| blob | d925452775d4f92b53eee355a08cf4bd1ba85991 |
1 2024-01-18 David Malcolm <dmalcolm@redhat.com>
3 PR analyzer/111361
4 * region-model.cc (svalue_byte_range_has_null_terminator_1): The
5 initial byte of an all-zeroes SVAL is a zero byte. Remove
6 gcc_unreachable from SK_CONSTANT for constants that aren't
7 STRING_CST or INTEGER_CST.
9 2024-01-18 David Malcolm <dmalcolm@redhat.com>
11 PR analyzer/112811
12 * region-model.cc (fragment::dump_to_pp): New.
13 (fragment::has_null_terminator): Convert to...
14 (svalue_byte_range_has_null_terminator_1): ...this new function,
15 updating to use a byte_range relative to the start of the svalue.
16 (svalue_byte_range_has_null_terminator): New.
17 (fragment::string_cst_has_null_terminator): Convert to...
18 (string_cst_has_null_terminator): ...this, updating to use a
19 byte_range relative to the start of the svalue.
20 (iterable_cluster::dump_to_pp): New.
21 (region_model::scan_for_null_terminator): Add logging, moving body
22 to...
23 (region_model::scan_for_null_terminator_1): ...this new function,
24 adding more logging, and updating to use
25 svalue_byte_range_has_null_terminator.
26 * region-model.h (region_model::scan_for_null_terminator_1): New
27 decl.
29 2024-01-16 David Malcolm <dmalcolm@redhat.com>
31 PR analyzer/106229
32 * analyzer.h (compare_constants): New decl.
33 * constraint-manager.cc (compare_constants): Make non-static.
34 * sm-taint.cc: Add include "fold-const.h".
35 (class concrete_range): New.
36 (get_possible_range): New.
37 (index_can_be_out_of_bounds_p): New.
38 (region_model::check_region_for_taint): Reject
39 -Wanalyzer-tainted-array-index if the type of the value makes it
40 impossible for it to be out-of-bounds of the array.
42 2024-01-16 David Malcolm <dmalcolm@redhat.com>
44 PR analyzer/113333
45 * region-model-manager.cc
46 (region_model_manager::maybe_fold_unaryop): Casting all zeroes
47 should give all zeroes.
49 2024-01-04 David Malcolm <dmalcolm@redhat.com>
51 * analyzer.opt.urls: New file, autogenerated by
52 regenerate-opt-urls.py.
54 2024-01-04 David Malcolm <dmalcolm@redhat.com>
56 * checker-event.cc: Include "diagnostic-format-sarif.h" and
57 "tree-logical-location.h".
58 (checker_event::maybe_add_sarif_properties): New.
59 (superedge_event::maybe_add_sarif_properties): New.
60 (superedge_event::superedge_event): Add comment.
61 * checker-event.h (checker_event::maybe_add_sarif_properties): New
62 decl.
63 (superedge_event::maybe_add_sarif_properties): New decl.
65 2024-01-04 David Malcolm <dmalcolm@redhat.com>
67 PR analyzer/112790
68 * checker-event.cc (class inlining_info): Move to...
69 * inlining-iterator.h (class inlining_info): ...here.
70 * sm-malloc.cc: Include "analyzer/inlining-iterator.h".
71 (maybe_complain_about_deref_before_check): Reject stmts that were
72 inlined from another function.
74 2024-01-04 David Malcolm <dmalcolm@redhat.com>
76 PR analyzer/113222
77 * access-diagram.cc (valid_region_spatial_item::add_boundaries):
78 Handle TYPE_DOMAIN being null.
79 (valid_region_spatial_item::add_array_elements_to_table):
80 Likewise.
82 2023-12-16 David Malcolm <dmalcolm@redhat.com>
84 * analyzer.cc: Include "tree-pretty-print.h" and
85 "diagnostic-event-id.h".
86 (tree_to_json): New.
87 (diagnostic_event_id_to_json): New.
88 (bit_offset_to_json): New.
89 (byte_offset_to_json): New.
90 * analyzer.h (tree_to_json): New decl.
91 (diagnostic_event_id_to_json): New decl.
92 (bit_offset_to_json): New decl.
93 (byte_offset_to_json): New decl.
94 * bounds-checking.cc: Include "diagnostic-format-sarif.h".
95 (out_of_bounds::maybe_add_sarif_properties): New.
96 (concrete_out_of_bounds::maybe_add_sarif_properties): New.
97 (concrete_past_the_end::maybe_add_sarif_properties): New.
98 (symbolic_past_the_end::maybe_add_sarif_properties): New.
99 * region-model.cc (region_to_value_map::to_json): New.
100 (region_model::to_json): New.
101 * region-model.h (region_to_value_map::to_json): New decl.
102 (region_model::to_json): New decl.
103 * store.cc (bit_range::to_json): New.
104 (byte_range::to_json): New.
105 * store.h (bit_range::to_json): New decl.
106 (byte_range::to_json): New decl.
108 2023-12-16 David Malcolm <dmalcolm@redhat.com>
110 PR analyzer/112792
111 * bounds-checking.cc
112 (out_of_bounds::oob_region_creation_event_capacity): Rename
113 "capacity" to "byte_capacity". Layout fix.
114 (out_of_bounds::::add_region_creation_events): Rename
115 "capacity" to "byte_capacity".
116 (class concrete_out_of_bounds): Rename m_out_of_bounds_range to
117 m_out_of_bounds_bits and convert from a byte_range to a bit_range.
118 (concrete_out_of_bounds::get_out_of_bounds_bytes): New.
119 (concrete_past_the_end::concrete_past_the_end): Rename param
120 "byte_bound" to "bit_bound". Initialize m_byte_bound.
121 (concrete_past_the_end::subclass_equal_p): Update for renaming
122 of m_byte_bound to m_bit_bound.
123 (concrete_past_the_end::m_bit_bound): New field.
124 (concrete_buffer_overflow::concrete_buffer_overflow): Convert
125 param "range" from byte_range to bit_range. Rename param
126 "byte_bound" to "bit_bound".
127 (concrete_buffer_overflow::emit): Update for bits vs bytes.
128 (concrete_buffer_overflow::describe_final_event): Split
129 into...
130 (concrete_buffer_overflow::describe_final_event_as_bytes): ...this
131 (concrete_buffer_overflow::describe_final_event_as_bits): ...and
132 this.
133 (concrete_buffer_over_read::concrete_buffer_over_read): Convert
134 param "range" from byte_range to bit_range. Rename param
135 "byte_bound" to "bit_bound".
136 (concrete_buffer_over_read::emit): Update for bits vs bytes.
137 (concrete_buffer_over_read::describe_final_event): Split into...
138 (concrete_buffer_over_read::describe_final_event_as_bytes):
139 ...this
140 (concrete_buffer_over_read::describe_final_event_as_bits): ...and
141 this.
142 (concrete_buffer_underwrite::concrete_buffer_underwrite): Convert
143 param "range" from byte_range to bit_range.
144 (concrete_buffer_underwrite::describe_final_event): Split into...
145 (concrete_buffer_underwrite::describe_final_event_as_bytes):
146 ...this
147 (concrete_buffer_underwrite::describe_final_event_as_bits): ...and
148 this.
149 (concrete_buffer_under_read::concrete_buffer_under_read): Convert
150 param "range" from byte_range to bit_range.
151 (concrete_buffer_under_read::describe_final_event): Split into...
152 (concrete_buffer_under_read::describe_final_event_as_bytes):
153 ...this
154 (concrete_buffer_under_read::describe_final_event_as_bits): ...and
155 this.
156 (region_model::check_region_bounds): Use bits for concrete values,
157 and rename locals to indicate whether we're dealing with bits or
158 bytes. Specifically, replace "num_bytes_sval" with
159 "num_bits_sval", and get it from reg's "get_bit_size_sval".
160 Replace "num_bytes_tree" with "num_bits_tree". Rename "capacity"
161 to "byte_capacity". Rename "cst_capacity_tree" to
162 "cst_byte_capacity_tree". Replace "offset" and
163 "num_bytes_unsigned" with "bit_offset" and "num_bits_unsigned"
164 respectively, converting from byte_offset_t to bit_offset_t.
165 Replace "out" and "read_bytes" with "bits_outside" and "read_bits"
166 respectively, converting from byte_range to bit_range. Convert
167 "buffer" from byte_range to bit_range. Replace "byte_bound" with
168 "bit_bound".
169 * region.cc (region::get_bit_size_sval): New.
170 (offset_region::get_bit_offset): New.
171 (offset_region::get_bit_size_sval): New.
172 (sized_region::get_bit_size_sval): New.
173 (bit_range_region::get_bit_size_sval): New.
174 * region.h (region::get_bit_size_sval): New vfunc.
175 (offset_region::get_bit_offset): New decl.
176 (offset_region::get_bit_size_sval): New decl.
177 (sized_region::get_bit_size_sval): New decl.
178 (bit_range_region::get_bit_size_sval): New decl.
179 * store.cc (bit_range::intersects_p): New, based on
180 byte_range::intersects_p.
181 (bit_range::exceeds_p): New, based on byte_range::exceeds_p.
182 (bit_range::falls_short_of_p): New, based on
183 byte_range::falls_short_of_p.
184 (byte_range::intersects_p): Delete.
185 (byte_range::exceeds_p): Delete.
186 (byte_range::falls_short_of_p): Delete.
187 * store.h (bit_range::intersects_p): New overload.
188 (bit_range::exceeds_p): New.
189 (bit_range::falls_short_of_p): New.
190 (byte_range::intersects_p): Delete.
191 (byte_range::exceeds_p): Delete.
192 (byte_range::falls_short_of_p): Delete.
194 2023-12-14 David Malcolm <dmalcolm@redhat.com>
196 PR analyzer/112655
197 * infinite-loop.cc (infinite_loop::infinite_loop): Pass eedges
198 via rvalue reference rather than by value.
199 (starts_infinite_loop_p): Move eedges when constructing an
200 infinite_loop instance.
201 * sm-file.cc (fileptr_state_machine::fileptr_state_machine): Use
202 initializer list for states.
203 * sm-sensitive.cc
204 (sensitive_state_machine::sensitive_state_machine): Likewise.
205 * sm-signal.cc (signal_state_machine::signal_state_machine):
206 Likewise.
207 * sm-taint.cc (taint_state_machine::taint_state_machine):
208 Likewise.
209 * varargs.cc (va_list_state_machine::va_list_state_machine): Likewise.
211 2023-12-11 David Malcolm <dmalcolm@redhat.com>
213 PR analyzer/112955
214 * engine.cc (feasibility_state::feasibility_state): Initialize
215 m_snodes_visited.
217 2023-12-11 Andrew Pinski <apinski@marvell.com>
219 * region-model-manager.cc (maybe_undo_optimize_bit_field_compare): Remove
220 the check for type being unsigned_char_type_node.
222 2023-12-08 David Malcolm <dmalcolm@redhat.com>
224 * sm-taint.cc (taint_state_machine::alt_get_inherited_state): Fix
225 handling of TRUNC_MOD_EXPR.
227 2023-12-08 David Malcolm <dmalcolm@redhat.com>
229 * region-model.cc (contains_uninit_p): Only check for
230 svalues that the infoleak warning can handle.
232 2023-12-08 David Malcolm <dmalcolm@redhat.com>
234 PR analyzer/112889
235 * store.h (concrete_binding::concrete_binding): Strengthen
236 assertion to require size to be be positive, rather than just
237 non-zero.
238 (concrete_binding::mark_deleted): Use size rather than start bit
239 offset.
240 (concrete_binding::mark_empty): Likewise.
241 (concrete_binding::is_deleted): Likewise.
242 (concrete_binding::is_empty): Likewise.
244 2023-12-07 Alexandre Oliva <oliva@adacore.com>
246 * region-model.cc (has_nondefault_case_for_value_p): Take
247 enumerate type as a parameter.
248 (region_model::apply_constraints_for_gswitch): Cope with
249 integral promotion type casts.
251 2023-12-07 David Malcolm <dmalcolm@redhat.com>
253 PR analyzer/103546
254 PR analyzer/112850
255 * analyzer.opt (-param=analyzer-max-svalue-depth=): Increase from
256 12 to 18.
257 (Wanalyzer-symbol-too-complex): New.
258 * diagnostic-manager.cc
259 (null_assignment_sm_context::clear_all_per_svalue_state): New.
260 * engine.cc (impl_sm_context::clear_all_per_svalue_state): New.
261 * program-state.cc (sm_state_map::clear_all_per_svalue_state):
262 New.
263 * program-state.h (sm_state_map::clear_all_per_svalue_state): New
264 decl.
265 * region-model-manager.cc
266 (region_model_manager::reject_if_too_complex): Add
267 -Wanalyzer-symbol-too-complex.
268 * sm-taint.cc (taint_state_machine::on_condition): Handle
269 comparisons against UNKNOWN.
270 * sm.h (sm_context::clear_all_per_svalue_state): New.
272 2023-12-06 David Malcolm <dmalcolm@redhat.com>
274 * engine.cc (dump_analyzer_json): Use
275 flag_diagnostics_json_formatting.
277 2023-12-01 David Malcolm <dmalcolm@redhat.com>
279 * analyzer.h (class saved_diagnostic): New forward decl.
280 * bounds-checking.cc: Update for changes to
281 pending_diagnostic::emit.
282 * call-details.cc: Likewise.
283 * diagnostic-manager.cc: Include "diagnostic-format-sarif.h".
284 (saved_diagnostic::maybe_add_sarif_properties): New.
285 (class pending_diagnostic_metadata): New.
286 (diagnostic_manager::emit_saved_diagnostic): Create a
287 pending_diagnostic_metadata and a diagnostic_emission_context.
288 Pass the latter to the pending_diagnostic::emit vfunc.
289 * diagnostic-manager.h
290 (saved_diagnostic::maybe_add_sarif_properties): New decl.
291 * engine.cc: Update for changes to pending_diagnostic::emit.
292 * infinite-loop.cc: Likewise.
293 * infinite-recursion.cc: Likewise.
294 * kf-analyzer.cc: Likewise.
295 * kf.cc: Likewise.
296 * pending-diagnostic.cc
297 (diagnostic_emission_context::get_pending_diagnostic): New.
298 (diagnostic_emission_context::warn): New.
299 (diagnostic_emission_context::inform): New.
300 * pending-diagnostic.h (class diagnostic_emission_context): New.
301 (pending_diagnostic::emit): Update params.
302 (pending_diagnostic::maybe_add_sarif_properties): New vfunc.
303 * region.cc: Don't include "diagnostic-metadata.h".
304 * region-model.cc: Include "diagnostic-format-sarif.h". Update
305 for changes to pending_diagnostic::emit.
306 (exposure_through_uninit_copy::maybe_add_sarif_properties): New.
307 * sm-fd.cc: Update for changes to pending_diagnostic::emit.
308 * sm-file.cc: Likewise.
309 * sm-malloc.cc: Likewise.
310 * sm-pattern-test.cc: Likewise.
311 * sm-sensitive.cc: Likewise.
312 * sm-signal.cc: Likewise.
313 * sm-taint.cc: Likewise.
314 * store.cc: Don't include "diagnostic-metadata.h".
315 * varargs.cc: Update for changes to pending_diagnostic::emit.
317 2023-11-19 David Malcolm <dmalcolm@redhat.com>
319 * analyzer.h: Include "rich-location.h".
321 2023-11-19 David Malcolm <dmalcolm@redhat.com>
323 PR analyzer/107573
324 * analyzer.h (register_known_functions): Add region_model_manager
325 param.
326 * analyzer.opt (Wanalyzer-undefined-behavior-strtok): New.
327 * call-summary.cc
328 (call_summary_replay::convert_region_from_summary_1): Handle
329 RK_PRIVATE.
330 * engine.cc (impl_run_checkers): Pass model manager to
331 register_known_functions.
332 * kf.cc (class undefined_function_behavior): New.
333 (class kf_strtok): New.
334 (register_known_functions): Add region_model_manager param.
335 Use it to register "strtok".
336 * region-model-manager.cc
337 (region_model_manager::get_or_create_conjured_svalue): Add "idx"
338 param.
339 * region-model-manager.h
340 (region_model_manager::get_or_create_conjured_svalue): Add "idx"
341 param.
342 (region_model_manager::get_root_region): New accessor.
343 * region-model.cc (region_model::scan_for_null_terminator): Handle
344 "expr" being null.
345 (region_model::get_representative_path_var_1): Handle RK_PRIVATE.
346 * region-model.h (region_model::called_from_main_p): Make public.
347 * region.cc (region::get_memory_space): Handle RK_PRIVATE.
348 (region::can_have_initial_svalue_p): Handle MEMSPACE_PRIVATE.
349 (private_region::dump_to_pp): New.
350 * region.h (MEMSPACE_PRIVATE): New.
351 (RK_PRIVATE): New.
352 (class private_region): New.
353 (is_a_helper <const private_region *>::test): New.
354 * store.cc (store::replay_call_summary_cluster): Handle
355 RK_PRIVATE.
356 * svalue.h (struct conjured_svalue::key_t): Add "idx" param to
357 ctor and "m_idx" field.
358 (class conjured_svalue::conjured_svalue): Likewise.
360 2023-11-18 David Malcolm <dmalcolm@redhat.com>
362 PR analyzer/106147
363 * analyzer.opt (Wanalyzer-infinite-loop): New option.
364 (fdump-analyzer-infinite-loop): New option.
365 * checker-event.h (start_cfg_edge_event::get_desc): Drop "final".
366 (start_cfg_edge_event::maybe_describe_condition): Convert from
367 private to protected.
368 * checker-path.h (checker_path::get_logger): New.
369 * diagnostic-manager.cc (process_worklist_item): Update for
370 new context param of maybe_update_for_edge.
371 * engine.cc
372 (impl_region_model_context::impl_region_model_context): Add
373 out_could_have_done_work param to both ctors and use it to
374 initialize mm_out_could_have_done_work.
375 (impl_region_model_context::maybe_did_work): New vfunc
376 implementation.
377 (exploded_node::on_stmt): Add out_could_have_done_work param and
378 pass to ctxt ctor.
379 (exploded_node::on_stmt_pre): Treat setjmp and longjmp as "doing
380 work".
381 (exploded_node::on_longjmp): Likewise.
382 (exploded_edge::exploded_edge): Add "could_do_work" param and use
383 it to initialize m_could_do_work_p.
384 (exploded_edge::dump_dot_label): Add result of could_do_work_p.
385 (exploded_graph::add_function_entry): Mark edge as doing no work.
386 (exploded_graph::add_edge): Add "could_do_work" param and pass to
387 exploded_edge ctor.
388 (add_tainted_args_callback): Treat as doing no work.
389 (exploded_graph::process_worklist): Likewise when merging nodes.
390 (maybe_process_run_of_before_supernode_enodes::item): Likewise.
391 (exploded_graph::maybe_create_dynamic_call): Likewise.
392 (exploded_graph::process_node): Likewise for phi nodes.
393 Pass in a "could_have_done_work" bool when handling stmts and use
394 when creating edges. Assume work is done at bifurcation.
395 (exploded_path::feasible_p): Update for new context param of
396 maybe_update_for_edge.
397 (feasibility_state::feasibility_state): New ctor.
398 (feasibility_state::operator=): New.
399 (feasibility_state::maybe_update_for_edge): Add ctxt param and use
400 it. Fix missing newline when logging state.
401 (impl_run_checkers): Call exploded_graph::detect_infinite_loops.
402 * exploded-graph.h
403 (impl_region_model_context::impl_region_model_context): Add
404 out_could_have_done_work param to both ctors.
405 (impl_region_model_context::maybe_did_work): New decl.
406 (impl_region_model_context::checking_for_infinite_loop_p): New.
407 (impl_region_model_context::on_unusable_in_infinite_loop): New.
408 (impl_region_model_context::m_out_could_have_done_work): New
409 field.
410 (exploded_node::on_stmt): Add "out_could_have_done_work" param.
411 (exploded_edge::exploded_edge): Add "could_do_work" param.
412 (exploded_edge::could_do_work_p): New accessor.
413 (exploded_edge::m_could_do_work_p): New field.
414 (exploded_graph::add_edge): Add "could_do_work" param.
415 (exploded_graph::detect_infinite_loops): New decl.
416 (feasibility_state::feasibility_state): New ctor.
417 (feasibility_state::operator=): New decl.
418 (feasibility_state::maybe_update_for_edge): Add ctxt param.
419 * infinite-loop.cc: New file.
420 * program-state.cc (program_state::on_edge): Log the rejected
421 constraint when region_model::maybe_update_for_edge fails.
422 * region-model.cc (region_model::on_assignment): Treat any writes
423 other than to the stack as "doing work".
424 (region_model::on_stmt_pre): Treat all asm stmts as "doing work".
425 (region_model::on_call_post): Likewise for all calls to functions
426 with unknown side effects.
427 (region_model::handle_phi): Add svals_changing_meaning param.
428 Mark widening svalue in phi nodes as changing meaning.
429 (unusable_in_infinite_loop_constraint_p): New.
430 (region_model::add_constraint): If we're checking for an infinite
431 loop, bail out on unusable svalues, or if we don't have a definite
432 true/false for the constraint.
433 (region_model::update_for_phis): Gather all svalues changing
434 meaning in phi nodes, and purge constraints involving them.
435 (region_model::replay_call_summary): Treat all call summaries as
436 doing work.
437 (region_model::can_merge_with_p): Purge constraints involving
438 svalues that change meaning.
439 (model_merger::on_widening_reuse): New.
440 (test_iteration_1): Likewise.
441 (selftest::test_iteration_1): Remove assertion that model6 "knows"
442 that i < 157.
443 * region-model.h (region_model::handle_phi): Add
444 svals_changing_meaning param
445 (region_model_context::maybe_did_work): New pure virtual func.
446 (region_model_context::checking_for_infinite_loop_p): Likewise.
447 (region_model_context::on_unusable_in_infinite_loop): Likewise.
448 (noop_region_model_context::maybe_did_work): Implement.
449 (noop_region_model_context::checking_for_infinite_loop_p):
450 Likewise.
451 (noop_region_model_context::on_unusable_in_infinite_loop):
452 Likewise.
453 (region_model_context_decorator::maybe_did_work): Implement.
454 (region_model_context_decorator::checking_for_infinite_loop_p):
455 Likewise.
456 (region_model_context_decorator::on_unusable_in_infinite_loop):
457 Likewise.
458 (model_merger::on_widening_reuse): New decl.
459 (model_merger::m_svals_changing_meaning): New field.
460 * sm-signal.cc (register_signal_handler::impl_transition): Assume
461 the edge "does work".
462 * supergraph.cc (supernode::get_start_location): Use CFG edge's
463 goto_locus if available.
464 (supernode::get_end_location): Likewise.
465 (cfg_superedge::dump_label_to_pp): Dump edges with a "goto_locus"
466 * supergraph.h (cfg_superedge::get_goto_locus): New.
467 * svalue.cc (svalue::can_merge_p): Call on_widening_reuse for
468 widening values.
469 (involvement_visitor::visit_widening_svalue): New.
