info_t): Update for replacement of m_enode
9737         with m_setjmp_record.
9738         (rewind_info_t::get_setjmp_point): Likewise.
9739         (rewind_info_t::get_setjmp_call): Likewise.
9740         * region-model.cc (region_model::dump_summary_of_map): Likewise.
9741         (region_model::on_setjmp): Likewise.
9742         * region-model.h (struct setjmp_record): New struct.
9743         (setjmp_svalue::m_enode): Replace...
9744         (setjmp_svalue::m_setjmp_record): ...with this.
9745         (setjmp_svalue::setjmp_svalue): Update for replacement of m_enode
9746         with m_setjmp_record.
9747         (setjmp_svalue::clone): Likewise.
9748         (setjmp_svalue::get_index): Rename...
9749         (setjmp_svalue::get_enode_index): ...to this.
9750         (setjmp_svalue::get_exploded_node): Replace...
9751         (setjmp_svalue::get_setjmp_record): ...with this.
9752
9753 2020-01-22  David Malcolm  <dmalcolm@redhat.com>
9754
9755         PR analyzer/93316
9756         * analyzer.cc (is_setjmp_call_p): Check for "setjmp" as well as
9757         "_setjmp".
9758
9759 2020-01-22  David Malcolm  <dmalcolm@redhat.com>
9760
9761         PR analyzer/93307
9762         * analysis-plan.h: Wrap everything namespace "ana".
9763         * analyzer-logging.cc: Likewise.
9764         * analyzer-logging.h: Likewise.
9765         * analyzer-pass.cc (pass_analyzer::execute): Update for "ana"
9766         namespace.
9767         * analyzer-selftests.cc: Wrap everything namespace "ana".
9768         * analyzer-selftests.h: Likewise.
9769         * analyzer.h: Likewise for forward decls of types.
9770         * call-string.h: Likewise.
9771         * checker-path.cc: Likewise.
9772         * checker-path.h: Likewise.
9773         * constraint-manager.cc: Likewise.
9774         * constraint-manager.h: Likewise.
9775         * diagnostic-manager.cc: Likewise.
9776         * diagnostic-manager.h: Likewise.
9777         * engine.cc: Likewise.
9778         * engine.h: Likewise.
9779         * exploded-graph.h: Likewise.
9780         * function-set.cc: Likewise.
9781         * function-set.h: Likewise.
9782         * pending-diagnostic.cc: Likewise.
9783         * pending-diagnostic.h: Likewise.
9784         * program-point.cc: Likewise.
9785         * program-point.h: Likewise.
9786         * program-state.cc: Likewise.
9787         * program-state.h: Likewise.
9788         * region-model.cc: Likewise.
9789         * region-model.h: Likewise.
9790         * sm-file.cc: Likewise.
9791         * sm-malloc.cc: Likewise.
9792         * sm-pattern-test.cc: Likewise.
9793         * sm-sensitive.cc: Likewise.
9794         * sm-signal.cc: Likewise.
9795         * sm-taint.cc: Likewise.
9796         * sm.cc: Likewise.
9797         * sm.h: Likewise.
9798         * state-purge.h: Likewise.
9799         * supergraph.cc: Likewise.
9800         * supergraph.h: Likewise.
9801
9802 2020-01-21  David Malcolm  <dmalcolm@redhat.com>
9803
9804         PR analyzer/93352
9805         * region-model.cc (int_cmp): Rename to...
9806         (array_region::key_cmp): ...this, using key_t rather than int.
9807         Rewrite in terms of comparisons rather than subtraction to
9808         ensure qsort is anti-symmetric when handling extreme values.
9809         (array_region::walk_for_canonicalization): Update for above
9810         renaming.
9811         * region-model.h (array_region::key_cmp): New decl.
9812
9813 2020-01-17  David Malcolm  <dmalcolm@redhat.com>
9814
9815         PR analyzer/93290
9816         * region-model.cc (region_model::eval_condition_without_cm): Avoid
9817         gcc_unreachable for unexpected operations for the case where
9818         we're comparing an svalue against itself.
9819
9820 2020-01-17  David Malcolm  <dmalcolm@redhat.com>
9821
9822         PR analyzer/93281
9823         * region-model.cc
9824         (region_model::convert_byte_offset_to_array_index): Convert to
9825         ssizetype before dividing by byte_size.  Use fold_binary rather
9826         than fold_build2 to avoid needlessly constructing a tree for the
9827         non-const case.
9828
9829 2020-01-15  David Malcolm  <dmalcolm@redhat.com>
9830
9831         * engine.cc (class impl_region_model_context): Fix comment.