470 (svalue::involves_p): Update assertion to allow widening svalues.
472 2023-11-14 David Malcolm <dmalcolm@redhat.com>
474 PR analyzer/103533
475 * sm-taint.cc: Remove "experimental" from comment.
476 * sm.cc (make_checkers): Always add taint state machine.
478 2023-11-04 David Malcolm <dmalcolm@redhat.com>
480 * bounds-checking.cc: Update for changes to diagnostic_context.
482 2023-11-02 David Malcolm <dmalcolm@redhat.com>
484 PR analyzer/112317
485 * access-diagram.cc (class x_aligned_x_ruler_widget): Eliminate
486 unused field "m_col_widths".
487 (access_diagram_impl::add_valid_vs_invalid_ruler): Update for
488 above change.
489 * region-model.cc
490 (check_one_function_attr_null_terminated_string_arg): Remove
491 unused variables "cd_unchecked", "strlen_sval", and
492 "limited_sval".
493 * region-model.h (region_model_context_decorator::warn): Add
494 missing "override".
496 2023-10-31 David Malcolm <dmalcolm@redhat.com>
498 * record-layout.cc: New file, based on material in region-model.cc.
499 * record-layout.h: Likewise.
500 * region-model.cc: Include "analyzer/record-layout.h".
501 (class record_layout): Move to record-layout.cc and .h
503 2023-10-26 David Malcolm <dmalcolm@redhat.com>
505 * region-model.cc
506 (region_model::check_external_function_for_access_attr): Split
507 out, replacing with...
508 (region_model::check_function_attr_access): ...this new function
509 and...
510 (region_model::check_function_attrs): ...this new function.
511 (region_model::check_one_function_attr_null_terminated_string_arg):
512 New.
513 (region_model::check_function_attr_null_terminated_string_arg):
514 New.
515 (region_model::handle_unrecognized_call): Update for renaming of
516 check_external_function_for_access_attr to check_function_attrs.
517 (region_model::check_for_null_terminated_string_arg): Add return
518 value to one overload. Make both overloads const.
519 * region-model.h: Include "stringpool.h" and "attribs.h".
520 (region_model::check_for_null_terminated_string_arg): Add return
521 value to one overload. Make both overloads const.
522 (region_model::check_external_function_for_access_attr): Delete
523 decl.
524 (region_model::check_function_attr_access): New decl.
525 (region_model::check_function_attr_null_terminated_string_arg):
526 New decl.
527 (region_model::check_one_function_attr_null_terminated_string_arg):
528 New decl.
529 (region_model::check_function_attrs): New decl.
531 2023-10-09 David Malcolm <dmalcolm@redhat.com>
533 * access-diagram.cc (boundaries::add): Explicitly state
534 "boundaries::" scope for "kind" enum.
536 2023-10-08 David Malcolm <dmalcolm@redhat.com>
538 PR analyzer/111155
539 * access-diagram.cc (boundaries::boundaries): Add logger param
540 (boundaries::add): Add logging.
541 (boundaries::get_hard_boundaries_in_range): New.
542 (boundaries::m_logger): New field.
543 (boundaries::get_table_x_for_offset): Make public.
544 (class svalue_spatial_item): New.
545 (class compound_svalue_spatial_item): New.
546 (add_ellipsis_to_gaps): New.
547 (valid_region_spatial_item::valid_region_spatial_item): Add theme
548 param. Initialize m_boundaries, m_existing_sval, and
549 m_existing_sval_spatial_item.
550 (valid_region_spatial_item::add_boundaries): Set m_boundaries.
551 Add boundaries for any m_existing_sval_spatial_item.
552 (valid_region_spatial_item::add_array_elements_to_table): Rewrite
553 creation of min/max index in terms of
554 maybe_add_array_index_to_table. Rewrite ellipsis code using
555 add_ellipsis_to_gaps. Add index values for any hard boundaries
556 within the valid region.
557 (valid_region_spatial_item::maybe_add_array_index_to_table): New,
558 based on code formerly in add_array_elements_to_table.
559 (valid_region_spatial_item::make_table): Make use of
560 m_existing_sval_spatial_item, if any.
561 (valid_region_spatial_item::m_boundaries): New field.
562 (valid_region_spatial_item::m_existing_sval): New field.
563 (valid_region_spatial_item::m_existing_sval_spatial_item): New
564 field.
565 (class svalue_spatial_item): Rename to...
566 (class written_svalue_spatial_item): ...this.
567 (class string_region_spatial_item): Rename to..
568 (class string_literal_spatial_item): ...this. Add "kind".
569 (string_literal_spatial_item::add_boundaries): Use m_kind to
570 determine kind of boundary. Update for renaming of m_actual_bits
571 to m_bits.
572 (string_literal_spatial_item::make_table): Likewise. Support not
573 displaying a row for byte indexes, and not displaying a row for
574 the type.
575 (string_literal_spatial_item::add_column_for_byte): Make byte index
576 row optional.
577 (svalue_spatial_item::make): Convert to...
578 (make_written_svalue_spatial_item): ...this.
579 (make_existing_svalue_spatial_item): New.
580 (access_diagram_impl::access_diagram_impl): Pass theme to
581 m_valid_region_spatial_item ctor. Update for renaming of
582 m_svalue_spatial_item.
583 (access_diagram_impl::find_boundaries): Pass logger to boundaries.
584 Update for renaming of...
585 (access_diagram_impl::m_svalue_spatial_item): Rename to...
586 (access_diagram_impl::m_written_svalue_spatial_item): ...this.
588 2023-10-03 David Malcolm <dmalcolm@redhat.com>
590 * analyzer-logging.cc (logger::log_va_partial): Use text_info
591 ctor.
592 * analyzer.cc (make_label_text): Likewise.
593 (make_label_text_n): Likewise.
594 * pending-diagnostic.cc (evdesc::event_desc::formatted_print):
595 Likewise.
597 2023-10-02 David Malcolm <dmalcolm@redhat.com>
599 * program-point.cc: Update for grouping of source printing fields
600 within diagnostic_context.
602 2023-09-15 David Malcolm <dmalcolm@redhat.com>
604 * analyzer.cc (get_stmt_location): Handle null stmt.
605 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic): Copy
606 m_loc from ploc.
607 (saved_diagnostic::operator==): Compare m_loc.
608 (saved_diagnostic::calc_best_epath): Only use m_stmt_finder if
609 m_loc is unknown.
610 (dedupe_key::dedupe_key): Initialize m_loc.
611 (dedupe_key::operator==): Compare m_loc.
612 (dedupe_key::get_location): Use m_loc if it's known.
613 (dedupe_key::m_loc): New field.
614 (diagnostic_manager::emit_saved_diagnostic): Only call
615 get_emission_location if m_loc is unknown, preferring to use m_loc
616 if it's available.
617 * diagnostic-manager.h (saved_diagnostic::m_loc): New field.
618 (pending_location::pending_location): Initialize m_loc. Add
619 overload taking a location_t rather than a stmt/stmt_finder.
620 (pending_location::m_loc): New field.
622 2023-09-15 David Malcolm <dmalcolm@redhat.com>
624 * analyzer.h (struct pending_location): New forward decl.
625 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
626 Replace params "enode", "snode", "stmt", and "stmt_finder" with
627 "ploc".
628 (diagnostic_manager::add_diagnostic): Likewise for both overloads.
629 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic):
630 Likewise.
631 (struct pending_location): New.
632 (diagnostic_manager::add_diagnostic): Replace params "enode",
633 "snode", "stmt", and "stmt_finder" with "ploc".
634 * engine.cc (impl_region_model_context::warn): Update call to
635 add_diagnostic for above change.
636 (impl_sm_context::warn): Likewise.
637 (impl_region_model_context::on_state_leak): Likewise.
638 * infinite-recursion.cc
639 (exploded_graph::detect_infinite_recursion): Likewise.
641 2023-09-15 David Malcolm <dmalcolm@redhat.com>
643 * region-model.cc (region_model::get_gassign_result): Handle
644 volatile ops by using a conjured_svalue.
646 2023-09-14 David Malcolm <dmalcolm@redhat.com>
648 * checker-event.h (checker_event::get_thread_id): New.
649 * checker-path.h (class checker_path): Implement thread-related
650 vfuncs via a single simple_diagnostic_thread instance named
651 "main".
653 2023-09-14 David Malcolm <dmalcolm@redhat.com>
655 * diagnostic-manager.cc (compatible_epath_p): Fix missing return.
657 2023-09-14 David Malcolm <dmalcolm@redhat.com>
659 * diagnostic-manager.cc (process_worklist_item): Use
660 std::unique_ptr rather than plain rejected_constraint *.
661 * engine.cc (exploded_path::feasible_p): Likewise.
662 (feasibility_state::maybe_update_for_edge): Likewise.
663 * exploded-graph.h (feasibility_problem::feasibility_problem):
664 Likewise.
665 (feasibility_problem::~feasibility_problem): Delete.
666 (feasibility_problem::m_rc): Use std::unique_ptr.
667 (feasibility_state::maybe_update_for_edge): Likewise.
668 * feasible-graph.cc (feasible_graph::add_feasibility_problem):
669 Likewise.
670 * feasible-graph.h (class infeasible_node): Likewise.
671 (feasible_graph::add_feasibility_problem): Likewise.
672 * region-model.cc (region_model::add_constraint): Likewise.
673 (region_model::maybe_update_for_edge): Likewise.
674 (region_model::apply_constraints_for_gcond): Likewise.
675 (region_model::apply_constraints_for_gswitch): Likewise.
676 (region_model::apply_constraints_for_exception): Likewise.
677 * region-model.h (class region_model): Likewise for decls.
679 2023-09-09 benjamin priour <vultkayn@gcc.gnu.org>
681 PR analyzer/96395
682 * region-model.cc
683 (region_model::add_constraints_from_binop): binop_svalues around
684 LT_EXPR, LE_EXPR, GT_EXPR, GE_EXPR are now unwrapped.
686 2023-09-07 David Malcolm <dmalcolm@redhat.com>
688 PR analyzer/110529
689 * program-point.cc (program_point::on_edge): Don't reject
690 EDGE_ABNORMAL for computed gotos.
691 * region-model.cc (region_model::maybe_update_for_edge): Handle
692 computed goto statements.
693 (region_model::apply_constraints_for_ggoto): New.
694 * region-model.h (region_model::apply_constraints_for_ggoto): New decl.
695 * supergraph.cc (supernode::get_label): New.
696 * supergraph.h (supernode::get_label): New decl.
698 2023-09-07 benjamin priour <vultkayn@gcc.gnu.org>
699 David Malcolm <dmalcolm@redhat.com>
701 PR analyzer/110830
702 * diagnostic-manager.cc
703 (compatible_epaths_p): New function.
704 (saved_diagnostic::supercedes_p): Now calls the above
705 to determine if the diagnostics do overlap and the superseding
706 may proceed.
708 2023-09-07 David Malcolm <dmalcolm@redhat.com>
710 * region-model.h: fix -Wunused-parameter warnings
712 2023-09-06 David Malcolm <dmalcolm@redhat.com>
714 PR analyzer/105899
715 * kf.cc (class kf_strstr): New.
716 (kf_strstr::impl_call_post): New.
717 (register_known_functions): Register it.
719 2023-09-06 David Malcolm <dmalcolm@redhat.com>
721 PR analyzer/105899
722 * kf.cc (class kf_strncpy): New.
723 (kf_strncpy::impl_call_post): New.
724 (register_known_functions): Register it.
725 * region-model.cc (region_model::read_bytes): Handle unknown
726 number of bytes.
728 2023-09-06 David Malcolm <dmalcolm@redhat.com>
730 * kf.cc (kf_calloc::impl_call_pre): Pass ctxt to zero_fill_region.
731 (kf_memset::impl_call_pre): Move responsibility for calling
732 check_region_for_write to fill_region.
733 * region-model.cc (region_model::on_assignment): Pass ctxt to
734 zero_fill_region.
735 (region_model::fill_region): Add "ctxt" param, using it to call
736 check_region_for_write.
737 (region_model::zero_fill_region): Likewise.
738 * region-model.h (region_model::fill_region): Add "ctxt" param.
739 (region_model::zero_fill_region): Likewise.
741 2023-09-01 benjamin priour <priour.be@gmail.com>
743 PR analyzer/105948
744 PR analyzer/94355
745 * analyzer.h (is_placement_new_p): New declaration.
746 * call-details.cc
747 (call_details::deref_ptr_arg): New function.
748 Dereference the argument at given index if possible.
749 * call-details.h: Declaration of the above function.
750 * kf-lang-cp.cc (is_placement_new_p): Returns true if the gcall
751 is recognized as a placement new.
752 (kf_operator_delete::impl_call_post): Unbinding a region and its
753 descendents now poisons with POISON_KIND_DELETED.
754 (register_known_functions_lang_cp): Known function "operator
755 delete" is now registered only once independently of its number of
756 arguments.
757 * region-model.cc (region_model::eval_condition): Now
758 recursively calls itself if any of the operand is wrapped in a
759 cast.
760 * sm-malloc.cc (malloc_state_machine::on_stmt):
761 Add placement new recognition.
762 * svalue.cc (poison_kind_to_str): Wording for the new PK.
763 * svalue.h (enum poison_kind): Add value POISON_KIND_DELETED.
765 2023-08-31 Francois-Xavier Coudert <fxcoudert@gcc.gnu.org>
767 * kf.cc: Change spelling to macOS.
769 2023-08-30 Eric Feng <ef2648@columbia.edu>
771 PR analyzer/107646
772 * engine.cc (impl_region_model_context::warn): New optional
773 parameter.
774 * exploded-graph.h (class impl_region_model_context): Likewise.
775 * region-model.cc (region_model::pop_frame): New callback
776 feature for region_model::pop_frame.
777 * region-model.h (struct append_regions_cb_data): Likewise.
778 (class region_model): Likewise.
779 (class region_model_context): New optional parameter.
780 (class region_model_context_decorator): Likewise.
782 2023-08-30 Francois-Xavier Coudert <fxcoudert@gcc.gnu.org>
784 * region-model.cc: Define INCLUDE_ALGORITHM.
786 2023-08-29 David Malcolm <dmalcolm@redhat.com>
788 PR analyzer/99860
789 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
790 selftest::analyzer_ranges_cc_tests.
791 * analyzer-selftests.h (selftest::run_analyzer_selftests): New
792 decl.
793 * analyzer.opt (Wanalyzer-overlapping-buffers): New option.
794 * call-details.cc: Include "analyzer/ranges.h" and "make-unique.h".
795 (class overlapping_buffers): New.
796 (call_details::complain_about_overlap): New.
797 * call-details.h (call_details::complain_about_overlap): New decl.
798 * kf.cc (kf_memcpy_memmove::impl_call_pre): Call
799 cd.complain_about_overlap for memcpy and memcpy_chk.
800 (kf_strcat::impl_call_pre): Call cd.complain_about_overlap.
801 (kf_strcpy::impl_call_pre): Likewise.
802 * ranges.cc: New file.
803 * ranges.h: New file.
805 2023-08-29 David Malcolm <dmalcolm@redhat.com>
807 PR analyzer/105899
808 * kf.cc (kf_strdup::impl_call_pre): Set size of
809 dynamically-allocated buffer. Simulate copying the string from
810 the source region to the new buffer.
812 2023-08-27 benjamin priour <vultkayn@gcc.gnu.org>
814 PR analyzer/96395
815 * analyzer.h (class known_function): Add virtual casts
816 to builtin_known_function.
817 (class builtin_known_function): New subclass of known_function
818 for builtins.
819 * kf.cc (class kf_alloca): Now derived from
820 builtin_known_function.
821 (class kf_calloc): Likewise.
822 (class kf_free): Likewise.
823 (class kf_malloc): Likewise.
824 (class kf_memcpy_memmove): Likewise.
825 (class kf_memset): Likewise.
826 (class kf_realloc): Likewise.
827 (class kf_strchr): Likewise.
828 (class kf_sprintf): Likewise.
829 (class kf_strcat): Likewise.
830 (class kf_strcpy): Likewise.
831 (class kf_strdup): Likewise.
832 (class kf_strlen): Likewise.
833 (class kf_strndup): Likewise.
834 (register_known_functions): Builtins are now registered as
835 known_functions by name rather than by their BUILTIN_CODE.
836 * known-function-manager.cc (get_normal_builtin): New overload.
837 * known-function-manager.h: New overload declaration.
838 * region-model.cc (region_model::get_builtin_kf): New function.
839 * region-model.h (class region_model): Add declaration of
840 get_builtin_kf.
841 * sm-fd.cc: For called recognized as builtins, use the
842 attributes of that builtin as defined in gcc/builtins.def
843 rather than the user's.
844 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
846 2023-08-25 David Malcolm <dmalcolm@redhat.com>
848 * access-diagram.cc (class string_region_spatial_item): Remove
849 assumption that the string is written to the start of the cluster.
851 2023-08-24 David Malcolm <dmalcolm@redhat.com>
853 PR analyzer/105899
854 * call-details.cc
855 (call_details::check_for_null_terminated_string_arg): Split into
856 overloads, one taking just an arg_idx, the other a new
857 "include_terminator" param.
858 * call-details.h: Likewise.
859 * kf.cc (class kf_strcat): New.
860 (kf_strcpy::impl_call_pre): Update for change to
861 check_for_null_terminated_string_arg.
862 (register_known_functions): Register kf_strcat.
863 * region-model.cc
864 (region_model::check_for_null_terminated_string_arg): Split into
865 overloads, one taking just an arg_idx, the other a new
866 "include_terminator" param. When returning an svalue, handle
867 "include_terminator" being false by subtracting one.
868 * region-model.h
869 (region_model::check_for_null_terminated_string_arg): Split into
870 overloads, one taking just an arg_idx, the other a new
871 "include_terminator" param.
873 2023-08-24 David Malcolm <dmalcolm@redhat.com>
875 PR analyzer/105899
876 * region-model.cc (fragment::has_null_terminator): Handle
877 SK_BITS_WITHIN.
879 2023-08-24 David Malcolm <dmalcolm@redhat.com>
881 PR analyzer/105899
882 * region-model-manager.cc
883 (region_model_manager::get_or_create_initial_value): Simplify
884 INIT_VAL(ELEMENT_REG(STRING_REG), CONSTANT_SVAL) to
885 CONSTANT_SVAL(STRING[N]).
887 2023-08-24 David Malcolm <dmalcolm@redhat.com>
889 PR analyzer/105899
890 * region-model.cc (fragment::has_null_terminator): Move STRING_CST
891 handling to fragment::string_cst_has_null_terminator; also use it to
892 handle INIT_VAL(STRING_REG).
893 (fragment::string_cst_has_null_terminator): New, from above.
895 2023-08-24 David Malcolm <dmalcolm@redhat.com>
897 * kf.cc (kf_memcpy_memmove::impl_call_pre): Reimplement using
898 region_model::copy_bytes.
899 * region-model.cc (region_model::read_bytes): New.
900 (region_model::copy_bytes): New.
901 * region-model.h (region_model::read_bytes): New decl.
902 (region_model::copy_bytes): New decl.
904 2023-08-24 David Malcolm <dmalcolm@redhat.com>
906 PR analyzer/105899
907 * region-model.cc (region_model::get_string_size): Delete both.
908 * region-model.h (region_model::get_string_size): Delete both
909 decls.
911 2023-08-24 David Malcolm <dmalcolm@redhat.com>
913 PR analyzer/105899
914 * kf.cc (kf_strcpy::impl_call_pre): Reimplement using
915 check_for_null_terminated_string_arg.
916 * region-model.cc (region_model::get_store_bytes): Shortcut
917 reading all of a string_region.
918 (region_model::scan_for_null_terminator): Use get_store_value for
919 the bytes rather than "unknown" when returning an unknown length.
920 (region_model::write_bytes): New.
921 * region-model.h (region_model::write_bytes): New decl.
923 2023-08-24 David Malcolm <dmalcolm@redhat.com>
925 PR analyzer/105899
926 * region-model.cc (iterable_cluster::iterable_cluster): Add
927 symbolic binding keys to m_symbolic_bindings.
928 (iterable_cluster::has_symbolic_bindings_p): New.
929 (iterable_cluster::m_symbolic_bindings): New field.
930 (region_model::scan_for_null_terminator): Treat clusters with
931 symbolic bindings as having unknown strlen.
933 2023-08-24 David Malcolm <dmalcolm@redhat.com>
935 * engine.cc (impl_path_context::impl_path_context): Add logger
936 param.
937 (impl_path_context::bifurcate): Add log message.
938 (impl_path_context::terminate_path): Likewise.
939 (impl_path_context::m_logger): New field.
940 (exploded_graph::process_node): Pass logger to path_ctxt ctor.
942 2023-08-22 David Malcolm <dmalcolm@redhat.com>
944 PR analyzer/105899
945 * kf-analyzer.cc (class kf_analyzer_get_strlen): Move to kf.cc.
946 (register_known_analyzer_functions): Use make_kf_strlen.
947 * kf.cc (class kf_strlen::impl_call_pre): Replace with
948 implementation of kf_analyzer_get_strlen from kf-analyzer.cc.
949 Handle "UNKNOWN" return from check_for_null_terminated_string_arg
950 by falling back to a conjured svalue.
951 (make_kf_strlen): New.
952 (register_known_functions): Use make_kf_strlen.
953 * known-function-manager.h (make_kf_strlen): New decl.
955 2023-08-22 David Malcolm <dmalcolm@redhat.com>
957 PR analyzer/105899
958 * call-details.cc (call_details::call_details): New ctor.
959 * call-details.h (call_details::call_details): New ctor decl.
960 (struct call_arg_details): Move here from region-model.cc.
961 * region-model.cc (region_model::check_call_format_attr): New.
962 (region_model::check_call_args): Call it.
963 (struct call_arg_details): Move it to call-details.h.
964 * region-model.h (region_model::check_call_format_attr): New decl.
966 2023-08-22 David Malcolm <dmalcolm@redhat.com>
968 * kf.cc (class kf_fopen): New.
969 (register_known_functions): Register it.
971 2023-08-22 David Malcolm <dmalcolm@redhat.com>
973 PR analyzer/105899
974 * analyzer.opt (Wanalyzer-unterminated-string): Delete.
975 * call-details.cc
976 (call_details::check_for_null_terminated_string_arg): Convert
977 return type from void to const svalue *. Add param "out_sval".
978 * call-details.h
979 (call_details::check_for_null_terminated_string_arg): Likewise.
980 * kf-analyzer.cc (kf_analyzer_get_strlen::impl_call_pre): Wire up
981 to result of check_for_null_terminated_string_arg.
982 * region-model.cc (get_strlen): Delete.
983 (class unterminated_string_arg): Delete.
984 (struct fragment): New.
985 (class iterable_cluster): New.
986 (region_model::get_store_bytes): New.
987 (get_tree_for_byte_offset): New.
988 (region_model::scan_for_null_terminator): New.
989 (region_model::check_for_null_terminated_string_arg): Convert
990 return type from void to const svalue *. Add param "out_sval".
991 Reimplement in terms of scan_for_null_terminator, dropping the
992 special-case for -Wanalyzer-unterminated-string.
993 * region-model.h (region_model::get_store_bytes): New decl.
994 (region_model::scan_for_null_terminator): New decl.
995 (region_model::check_for_null_terminated_string_arg): Convert
996 return type from void to const svalue *. Add param "out_sval".
997 * store.cc (concrete_binding::get_byte_range): New.
998 * store.h (concrete_binding::get_byte_range): New decl.
999 (store_manager::get_concrete_binding): New overload.
1001 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1003 * region-model.cc (region_model_context_decorator::add_event):
1004 Handle m_inner being NULL.
1005 * region-model.h (class region_model_context_decorator): Likewise.
1006 (annotating_context::warn): Likewise.
1008 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1010 * diagnostic-manager.cc (saved_diagnostic::add_event): New.
1011 (saved_diagnostic::add_any_saved_events): New.
1012 (diagnostic_manager::add_event): New.
1013 (dedupe_winners::emit_best): New.
1014 (diagnostic_manager::emit_saved_diagnostic): Make "sd" param
1015 non-const. Call saved_diagnostic::add_any_saved_events.
1016 * diagnostic-manager.h (saved_diagnostic::add_event): New decl.
1017 (saved_diagnostic::add_any_saved_events): New decl.
1018 (saved_diagnostic::m_saved_events): New field.
1019 (diagnostic_manager::add_event): New decl.
1020 (diagnostic_manager::emit_saved_diagnostic): Make "sd" param
1021 non-const.
1022 * engine.cc (impl_region_model_context::add_event): New.
1023 * exploded-graph.h (impl_region_model_context::add_event): New decl.
1024 * region-model.cc
1025 (noop_region_model_context::add_event): New.
1026 (region_model_context_decorator::add_event): New.
1027 * region-model.h (region_model_context::add_event): New vfunc.
1028 (noop_region_model_context::add_event): New decl.
1029 (region_model_context_decorator::add_event): New decl.
1031 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1033 * region-model.cc
1034 (class check_external_function_for_access_attr::annotating_ctxt):
1035 Convert to an annotating_context.
1036 * region-model.h (class note_adding_context): Rename to...
1037 (class annotating_context): ...this, updating the "warn" method.
1038 (note_adding_context::make_note): Replace with...
1039 (annotating_context::add_annotations): ...this.
1041 2023-08-14 benjamin priour <vultkayn@gcc.gnu.org>
1043 PR analyzer/110543
1044 * analyzer.opt: Add new option.
1045 * diagnostic-manager.cc
1046 (diagnostic_manager::prune_path): Call prune_system_headers.
1047 (prune_frame): New function that deletes all events in a frame.
1048 (diagnostic_manager::prune_system_headers): New function.
1049 * diagnostic-manager.h: Add prune_system_headers declaration.
1051 2023-08-11 David Malcolm <dmalcolm@redhat.com>
1053 PR analyzer/105899
1054 * analyzer.opt (Wanalyzer-unterminated-string): New.
1055 * call-details.cc
1056 (call_details::check_for_null_terminated_string_arg): New.
1057 * call-details.h
1058 (call_details::check_for_null_terminated_string_arg): New decl.
1059 * kf-analyzer.cc (class kf_analyzer_get_strlen): New.
1060 (register_known_analyzer_functions): Register it.
1061 * kf.cc (kf_error::impl_call_pre): Check that format arg is a
1062 valid null-terminated string.
1063 (kf_putenv::impl_call_pre): Likewise for the sole param.
1064 (kf_strchr::impl_call_pre): Likewise for the first param.
1065 (kf_strcpy::impl_call_pre): Likewise for the second param.
1066 (kf_strdup::impl_call_pre): Likewise for the sole param.
1067 * region-model.cc (get_strlen): New.
1068 (struct call_arg_details): New.
1069 (inform_about_expected_null_terminated_string_arg): New.
1070 (class unterminated_string_arg): New.
1071 (region_model::check_for_null_terminated_string_arg): New.
1072 * region-model.h
1073 (region_model::check_for_null_terminated_string_arg): New decl.
1075 2023-08-11 Eric Feng <ef2648@columbia.edu>
1077 PR analyzer/107646
1078 * call-details.h: New function.
1079 * region-model.cc (region_model::get_or_create_region_for_heap_alloc):
1080 New optional parameters.
1081 * region-model.h (class region_model): New optional parameters.
1082 * sm-malloc.cc (on_realloc_with_move): New function.
1083 (region_model::transition_ptr_sval_non_null): New function.
1085 2023-08-09 David Malcolm <dmalcolm@redhat.com>
1087 * analyzer.h (class pure_known_function_with_default_return): New
1088 subclass.
1089 * call-details.cc (const_fn_p): Move here from region-model.cc.
1090 (maybe_get_const_fn_result): Likewise.
1091 (get_result_size_in_bytes): Likewise.
1092 (call_details::set_any_lhs_with_defaults): New function, based on
1093 code in region_model::on_call_pre.
1094 * call-details.h (call_details::set_any_lhs_with_defaults): New
1095 decl.
1096 * diagnostic-manager.cc
1097 (diagnostic_manager::emit_saved_diagnostic): Log the index of the
1098 saved_diagnostic.
1099 * kf.cc (pure_known_function_with_default_return::impl_call_pre):
1100 New.
1101 (kf_memset::impl_call_pre): Set the LHS to the first param.
1102 (kf_putenv::impl_call_pre): Call cd.set_any_lhs_with_defaults.
1103 (kf_sprintf::impl_call_pre): Call cd.set_any_lhs_with_defaults.
1104 (class kf_stack_restore): Derive from
1105 pure_known_function_with_default_return.
1106 (class kf_stack_save): Likewise.
1107 (kf_strlen::impl_call_pre): Call cd.set_any_lhs_with_defaults.
1108 * region-model-reachability.cc (reachable_regions::handle_sval):
1109 Remove logic for symbolic regions for pointers.
1110 * region-model.cc (region_model::canonicalize): Remove purging of
1111 dynamic extents workaround for surplus values from
1112 region_model::on_call_pre's default LHS code.
1113 (const_fn_p): Move to call-details.cc.
1114 (maybe_get_const_fn_result): Likewise.
1115 (get_result_size_in_bytes): Likewise.
1116 (region_model::update_for_nonzero_return): Call
1117 cd.set_any_lhs_with_defaults.
1118 (region_model::on_call_pre): Remove the assignment to the LHS of a
1119 default return value, instead requiring all known_function
1120 implementations to write to any LHS of the call. Use
1121 cd.set_any_lhs_with_defaults on the non-kf paths.
1122 * sm-fd.cc (kf_socket::outcome_of_socket::update_model): Use
1123 cd.set_any_lhs_with_defaults when failing to get at fd state.
1124 (kf_bind::outcome_of_bind::update_model): Likewise.
1125 (kf_listen::outcome_of_listen::update_model): Likewise.
1126 (kf_accept::outcome_of_accept::update_model): Likewise.
1127 (kf_connect::outcome_of_connect::update_model): Likewise.
1128 (kf_read::impl_call_pre): Use cd.set_any_lhs_with_defaults.
1129 * sm-file.cc (class kf_stdio_output_fn): Derive from
1130 pure_known_function_with_default_return.
1131 (class kf_ferror): Likewise.
1132 (class kf_fileno): Likewise.
1133 (kf_fgets::impl_call_pre): Use cd.set_any_lhs_with_defaults.
1134 (kf_read::impl_call_pre): Likewise.
1135 (class kf_getc): Derive from
1136 pure_known_function_with_default_return.
1137 (class kf_getchar): Likewise.
1138 * varargs.cc (kf_va_arg::impl_call_pre): Use
1139 cd.set_any_lhs_with_defaults.
1141 2023-08-04 David Malcolm <dmalcolm@redhat.com>
1143 PR analyzer/110426
1144 * bounds-checking.cc (region_model::check_region_bounds): Handle
1145 symbolic base regions.
1146 * call-details.cc: Include "stringpool.h" and "attribs.h".
1147 (call_details::lookup_function_attribute): New function.
1148 * call-details.h (call_details::lookup_function_attribute): New
1149 function decl.
1150 * region-model-manager.cc
1151 (region_model_manager::maybe_fold_binop): Add reference to
1152 PR analyzer/110902.
1153 * region-model-reachability.cc (reachable_regions::handle_sval):
1154 Add symbolic regions for pointers that are conjured svalues for
1155 the LHS of a stmt.
1156 * region-model.cc (region_model::canonicalize): Purge dynamic
1157 extents for regions that aren't referenced.
1158 (get_result_size_in_bytes): New function.
1159 (region_model::on_call_pre): Use get_result_size_in_bytes and
1160 potentially set the dynamic extents of the region pointed to by
1161 the return value.
1162 (region_model::deref_rvalue): Add param "add_nonnull_constraint"
1163 and use it to conditionalize adding the constraint.
1164 (pending_diagnostic_subclass::dubious_allocation_size): Add "stmt"
1165 param to both ctors and use it to initialize new "m_stmt" field.
1166 (pending_diagnostic_subclass::operator==): Use m_stmt; don't use
1167 m_lhs or m_rhs.
1168 (pending_diagnostic_subclass::m_stmt): New field.
1169 (region_model::check_region_size): Generalize to any kind of
1170 pointer svalue by using deref_rvalue rather than checking for
1171 region_svalue. Pass stmt to dubious_allocation_size ctor.
1172 * region-model.h (region_model::deref_rvalue): Add param
1173 "add_nonnull_constraint".
1174 * svalue.cc (conjured_svalue::lhs_value_p): New function.
1175 * svalue.h (conjured_svalue::lhs_value_p): New decl.
1177 2023-08-04 David Malcolm <dmalcolm@redhat.com>
1179 * svalue.cc (region_svalue::dump_to_pp): Support NULL type.
1180 (constant_svalue::dump_to_pp): Likewise.
1181 (initial_svalue::dump_to_pp): Likewise.
1182 (conjured_svalue::dump_to_pp): Likewise. Fix missing print of the
1183 type.
1185 2023-08-03 David Malcolm <dmalcolm@redhat.com>
1187 PR analyzer/110882
1188 * region.cc (int_size_in_bits): Fail on zero-sized types.
1190 2023-08-02 Eric Feng <ef2648@columbia.edu>
1192 PR analyzer/107646
1193 * analyzer-language.cc (run_callbacks): New function.
1194 (on_finish_translation_unit): New function.
1195 * analyzer-language.h (GCC_ANALYZER_LANGUAGE_H): New include.
1196 (class translation_unit): New vfuncs.
1198 2023-07-26 David Malcolm <dmalcolm@redhat.com>
1200 PR analyzer/104940
1201 * region-model-manager.cc
1202 (region_model_manager::region_model_manager): Update for
1203 generalizing region ids to also cover svalues.
1204 (region_model_manager::get_or_create_constant_svalue): Likewise.
1205 (region_model_manager::get_or_create_unknown_svalue): Likewise.
1206 (region_model_manager::create_unique_svalue): Likewise.
1207 (region_model_manager::get_or_create_initial_value): Likewise.
1208 (region_model_manager::get_or_create_setjmp_svalue): Likewise.
1209 (region_model_manager::get_or_create_poisoned_svalue): Likewise.
1210 (region_model_manager::get_ptr_svalue): Likewise.
1211 (region_model_manager::get_or_create_unaryop): Likewise.
1212 (region_model_manager::get_or_create_binop): Likewise.
1213 (region_model_manager::get_or_create_sub_svalue): Likewise.
1214 (region_model_manager::get_or_create_repeated_svalue): Likewise.
1215 (region_model_manager::get_or_create_bits_within): Likewise.
1216 (region_model_manager::get_or_create_unmergeable): Likewise.
1217 (region_model_manager::get_or_create_widening_svalue): Likewise.
1218 (region_model_manager::get_or_create_compound_svalue): Likewise.
1219 (region_model_manager::get_or_create_conjured_svalue): Likewise.
1220 (region_model_manager::get_or_create_asm_output_svalue): Likewise.
1221 (region_model_manager::get_or_create_const_fn_result_svalue):
1222 Likewise.
1223 (region_model_manager::get_region_for_fndecl): Likewise.
1224 (region_model_manager::get_region_for_label): Likewise.
1225 (region_model_manager::get_region_for_global): Likewise.
1226 (region_model_manager::get_field_region): Likewise.
1227 (region_model_manager::get_element_region): Likewise.
1228 (region_model_manager::get_offset_region): Likewise.
1229 (region_model_manager::get_sized_region): Likewise.
1230 (region_model_manager::get_cast_region): Likewise.
1231 (region_model_manager::get_frame_region): Likewise.
1232 (region_model_manager::get_symbolic_region): Likewise.
1233 (region_model_manager::get_region_for_string): Likewise.
1234 (region_model_manager::get_bit_range): Likewise.
1235 (region_model_manager::get_var_arg_region): Likewise.
1236 (region_model_manager::get_region_for_unexpected_tree_code):
1237 Likewise.
1238 (region_model_manager::get_or_create_region_for_heap_alloc):
1239 Likewise.
1240 (region_model_manager::create_region_for_alloca): Likewise.
1241 (region_model_manager::log_stats): Likewise.
1242 * region-model-manager.h (region_model_manager::get_num_regions):
1243 Replace with...
1244 (region_model_manager::get_num_symbols): ...this.
1245 (region_model_manager::alloc_region_id): Replace with...
1246 (region_model_manager::alloc_symbol_id): ...this.
1247 (region_model_manager::m_next_region_id): Replace with...
1248 (region_model_manager::m_next_symbol_id): ...this.
1249 * region-model.cc (selftest::test_get_representative_tree): Update
1250 for generalizing region ids to also cover svalues.
1251 (selftest::test_binop_svalue_folding): Likewise.
1252 (selftest::test_state_merging): Likewise.
1253 * region.cc (region::cmp_ids): Delete, in favor of
1254 symbol::cmp_ids.
1255 (region::region): Update for introduction of symbol base class.
1256 (frame_region::get_region_for_local): Likewise.
1257 (root_region::root_region): Likewise.
1258 (symbolic_region::symbolic_region): Likewise.
1259 * region.h: Replace include of "analyzer/complexity.h" with
1260 "analyzer/symbol.h".
1261 (class region): Make a subclass of symbol.
1262 (region::get_id): Delete in favor of symbol::get_id.
1263 (region::cmp_ids): Delete in favor of symbol::cmp_ids.
1264 (region::get_complexity): Delete in favor of
1265 symbol::get_complexity.
1266 (region::region): Use symbol::id_t for "id" param.
1267 (region::m_complexity): Move field to symbol base class.
1268 (region::m_id): Likewise.
1269 (space_region::space_region): Use symbol::id_t for "id" param.
1270 (frame_region::frame_region): Likewise.
1271 (globals_region::globals_region): Likewise.
1272 (code_region::code_region): Likewise.
1273 (function_region::function_region): Likewise.
1274 (label_region::label_region): Likewise.
1275 (stack_region::stack_region): Likewise.
1276 (heap_region::heap_region): Likewise.
1277 (thread_local_region::thread_local_region): Likewise.
1278 (root_region::root_region): Likewise.
1279 (symbolic_region::symbolic_region): Likewise.
1280 (decl_region::decl_region): Likewise.
1281 (field_region::field_region): Likewise.
1282 (element_region::element_region): Likewise.
1283 (offset_region::offset_region): Likewise.
1284 (sized_region::sized_region): Likewise.
1285 (cast_region::cast_region): Likewise.
1286 (heap_allocated_region::heap_allocated_region): Likewise.
1287 (alloca_region::alloca_region): Likewise.
1288 (string_region::string_region): Likewise.
1289 (bit_range_region::bit_range_region): Likewise.
1290 (var_arg_region::var_arg_region): Likewise.
1291 (errno_region::errno_region): Likewise.
1292 (unknown_region::unknown_region): Likewise.
1293 * svalue.cc (sub_svalue::sub_svalue): Add symbol::id_t param.
1294 (repeated_svalue::repeated_svalue): Likewise.
1295 (bits_within_svalue::bits_within_svalue): Likewise.
1296 (compound_svalue::compound_svalue): Likewise.
1297 * svalue.h: Replace include of "analyzer/complexity.h" with
1298 "analyzer/symbol.h".
1299 (class svalue): Make a subclass of symbol.
1300 (svalue::get_complexity): Delete in favor of
1301 symbol::get_complexity.
1302 (svalue::svalue): Add symbol::id_t param. Update for new base
1303 class.
1304 (svalue::m_complexity): Delete in favor of
1305 symbol::m_complexity.
1306 (region_svalue::region_svalue): Add symbol::id_t param
1307 (constant_svalue::constant_svalue): Likewise.
1308 (unknown_svalue::unknown_svalue): Likewise.
1309 (poisoned_svalue::poisoned_svalue): Likewise.
1310 (setjmp_svalue::setjmp_svalue): Likewise.
1311 (initial_svalue::initial_svalue): Likewise.
1312 (unaryop_svalue::unaryop_svalue): Likewise.
1313 (binop_svalue::binop_svalue): Likewise.
1314 (sub_svalue::sub_svalue): Likewise.
1315 (repeated_svalue::repeated_svalue): Likewise.
1316 (bits_within_svalue::bits_within_svalue): Likewise.
1317 (unmergeable_svalue::unmergeable_svalue): Likewise.
1318 (placeholder_svalue::placeholder_svalue): Likewise.
1319 (widening_svalue::widening_svalue): Likewise.
1320 (compound_svalue::compound_svalue): Likewise.
1321 (conjured_svalue::conjured_svalue): Likewise.
1322 (asm_output_svalue::asm_output_svalue): Likewise.
1323 (const_fn_result_svalue::const_fn_result_svalue): Likewise.
1324 * symbol.cc: New file.
1325 * symbol.h: New file.
1327 2023-07-21 David Malcolm <dmalcolm@redhat.com>
1329 PR analyzer/110455
1330 * region-model.cc (region_model::get_gassign_result): Only check
1331 for bad shift counts when dealing with an integral type.
1333 2023-07-21 David Malcolm <dmalcolm@redhat.com>
1335 PR analyzer/110433
1336 PR middle-end/110612
1337 * access-diagram.cc (class spatial_item): Add virtual dtor.
1339 2023-07-21 David Malcolm <dmalcolm@redhat.com>
1341 PR analyzer/110387
1342 * region.h (struct cast_region::key_t): Support "m_type" being
1343 null by using "m_original_region" for empty/deleted slots.
1345 2023-07-19 David Malcolm <dmalcolm@redhat.com>
1347 PR analyzer/110700
1348 * region-model-manager.cc
1349 (region_model_manager::get_or_create_int_cst): Assert that we have
1350 an integral or pointer type.
1351 * sm-taint.cc (taint_state_machine::check_for_tainted_divisor):
1352 Don't check non-integral types.
1354 2023-06-29 benjamin priour <priour.be@gmail.com>
1356 PR analyzer/110198
1357 * region-model-manager.cc
1358 (region_model_manager::get_or_create_initial_value): Take an
1359 optional boolean value to bypass poisoning checks
1360 * region-model-manager.h: Update declaration of the above function.
1361 * region-model.cc (region_model::get_store_value): No longer returns
1362 on OOB, but rather gives a boolean to get_or_create_initial_value.
1363 (region_model::check_region_access): Update docstring.
1364 (region_model::check_region_for_write): Update docstring.
1366 2023-06-24 David Malcolm <dmalcolm@redhat.com>
1368 * access-diagram.cc: Add #define INCLUDE_VECTOR.
1369 * bounds-checking.cc: Likewise.
1371 2023-06-22 David Malcolm <dmalcolm@redhat.com>
1373 PR analyzer/106626
1374 * access-diagram.cc: New file.
1375 * access-diagram.h: New file.
1376 * analyzer.h (class region_offset): Add default ctor.
1377 (region_offset::make_byte_offset): New decl.
1378 (region_offset::concrete_p): New.
1379 (region_offset::get_concrete_byte_offset): New.
1380 (region_offset::calc_symbolic_bit_offset): New decl.
1381 (region_offset::calc_symbolic_byte_offset): New decl.
1382 (region_offset::dump_to_pp): New decl.
1383 (region_offset::dump): New decl.
1384 (operator<, operator<=, operator>, operator>=): New decls for
1385 region_offset.
1386 * analyzer.opt
1387 (-param=analyzer-text-art-string-ellipsis-threshold=): New.
1388 (-param=analyzer-text-art-string-ellipsis-head-len=): New.
1389 (-param=analyzer-text-art-string-ellipsis-tail-len=): New.
1390 (-param=analyzer-text-art-ideal-canvas-width=): New.
1391 (fanalyzer-debug-text-art): New.
1392 * bounds-checking.cc: Include "intl.h", "diagnostic-diagram.h",
1393 and "analyzer/access-diagram.h".
1394 (class out_of_bounds::oob_region_creation_event_capacity): New.
1395 (out_of_bounds::out_of_bounds): Add "model" and "sval_hint"
1396 params.
1397 (out_of_bounds::mark_interesting_stuff): Use the base region.
1398 (out_of_bounds::add_region_creation_events): Use
1399 oob_region_creation_event_capacity.
1400 (out_of_bounds::get_dir): New pure vfunc.
1401 (out_of_bounds::maybe_show_notes): New.
1402 (out_of_bounds::maybe_show_diagram): New.
1403 (out_of_bounds::make_access_diagram): New.
1404 (out_of_bounds::m_model): New field.
1405 (out_of_bounds::m_sval_hint): New field.
1406 (out_of_bounds::m_region_creation_event_id): New field.
1407 (concrete_out_of_bounds::concrete_out_of_bounds): Update for new
1408 fields.
1409 (concrete_past_the_end::concrete_past_the_end): Likewise.
1410 (concrete_past_the_end::add_region_creation_events): Use
1411 oob_region_creation_event_capacity.
1412 (concrete_buffer_overflow::concrete_buffer_overflow): Update for
1413 new fields.
1414 (concrete_buffer_overflow::emit): Replace call to
1415 maybe_describe_array_bounds with maybe_show_notes.
1416 (concrete_buffer_overflow::get_dir): New.
1417 (concrete_buffer_over_read::concrete_buffer_over_read): Update for
1418 new fields.
1419 (concrete_buffer_over_read::emit): Replace call to
1420 maybe_describe_array_bounds with maybe_show_notes.
1421 (concrete_buffer_overflow::get_dir): New.
1422 (concrete_buffer_underwrite::concrete_buffer_underwrite): Update
1423 for new fields.
1424 (concrete_buffer_underwrite::emit): Replace call to
1425 maybe_describe_array_bounds with maybe_show_notes.
1426 (concrete_buffer_underwrite::get_dir): New.
1427 (concrete_buffer_under_read::concrete_buffer_under_read): Update
1428 for new fields.
1429 (concrete_buffer_under_read::emit): Replace call to
1430 maybe_describe_array_bounds with maybe_show_notes.
1431 (concrete_buffer_under_read::get_dir): New.
1432 (symbolic_past_the_end::symbolic_past_the_end): Update for new
1433 fields.
1434 (symbolic_buffer_overflow::symbolic_buffer_overflow): Likewise.