9832
9833 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
9834
9835         PR analyzer/93212
9836         * region-model.cc (make_region_for_type): Use
9837         FUNC_OR_METHOD_TYPE_P rather than comparing against FUNCTION_TYPE.
9838         * region-model.h (function_region::function_region): Likewise.
9839
9840 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
9841
9842         * program-state.cc (sm_state_map::clone_with_remapping): Copy
9843         m_global_state.
9844         (selftest::test_program_state_merging_2): New selftest.
9845         (selftest::analyzer_program_state_cc_tests): Call it.
9846
9847 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
9848
9849         * checker-path.h (checker_path::get_checker_event): New function.
9850         (checker_path): Add DISABLE_COPY_AND_ASSIGN; make fields private.
9851         * diagnostic-manager.cc
9852         (diagnostic_manager::prune_for_sm_diagnostic): Replace direct
9853         access to checker_path::m_events with accessor functions.  Fix
9854         overlong line.
9855         (diagnostic_manager::prune_interproc_events): Replace direct
9856         access to checker_path::m_events with accessor functions.
9857         (diagnostic_manager::finish_pruning): Likewise.
9858
9859 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
9860
9861         * checker-path.h (checker_event::clone): Delete vfunc decl.
9862         (debug_event::clone): Delete vfunc impl.
9863         (custom_event::clone): Delete vfunc impl.
9864         (statement_event::clone): Delete vfunc impl.
9865         (function_entry_event::clone): Delete vfunc impl.
9866         (state_change_event::clone): Delete vfunc impl.
9867         (start_cfg_edge_event::clone): Delete vfunc impl.
9868         (end_cfg_edge_event::clone): Delete vfunc impl.
9869         (call_event::clone): Delete vfunc impl.
9870         (return_event::clone): Delete vfunc impl.
9871         (setjmp_event::clone): Delete vfunc impl.
9872         (rewind_from_longjmp_event::clone): Delete vfunc impl.
9873         (rewind_to_setjmp_event::clone): Delete vfunc impl.
9874         (warning_event::clone): Delete vfunc impl.
9875
9876 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
9877
9878         * supergraph.cc (supernode::dump_dot): Ensure that the TABLE
9879         element has at least one TR.
9880
9881 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
9882
9883         PR analyzer/58237
9884         * engine.cc (leak_stmt_finder::find_stmt): Use get_pure_location
9885         when comparing against UNKNOWN_LOCATION.
9886         (stmt_requires_new_enode_p): Likewise.
9887         (exploded_graph::dump_exploded_nodes): Likewise.
9888         * supergraph.cc (supernode::get_start_location): Likewise.
9889         (supernode::get_end_location): Likewise.
9890
9891 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
9892
9893         PR analyzer/58237
9894         * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
9895         selftest::analyzer_sm_file_cc_tests.
9896         * analyzer-selftests.h (selftest::analyzer_sm_file_cc_tests): New
9897         decl.
9898         * sm-file.cc: Include "analyzer/function-set.h" and
9899         "analyzer/analyzer-selftests.h".
9900         (get_file_using_fns): New function.
9901         (is_file_using_fn_p): New function.
9902         (fileptr_state_machine::on_stmt): Return true for known functions.
9903         (selftest::analyzer_sm_file_cc_tests): New function.
9904
9905 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
9906
9907         * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
9908         selftest::analyzer_sm_signal_cc_tests.
9909         * analyzer-selftests.h (selftest::analyzer_sm_signal_cc_tests):
9910         New decl.
9911         * sm-signal.cc: Include "analyzer/function-set.h" and
9912         "analyzer/analyzer-selftests.h".
9913         (get_async_signal_unsafe_fns): New function.
9914         (signal_unsafe_p): Reimplement in terms of the above.
9915         (selftest::analyzer_sm_signal_cc_tests): New function.
9916
9917 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
9918
9919         * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
9920         selftest::analyzer_function_set_cc_tests.
9921         * analyzer-selftests.h (selftest::analyzer_function_set_cc_tests):
9922         New decl.
9923         * function-set.cc: New file.
9924         * function-set.h: New file.
9925
9926 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
9927
9928         * analyzer.h (fndecl_has_gimple_body_p): New decl.
9929         * engine.cc (impl_region_model_context::on_unknown_change): New
9930         function.
9931         (fndecl_has_gimple_body_p): Make non-static.
9932         (exploded_node::on_stmt): Treat __analyzer_dump_exploded_nodes as
9933         known.  Track whether we have a call with unknown side-effects and
9934         pass it to on_call_post.