1435 (symbolic_buffer_overflow::emit): Call maybe_show_notes.
1436 (symbolic_buffer_overflow::get_dir): New.
1437 (symbolic_buffer_over_read::symbolic_buffer_over_read): Update for
1438 new fields.
1439 (symbolic_buffer_over_read::emit): Call maybe_show_notes.
1440 (symbolic_buffer_over_read::get_dir): New.
1441 (region_model::check_symbolic_bounds): Add "sval_hint" param. Pass
1442 it and sized_offset_reg to diagnostics.
1443 (region_model::check_region_bounds): Add "sval_hint" param, passing
1444 it to diagnostics.
1445 * diagnostic-manager.cc
1446 (diagnostic_manager::emit_saved_diagnostic): Pass logger to
1447 pending_diagnostic::emit.
1448 * engine.cc: Add logger param to pending_diagnostic::emit
1449 implementations.
1450 * infinite-recursion.cc: Likewise.
1451 * kf-analyzer.cc: Likewise.
1452 * kf.cc: Likewise. Add nullptr for new param of
1453 check_region_for_write.
1454 * pending-diagnostic.h: Likewise in decl.
1455 * region-model-manager.cc
1456 (region_model_manager::get_or_create_int_cst): Convert param from
1457 poly_int64 to const poly_wide_int_ref &.
1458 (region_model_manager::maybe_fold_binop): Support type being NULL
1459 when checking for floating-point types.
1460 Check for (X + Y) - X => Y. Be less strict about types when folding
1461 associative ops. Check for (X + Y) * CST => (X * CST) + (Y * CST).
1462 * region-model-manager.h
1463 (region_model_manager::get_or_create_int_cst): Convert param from
1464 poly_int64 to const poly_wide_int_ref &.
1465 * region-model.cc: Add logger param to pending_diagnostic::emit
1466 implementations.
1467 (region_model::check_external_function_for_access_attr): Update
1468 for new param of check_region_for_write.
1469 (region_model::deref_rvalue): Use nullptr rather than NULL.
1470 (region_model::get_capacity): Handle RK_STRING.
1471 (region_model::check_region_access): Add "sval_hint" param; pass it to
1472 check_region_bounds.
1473 (region_model::check_region_for_write): Add "sval_hint" param;
1474 pass it to check_region_access.
1475 (region_model::check_region_for_read): Add NULL for new param to
1476 check_region_access.
1477 (region_model::set_value): Pass rhs_sval to
1478 check_region_for_write.
1479 (region_model::get_representative_path_var_1): Handle SK_CONSTANT
1480 in the check for infinite recursion.
1481 * region-model.h (region_model::check_region_for_write): Add
1482 "sval_hint" param.
1483 (region_model::check_region_access): Likewise.
1484 (region_model::check_symbolic_bounds): Likewise.
1485 (region_model::check_region_bounds): Likewise.
1486 * region.cc (region_offset::make_byte_offset): New.
1487 (region_offset::calc_symbolic_bit_offset): New.
1488 (region_offset::calc_symbolic_byte_offset): New.
1489 (region_offset::dump_to_pp): New.
1490 (region_offset::dump): New.
1491 (struct linear_op): New.
1492 (operator<, operator<=, operator>, operator>=): New, for
1493 region_offset.
1494 (region::get_next_offset): New.
1495 (region::get_relative_symbolic_offset): Use ptrdiff_type_node.
1496 (field_region::get_relative_symbolic_offset): Likewise.
1497 (element_region::get_relative_symbolic_offset): Likewise.
1498 (bit_range_region::get_relative_symbolic_offset): Likewise.
1499 * region.h (region::get_next_offset): New decl.
1500 * sm-fd.cc: Add logger param to pending_diagnostic::emit
1501 implementations.
1502 * sm-file.cc: Likewise.
1503 * sm-malloc.cc: Likewise.
1504 * sm-pattern-test.cc: Likewise.
1505 * sm-sensitive.cc: Likewise.
1506 * sm-signal.cc: Likewise.
1507 * sm-taint.cc: Likewise.
1508 * store.cc (bit_range::contains_p): Allow "out" to be null.
1509 * store.h (byte_range::get_start_bit_offset): New.
1510 (byte_range::get_next_bit_offset): New.
1511 * varargs.cc: Add logger param to pending_diagnostic::emit
1512 implementations.
1514 2023-06-10 Tim Lange <mail@tim-lange.me>
1516 PR analyzer/109577
1517 * constraint-manager.cc (class sval_finder): Visitor to find
1518 childs in svalue trees.
1519 (constraint_manager::sval_constrained_p): Add new function to
1520 check whether a sval might be part of an constraint.
1521 * constraint-manager.h: Add sval_constrained_p function.
1522 * region-model.cc (class size_visitor): Reverse behavior to not
1523 emit a warning on not explicitly considered cases.
1524 (region_model::check_region_size):
1525 Adapt to size_visitor changes.
1527 2023-06-09 David Malcolm <dmalcolm@redhat.com>
1529 PR analyzer/110112
1530 * region-model.cc (region_model::get_initial_value_for_global):
1531 Move code to region::calc_initial_value_at_main.
1532 * region.cc (region::get_initial_value_at_main): New function.
1533 (region::calc_initial_value_at_main): New function, based on code
1534 in region_model::get_initial_value_for_global.
1535 (region::region): Initialize m_cached_init_sval_at_main.
1536 (decl_region::get_svalue_for_constructor): Add a cache, splitting
1537 out body to...
1538 (decl_region::calc_svalue_for_constructor): ...this new function.
1539 * region.h (region::get_initial_value_at_main): New decl.
1540 (region::calc_initial_value_at_main): New decl.
1541 (region::m_cached_init_sval_at_main): New field.
1542 (decl_region::decl_region): Initialize m_ctor_svalue.
1543 (decl_region::calc_svalue_for_constructor): New decl.
1544 (decl_region::m_ctor_svalue): New field.
1546 2023-06-08 Benjamin Priour <vultkayn@gcc.gnu.org>
1548 * bounds-checking.cc (region_model::check_symbolic_bounds): Returns whether the BASE_REG
1549 region access was OOB.
1550 (region_model::check_region_bounds): Likewise.
1551 * region-model.cc (region_model::get_store_value): Creates an
1552 unknown svalue on OOB-read access to REG.
1553 (region_model::check_region_access): Returns whether an unknown svalue needs be created.
1554 (region_model::check_region_for_read): Passes check_region_access return value.
1555 * region-model.h: Update prior function definitions.
1557 2023-06-02 David Malcolm <dmalcolm@redhat.com>
1559 PR analyzer/109015
1560 * kf.cc (class kf_atomic_exchange): New.
1561 (class kf_atomic_exchange_n): New.
1562 (class kf_atomic_fetch_op): New.
1563 (class kf_atomic_op_fetch): New.
1564 (class kf_atomic_load): New.
1565 (class kf_atomic_load_n): New.
1566 (class kf_atomic_store_n): New.
1567 (register_atomic_builtins): New function.
1568 (register_known_functions): Call register_atomic_builtins.
1570 2023-06-02 David Malcolm <dmalcolm@redhat.com>
1572 * store.cc (store::eval_alias_1): Regions in different memory
1573 spaces can't alias.
1575 2023-05-18 Bernhard Reutner-Fischer <aldot@gcc.gnu.org>
1577 * region-model-manager.cc (get_code_for_cast): Use _P defines from
1578 tree.h.
1579 (region_model_manager::get_or_create_cast): Ditto.
1580 (region_model_manager::get_region_for_global): Ditto.
1581 * region-model.cc (region_model::get_lvalue_1): Ditto.
1582 * region.cc (decl_region::maybe_get_constant_value): Ditto.
1584 2023-03-22 David Malcolm <dmalcolm@redhat.com>
1586 PR analyzer/109239
1587 * program-point.cc: Include "analyzer/inlining-iterator.h".
1588 (program_point::effectively_intraprocedural_p): New function.
1589 * program-point.h (program_point::effectively_intraprocedural_p):
1590 New decl.
1591 * sm-malloc.cc (deref_before_check::emit): Use it when rejecting
1592 interprocedural cases, so that we reject interprocedural cases
1593 that have become intraprocedural due to inlining.
1595 2023-03-18 David Malcolm <dmalcolm@redhat.com>
1597 PR analyzer/109094
1598 * region-model.cc (region_model::on_longjmp): Pass false for
1599 new "eval_return_svalue" param of pop_frame.
1600 (region_model::pop_frame): Add new "eval_return_svalue" param and
1601 use it to suppress the call to get_rvalue on the result when
1602 needed by on_longjmp.
1603 * region-model.h (region_model::pop_frame): Add new
1604 "eval_return_svalue" param.
1606 2023-03-10 David Malcolm <dmalcolm@redhat.com>
1608 PR analyzer/109059
1609 * region-model.cc (region_model::mark_region_as_unknown): Gather a
1610 set of maybe-live svalues and call on_maybe_live_values with it.
1611 * store.cc (binding_map::remove_overlapping_bindings): Add new
1612 "maybe_live_values" param; add any removed svalues to it.
1613 (binding_cluster::clobber_region): Add NULL as new param of
1614 remove_overlapping_bindings.
1615 (binding_cluster::mark_region_as_unknown): Add "maybe_live_values"
1616 param and pass it to remove_overlapping_bindings.
1617 (binding_cluster::maybe_get_compound_binding): Add NULL for new
1618 param of binding_map::remove_overlapping_bindings.
1619 (binding_cluster::remove_overlapping_bindings): Add
1620 "maybe_live_values" param and pass to
1621 binding_map::remove_overlapping_bindings.
1622 (store::set_value): Capture a set of maybe-live svalues, and call
1623 on_maybe_live_values with it.
1624 (store::on_maybe_live_values): New.
1625 (store::mark_region_as_unknown): Add "maybe_live_values" param
1626 and pass it to binding_cluster::mark_region_as_unknown.
1627 (store::remove_overlapping_bindings): Pass NULL for new param of
1628 binding_cluster::remove_overlapping_bindings.
1629 * store.h (binding_map::remove_overlapping_bindings): Add
1630 "maybe_live_values" param.
1631 (binding_cluster::mark_region_as_unknown): Likewise.
1632 (binding_cluster::remove_overlapping_bindings): Likewise.
1633 (store::mark_region_as_unknown): Likewise.
1634 (store::on_maybe_live_values): New decl.
1636 2023-03-10 David Malcolm <dmalcolm@redhat.com>
1638 PR analyzer/108475
1639 PR analyzer/109060
1640 * sm-malloc.cc (deref_before_check::deref_before_check):
1641 Initialize new field m_deref_expr. Assert that arg is non-NULL.
1642 (deref_before_check::emit): Reject cases where the spelling of the
1643 thing that was dereferenced differs from that of what is checked,
1644 or if the dereference expression was not found. Remove code to
1645 handle NULL m_arg.
1646 (deref_before_check::describe_state_change): Remove code to handle
1647 NULL m_arg.
1648 (deref_before_check::describe_final_event): Likewise.
1649 (deref_before_check::sufficiently_similar_p): New.
1650 (deref_before_check::m_deref_expr): New field.
1651 (malloc_state_machine::maybe_complain_about_deref_before_check):
1652 Don't warn if the diag_ptr is NULL.
1654 2023-03-03 David Malcolm <dmalcolm@redhat.com>
1656 * kf.cc (class kf_sprintf): New.
1657 (register_known_functions): Register it.
1659 2023-03-02 David Malcolm <dmalcolm@redhat.com>
1661 PR analyzer/108968
1662 * region-model.cc (region_model::get_rvalue_1): Handle VAR_DECLs
1663 with a DECL_HARD_REGISTER by returning UNKNOWN.
1665 2023-03-02 Hans-Peter Nilsson <hp@axis.com>
1667 * kf.cc (register_known_functions): Add __errno function for newlib.
1669 2023-03-01 David Malcolm <dmalcolm@redhat.com>
1671 PR analyzer/107565
1672 * region-model.cc (region_model::on_call_pre): Flatten logic by
1673 returning early. Consolidate logic for detecting const and pure
1674 functions. When considering whether an unhandled built-in
1675 function has side-effects, consider all kinds of builtin, rather
1676 than just BUILT_IN_NORMAL, and don't require
1677 gimple_builtin_call_types_compatible_p.
1679 2023-03-01 David Malcolm <dmalcolm@redhat.com>
1681 PR analyzer/108935
1682 * infinite-recursion.cc (contains_unknown_p): New.
1683 (sufficiently_different_region_binding_p): New function, splitting
1684 out inner loop from...
1685 (sufficiently_different_p): ...here. Extend detection of unknown
1686 svalues to also include svalues that contain unknown. Treat
1687 changes in frames below the entry to the recursion as being
1688 sufficiently different to reject being an infinite recursion.
1690 2023-02-21 David Malcolm <dmalcolm@redhat.com>
1692 PR analyzer/108830
1693 * analyzer.opt (fanalyzer-suppress-followups): New option.
1694 * engine.cc (impl_region_model_context::warn): Terminate the path
1695 if the diagnostic's terminate_path_p vfunc returns true and
1696 -fanalyzer-suppress-followups is true (the default).
1697 (impl_sm_context::warn): Likewise, for both overloads.
1698 * pending-diagnostic.h (pending_diagnostic::terminate_path_p): New
1699 vfunc.
1700 * program-state.cc (program_state::on_edge): Terminate the path if
1701 the ctxt requests it during updating the edge.
1702 * region-model.cc (poisoned_value_diagnostic::terminate_path_p):
1703 New vfunc.
1704 * sm-malloc.cc (null_deref::terminate_path_p): New vfunc.
1705 (null_arg::terminate_path_p): New vfunc.
1707 2023-02-16 David Malcolm <dmalcolm@redhat.com>
1709 PR analyzer/108806
1710 * constraint-manager.cc (bounded_range::dump_to_pp): Use
1711 bounded_range::singleton_p.
1712 (constraint_manager::add_bounded_ranges): Handle singleton ranges
1713 by adding an EQ_EXPR constraint.
1714 (constraint_manager::impossible_derived_conditions_p): New.
1715 (constraint_manager::eval_condition): Reject EQ_EXPR when it would
1716 imply impossible derived conditions.
1717 (selftest::test_bits): New.
1718 (selftest::run_constraint_manager_tests): Run it.
1719 * constraint-manager.h (bounded_range::singleton_p): New.
1720 (constraint_manager::impossible_derived_conditions_p): New decl.
1721 * region-model.cc (region_model::get_rvalue_1): Handle
1722 BIT_AND_EXPR, BIT_IOR_EXPR, and BIT_XOR_EXPR.
1724 2023-02-15 David Malcolm <dmalcolm@redhat.com>
1726 PR analyzer/108664
1727 PR analyzer/108666
1728 PR analyzer/108725
1729 * diagnostic-manager.cc (epath_finder::get_best_epath): Add
1730 "target_stmt" param.
1731 (epath_finder::explore_feasible_paths): Likewise.
1732 (epath_finder::process_worklist_item): Likewise.
1733 (saved_diagnostic::calc_best_epath): Pass m_stmt to
1734 epath_finder::get_best_epath.
1735 * engine.cc (feasibility_state::maybe_update_for_edge): Move
1736 per-stmt logic to...
1737 (feasibility_state::update_for_stmt): ...this new function.
1738 * exploded-graph.h (feasibility_state::update_for_stmt): New decl.
1739 * feasible-graph.cc (feasible_node::get_state_at_stmt): New.
1740 * feasible-graph.h: Include "analyzer/exploded-graph.h".
1741 (feasible_node::get_state_at_stmt): New decl.
1742 * infinite-recursion.cc
1743 (infinite_recursion_diagnostic::check_valid_fpath_p): Update for
1744 vfunc signature change.
1745 * pending-diagnostic.h (pending_diagnostic::check_valid_fpath_p):
1746 Convert first param to a reference. Add stmt param.
1747 * region-model.cc: Include "analyzer/feasible-graph.h".
1748 (poisoned_value_diagnostic::poisoned_value_diagnostic): Add
1749 "check_expr" param.
1750 (poisoned_value_diagnostic::check_valid_fpath_p): New.
1751 (poisoned_value_diagnostic::m_check_expr): New field.
1752 (region_model::check_for_poison): Attempt to supply a check_expr
1753 to the diagnostic
1754 (region_model::deref_rvalue): Add NULL for new check_expr param
1755 of poisoned_value_diagnostic.
1756 (region_model::get_or_create_region_for_heap_alloc): Don't reuse
1757 regions that are marked as TOUCHED.
1759 2023-02-10 David Malcolm <dmalcolm@redhat.com>
1761 PR analyzer/108745
1762 * sm-malloc.cc (deref_before_check::emit): Reject the warning if
1763 the check occurs within a macro defintion.
1765 2023-02-09 David Malcolm <dmalcolm@redhat.com>
1767 PR analyzer/108733
1768 * state-purge.cc (get_candidate_for_purging): Add ADDR_EXPR
1769 and MEM_REF.
1771 2023-02-08 David Malcolm <dmalcolm@redhat.com>
1773 PR analyzer/108704
1774 * state-purge.cc (state_purge_per_decl::process_point_backwards):
1775 Don't stop processing the decl if it's fully overwritten by
1776 this stmt if it's also used by this stmt.
1778 2023-02-07 David Malcolm <dmalcolm@redhat.com>
1780 PR analyzer/108661
1781 * sm-fd.cc (class kf_read): New.
1782 (register_known_fd_functions): Register "read".
1783 * sm-file.cc (class kf_fread): Update comment.
1785 2023-02-02 David Malcolm <dmalcolm@redhat.com>
1787 PR analyzer/108633
1788 * sm-fd.cc (fd_state_machine::check_for_fd_attrs): Add missing
1789 "continue".
1790 (fd_state_machine::on_listen): Don't issue phase-mismatch or
1791 type-mismatch warnings for the "invalid" state.
1793 2023-02-01 David Malcolm <dmalcolm@redhat.com>
1795 PR analyzer/108616
1796 * pending-diagnostic.cc (fixup_location_in_macro_p): Add "alloca"
1797 to macros that we shouldn't unwind inside.
1799 2023-01-26 David Malcolm <dmalcolm@redhat.com>
1801 PR analyzer/108524
1802 * analyzer.h (class feasible_node): New forward decl.
1803 * diagnostic-manager.cc (epath_finder::get_best_epath): Add "pd"
1804 param.
1805 (epath_finder::explore_feasible_paths): Likewise.
1806 (epath_finder::process_worklist_item): Likewise. Use it to call
1807 pending_diagnostic::check_valid_fpath_p on the final fpath to
1808 give pending_diagnostic a way to add additional restrictions on
1809 feasibility.
1810 (saved_diagnostic::calc_best_epath): Pass pending_diagnostic to
1811 epath_finder::get_best_epath.
1812 * infinite-recursion.cc: Include "analyzer/feasible-graph.h".
1813 (infinite_recursion_diagnostic::check_valid_fpath_p): New.
1814 (infinite_recursion_diagnostic::fedge_uses_conjured_svalue_p): New.
1815 (infinite_recursion_diagnostic::expr_uses_conjured_svalue_p): New.
1816 * pending-diagnostic.h (pending_diagnostic::check_valid_fpath_p):
1817 New vfunc.
1819 2023-01-19 David Malcolm <dmalcolm@redhat.com>
1821 PR analyzer/108455
1822 * analyzer.h (class checker_event): New forward decl.
1823 (class state_change_event): Indent.
1824 (class warning_event): New forward decl.
1825 * checker-event.cc (state_change_event::state_change_event): Add
1826 "enode" param.
1827 (warning_event::get_desc): Update for new param of
1828 evdesc::final_event ctor.
1829 * checker-event.h (state_change_event::state_change_event): Add
1830 "enode" param.
1831 (state_change_event::get_exploded_node): New accessor.
1832 (state_change_event::m_enode): New field.
1833 (warning_event::warning_event): New "enode" param.
1834 (warning_event::get_exploded_node): New accessor.
1835 (warning_event::m_enode): New field.
1836 * diagnostic-manager.cc
1837 (state_change_event_creator::on_global_state_change): Pass
1838 src_node to state_change_event ctor.
1839 (state_change_event_creator::on_state_change): Likewise.
1840 (null_assignment_sm_context::set_next_state): Pass NULL for
1841 new param of state_change_event ctor.
1842 * infinite-recursion.cc
1843 (infinite_recursion_diagnostic::add_final_event): Update for new
1844 param of warning_event ctor.
1845 * pending-diagnostic.cc (pending_diagnostic::add_final_event):
1846 Pass enode to warning_event ctor.
1847 * pending-diagnostic.h (evdesc::final_event): Add reference to
1848 warning_event.
1849 * sm-malloc.cc: Include "analyzer/checker-event.h" and
1850 "analyzer/exploded-graph.h".
1851 (deref_before_check::deref_before_check): Initialize new fields.
1852 (deref_before_check::emit): Reject warnings in which we were
1853 unable to determine the enodes of the dereference and the check.
1854 Reject warnings interprocedural warnings. Reject warnings in which
1855 the dereference doesn't dominate the check.
1856 (deref_before_check::describe_state_change): Set m_deref_enode.
1857 (deref_before_check::describe_final_event): Set m_check_enode.
1858 (deref_before_check::m_deref_enode): New field.
1859 (deref_before_check::m_check_enode): New field.
1861 2023-01-13 David Malcolm <dmalcolm@redhat.com>
1863 PR analyzer/105273
1864 * region-model.cc (has_nondefault_case_for_value_p): New.
1865 (has_nondefault_cases_for_all_enum_values_p): New.
1866 (region_model::apply_constraints_for_gswitch): Skip
1867 implicitly-created "default" when switching on an enum
1868 and all enum values have non-default cases.
1869 (rejected_default_case::dump_to_pp): New.
1870 * region-model.h (region_model_context::possibly_tainted_p): New
1871 decl.
1872 (class rejected_default_case): New.
1873 * sm-taint.cc (region_model_context::possibly_tainted_p): New.
1874 * supergraph.cc (switch_cfg_superedge::dump_label_to_pp): Dump
1875 when implicitly_created_default_p.
1876 (switch_cfg_superedge::implicitly_created_default_p): New.
1877 * supergraph.h
1878 (switch_cfg_superedge::implicitly_created_default_p): New decl.
1880 2023-01-11 David Malcolm <dmalcolm@redhat.com>
1882 PR analyzer/108252
1883 * kf.cc (class kf_strdup): New.
1884 (class kf_strndup): New.
1885 (register_known_functions): Register them.
1886 * region-model.cc (region_model::on_call_pre): Use
1887 &HEAP_ALLOCATED_REGION for the default result of an external
1888 function with the "malloc" attribute, rather than CONJURED_SVALUE.
1889 (region_model::get_or_create_region_for_heap_alloc): Allow
1890 "size_in_bytes" to be NULL.
1891 * store.cc (store::set_value): When handling *UNKNOWN = VAL,
1892 mark VAL as "maybe bound".
1894 2022-12-16 David Malcolm <dmalcolm@redhat.com>
1896 PR analyzer/106479
1897 * kf.cc (kf_memcpy_memmove::impl_call_pre): Pass in source region
1898 to region_model::check_for_poison.
1899 * region-model-asm.cc (region_model::on_asm_stmt): Pass NULL
1900 region to region_model::check_for_poison.
1901 * region-model.cc (region_model::check_for_poison): Add
1902 "src_region" param, and pass it to poisoned_value_diagnostic.
1903 (region_model::on_assignment): Pass NULL region to
1904 region_model::check_for_poison.
1905 (region_model::get_rvalue): Likewise.
1906 * region-model.h (region_model::check_for_poison): Add
1907 "src_region" param.
1908 * sm-fd.cc (fd_state_machine::on_accept): Pass in source region
1909 to region_model::check_for_poison.
1910 * varargs.cc (kf_va_copy::impl_call_pre): Pass NULL region to
1911 region_model::check_for_poison.
1912 (kf_va_arg::impl_call_pre): Pass in source region to
1913 region_model::check_for_poison.
1915 2022-12-14 David Malcolm <dmalcolm@redhat.com>
1917 PR analyzer/108065
1918 * region.cc (decl_region::get_svalue_for_initializer): Bail out to
1919 avoid calling binding_key::make with an empty region.
1920 * store.cc (binding_map::apply_ctor_val_to_range): Likewise.
1921 (binding_map::apply_ctor_pair_to_child_region): Likewise.
1922 (binding_cluster::bind): Likewise.
1923 (binding_cluster::purge_region): Likewise.
1924 (binding_cluster::maybe_get_compound_binding): Likewise.
1925 (binding_cluster::maybe_get_simple_value): Likewise.
1927 2022-12-09 David Malcolm <dmalcolm@redhat.com>
1929 * analyzer.h (class known_function): Expand comment.
1930 * region-model-impl-calls.cc: Rename to...
1931 * kf.cc: ...this.
1932 * known-function-manager.h (class known_function_manager): Add
1933 leading comment.
1935 2022-12-09 David Malcolm <dmalcolm@redhat.com>
1937 PR analyzer/108003
1938 * call-summary.cc
1939 (call_summary_replay::convert_region_from_summary_1): Convert
1940 heap_regs_in_use from auto_sbitmap to auto_bitmap.
1941 * region-model-manager.cc
1942 (region_model_manager::get_or_create_region_for_heap_alloc):
1943 Convert from sbitmap to bitmap.
1944 * region-model-manager.h: Likewise.
1945 * region-model.cc
1946 (region_model::get_or_create_region_for_heap_alloc): Convert from
1947 auto_sbitmap to auto_bitmap.
1948 (region_model::get_referenced_base_regions): Likewise.
1949 * region-model.h: Include "bitmap.h" rather than "sbitmap.h".
1950 (region_model::get_referenced_base_regions): Convert from
1951 auto_sbitmap to auto_bitmap.
1953 2022-12-09 David Malcolm <dmalcolm@redhat.com>
1955 * region-model-impl-calls.cc (class kf_memcpy): Rename to...
1956 (class kf_memcpy_memmove): ...this.
1957 (kf_memcpy::impl_call_pre): Rename to...
1958 (kf_memcpy_memmove::impl_call_pre): ...this, and check the src for
1959 poison.
1960 (register_known_functions): Update for above renaming, and
1961 register BUILT_IN_MEMMOVE and BUILT_IN_MEMMOVE_CHK.
1963 2022-12-06 David Malcolm <dmalcolm@redhat.com>
1965 PR analyzer/107882
1966 * region-model.cc (region_model::get_store_value): Return an
1967 unknown value for empty regions.
1968 (region_model::set_value): Bail on empty regions.
1969 * region.cc (region::empty_p): New.
1970 * region.h (region::empty_p): New decl.
1971 * state-purge.cc (same_binding_p): Bail if either region is empty.
1972 * store.cc (binding_key::make): Assert that a concrete binding's
1973 bit_size must be > 0.
1974 (binding_cluster::mark_region_as_unknown): Bail on empty regions.
1975 (binding_cluster::get_binding): Likewise.
1976 (binding_cluster::remove_overlapping_bindings): Likewise.
1977 (binding_cluster::on_unknown_fncall): Don't conjure values for
1978 empty regions.
1979 (store::fill_region): Bail on empty regions.
1980 * store.h (class concrete_binding): Update comment to reflect that
1981 the range of bits must be non-empty.
1982 (concrete_binding::concrete_binding): Assert that bit range is
1983 non-empty.
1985 2022-12-06 David Malcolm <dmalcolm@redhat.com>
1987 PR analyzer/106325
1988 * region-model-manager.cc
1989 (region_model_manager::get_or_create_null_ptr): New.
1990 * region-model-manager.h
1991 (region_model_manager::get_or_create_null_ptr): New decl.
1992 * region-model.cc (region_model::on_top_level_param): Add
1993 "nonnull" param and make use of it.
1994 (region_model::push_frame): When handling a top-level entrypoint
1995 to the analysis, determine which params __attribute__((nonnull))
1996 applies to, and pass to on_top_level_param.
1997 * region-model.h (region_model::on_top_level_param): Add "nonnull"
1998 param.
2000 2022-12-06 David Malcolm <dmalcolm@redhat.com>
2002 * analyzer.h (register_known_analyzer_functions): New decl.
2003 (register_known_functions_lang_cp): New decl.
2004 * call-details.cc: New file, split out from
2005 region-model-impl-calls.cc.
2006 * call-details.h: New file, split out from region-model.h.
2007 * call-info.cc: Include "analyzer/call-details.h".
2008 * call-summary.h: Likewise.
2009 * kf-analyzer.cc: New file, split out from
2010 region-model-impl-calls.cc.
2011 * kf-lang-cp.cc: Likewise.
2012 * known-function-manager.cc: Include "analyzer/call-details.h".
2013 * region-model-impl-calls.cc: Move definitions of call_details's
2014 member functions to call-details.cc. Move class kf_analyzer_* to
2015 kf-analyzer.cc. Move kf_operator_new and kf_operator_delete to
2016 kf-lang-cp.cc. Refresh #includes accordingly.
2017 (register_known_functions): Replace registration of __analyzer_*
2018 functions with a call to register_known_analyzer_functions.
2019 Replace registration of C++ support functions with a call to
2020 register_known_functions_lang_cp.
2021 * region-model.h (class call_details): Move to new call-details.h.
2022 * sm-fd.cc: Include "analyzer/call-details.h".
2023 * sm-file.cc: Likewise.
2024 * sm-malloc.cc: Likewise.
2025 * varargs.cc: Likewise.
2027 2022-12-02 David Malcolm <dmalcolm@redhat.com>
2029 * analyzer.h (struct event_loc_info): New forward decl.
2030 * bounds-checking.cc: Use event_loc_info throughout to bundle the
2031 loc, fndecl, depth triples.
2032 * call-info.cc: Likewise.
2033 * checker-event.cc: Likewise.
2034 * checker-event.h (struct event_loc_info): New decl. Use it
2035 throughout to bundle the loc, fndecl, depth triples.
2036 * checker-path.cc: Likewise.
2037 * checker-path.h: Likewise.
2038 * diagnostic-manager.cc: Likewise.
2039 * engine.cc: Likewise.
2040 * infinite-recursion.cc: Likewise.
2041 * pending-diagnostic.cc: Likewise.
2042 * pending-diagnostic.h: Likewise.
2043 * region-model.cc: Likewise.
2044 * sm-signal.cc: Likewise.
2045 * varargs.cc: Likewise.
2047 2022-12-02 David Malcolm <dmalcolm@redhat.com>
2049 PR analyzer/107851
2050 * analyzer.cc (make_label_text_n): Convert param "n" from int to
2051 unsigned HOST_WIDE_INT.
2052 * analyzer.h (make_label_text_n): Likewise for decl.
2053 * bounds-checking.cc: Include "analyzer/checker-event.h" and
2054 "analyzer/checker-path.h".
2055 (out_of_bounds::add_region_creation_events): New.
2056 (concrete_past_the_end::describe_region_creation_event): Replace
2057 with...
2058 (concrete_past_the_end::add_region_creation_events): ...this.
2059 (symbolic_past_the_end::describe_region_creation_event): Delete.
2060 * checker-event.cc (region_creation_event::region_creation_event):
2061 Update for dropping all member data.
2062 (region_creation_event::get_desc): Delete, splitting out into
2063 region_creation_event_memory_space::get_desc,
2064 region_creation_event_capacity::get_desc, and
2065 region_creation_event_debug::get_desc.
2066 (region_creation_event_memory_space::get_desc): New.
2067 (region_creation_event_capacity::get_desc): New.
2068 (region_creation_event_allocation_size::get_desc): New.
2069 (region_creation_event_debug::get_desc): New.
2070 * checker-event.h: Include "analyzer/program-state.h".
2071 (enum rce_kind): Delete.
2072 (class region_creation_event): Drop all member data.
2073 (region_creation_event::region_creation_event): Make protected.
2074 (region_creation_event::get_desc): Delete.
2075 (class region_creation_event_memory_space): New.
2076 (class region_creation_event_capacity): New.
2077 (class region_creation_event_allocation_size): New.
2078 (class region_creation_event_debug): New.
2079 * checker-path.cc (checker_path::add_region_creation_events): Add
2080 "pd" param. Call pending_diangnostic::add_region_creation_events.
2081 Update for conversion of RCE_DEBUG to region_creation_event_debug.
2082 * checker-path.h (checker_path::add_region_creation_events): Add
2083 "pd" param.
2084 * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
2085 Pass pending_diagnostic to
2086 emission_path::add_region_creation_events.
2087 (diagnostic_manager::build_emission_path): Pass path_builder to
2088 add_event_on_final_node.
2089 (diagnostic_manager::add_event_on_final_node): Add "pb" param.
2090 Pass pending_diagnostic to
2091 emission_path::add_region_creation_events.
2092 (diagnostic_manager::add_events_for_eedge): Pass
2093 pending_diagnostic to emission_path::add_region_creation_events.
2094 * diagnostic-manager.h
2095 (diagnostic_manager::add_event_on_final_node): Add "pb" param.
2096 * pending-diagnostic.cc
2097 (pending_diagnostic::add_region_creation_events): New.
2098 * pending-diagnostic.h (struct region_creation): Delete.
2099 (pending_diagnostic::describe_region_creation_event): Delete.
2100 (pending_diagnostic::add_region_creation_events): New vfunc.
2101 * region-model.cc: Include "analyzer/checker-event.h" and
2102 "analyzer/checker-path.h".
2103 (dubious_allocation_size::dubious_allocation_size): Initialize
2104 m_has_allocation_event.
2105 (dubious_allocation_size::describe_region_creation_event): Delete.
2106 (dubious_allocation_size::describe_final_event): Update for
2107 replacement of m_allocation_event with m_has_allocation_event.
2108 (dubious_allocation_size::add_region_creation_events): New.
2109 (dubious_allocation_size::m_allocation_event): Replace with...
2110 (dubious_allocation_size::m_has_allocation_event): ...this.
2112 2022-12-02 David Malcolm <dmalcolm@redhat.com>
2114 PR analyzer/107948
2115 * region-model-manager.cc
2116 (region_model_manager::maybe_fold_binop): Fold (0 - VAL) to -VAL.
2117 * region-model.cc (region_model::eval_condition): Handle e.g.
2118 "-X <= 0" as equivalent to X >= 0".
2120 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2122 PR analyzer/106626
2123 * bounds-checking.cc
2124 (symbolic_past_the_end::describe_final_event): Delete, moving to
2125 symbolic_buffer_overflow::describe_final_event and
2126 symbolic_buffer_over_read::describe_final_event, eliminating
2127 composition of text strings via "byte_str" and "m_dir_str".
2128 (symbolic_past_the_end::m_dir_str): Delete field.
2129 (symbolic_buffer_overflow::symbolic_buffer_overflow): Drop
2130 m_dir_str.
2131 (symbolic_buffer_overflow::describe_final_event): New, as noted
2132 above.
2133 (symbolic_buffer_over_read::symbolic_buffer_overflow): Drop
2134 m_dir_str.
2135 (symbolic_buffer_over_read::describe_final_event): New, as noted
2136 above.
2138 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2140 * bounds-checking.cc (class out_of_bounds): Split out from...
2141 (class concrete_out_of_bounds): New abstract subclass.
2142 (class past_the_end): Rename to...
2143 (class concrete_past_the_end): ...this, and make a subclass of
2144 concrete_out_of_bounds.
2145 (class buffer_overflow): Rename to...
2146 (class concrete_buffer_overflow): ...this, and make a subclass of
2147 concrete_past_the_end.
2148 (class buffer_over_read): Rename to...
2149 (class concrete_buffer_over_read): ...this, and make a subclass of
2150 concrete_past_the_end.
2151 (class buffer_underwrite): Rename to...
2152 (class concrete_buffer_underwrite): ...this, and make a subclass
2153 of concrete_out_of_bounds.
2154 (class buffer_under_read): Rename to...
2155 (class concrete_buffer_under_read): ...this, and make a subclass
2156 of concrete_out_of_bounds.
2157 (class symbolic_past_the_end): Convert to a subclass of
2158 out_of_bounds.
2159 (symbolic_buffer_overflow::get_kind): New.
2160 (symbolic_buffer_over_read::get_kind): New.
2161 (region_model::check_region_bounds): Update for renamings.
2162 * engine.cc (impl_sm_context::set_next_state): Eliminate
2163 "new_ctxt", passing NULL to get_rvalue instead.
2164 (impl_sm_context::warn): Likewise.
2166 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2168 PR analyzer/106626
2169 * bounds-checking.cc (out_of_bounds::get_memory_space): New.
2170 (buffer_overflow::emit): Use it.
2171 (class buffer_overread): Rename to...
2172 (class buffer_over_read): ...this.
2173 (buffer_over_read::emit): Specify which memory space the read is
2174 from, where known. Change "overread" to "over-read".
2175 (class buffer_underflow): Rename to...
2176 (class buffer_underwrite): ...this.
2177 (buffer_underwrite::emit): Specify which memory space the write is
2178 to, where known. Change "underflow" to "underwrite".
2179 (class buffer_underread): Rename to...
2180 (class buffer_under_read): Rename to...
2181 (buffer_under_read::emit): Specify which memory space the read is
2182 from, where known. Change "underread" to "under-read".
2183 (symbolic_past_the_end::get_memory_space): New.
2184 (symbolic_buffer_overflow::emit): Use it.
2185 (class symbolic_buffer_overread): Rename to...
2186 (class symbolic_buffer_over_read): ...this.
2187 (symbolic_buffer_over_read::emit): Specify which memory space the
2188 read is from, where known. Change "overread" to "over-read".
2189 (region_model::check_symbolic_bounds): Update for class renaming.
2190 (region_model::check_region_bounds): Likewise.
2192 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2194 PR analyzer/106626
2195 * bounds-checking.cc (out_of_bounds::maybe_describe_array_bounds):
2196 New.
2197 (buffer_overflow::emit): Call maybe_describe_array_bounds.
2198 (buffer_overread::emit): Likewise.
2199 (buffer_underflow::emit): Likewise.
2200 (buffer_underread::emit): Likewise.
2202 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2204 PR analyzer/106626
2205 * bounds-checking.cc (buffer_overflow::emit): Use inform_n.
2206 Update wording to clarify that we're talking about the size of
2207 the bad access, rather than its position.
2208 (buffer_overread::emit): Likewise.
2210 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2212 * bounds-checking.cc: New file, taken from region-model.cc.
2213 * region-model.cc (class out_of_bounds): Move to
2214 bounds-checking.cc.
2215 (class past_the_end): Likewise.
2216 (class buffer_overflow): Likewise.
2217 (class buffer_overread): Likewise.
2218 (class buffer_underflow): Likewise.
2219 (class buffer_underread): Likewise.
2220 (class symbolic_past_the_end): Likewise.
2221 (class symbolic_buffer_overflow): Likewise.
2222 (class symbolic_buffer_overread): Likewise.
2223 (region_model::check_symbolic_bounds): Likewise.
2224 (maybe_get_integer_cst_tree): Likewise.
2225 (region_model::check_region_bounds): Likewise.
2226 * region-model.h: Add comment.
2228 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2230 PR analyzer/107928
2231 * sm-fd.cc (fd_state_machine::on_bind): Handle m_constant_fd in
2232 the "success" outcome.
2233 (fd_state_machine::on_connect): Likewise.
2234 * sm-fd.dot: Add "constant_fd" state and its transitions.
2236 2022-11-30 David Malcolm <dmalcolm@redhat.com>
2238 * region-model-impl-calls.cc (class kf_fgets): Move to sm-file.cc.
2239 (kf_fgets::impl_call_pre): Likewise.
2240 (class kf_fread): Likewise.
2241 (kf_fread::impl_call_pre): Likewise.
2242 (class kf_getchar): Likewise.
2243 (class kf_stdio_output_fn): Likewise.
2244 (register_known_functions): Move registration of
2245 BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
2246 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
2247 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
2248 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
2249 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
2250 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF,
2251 "getchar", "fgets", "fgets_unlocked", and "fread" to
2252 register_known_file_functions.
2253 * sm-file.cc (class kf_stdio_output_fn): Move here from
2254 region-model-impl-calls.cc.
2255 (class kf_fgets): Likewise.
2256 (class kf_fread): Likewise.
2257 (class kf_getchar): Likewise.
2258 (register_known_file_functions): Move registration of
2259 BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
2260 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
2261 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
2262 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
2263 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
2264 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF,
2265 "fgets", "fgets_unlocked", "fread", and "getchar" to here from
2266 register_known_functions.
2268 2022-11-30 David Malcolm <dmalcolm@redhat.com>
2270 PR analyzer/103546
2271 * analyzer.h (register_known_file_functions): New decl.
2272 * program-state.cc (sm_state_map::replay_call_summary): Rejct
2273 attempts to store sm-state for caller_sval that can't have
2274 associated state.
2275 * region-model-impl-calls.cc (register_known_functions): Call
2276 register_known_file_functions.
2277 * sm-fd.cc (class kf_isatty): New.
2278 (register_known_fd_functions): Register it.
2279 * sm-file.cc (class kf_ferror): New.
2280 (class kf_fileno): New.
2281 (class kf_getc): New.
2282 (register_known_file_functions): New.
2284 2022-11-30 David Malcolm <dmalcolm@redhat.com>
2286 PR analyzer/105784
2287 * region-model-manager.cc
2288 (region_model_manager::maybe_fold_binop): For POINTER_PLUS_EXPR,
2289 PLUS_EXPR and MINUS_EXPR, eliminate requirement that the final
2290 type matches that of arg0 in favor of a cast.
2292 2022-11-24 Martin Liska <mliska@suse.cz>
2294 * varargs.cc: Fix Clang warnings.
2296 2022-11-24 David Malcolm <dmalcolm@redhat.com>
2298 PR analyzer/106473
2299 * call-summary.cc
2300 (call_summary_replay::convert_region_from_summary_1): Update for
2301 change to creation of heap-allocated regions.
2302 * program-state.cc (test_program_state_1): Likewise.
2303 (test_program_state_merging): Likewise.
2304 * region-model-impl-calls.cc (kf_calloc::impl_call_pre): Likewise.
2305 (kf_malloc::impl_call_pre): Likewise.
2306 (kf_operator_new::impl_call_pre): Likewise.
2307 (kf_realloc::impl_call_postsuccess_with_move::update_model): Likewise.
2308 * region-model-manager.cc
2309 (region_model_manager::create_region_for_heap_alloc): Convert
2310 to...
2311 (region_model_manager::get_or_create_region_for_heap_alloc):
2312 ...this, reusing an existing region if it's unreferenced in the
2313 client state.
2314 * region-model-manager.h (region_model_manager::get_num_regions): New.
2315 (region_model_manager::create_region_for_heap_alloc): Convert to...
2316 (region_model_manager::get_or_create_region_for_heap_alloc): ...this.
2317 * region-model.cc (region_to_value_map::can_merge_with_p): Reject
2318 merger when the values are different.
2319 (region_model::create_region_for_heap_alloc): Convert to...
2320 (region_model::get_or_create_region_for_heap_alloc): ...this.
2321 (region_model::get_referenced_base_regions): New.
2322 (selftest::test_state_merging): Update for change to creation of
2323 heap-allocated regions.
2324 (selftest::test_malloc_constraints): Likewise.
2325 (selftest::test_malloc): Likewise.
2326 * region-model.h: Include "sbitmap.h".
2327 (region_model::create_region_for_heap_alloc): Convert to...
2328 (region_model::get_or_create_region_for_heap_alloc): ...this.
2329 (region_model::get_referenced_base_regions): New decl.
2330 * store.cc (store::canonicalize): Don't purge a heap-allocated region
2331 that's been marked as escaping.
2333 2022-11-24 David Malcolm <dmalcolm@redhat.com>
2335 * checker-path.cc (checker_path::inject_any_inlined_call_events):
2336 Don't dump the address of the block when -fdump-noaddr.
2338 2022-11-24 David Malcolm <dmalcolm@redhat.com>
2340 * region-model.h (region_model::on_socket): Delete decl.
2341 (region_model::on_bind): Likewise.
2342 (region_model::on_listen): Likewise.
2343 (region_model::on_accept): Likewise.
2344 (region_model::on_connect): Likewise.
2345 * sm-fd.cc (kf_socket::outcome_of_socket::update_model): Move body
2346 of region_model::on_socket into here, ...
2347 (region_model::on_socket): ...eliminating this function.
2348 (kf_bind::outcome_of_bind::update_model): Likewise for on_bind...
2349 (region_model::on_bind): ...eliminating this function.
2350 (kf_listen::outcome_of_listen::update_model): Likewise fo
2351 on_listen...
2352 (region_model::on_listen): ...eliminating this function.
2353 (kf_accept::outcome_of_accept::update_model): Likewise fo
2354 on_accept...
2355 (region_model::on_accept): ...eliminating this function.
2356 (kf_connect::outcome_of_connect::update_model): Likewise fo
2357 on_connect...
2358 (region_model::on_connect): ...eliminating this function.
2360 2022-11-24 David Malcolm <dmalcolm@redhat.com>
2362 * analyzer.h (register_known_fd_functions): New decl.
2363 * region-model-impl-calls.cc (class kf_accept): Move to sm-fd.cc.
2364 (class kf_bind): Likewise.
2365 (class kf_connect): Likewise.
2366 (class kf_listen): Likewise.
2367 (class kf_pipe): Likewise.
2368 (class kf_socket): Likewise.
2369 (register_known_functions): Remove registration of the above
2370 functions, instead calling register_known_fd_functions.
2371 * sm-fd.cc: Include "analyzer/call-info.h".
2372 (class kf_socket): Move here from region-model-impl-calls.cc.
2373 (class kf_bind): Likewise.
2374 (class kf_listen): Likewise.
2375 (class kf_accept): Likewise.
2376 (class kf_connect): Likewise.
2377 (class kf_pipe): Likewise.
2378 (register_known_fd_functions): New.
2380 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2382 PR analyzer/107788
2383 * known-function-manager.cc (known_function_manager::get_match):
2384 Don't look up fndecls by name when they're not in the root
2385 namespace.