9935         * exploded-graph.h (impl_region_model_context::on_unknown_change):
9936         New decl.
9937         * program-state.cc (sm_state_map::on_unknown_change): New function.
9938         * program-state.h (sm_state_map::on_unknown_change): New decl.
9939         * region-model.cc: Include "bitmap.h".
9940         (region_model::on_call_pre): Return a bool, capturing whether the
9941         call has unknown side effects.
9942         (region_model::on_call_post): Add arg "bool unknown_side_effects"
9943         and if true, call handle_unrecognized_call.
9944         (class reachable_regions): New class.
9945         (region_model::handle_unrecognized_call): New function.
9946         * region-model.h (region_model::on_call_pre): Return a bool.
9947         (region_model::on_call_post): Add arg "bool unknown_side_effects".
9948         (region_model::handle_unrecognized_call): New decl.
9949         (region_model_context::on_unknown_change): New vfunc.
9950         (test_region_model_context::on_unknown_change): New function.
9951
9952 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
9953
9954         * diagnostic-manager.cc (saved_diagnostic::operator==): Move here
9955         from header.  Replace pointer equality test on m_var with call to
9956         pending_diagnostic::same_tree_p.
9957         * diagnostic-manager.h (saved_diagnostic::operator==): Move to
9958         diagnostic-manager.cc.
9959         * pending-diagnostic.cc (pending_diagnostic::same_tree_p): New.
9960         * pending-diagnostic.h (pending_diagnostic::same_tree_p): New.
9961         * sm-file.cc (file_diagnostic::subclass_equal_p): Replace pointer
9962         equality on m_arg with call to pending_diagnostic::same_tree_p.
9963         * sm-malloc.cc (malloc_diagnostic::subclass_equal_p): Likewise.
9964         (possible_null_arg::subclass_equal_p): Likewise.
9965         (null_arg::subclass_equal_p): Likewise.
9966         (free_of_non_heap::subclass_equal_p): Likewise.
9967         * sm-pattern-test.cc (pattern_match::operator==): Likewise.
9968         * sm-sensitive.cc (exposure_through_output_file::operator==):
9969         Likewise.
9970         * sm-taint.cc (tainted_array_index::operator==): Likewise.
9971
9972 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
9973
9974         * diagnostic-manager.cc (dedupe_winners::add): Add logging
9975         of deduplication decisions made.
9976
9977 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
9978
9979         * ChangeLog: New file.
9980         * analyzer-selftests.cc: New file.
9981         * analyzer-selftests.h: New file.
9982         * analyzer.opt: New file.
9983         * analysis-plan.cc: New file.
9984         * analysis-plan.h: New file.
9985         * analyzer-logging.cc: New file.
9986         * analyzer-logging.h: New file.
9987         * analyzer-pass.cc: New file.
9988         * analyzer.cc: New file.
9989         * analyzer.h: New file.
9990         * call-string.cc: New file.
9991         * call-string.h: New file.
9992         * checker-path.cc: New file.
9993         * checker-path.h: New file.
9994         * constraint-manager.cc: New file.
9995         * constraint-manager.h: New file.
9996         * diagnostic-manager.cc: New file.
9997         * diagnostic-manager.h: New file.
9998         * engine.cc: New file.
9999         * engine.h: New file.
10000         * exploded-graph.h: New file.
10001         * pending-diagnostic.cc: New file.
10002         * pending-diagnostic.h: New file.
10003         * program-point.cc: New file.
10004         * program-point.h: New file.
10005         * program-state.cc: New file.
10006         * program-state.h: New file.
10007         * region-model.cc: New file.
10008         * region-model.h: New file.
10009         * sm-file.cc: New file.
10010         * sm-malloc.cc: New file.
10011         * sm-malloc.dot: New file.
10012         * sm-pattern-test.cc: New file.
10013         * sm-sensitive.cc: New file.
10014         * sm-signal.cc: New file.
10015         * sm-taint.cc: New file.
10016         * sm.cc: New file.
10017         * sm.h: New file.
10018         * state-purge.cc: New file.
10019         * state-purge.h: New file.
10020         * supergraph.cc: New file.
10021         * supergraph.h: New file.
10022
10023 2019-12-13  David Malcolm  <dmalcolm@redhat.com>
10024
10025         * Initial creation
10026
10027 \f
10028 Copyright (C) 2019-2023 Free Software Foundation, Inc.
10029
10030 Copying and distribution of this file, with or without modification,
10031 are permitted in any medium without royalty provided the copyright
10032 notice and this notice are preserved.