2387 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2389 PR analyzer/107783
2390 * sm-fd.cc (fd_state_machine::check_for_new_socket_fd): Don't
2391 complain when old state is "fd-constant".
2392 (fd_state_machine::on_listen): Likewise.
2393 (fd_state_machine::on_accept): Likewise.
2395 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2397 PR analyzer/107807
2398 * region-model-impl-calls.cc (register_known_functions): Register
2399 "___errno" and "__error" as synonyms for "__errno_location".
2401 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2403 * analyzer.h (class internal_known_function): New.
2404 (register_varargs_builtins): New decl.
2405 * engine.cc (exploded_node::on_stmt_pre): Remove
2406 "out_terminate_path" param from call to region_model::on_stmt_pre.
2407 (feasibility_state::maybe_update_for_edge): Likewise.
2408 * known-function-manager.cc: Include "basic-block.h", "gimple.h",
2409 and "analyzer/region-model.h".
2410 (known_function_manager::known_function_manager): Initialize
2411 m_combined_fns_arr.
2412 (known_function_manager::~known_function_manager): Clean up
2413 m_combined_fns_arr.
2414 (known_function_manager::get_by_identifier): Make const.
2415 (known_function_manager::add): New overloaded definitions for
2416 enum built_in_function and enum internal_fn.
2417 (known_function_manager::get_by_fndecl): Delete.
2418 (known_function_manager::get_match): New.
2419 (known_function_manager::get_internal_fn): New.
2420 (known_function_manager::get_normal_builtin): New.
2421 * known-function-manager.h
2422 (known_function_manager::get_by_identifier): Make private and
2423 add const qualifier.
2424 (known_function_manager::get_by_fndecl): Delete.
2425 (known_function_manager::add): Add overloaded decls for
2426 enum built_in_function name and enum internal_fn.
2427 (known_function_manager::get_match): New decl.
2428 (known_function_manager::get_internal_fn): New decl.
2429 (known_function_manager::get_normal_builtin): New decl.
2430 (known_function_manager::m_combined_fns_arr): New field.
2431 * region-model-impl-calls.cc (call_details::arg_is_size_p): New.
2432 (class kf_alloca): New.
2433 (region_model::impl_call_alloca): Convert to...
2434 (kf_alloca::impl_call_pre): ...this.
2435 (kf_analyzer_dump_capacity::matches_call_types_p): Rewrite check
2436 to use call_details::arg_is_pointer_p.
2437 (region_model::impl_call_builtin_expect): Convert to...
2438 (class kf_expect): ...this.
2439 (class kf_calloc): New, adding check that both arguments are
2440 size_t.
2441 (region_model::impl_call_calloc): Convert to...
2442 (kf_calloc::impl_call_pre): ...this.
2443 (kf_connect::matches_call_types_p): Rewrite check to use
2444 call_details::arg_is_pointer_p.
2445 (region_model::impl_call_error): Convert to...
2446 (class kf_error): ...this, and...
2447 (kf_error::impl_call_pre): ...this.
2448 (class kf_fgets): New, adding checks that args 0 and 2 are
2449 pointers.
2450 (region_model::impl_call_fgets): Convert to...
2451 (kf_fgets::impl_call_pre): ...this.
2452 (class kf_fread): New, adding checks on the argument types.
2453 (region_model::impl_call_fread): Convert to...
2454 (kf_fread::impl_call_pre): ...this.
2455 (class kf_free): New, adding check that the argument is a pointer.
2456 (region_model::impl_call_free): Convert to...
2457 (kf_free::impl_call_post): ...this.
2458 (class kf_getchar): New.
2459 (class kf_malloc): New, adding check that the argument is a
2460 size_t.
2461 (region_model::impl_call_malloc): Convert to...
2462 (kf_malloc::impl_call_pre): ...this.
2463 (class kf_memcpy): New, adding checks on arguments.
2464 (region_model::impl_call_memcpy): Convert to...
2465 (kf_memcpy::impl_call_pre): ...this.
2466 (class kf_memset): New.
2467 (region_model::impl_call_memset): Convert to...
2468 (kf_memset::impl_call_pre): ...this.
2469 (kf_pipe::matches_call_types_p): Rewrite check to use
2470 call_details::arg_is_pointer_p.
2471 (kf_putenv::matches_call_types_p): Likewise.
2472 (class kf_realloc): New, adding checks on the argument types.
2473 (region_model::impl_call_realloc): Convert to...
2474 (kf_realloc::impl_call_post): ...this.
2475 (class kf_strchr): New.
2476 (region_model::impl_call_strchr): Convert to...
2477 (kf_strchr::impl_call_post): ...this.
2478 (class kf_stack_restore): New.
2479 (class kf_stack_save): New.
2480 (class kf_stdio_output_fn): New.
2481 (class kf_strcpy): New,
2482 (region_model::impl_call_strcpy): Convert to...
2483 (kf_strcpy::impl_call_pre): ...this.
2484 (class kf_strlen): New.
2485 (region_model::impl_call_strlen): Convert to...
2486 (kf_strlen::impl_call_pre): ...this.
2487 (class kf_ubsan_bounds): New.
2488 (region_model::impl_deallocation_call): Reimplement to avoid call
2489 to impl_call_free.
2490 (register_known_functions): Add handlers for IFN_BUILTIN_EXPECT
2491 and IFN_UBSAN_BOUNDS. Add handlers for BUILT_IN_ALLOCA,
2492 BUILT_IN_ALLOCA_WITH_ALIGN, BUILT_IN_CALLOC, BUILT_IN_EXPECT,
2493 BUILT_IN_EXPECT_WITH_PROBABILITY, BUILT_IN_FPRINTF,
2494 BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
2495 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
2496 BUILT_IN_FREE, BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED,
2497 BUILT_IN_MALLOC, BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK,
2498 BUILT_IN_MEMSET, BUILT_IN_MEMSET_CHK, BUILT_IN_PRINTF,
2499 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
2500 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
2501 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_REALLOC, BUILT_IN_STACK_RESTORE,
2502 BUILT_IN_STACK_SAVE, BUILT_IN_STRCHR, BUILT_IN_STRCPY,
2503 BUILT_IN_STRCPY_CHK, BUILT_IN_STRLEN, BUILT_IN_VFPRINTF, and
2504 BUILT_IN_VPRINTF. Call register_varargs_builtins. Add handlers
2505 for "getchar", "memset", "fgets", "fgets_unlocked", "fread",
2506 "error", and "error_at_line".
2507 * region-model.cc (region_model::on_stmt_pre): Drop
2508 "out_terminate_path" param.
2509 (region_model::get_known_function): Reimplement by calling
2510 known_function_manager::get_match, passing new "cd" param.
2511 Add overload taking enum internal_fn.
2512 (region_model::on_call_pre): Drop "out_terminate_path" param.
2513 Remove special-case handling of internal fns IFN_BUILTIN_EXPECT,
2514 IFN_UBSAN_BOUNDS, and IFN_VA_ARG, of built-in fns BUILT_IN_ALLOCA,
2515 BUILT_IN_ALLOCA_WITH_ALIGN, BUILT_IN_CALLOC, BUILT_IN_EXPECT,
2516 BUILT_IN_EXPECT_WITH_PROBABILITY, BUILT_IN_FREE, BUILT_IN_MALLOC,
2517 BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_MEMSET,
2518 BUILT_IN_MEMSET_CHK, BUILT_IN_REALLOC, BUILT_IN_STRCHR,
2519 BUILT_IN_STRCPY, BUILT_IN_STRCPY_CHK, BUILT_IN_STRLEN,
2520 BUILT_IN_STACK_SAVE, BUILT_IN_STACK_RESTORE, BUILT_IN_FPRINTF,
2521 BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED,
2522 BUILT_IN_FPUTC, BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS,
2523 BUILT_IN_FPUTS_UNLOCKED, BUILT_IN_FWRITE,
2524 BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
2525 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR,
2526 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED,
2527 BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF, BUILT_IN_VA_START, and
2528 BUILT_IN_VA_COPY, and of named functions "malloc", "calloc",
2529 "alloca", "realloc", "error", "error_at_line", "fgets",
2530 "fgets_unlocked", "fread", "getchar", "memset", "strchr", and
2531 "strlen". Replace all this special-casing with calls to
2532 get_known_function for internal fns and for fn decls.
2533 (region_model::on_call_post): Remove special-casing handling for
2534 "free" and "strchr", and for BUILT_IN_REALLOC, BUILT_IN_STRCHR,
2535 and BUILT_IN_VA_END. Replace by consolidating on usage of
2536 get_known_function.
2537 * region-model.h (call_details::arg_is_size_p): New.
2538 (region_model::on_stmt_pre): Drop "out_terminate_path" param.
2539 (region_model::on_call_pre): Likewise.
2540 (region_model::impl_call_alloca): Delete.
2541 (region_model::impl_call_builtin_expect): Delete.
2542 (region_model::impl_call_calloc): Delete.
2543 (region_model::impl_call_error): Delete.
2544 (region_model::impl_call_fgets): Delete.
2545 (region_model::impl_call_fread): Delete.
2546 (region_model::impl_call_free): Delete.
2547 (region_model::impl_call_malloc): Delete.
2548 (region_model::impl_call_memcpy): Delete.
2549 (region_model::impl_call_memset): Delete.
2550 (region_model::impl_call_realloc): Delete.
2551 (region_model::impl_call_strchr): Delete.
2552 (region_model::impl_call_strcpy): Delete.
2553 (region_model::impl_call_strlen): Delete.
2554 (region_model::impl_call_va_start): Delete.
2555 (region_model::impl_call_va_copy): Delete.
2556 (region_model::impl_call_va_arg): Delete.
2557 (region_model::impl_call_va_end): Delete.
2558 (region_model::check_region_for_write): Public.
2559 (region_model::get_known_function): Add "cd" param. Add
2560 overloaded decl taking enum internal_fn.
2561 * sm-malloc.cc: Update comments.
2562 * varargs.cc (class kf_va_start): New.
2563 (region_model::impl_call_va_start): Convert to...
2564 (kf_va_start::impl_call_pre): ...this.
2565 (class kf_va_copy): New.
2566 (region_model::impl_call_va_copy): Convert to...
2567 (kf_va_copy::impl_call_pre): ...this.
2568 (class kf_va_arg): New.
2569 (region_model::impl_call_va_arg): Convert to...
2570 (kf_va_arg::impl_call_pre): ...this.
2571 (class kf_va_end): New.
2572 (region_model::impl_call_va_end): Delete.
2573 (register_varargs_builtins): New.
2575 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2577 PR analyzer/107788
2578 * region-model.cc (region_model::update_for_int_cst_return):
2579 Require that the return type be an integer type.
2580 (region_model::update_for_nonzero_return): Likewise.
2582 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2584 PR analyzer/107783
2585 * region-model-impl-calls.cc (kf_accept::matches_call_types_p):
2586 Require that args 1 and 2 be pointers.
2587 (kf_bind::matches_call_types_p): Require that arg 1 be a pointer.
2588 * region-model.h (call_details::arg_is_pointer_p): New
2590 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2592 PR analyzer/107777
2593 * call-summary.cc
2594 (call_summary_replay::convert_region_from_summary_1): Handle
2595 RK_THREAD_LOCAL and RK_ERRNO in switch.
2596 * region-model.cc (region_model::get_representative_path_var_1):
2597 Likewise.
2599 2022-11-19 David Malcolm <dmalcolm@redhat.com>
2601 PR analyzer/107582
2602 * engine.cc (dynamic_call_info_t::update_model): Update the model
2603 by pushing or pop a frame, rather than by clobbering it with the
2604 model from the exploded_node's state.
2606 2022-11-18 David Malcolm <dmalcolm@redhat.com>
2608 * analyzer.cc (is_pipe_call_p): Delete.
2609 * analyzer.h (is_pipe_call_p): Delete.
2610 * region-model-impl-calls.cc (call_details::get_location): New.
2611 (class kf_analyzer_break): New, adapted from
2612 region_model::on_stmt_pre.
2613 (region_model::impl_call_analyzer_describe): Convert to...
2614 (class kf_analyzer_describe): ...this.
2615 (region_model::impl_call_analyzer_dump_capacity): Convert to...
2616 (class kf_analyzer_dump_capacity): ...this.
2617 (region_model::impl_call_analyzer_dump_escaped): Convert to...
2618 (class kf_analyzer_dump_escaped): ...this.
2619 (class kf_analyzer_dump_exploded_nodes): New.
2620 (region_model::impl_call_analyzer_dump_named_constant): Convert
2621 to...
2622 (class kf_analyzer_dump_named_constant): ...this.
2623 (class dump_path_diagnostic): Move here from region-model.cc.
2624 (class kf_analyzer_dump_path) New, adapted from
2625 region_model::on_stmt_pre.
2626 (class kf_analyzer_dump_region_model): Likewise.
2627 (region_model::impl_call_analyzer_eval): Convert to...
2628 (class kf_analyzer_eval): ...this.
2629 (region_model::impl_call_analyzer_get_unknown_ptr): Convert to...
2630 (class kf_analyzer_get_unknown_ptr): ...this.
2631 (class known_function_accept): Rename to...
2632 (class kf_accept): ...this.
2633 (class known_function_bind): Rename to...
2634 (class kf_bind): ...this.
2635 (class known_function_connect): Rename to...
2636 (class kf_connect): ...this.
2637 (region_model::impl_call_errno_location): Convert to...
2638 (class kf_errno_location): ...this.
2639 (class known_function_listen): Rename to...
2640 (class kf_listen): ...this.
2641 (region_model::impl_call_pipe): Convert to...
2642 (class kf_pipe): ...this.
2643 (region_model::impl_call_putenv): Convert to...
2644 (class kf_putenv): ...this.
2645 (region_model::impl_call_operator_new): Convert to...
2646 (class kf_operator_new): ...this.
2647 (region_model::impl_call_operator_delete): Convert to...
2648 (class kf_operator_delete): ...this.
2649 (class known_function_socket): Rename to...
2650 (class kf_socket): ...this.
2651 (register_known_functions): Rename param to KFM. Break out
2652 existing known functions into a "POSIX" section, and add "pipe",
2653 "pipe2", and "putenv". Add debugging functions
2654 "__analyzer_break", "__analyzer_describe",
2655 "__analyzer_dump_capacity", "__analyzer_dump_escaped",
2656 "__analyzer_dump_exploded_nodes",
2657 "__analyzer_dump_named_constant", "__analyzer_dump_path",
2658 "__analyzer_dump_region_model", "__analyzer_eval",
2659 "__analyzer_get_unknown_ptr". Add C++ support functions
2660 "operator new", "operator new []", "operator delete", and
2661 "operator delete []".
2662 * region-model.cc (class dump_path_diagnostic): Move to
2663 region-model-impl-calls.cc.
2664 (region_model::on_stmt_pre): Eliminate special-casing of
2665 "__analyzer_describe", "__analyzer_dump_capacity",
2666 "__analyzer_dump_escaped", "__analyzer_dump_named_constant",
2667 "__analyzer_dump_path", "__analyzer_dump_region_model",
2668 "__analyzer_eval", "__analyzer_break",
2669 "__analyzer_dump_exploded_nodes", "__analyzer_get_unknown_ptr",
2670 "__errno_location", "pipe", "pipe2", "putenv", "operator new",
2671 "operator new []", "operator delete", "operator delete []"
2672 "pipe" and "pipe2", handling them instead via the known_functions
2673 mechanism.
2674 * region-model.h (call_details::get_location): New decl.
2675 (region_model::impl_call_analyzer_describe): Delete decl.
2676 (region_model::impl_call_analyzer_dump_capacity): Delete decl.
2677 (region_model::impl_call_analyzer_dump_escaped): Delete decl.
2678 (region_model::impl_call_analyzer_dump_named_constant): Delete decl.
2679 (region_model::impl_call_analyzer_eval): Delete decl.
2680 (region_model::impl_call_analyzer_get_unknown_ptr): Delete decl.
2681 (region_model::impl_call_errno_location): Delete decl.
2682 (region_model::impl_call_pipe): Delete decl.
2683 (region_model::impl_call_putenv): Delete decl.
2684 (region_model::impl_call_operator_new): Delete decl.
2685 (region_model::impl_call_operator_delete): Delete decl.
2686 * sm-fd.cc: Update comments.
2688 2022-11-16 David Malcolm <dmalcolm@redhat.com>
2690 PR analyzer/107711
2691 * analyzer-language.cc: Include "diagnostic.h".
2692 (maybe_stash_named_constant): Add logger param and use it to log
2693 the name being looked up, and the result.
2694 (stash_named_constants): New, splitting out from...
2695 (on_finish_translation_unit): ...this function. Call
2696 get_or_create_logfile and use the result to create a logger
2697 instance, passing it to stash_named_constants.
2698 * analyzer.h (get_or_create_any_logfile): New decl.
2699 * engine.cc (dump_fout, owns_dump_fout): New globals, split out
2700 from run_checkers.
2701 (get_or_create_any_logfile): New function, split out from...
2702 (run_checkers): ...here, so that the logfile can be opened by
2703 on_finish_translation_unit. Clear the globals when closing the
2704 dump file.
2706 2022-11-16 David Malcolm <dmalcolm@redhat.com>
2708 * analyzer.h (known_function::matches_call_types_p): New vfunc.
2709 (known_function::impl_call_pre): Provide base implementation.
2710 (known_function::impl_call_post): New vfunc.
2711 (register_known_functions): New.
2712 * engine.cc (impl_run_checkers): Call register_known_functions.
2713 * region-model-impl-calls.cc (region_model::impl_call_accept):
2714 Convert to...
2715 (class known_function_accept): ...this.
2716 (region_model::impl_call_bind): Convert to...
2717 (class known_function_bind): ...this.
2718 (region_model::impl_call_connect): Convert to...
2719 (class known_function_connect): ...this.
2720 (region_model::impl_call_listen): Convert to...
2721 (class known_function_listen): ...this.
2722 (region_model::impl_call_socket): Convert to...
2723 (class known_function_socket): ...this.
2724 (register_known_functions): New.
2725 * region-model.cc (region_model::on_call_pre): Remove special
2726 case for "bind" in favor of the known_function-handling dispatch.
2727 Add call to known_function::matches_call_types_p to latter.
2728 (region_model::on_call_post): Remove special cases for "accept",
2729 "bind", "connect", "listen", and "socket" in favor of dispatch
2730 to known_function::impl_call_post.
2731 * region-model.h (region_model::impl_call_accept): Delete decl.
2732 (region_model::impl_call_bind): Delete decl.
2733 (region_model::impl_call_connect): Delete decl.
2734 (region_model::impl_call_listen): Delete decl.
2735 (region_model::impl_call_socket): Delete decl.
2736 * sm-fd.cc: Update comments.
2738 2022-11-16 David Malcolm <dmalcolm@redhat.com>
2740 * checker-event.cc: New file, split out from...
2741 * checker-path.cc: ...this file.
2743 2022-11-15 David Malcolm <dmalcolm@redhat.com>
2745 PR analyzer/106140
2746 * analyzer-language.cc (on_finish_translation_unit): Stash named
2747 constants "SOCK_STREAM" and "SOCK_DGRAM".
2748 * analyzer.opt (Wanalyzer-fd-phase-mismatch): New.
2749 (Wanalyzer-fd-type-mismatch): New.
2750 * engine.cc (impl_region_model_context::get_state_map_by_name):
2751 Add "out_sm_context" param. Allow out_sm_idx to be NULL.
2752 * exploded-graph.h
2753 (impl_region_model_context::get_state_map_by_name):
2754 Add "out_sm_context" param.
2755 * region-model-impl-calls.cc (region_model::impl_call_accept): New.
2756 (region_model::impl_call_bind): New.
2757 (region_model::impl_call_connect): New.
2758 (region_model::impl_call_listen): New.
2759 (region_model::impl_call_socket): New.
2760 * region-model.cc (region_model::on_call_pre): Special-case
2761 "bind".
2762 (region_model::on_call_post): Special-case "accept", "bind",
2763 "connect", "listen", and "socket".
2764 * region-model.h (region_model::impl_call_accept): New decl.
2765 (region_model::impl_call_bind): New decl.
2766 (region_model::impl_call_connect): New decl.
2767 (region_model::impl_call_listen): New decl.
2768 (region_model::impl_call_socket): New decl.
2769 (region_model::on_socket): New decl.
2770 (region_model::on_bind): New decl.
2771 (region_model::on_listen): New decl.
2772 (region_model::on_accept): New decl.
2773 (region_model::on_connect): New decl.
2774 (region_model::add_constraint): Make public.
2775 (region_model::check_for_poison): Make public.
2776 (region_model_context::get_state_map_by_name): Add out_sm_context param.
2777 (region_model_context::get_fd_map): Likewise.
2778 (region_model_context::get_malloc_map): Likewise.
2779 (region_model_context::get_taint_map): Likewise.
2780 (noop_region_model_context::get_state_map_by_name): Likewise.
2781 (region_model_context_decorator::get_state_map_by_name): Likewise.
2782 * sm-fd.cc: Include "analyzer/supergraph.h" and
2783 "analyzer/analyzer-language.h".
2784 (enum expected_phase): New enum.
2785 (fd_state_machine::m_new_datagram_socket): New.
2786 (fd_state_machine::m_new_stream_socket): New.
2787 (fd_state_machine::m_new_unknown_socket): New.
2788 (fd_state_machine::m_bound_datagram_socket): New.
2789 (fd_state_machine::m_bound_stream_socket): New.
2790 (fd_state_machine::m_bound_unknown_socket): New.
2791 (fd_state_machine::m_listening_stream_socket): New.
2792 (fd_state_machine::m_m_connected_stream_socket): New.
2793 (fd_state_machine::m_SOCK_STREAM): New.
2794 (fd_state_machine::m_SOCK_DGRAM): New.
2795 (fd_diagnostic::describe_state_change): Handle socket states.
2796 (fd_diagnostic::get_meaning_for_state_change): Likewise.
2797 (class fd_phase_mismatch): New.
2798 (enum expected_type): New enum.
2799 (class fd_type_mismatch): New.
2800 (fd_state_machine::fd_state_machine): Initialize new states and
2801 stashed named constants.
2802 (fd_state_machine::is_socket_fd_p): New.
2803 (fd_state_machine::is_datagram_socket_fd_p): New.
2804 (fd_state_machine::is_stream_socket_fd_p): New.
2805 (fd_state_machine::on_close): Handle the socket states.
2806 (fd_state_machine::check_for_open_fd): Complain about fncalls on
2807 sockets in the wrong phase. Support socket FDs.
2808 (add_constraint_ge_zero): New.
2809 (fd_state_machine::get_state_for_socket_type): New.
2810 (fd_state_machine::on_socket): New.
2811 (fd_state_machine::check_for_socket_fd): New.
2812 (fd_state_machine::check_for_new_socket_fd): New.
2813 (fd_state_machine::on_bind): New.
2814 (fd_state_machine::on_listen): New.
2815 (fd_state_machine::on_accept): New.
2816 (fd_state_machine::on_connect): New.
2817 (fd_state_machine::can_purge_p): Don't purge socket values.
2818 (get_fd_state): New.
2819 (region_model::mark_as_valid_fd): Use get_fd_state.
2820 (region_model::on_socket): New.
2821 (region_model::on_bind): New.
2822 (region_model::on_listen): New.
2823 (region_model::on_accept): New.
2824 (region_model::on_connect): New.
2825 * sm-fd.dot: Update to reflect sm-fd.cc changes.
2827 2022-11-15 David Malcolm <dmalcolm@redhat.com>
2829 PR analyzer/106302
2830 * analyzer-language.cc: New file.
2831 * analyzer-language.h: New file.
2832 * analyzer.h (get_stashed_constant_by_name): New decl.
2833 (log_stashed_constants): New decl.
2834 * engine.cc (impl_run_checkers): Call log_stashed_constants.
2835 * region-model-impl-calls.cc
2836 (region_model::impl_call_analyzer_dump_named_constant): New.
2837 * region-model.cc (region_model::on_stmt_pre): Handle
2838 __analyzer_dump_named_constant.
2839 * region-model.h
2840 (region_model::impl_call_analyzer_dump_named_constant): New decl.
2841 * sm-fd.cc (fd_state_machine::m_O_ACCMODE): New.
2842 (fd_state_machine::m_O_RDONLY): New.
2843 (fd_state_machine::m_O_WRONLY): New.
2844 (fd_state_machine::fd_state_machine): Initialize the new fields.
2845 (fd_state_machine::get_access_mode_from_flag): Use the new fields,
2846 rather than using the host values.
2848 2022-11-13 David Malcolm <dmalcolm@redhat.com>
2850 PR analyzer/106235
2851 * analyzer.opt (Wanalyzer-tainted-assertion): New.
2852 * checker-path.cc (checker_path::fixup_locations): Pass false to
2853 pending_diagnostic::fixup_location.
2854 * diagnostic-manager.cc (get_emission_location): Pass true to
2855 pending_diagnostic::fixup_location.
2856 * pending-diagnostic.cc (pending_diagnostic::fixup_location): Add
2857 bool param.
2858 * pending-diagnostic.h (pending_diagnostic::fixup_location): Add
2859 bool param to decl.
2860 * sm-taint.cc (taint_state_machine::m_tainted_control_flow): New.
2861 (taint_diagnostic::describe_state_change): Drop "final".
2862 (class tainted_assertion): New.
2863 (taint_state_machine::taint_state_machine): Initialize
2864 m_tainted_control_flow.
2865 (taint_state_machine::alt_get_inherited_state): Support
2866 comparisons being tainted, based on their arguments.
2867 (is_assertion_failure_handler_p): New.
2868 (taint_state_machine::on_stmt): Complain about calls to assertion
2869 failure handlers guarded by an attacker-controller conditional.
2870 Detect attacker-controlled gcond conditionals and gswitch index
2871 values.
2872 (taint_state_machine::check_control_flow_arg_for_taint): New.
2874 2022-11-11 David Malcolm <dmalcolm@redhat.com>
2876 * sm-fd.dot: Fix typo in comment.
2877 * sm-file.dot: New file.
2878 * varargs.cc: Fix typo in comment.
2879 * varargs.dot: New file.
2881 2022-11-11 David Malcolm <dmalcolm@redhat.com>
2883 * checker-path.h: Split out checker_event and its subclasses to...
2884 * checker-event.h: ...this new header.
2886 2022-11-11 David Malcolm <dmalcolm@redhat.com>
2888 PR analyzer/106147
2889 * analyzer.opt (Wanalyzer-infinite-recursion): New.
2890 * call-string.cc (call_string::count_occurrences_of_function):
2891 New.
2892 * call-string.h (call_string::count_occurrences_of_function): New
2893 decl.
2894 * checker-path.cc (function_entry_event::function_entry_event):
2895 New ctor.
2896 (checker_path::add_final_event): Delete.
2897 * checker-path.h (function_entry_event::function_entry_event): New
2898 ctor.
2899 (function_entry_event::get_desc): Drop "final".
2900 (checker_path::add_final_event): Delete.
2901 * diagnostic-manager.cc
2902 (diagnostic_manager::emit_saved_diagnostic): Create the final
2903 event via a new pending_diagnostic::add_final_event vfunc, rather
2904 than checker_path::add_final_event.
2905 (diagnostic_manager::add_events_for_eedge): Create function entry
2906 events via a new pending_diagnostic::add_function_entry_event
2907 vfunc.
2908 * engine.cc (exploded_graph::process_node): When creating a new
2909 PK_BEFORE_SUPERNODE node, call
2910 exploded_graph::detect_infinite_recursion on it after adding the
2911 in-edge.
2912 * exploded-graph.h (exploded_graph::detect_infinite_recursion):
2913 New decl.
2914 (exploded_graph::find_previous_entry_to): New decl.
2915 * infinite-recursion.cc: New file.
2916 * pending-diagnostic.cc
2917 (pending_diagnostic::add_function_entry_event): New.
2918 (pending_diagnostic::add_final_event): New.
2919 * pending-diagnostic.h
2920 (pending_diagnostic::add_function_entry_event): New vfunc.
2921 (pending_diagnostic::add_final_event): New vfunc.
2923 2022-11-10 David Malcolm <dmalcolm@redhat.com>
2925 PR analyzer/99671
2926 * analyzer.opt (Wanalyzer-deref-before-check): New warning.
2927 * diagnostic-manager.cc
2928 (null_assignment_sm_context::set_next_state): Only add state
2929 change events for transition to "null" state.
2930 (null_assignment_sm_context::is_transition_to_null): New.
2931 * engine.cc (impl_region_model_context::on_pop_frame): New.
2932 * exploded-graph.h (impl_region_model_context::on_pop_frame): New
2933 decl.
2934 * program-state.cc (sm_state_map::clear_any_state): New.
2935 (sm_state_map::can_merge_with_p): New.
2936 (program_state::can_merge_with_p): Replace requirement that
2937 sm-states be equal in favor of an attempt to merge them.
2938 * program-state.h (sm_state_map::clear_any_state): New decl.
2939 (sm_state_map::can_merge_with_p): New decl.
2940 * region-model.cc (region_model::eval_condition): Make const.
2941 (region_model::pop_frame): Call ctxt->on_pop_frame.
2942 * region-model.h (region_model::eval_condition): Make const.
2943 (region_model_context::on_pop_frame): New vfunc.
2944 (noop_region_model_context::on_pop_frame): New.
2945 (region_model_context_decorator::on_pop_frame): New.
2946 * sm-malloc.cc (enum resource_state): Add RS_ASSUMED_NON_NULL.
2947 (allocation_state::dump_to_pp): Drop "final".
2948 (struct assumed_non_null_state): New subclass.
2949 (malloc_state_machine::m_assumed_non_null): New.
2950 (assumed_non_null_p): New.
2951 (class deref_before_check): New.
2952 (assumed_non_null_state::dump_to_pp): New.
2953 (malloc_state_machine::get_or_create_assumed_non_null_state_for_frame):
2954 New.
2955 (malloc_state_machine::maybe_assume_non_null): New.
2956 (malloc_state_machine::on_stmt): Transition from start state to
2957 "assumed-non-null" state for pointers passed to
2958 __attribute__((nonnull)) arguments, and for pointers explicitly
2959 dereferenced. Call maybe_complain_about_deref_before_check for
2960 pointers explicitly compared against NULL.
2961 (malloc_state_machine::maybe_complain_about_deref_before_check):
2962 New.
2963 (malloc_state_machine::on_deallocator_call): Also transition
2964 "assumed-non-null" states to "freed".
2965 (malloc_state_machine::on_pop_frame): New.
2966 (malloc_state_machine::maybe_get_merged_states_nonequal): New.
2967 * sm-malloc.dot: Update for changes to sm-malloc.cc.
2968 * sm.h (state_machine::on_pop_frame): New.
2969 (state_machine::maybe_get_merged_state): New.
2970 (state_machine::maybe_get_merged_states_nonequal): New.
2972 2022-11-09 David Malcolm <dmalcolm@redhat.com>
2974 * checker-path.cc (checker_event::debug): New.
2975 (checker_path::add_event): Move here from checker-path.h. Add
2976 logging.
2977 * checker-path.h (checker_event::debug): New decl.
2978 (checker_path::checker_path): Add logger param.
2979 (checker_path::add_event): Move definition from here to
2980 checker-path.cc.
2981 (checker_path::m_logger): New field.
2982 * diagnostic-manager.cc
2983 (diagnostic_manager::emit_saved_diagnostic): Pass logger to
2984 checker_path ctor.
2985 (diagnostic_manager::add_events_for_eedge): Log scope when
2986 processing a run of stmts.
2988 2022-11-08 David Malcolm <dmalcolm@redhat.com>
2990 PR analyzer/101962
2991 * region-model-impl-calls.cc: Update comment.
2992 * region-model.cc (region_model::check_symbolic_bounds): Fix
2993 layout of "void" return. Replace usage of
2994 eval_condition_without_cm with eval_condition.
2995 (region_model::eval_condition): Take over body of...
2996 (region_model::eval_condition_without_cm): ...this subroutine,
2997 dropping the latter. Eliminating this distinction avoids issues
2998 where constraints were not considered when recursing.
2999 (region_model::compare_initial_and_pointer): Update comment.
3000 (region_model::symbolic_greater_than): Replace usage of
3001 eval_condition_without_cm with eval_condition.
3002 * region-model.h
3003 (region_model::eval_condition_without_cm): Delete decl.
3005 2022-11-08 David Malcolm <dmalcolm@redhat.com>
3007 * region-model-impl-calls.cc
3008 (region_model::impl_call_errno_location): New.
3009 * region-model-manager.cc
3010 (region_model_manager::region_model_manager): Initialize
3011 m_thread_local_region and m_errno_region.
3012 * region-model-manager.h (region_model_manager::get_errno_region):
3013 New accessor.
3014 (region_model_manager::m_thread_local_region): New.
3015 (region_model_manager::m_errno_region): New.
3016 * region-model.cc (region_model::on_call_pre): Special-case
3017 "__errno_location".
3018 (region_model::set_errno): New.
3019 * region-model.h (impl_call_errno_location): New decl.
3020 (region_model::set_errno): New decl.
3021 * region.cc (thread_local_region::dump_to_pp): New.
3022 (errno_region::dump_to_pp): New.
3023 * region.h (enum memory_space): Add MEMSPACE_THREAD_LOCAL.
3024 (enum region_kind): Add RK_THREAD_LOCAL and RK_ERRNO.
3025 (class thread_local_region): New.
3026 (is_a_helper <const thread_local_region *>::test): New.
3027 (class errno_region): New.
3028 (is_a_helper <const errno_region *>::test): New.
3029 * store.cc (binding_cluster::escaped_p): New.
3030 (store::escaped_p): Treat errno as always having escaped.
3031 (store::replay_call_summary_cluster): Handle RK_THREAD_LOCAL and
3032 RK_ERRNO.
3033 * store.h (binding_cluster::escaped_p): Remove definition.
3035 2022-11-08 David Malcolm <dmalcolm@redhat.com>
3037 * call-info.cc (success_call_info::get_desc): Delete.
3038 (failed_call_info::get_desc): Likewise.
3039 (succeed_or_fail_call_info::get_desc): New.
3040 * call-info.h (class succeed_or_fail_call_info): New.
3041 (class success_call_info): Convert to a subclass of
3042 succeed_or_fail_call_info.
3043 (class failed_call_info): Likewise.
3045 2022-11-08 David Malcolm <dmalcolm@redhat.com>
3047 * region-model-impl-calls.cc (region_model::impl_call_strchr):
3048 Move to on_call_post. Handle both outcomes using bifurcation,
3049 rather than just the "not found" case.
3050 * region-model.cc (region_model::on_call_pre): Move
3051 BUILT_IN_STRCHR and "strchr" to...
3052 (region_model::on_call_post): ...here.
3054 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3056 * analyzer.h: Use std::unique_ptr for state machines from plugins.
3057 * engine.cc: Likewise.
3059 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3061 * analyzer.h: Use std::unique_ptr for known functions.
3062 * engine.cc: Likewise.
3063 * known-function-manager.cc: Likewise.
3064 * known-function-manager.h: Likewise.
3066 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3068 * analysis-plan.cc: Define INCLUDE_MEMORY before including
3069 system.h.
3070 * analyzer-pass.cc: Likewise.
3071 * analyzer-selftests.cc: Likewise.
3072 * analyzer.cc: Likewise.
3073 * analyzer.h: Use std::unique_ptr in bifurcation code.
3074 * call-string.cc: Define INCLUDE_MEMORY before including system.h.
3075 * complexity.cc: Likewise.
3076 * engine.cc: Use std::unique_ptr in bifurcation code.
3077 * exploded-graph.h: Likewise.
3078 * known-function-manager.cc: Define INCLUDE_MEMORY before
3079 including system.h.
3080 * region-model-impl-calls.cc: Use std::unique_ptr in bifurcation
3081 code.
3082 * region-model.cc: Likewise.
3083 * region-model.h: Likewise.
3084 * supergraph.cc: Define INCLUDE_MEMORY before including system.h.
3086 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3088 * call-info.cc: Use std::unique_ptr for checker_event.
3089 * checker-path.cc: Likewise.
3090 * checker-path.h: Likewise.
3091 * diagnostic-manager.cc: Likewise.
3092 * engine.cc: Likewise.
3093 * pending-diagnostic.cc: Likewise.
3094 * sm-signal.cc: Likewise.
3095 * varargs.cc: Likewise.
3097 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3099 * diagnostic-manager.cc: Include "make-unique.h".
3100 Use std::unique_ptr for feasibility_problems and exploded_path.
3101 Delete explicit saved_diagnostic dtor.
3102 * diagnostic-manager.h: Likewise.
3103 * engine.cc: Likewise.
3104 * exploded-graph.h: Likewise.
3105 * feasible-graph.cc: Likewise.
3106 * feasible-graph.h: Likewise.
3108 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3110 * checker-path.cc (rewind_event::rewind_event): Update for usage of
3111 std::unique_ptr on custom_edge_info.
3112 * engine.cc (exploded_node::on_longjmp): Likewise.
3113 (exploded_edge::exploded_edge): Likewise.
3114 (exploded_edge::~exploded_edge): Delete.
3115 (exploded_graph::add_function_entry): Update for usage of
3116 std::unique_ptr on custom_edge_info.
3117 (exploded_graph::add_edge): Likewise.
3118 (add_tainted_args_callback): Likewise.
3119 (exploded_graph::maybe_create_dynamic_call): Likewise.
3120 (exploded_graph::process_node): Likewise.
3121 * exploded-graph.h (exploded_edge::~exploded_edge): Delete.
3122 (exploded_edge::m_custom_info): Use std::unique_ptr.
3123 (exploded_edge::add_edge): Likewise.
3124 * sm-signal.cc (register_signal_handler::impl_transition): Use
3125 make_unique.
3127 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3129 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic): Make
3130 stmt_finder const.
3131 (saved_diagnostic::~saved_diagnostic): Remove explicit delete of
3132 m_stmt_finder.
3133 (diagnostic_manager::add_diagnostic): Make stmt_finder const.
3134 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic):
3135 Likewise.
3136 (saved_diagnostic::m_stmt_finder): Convert to std::unique_ptr.
3137 (diagnostic_manager::add_diagnostic): Make stmt_finder const.
3138 * engine.cc (impl_sm_context::impl_sm_context): Likewise.
3139 (impl_sm_context::m_stmt_finder): Likewise.
3140 (leak_stmt_finder::clone): Convert return type to std::unique_ptr.
3141 * exploded-graph.h (stmt_finder::clone): Likewise.
3143 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3145 * call-info.cc: Add define of INCLUDE_MEMORY.
3146 * call-summary.cc: Likewise.
3147 * checker-path.cc: Likewise.
3148 * constraint-manager.cc: Likewise.
3149 * diagnostic-manager.cc: Likewise.
3150 (saved_diagnostic::saved_diagnostic): Use std::unique_ptr for
3151 param d and field m_d.
3152 (saved_diagnostic::~saved_diagnostic): Remove explicit delete of m_d.
3153 (saved_diagnostic::add_note): Use std::unique_ptr for
3154 param pn.
3155 (saved_diagnostic::get_pending_diagnostic): Update for conversion
3156 of m_sd.m_d to unique_ptr.
3157 (diagnostic_manager::add_diagnostic): Use std::unique_ptr for
3158 param d. Remove explicit deletion.
3159 (diagnostic_manager::add_note): Use std::unique_ptr for param pn.
3160 (diagnostic_manager::emit_saved_diagnostic): Update for conversion
3161 of m_sd.m_d to unique_ptr.
3162 (null_assignment_sm_context::warn): Use std::unique_ptr for
3163 param d. Remove explicit deletion.
3164 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Use
3165 std::unique_ptr for param d.
3166 (saved_diagnostic::add_note): Likewise for param pn.
3167 (saved_diagnostic::m_d): Likewise.
3168 (diagnostic_manager::add_diagnostic): Use std::unique_ptr for
3169 param d.
3170 (diagnostic_manager::add_note): Use std::unique_ptr for param pn.
3171 * engine.cc: Include "make-unique.h".
3172 (impl_region_model_context::warn): Update to use std::unique_ptr
3173 for param, removing explicit deletion.
3174 (impl_region_model_context::add_note): Likewise.
3175 (impl_sm_context::warn): Update to use std::unique_ptr
3176 for param.
3177 (impl_region_model_context::on_state_leak): Likewise for result of
3178 on_leak.
3179 (exploded_node::on_longjmp): Use make_unique when creating
3180 pending_diagnostic.
3181 (exploded_graph::process_node): Likewise.
3182 * exploded-graph.h (impl_region_model_context::warn): Update to
3183 use std::unique_ptr for param.
3184 (impl_region_model_context::add_note): Likewise.
3185 * feasible-graph.cc: Add define of INCLUDE_MEMORY.
3186 * pending-diagnostic.cc: Likewise.
3187 * pending-diagnostic.h: Include analyzer.sm.h"
3188 * program-point.cc: Add define of INCLUDE_MEMORY.
3189 * program-state.cc: Likewise.
3190 * region-model-asm.cc: Likewise.
3191 * region-model-impl-calls.cc: Likewise. Include "make-unique.h".
3192 (region_model::impl_call_putenv): Use make_unique when creating
3193 pending_diagnostic.
3194 * region-model-manager.cc: Add define of INCLUDE_MEMORY.
3195 * region-model-reachability.cc: Likewise.
3196 * region-model.cc: Likewise. Include "make-unique.h".
3197 (region_model::get_gassign_result): Use make_unique when creating
3198 pending_diagnostic.
3199 (region_model::check_for_poison): Likewise.
3200 (region_model::on_stmt_pre): Likewise.
3201 (region_model::check_symbolic_bounds): Likewise.
3202 (region_model::check_region_bounds): Likewise.
3203 (annotating_ctxt: make_note): Use std::unique_ptr for result.
3204 (region_model::deref_rvalue): Use make_unique when creating
3205 pending_diagnostic.
3206 (region_model::check_for_writable_region): Likewise.
3207 (region_model::check_region_size): Likewise.
3208 (region_model::check_dynamic_size_for_floats): Likewise.
3209 (region_model::maybe_complain_about_infoleak): Likewise.
3210 (noop_region_model_context::add_note): Use std::unique_ptr for
3211 param. Remove explicit deletion.
3212 * region-model.h: Include "analyzer/pending-diagnostic.h".
3213 (region_model_context::warn): Convert param to std::unique_ptr.
3214 (region_model_context::add_note): Likewise.
3215 (noop_region_model_context::warn): Likewise.
3216 (noop_region_model_context::add_note): Likewise.
3217 (region_model_context_decorator::warn): Likewise.
3218 (region_model_context_decorator::add_note): Likewise.
3219 (note_adding_context::warn): Likewise.
3220 (note_adding_context::make_note): Likewise for return type.
3221 (test_region_model_context::warn): Convert param to
3222 std::unique_ptr.
3223 * region.cc: Add define of INCLUDE_MEMORY.
3224 * sm-fd.cc: Likewise. Include "make-unique.h".
3225 (fd_state_machine::check_for_fd_attrs): Use make_unique when
3226 creating pending_diagnostics.
3227 (fd_state_machine::on_open): Likewise.
3228 (fd_state_machine::on_creat): Likewise.
3229 (fd_state_machine::check_for_dup): Likewise.
3230 (fd_state_machine::on_close): Likewise.
3231 (fd_state_machine::check_for_open_fd): Likewise.
3232 (fd_state_machine::on_leak): Likewise, converting return type to
3233 std::unique_ptr.
3234 * sm-file.cc: Add define of INCLUDE_MEMORY. Include
3235 "make-unique.h".
3236 (fileptr_state_machine::on_stmt): Use make_unique when creating
3237 pending_diagnostic.
3238 (fileptr_state_machine::on_leak): Likewise, converting return type
3239 to std::unique_ptr.
3240 * sm-malloc.cc: Add define of INCLUDE_MEMORY. Include
3241 "make-unique.h".
3242 (malloc_state_machine::on_stmt): Use make_unique when creating
3243 pending_diagnostic.
3244 (malloc_state_machine::handle_free_of_non_heap): Likewise.
3245 (malloc_state_machine::on_deallocator_call): Likewise.
3246 (malloc_state_machine::on_realloc_call): Likewise.
3247 (malloc_state_machine::on_leak): Likewise, converting return type
3248 to std::unique_ptr.
3249 * sm-pattern-test.cc: Add define of INCLUDE_MEMORY. Include
3250 "make-unique.h".
3251 (pattern_test_state_machine::on_condition): Use make_unique when
3252 creating pending_diagnostic.
3253 * sm-sensitive.cc: Add define of INCLUDE_MEMORY. Include
3254 "make-unique.h".
3255 (sensitive_state_machine::warn_for_any_exposure): Use make_unique
3256 when creating pending_diagnostic.
3257 * sm-signal.cc: Add define of INCLUDE_MEMORY. Include
3258 "make-unique.h".
3259 (signal_state_machine::on_stmt): Use make_unique when creating
3260 pending_diagnostic.
3261 * sm-taint.cc: Add define of INCLUDE_MEMORY. Include
3262 "make-unique.h".
3263 (taint_state_machine::check_for_tainted_size_arg): Use make_unique
3264 when creating pending_diagnostic.
3265 (taint_state_machine::check_for_tainted_divisor): Likewise.
3266 (region_model::check_region_for_taint): Likewise.
3267 (region_model::check_dynamic_size_for_taint): Likewise.
3268 * sm.cc: Add define of INCLUDE_MEMORY. Include
3269 "analyzer/pending-diagnostic.h".
3270 (state_machine::on_leak): Move here from sm.h, changing return
3271 type to std::unique_ptr.
3272 * sm.h (state_machine::on_leak): Change return type to
3273 std::unique_ptr. Move defn of base impl to sm.cc
3274 (sm_context::warn): Convert param d to std_unique_ptr.
3275 * state-purge.cc: Add define of INCLUDE_MEMORY.
3276 * store.cc: Likewise.
3277 * svalue.cc: Likewise.
3278 * trimmed-graph.cc: Likewise.
3279 * varargs.cc: Likewise. Include "make-unique.h".
3280 (va_list_state_machine::check_for_ended_va_list): Use make_unique
3281 when creating pending_diagnostic.
3282 (va_list_state_machine::on_leak): Likewise, converting return type
3283 to std::unique_ptr.
3284 (region_model::impl_call_va_arg): Use make_unique when creating
3285 pending_diagnostic.
3287 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3289 PR analyzer/107486
3290 * analyzer.cc (is_pipe_call_p): New.
3291 * analyzer.h (is_pipe_call_p): New decl.
3292 * region-model.cc (region_model::on_call_pre): Use it.
3293 (region_model::on_call_post): Likewise.
3295 2022-10-26 David Malcolm <dmalcolm@redhat.com>
3297 * sm-fd.cc (fd_state_machine::on_open): Transition to "unchecked"
3298 when the mode is symbolic, rather than just on integer constants.
3299 (fd_state_machine::check_for_open_fd): Don't complain about
3300 unchecked values in the start state.
3302 2022-10-26 David Malcolm <dmalcolm@redhat.com>
3304 * sm-fd.dot: New file.
3306 2022-10-24 David Malcolm <dmalcolm@redhat.com>
3308 PR analyzer/107349
3309 * varargs.cc (get_va_copy_arg): Fix the non-pointer case.
3311 2022-10-24 David Malcolm <dmalcolm@redhat.com>
3313 PR analyzer/107345
3314 * region-model.cc (region_model::eval_condition_without_cm):
3315 Ensure that constants are on the right-hand side before checking
3316 for them.
3318 2022-10-24 David Malcolm <dmalcolm@redhat.com>
3320 * engine.cc (impl_region_model_context::get_malloc_map): Replace
3321 with...
3322 (impl_region_model_context::get_state_map_by_name): ...this.
3323 (impl_region_model_context::get_fd_map): Delete.
3324 (impl_region_model_context::get_taint_map): Delete.
3325 * exploded-graph.h (impl_region_model_context::get_fd_map):
3326 Delete.
3327 (impl_region_model_context::get_malloc_map): Delete.
3328 (impl_region_model_context::get_taint_map): Delete.
3329 (impl_region_model_context::get_state_map_by_name): New.
3330 * region-model.h (region_model_context::get_state_map_by_name):
3331 New vfunc.
3332 (region_model_context::get_fd_map): Convert from vfunc to
3333 function.
3334 (region_model_context::get_malloc_map): Likewise.
3335 (region_model_context::get_taint_map): Likewise.
3336 (noop_region_model_context::get_state_map_by_name): New.
3337 (noop_region_model_context::get_fd_map): Delete.
3338 (noop_region_model_context::get_malloc_map): Delete.
3339 (noop_region_model_context::get_taint_map): Delete.
3340 (region_model_context_decorator::get_state_map_by_name): New.
3341 (region_model_context_decorator::get_fd_map): Delete.
3342 (region_model_context_decorator::get_malloc_map): Delete.
3343 (region_model_context_decorator::get_taint_map): Delete.
3345 2022-10-24 David Malcolm <dmalcolm@redhat.com>
3347 PR analyzer/106300
3348 * engine.cc (impl_region_model_context::get_fd_map): New.
3349 * exploded-graph.h (impl_region_model_context::get_fd_map): New
3350 decl.
3351 * region-model-impl-calls.cc (region_model::impl_call_pipe): New.
3352 * region-model.cc (region_model::update_for_int_cst_return): New,
3353 based on...
3354 (region_model::update_for_zero_return): ...this. Reimplement in
3355 terms of the former.
3356 (region_model::on_call_pre): Handle "pipe" and "pipe2".
3357 (region_model::on_call_post): Likewise.
3358 * region-model.h (region_model::impl_call_pipe): New decl.
3359 (region_model::update_for_int_cst_return): New decl.
3360 (region_model::mark_as_valid_fd): New decl.
3361 (region_model_context::get_fd_map): New pure virtual fn.
3362 (noop_region_model_context::get_fd_map): New.
3363 (region_model_context_decorator::get_fd_map): New.
3364 * sm-fd.cc: Include "analyzer/program-state.h".
3365 (fd_state_machine::describe_state_change): Handle transitions from
3366 start state to valid states.
3367 (fd_state_machine::mark_as_valid_fd): New.
3368 (fd_state_machine::on_stmt): Add missing return for "creat".
3369 (region_model::mark_as_valid_fd): New.
3371 2022-10-19 David Malcolm <dmalcolm@redhat.com>
3373 PR analyzer/105765
3374 * varargs.cc (get_BT_VALIST_ARG): Rename to...
3375 (get_va_copy_arg): ...this, and update logic for determining level
3376 of indirection of va_copy's argument to use type of argument,
3377 rather than looking at va_list_type_node, to correctly handle
3378 __builtin_ms_va_copy.
3379 (get_stateful_BT_VALIST_ARG): Rename to...
3380 (get_stateful_va_copy_arg): ...this.
3381 (va_list_state_machine::on_va_copy): Update for renaming.
3382 (region_model::impl_call_va_copy): Likewise.
3384 2022-10-13 David Malcolm <dmalcolm@redhat.com>
3386 PR analyzer/107210
3387 * svalue.cc (constant_svalue::maybe_fold_bits_within): Only
3388 attempt to extract individual bits when tree_fits_uhwi_p.
3390 2022-10-07 David Malcolm <dmalcolm@redhat.com>
3392 PR analyzer/105783
3393 * region-model.cc (selftest::get_bit): New function.
3394 (selftest::test_bits_within_svalue_folding): New.
3395 (selfftest::analyzer_region_model_cc_tests): Call it.
3396 * svalue.cc (constant_svalue::maybe_fold_bits_within): Handle the
3397 case of extracting a single bit.
3399 2022-10-06 David Malcolm <dmalcolm@redhat.com>
3401 PR analyzer/107158
3402 * store.cc (store::replay_call_summary_cluster): Eliminate
3403 special-casing of RK_HEAP_ALLOCATED in favor of sharing code with
3404 RK_DECL, avoiding an ICE due to attempting to bind a
3405 compound_svalue into a binding_cluster when an svalue in the
3406 summary cluster converts to a compound_svalue in the caller.
3408 2022-10-06 David Malcolm <dmalcolm@redhat.com>
3410 * call-summary.cc (call_summary_replay::dump_to_pp): Bulletproof
3411 against NULL caller regions/svalues.
3413 2022-10-05 David Malcolm <dmalcolm@redhat.com>
3415 * analysis-plan.cc: Simplify includes.
3416 * analyzer-pass.cc: Likewise.
3417 * analyzer-selftests.cc: Likewise.
3418 * analyzer.cc: Likewise.
3419 * analyzer.h: Add includes of "json.h" and "tristate.h".
3420 * call-info.cc: Simplify includes.
3421 * call-string.cc: Likewise.
3422 * call-summary.cc: Likewise.
3423 * checker-path.cc: Likewise.
3424 * complexity.cc: Likewise.
3425 * constraint-manager.cc: Likewise.
3426 * diagnostic-manager.cc: Likewise.
3427 * engine.cc: Likewise.
3428 * feasible-graph.cc: Likewise.
3429 * known-function-manager.cc: Likewise.
3430 * pending-diagnostic.cc: Likewise.
3431 * program-point.cc: Likewise.
3432 * program-state.cc: Likewise.
3433 * region-model-asm.cc: Likewise.
3434 * region-model-impl-calls.cc: Likewise.
3435 * region-model-manager.cc: Likewise.
3436 * region-model-reachability.cc: Likewise.
3437 * region-model.cc: Likewise.
3438 * region-model.h: Include "selftest.h".
3439 * region.cc: Simplify includes.
3440 * sm-fd.cc: Likewise.
3441 * sm-file.cc: Likewise.
3442 * sm-malloc.cc: Likewise.
3443 * sm-pattern-test.cc: Likewise.
3444 * sm-sensitive.cc: Likewise.
3445 * sm-signal.cc: Likewise.
3446 * sm-taint.cc: Likewise.
3447 * sm.cc: Likewise.
3448 * state-purge.cc: Likewise.
3449 * store.cc: Likewise.
3450 * store.h: Likewise.
3451 * supergraph.cc: Likewise.
3452 * svalue.cc: Likewise.
3453 * svalue.h: Likewise.
3454 * trimmed-graph.cc: Likewise.
3455 * varargs.cc: Likewise.
3457 2022-10-05 David Malcolm <dmalcolm@redhat.com>
3459 PR analyzer/107060
3460 * call-summary.cc
3461 (call_summary_replay::convert_svalue_from_summary_1): Handle NULL
3462 results from convert_svalue_from_summary in SK_UNARY_OP and
3463 SK_BIN_OP.
3464 * engine.cc (impl_region_model_context::on_unknown_change): Bail
3465 out on svalues that can't have associated state.
3466 * region-model-impl-calls.cc
3467 (region_model::impl_call_analyzer_get_unknown_ptr): New.
3468 * region-model.cc (region_model::on_stmt_pre): Handle
3469 "__analyzer_get_unknown_ptr".
3470 * region-model.h
3471 (region_model::impl_call_analyzer_get_unknown_ptr): New decl.
3472 * store.cc (store::replay_call_summary_cluster): Avoid trying to
3473 create binding clusters for base regions that shouldn't have them.
3475 2022-10-05 Martin Liska <mliska@suse.cz>
3477 * call-summary.cc (call_summary_replay::call_summary_replay):
3478 Remove unused variable and arguments.
3479 * call-summary.h: Likewise.
3480 * engine.cc (exploded_node::on_stmt): Likewise.
3481 (exploded_node::replay_call_summaries): Likewise.
3482 (exploded_node::replay_call_summary): Likewise.
3483 * exploded-graph.h (class exploded_node): Likewise.
3485 2022-10-05 David Malcolm <dmalcolm@redhat.com>
3487 PR analyzer/107072
3488 * analyzer-logging.h: Include "diagnostic-core.h".
3489 * analyzer.h: Include "function.h".
3490 (class call_summary): New forward decl.
3491 (class call_summary_replay): New forward decl.
3492 (struct per_function_data): New forward decl.
3493 (struct interesting_t): New forward decl.
3494 (custom_edge_info::update_state): New vfunc.
3495 * call-info.cc (custom_edge_info::update_state): New.
3496 * call-summary.cc: New file.
3497 * call-summary.h: New file.
3498 * constraint-manager.cc: Include "analyzer/call-summary.h".
3499 (class replay_fact_visitor): New.
3500 (constraint_manager::replay_call_summary): New.
3501 * constraint-manager.h (constraint_manager::replay_call_summary):
3502 New.
3503 * engine.cc: Include "analyzer/call-summary.h".
3504 (exploded_node::on_stmt): Handle call summaries.
3505 (class call_summary_edge_info): New.
3506 (exploded_node::replay_call_summaries): New.
3507 (exploded_node::replay_call_summary): New.
3508 (per_function_data::~per_function_data): New.
3509 (per_function_data::add_call_summary): Move here from header and
3510 reimplement.
3511 (exploded_graph::process_node): Call update_state rather than
3512 update_model when handling bifurcation
3513 (viz_callgraph_node::dump_dot): Use a regular label rather
3514 than an HTML table; add summaries to dump.
3515 * exploded-graph.h: Include "alloc-pool.h", "fibonacci_heap.h",
3516 "supergraph.h", "sbitmap.h", "shortest-paths.h", "analyzer/sm.h",
3517 "analyzer/program-state.h", and "analyzer/diagnostic-manager.h".
3518 (exploded_node::replay_call_summaries): New decl.
3519 (exploded_node::replay_call_summary): New decl.
3520 (per_function_data::~per_function_data): New decl.
3521 (per_function_data::add_call_summary): Move implemention from
3522 header.
3523 (per_function_data::m_summaries): Update type of element.
3524 * known-function-manager.h: Include "analyzer/analyzer-logging.h".
3525 * program-point.h: Include "pretty-print.h" and
3526 "analyzer/call-string.h".
3527 * program-state.cc: Include "analyzer/call-summary.h".
3528 (sm_state_map::replay_call_summary): New.
3529 (program_state::replay_call_summary): New.
3530 * program-state.h (sm_state_map::replay_call_summary): New decl.
3531 (program_state::replay_call_summary): New decl.
3532 * region-model-manager.cc
3533 (region_model_manager::get_or_create_asm_output_svalue): New
3534 overload.
3535 * region-model-manager.h
3536 (region_model_manager::get_or_create_asm_output_svalue): New
3537 overload decl.
3538 * region-model.cc: Include "analyzer/call-summary.h".
3539 (region_model::maybe_update_for_edge): Remove call to
3540 region_model::update_for_call_summary on
3541 SUPEREDGE_INTRAPROCEDURAL_CALL.
3542 (region_model::update_for_call_summary): Delete.
3543 (region_model::replay_call_summary): New.
3544 * region-model.h (region_model::replay_call_summary): New decl.
3545 (region_model::update_for_call_summary): Delete decl.
3546 * store.cc: Include "analyzer/call-summary.h".
3547 (store::replay_call_summary): New.
3548 (store::replay_call_summary_cluster): New.
3549 * store.h: Include "tristate.h".
3550 (is_a_helper <const ana::concrete_binding *>::test): New.
3551 (store::replay_call_summary): New decl.
3552 (store::replay_call_summary_cluster): New decl.
3553 * supergraph.cc (get_ultimate_function_for_cgraph_edge): Remove
3554 "static" from decl.
3555 (supergraph_call_edge): Make stmt param const.
3556 * supergraph.h: Include "ordered-hash-map.h", "cfg.h",
3557 "basic-block.h", "gimple.h", "gimple-iterator.h", and "digraph.h".
3558 (supergraph_call_edge): Make stmt param const.
3559 (get_ultimate_function_for_cgraph_edge): New decl.
3560 * svalue.cc (compound_svalue::compound_svalue): Assert that we're
3561 not nesting compound_svalues.
3562 * svalue.h: Include "json.h", "analyzer/store.h", and
3563 "analyzer/program-point.h".
3564 (asm_output_svalue::get_num_outputs): New accessor.
3566 2022-10-05 David Malcolm <dmalcolm@redhat.com>
3568 * region-model.h: Include "analyzer/region-model-manager.h"
3569 (class region_model_manager): Move decl to...
3570 * region-model-manager.h: ...this new file.
3572 2022-10-05 David Malcolm <dmalcolm@redhat.com>
3574 * region-model-manager.cc
3575 (region_model_manager::maybe_fold_unaryop): Fold -(-(VAL)) to VAL.
3577 2022-10-05 David Malcolm <dmalcolm@redhat.com>
3579 * region-model-manager.cc
3580 (region_model_manager::get_or_create_widening_svalue): Use a
3581 function_point rather than a program_point.
3582 * region-model.cc (selftest::test_widening_constraints): Likewise.
3583 * region-model.h
3584 (region_model_manager::get_or_create_widening_svalue): Likewise.
3585 (model_merger::get_function_point): New.
3586 * svalue.cc (svalue::can_merge_p): Use a function_point rather
3587 than a program_point.
3588 (svalue::can_merge_p): Likewise.
3589 * svalue.h (widening_svalue::key_t): Likewise.
3590 (widening_svalue::widening_svalue): Likewise.
3592 2022-09-12 Martin Liska <mliska@suse.cz>
3594 * region-model.cc (region_model::maybe_complain_about_infoleak):
3595 Remove unused fields.
3597 2022-09-11 Tim Lange <mail@tim-lange.me>
3599 PR analyzer/106845
3600 * region-model.cc (region_model::check_region_bounds):
3601 Bail out if 0 bytes were accessed.
3602 * store.cc (byte_range::dump_to_pp):
3603 Add special case for empty ranges.
3604 (byte_range::exceeds_p): Restrict to non-empty ranges.
3605 (byte_range::falls_short_of_p): Restrict to non-empty ranges.
3606 * store.h (bit_range::empty_p): New function.
3607 (bit_range::get_last_byte_offset): Restrict to non-empty ranges.
3608 (byte_range::empty_p): New function.
3609 (byte_range::get_last_byte_offset): Restrict to non-empty ranges.
3611 2022-09-09 David Malcolm <dmalcolm@redhat.com>
3613 * analyzer.opt (Wanalyzer-exposure-through-uninit-copy): New.
3614 * checker-path.cc (region_creation_event::region_creation_event):
3615 Add "capacity" and "kind" params.
3616 (region_creation_event::get_desc): Generalize to different kinds
3617 of event.
3618 (checker_path::add_region_creation_event): Convert to...
3619 (checker_path::add_region_creation_events): ...this.
3620 * checker-path.h (enum rce_kind): New.
3621 (region_creation_event::region_creation_event): Add "capacity" and
3622 "kind" params.
3623 (region_creation_event::m_capacity): New field.
3624 (region_creation_event::m_rce_kind): New field.
3625 (checker_path::add_region_creation_event): Convert to...
3626 (checker_path::add_region_creation_events): ...this.
3627 * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
3628 Update for multiple region creation events.
3629 (diagnostic_manager::add_event_on_final_node): Likewise.
3630 (diagnostic_manager::add_events_for_eedge): Likewise.
3631 * region-model-impl-calls.cc (call_details::get_logger): New.
3632 * region-model.cc: Define INCLUDE_MEMORY before including
3633 "system.h". Include "gcc-rich-location.h".
3634 (class record_layout): New.
3635 (class exposure_through_uninit_copy): New.
3636 (contains_uninit_p): New.
3637 (region_model::maybe_complain_about_infoleak): New.
3638 * region-model.h (call_details::get_logger): New decl.
3639 (region_model::maybe_complain_about_infoleak): New decl.
3640 (region_model::mark_as_tainted): New decl.
3641 * sm-taint.cc (region_model::mark_as_tainted): New.
3643 2022-09-09 David Malcolm <dmalcolm@redhat.com>
3645 * analyzer.h (class known_function_manager): New forward decl.
3646 (class known_function): New.
3647 (plugin_analyzer_init_iface::register_known_function): New.
3648 * engine.cc: Include "analyzer/known-function-manager.h".
3649 (plugin_analyzer_init_impl::plugin_analyzer_init_impl): Add
3650 known_fn_mgr param.
3651 (plugin_analyzer_init_impl::register_state_machine): Add
3652 LOC_SCOPE.
3653 (plugin_analyzer_init_impl::register_known_function): New.
3654 (plugin_analyzer_init_impl::m_known_fn_mgr): New.
3655 (impl_run_checkers): Update plugin callback invocation to use
3656 eng's known_function_manager.
3657 * known-function-manager.cc: New file.
3658 * known-function-manager.h: New file.
3659 * region-model-manager.cc
3660 (region_model_manager::region_model_manager): Pass logger to
3661 m_known_fn_mgr's ctor.
3662 * region-model.cc (region_model::update_for_zero_return): New.
3663 (region_model::update_for_nonzero_return): New.
3664 (maybe_simplify_upper_bound): New.
3665 (region_model::maybe_get_copy_bounds): New.
3666 (region_model::get_known_function): New.
3667 (region_model::on_call_pre): Handle plugin-supplied known
3668 functions.
3669 * region-model.h: Include "analyzer/known-function-manager.h".
3670 (region_model_manager::get_known_function_manager): New.
3671 (region_model_manager::m_known_fn_mgr): New.
3672 (call_details::get_model): New accessor.
3673 (region_model::maybe_get_copy_bounds): New decl.
3674 (region_model::update_for_zero_return): New decl.
3675 (region_model::update_for_nonzero_return): New decl.
3676 (region_model::get_known_function): New decl.
3677 (region_model::get_known_function_manager): New.
3679 2022-09-08 Tim Lange <mail@tim-lange.me>
3681 PR analyzer/106625
3682 * analyzer.h (region_offset): Eliminate m_is_symbolic member.
3683 * region-model-impl-calls.cc (region_model::impl_call_realloc):
3684 Refine implementation to be more precise.
3685 * region-model.cc (class symbolic_past_the_end):
3686 Abstract diagnostic class to complain about accesses past the end
3687 with symbolic values.
3688 (class symbolic_buffer_overflow):
3689 Concrete diagnostic class to complain about buffer overflows with
3690 symbolic values.
3691 (class symbolic_buffer_overread):
3692 Concrete diagnostic class to complain about buffer overreads with
3693 symbolic values.
3694 (region_model::check_symbolic_bounds): New function.
3695 (maybe_get_integer_cst_tree): New helper function.
3696 (region_model::check_region_bounds):
3697 Add call to check_symbolic_bounds if offset is not concrete.
3698 (region_model::eval_condition_without_cm):
3699 Add support for EQ_EXPR and GT_EXPR with binaryop_svalues.
3700 (is_positive_svalue): New hleper function.
3701 (region_model::symbolic_greater_than):
3702 New function to handle GT_EXPR comparisons with symbolic values.
3703 (region_model::structural_equality): New function to compare
3704 whether two svalues are structured the same, i.e. evaluate to
3705 the same value.
3706 (test_struct): Reflect changes to region::calc_offset.
3707 (test_var): Likewise.
3708 (test_array_2): Likewise and add selftest with symbolic i.
3709 * region-model.h (class region_model): Add check_symbolic_bounds,
3710 symbolic_greater_than and structural_equality.
3711 * region.cc (region::get_offset):
3712 Reflect changes to region::calc_offset.
3713 (region::calc_offset):
3714 Compute the symbolic offset if the offset is not concrete.
3715 (region::get_relative_symbolic_offset): New function to return the
3716 symbolic offset in bytes relative to its parent.
3717 (field_region::get_relative_symbolic_offset): Likewise.
3718 (element_region::get_relative_symbolic_offset): Likewise.
3719 (offset_region::get_relative_symbolic_offset): Likewise.
3720 (bit_range_region::get_relative_symbolic_offset): Likewise.
3721 * region.h: Add get_relative_symbolic_offset.
3722 * store.cc (binding_key::make):
3723 Reflect changes to region::calc_offset.
3724 (binding_map::apply_ctor_val_to_range): Likewise.
3725 (binding_map::apply_ctor_pair_to_child_region): Likewise.
3726 (binding_cluster::bind_compound_sval): Likewise.
3727 (binding_cluster::get_any_binding): Likewise.
3728 (binding_cluster::maybe_get_compound_binding): Likewise.
3730 2022-09-05 Tim Lange <mail@tim-lange.me>
3732 * region-model-impl-calls.cc (region_model::impl_call_strcpy):
3733 Handle the constant string case.
3734 * region-model.cc (region_model::get_string_size):
3735 New function to get the string size from a region or svalue.
3736 * region-model.h (class region_model): Add get_string_size.
3738 2022-09-05 Tim Lange <mail@tim-lange.me>
3740 * region.cc (cast_region::get_relative_concrete_offset):
3741 New overloaded method.
3742 * region.h: Add cast_region::get_relative_concrete_offset.
3744 2022-08-22 Martin Liska <mliska@suse.cz>
3746 * region-model.cc: Add missing final keyword.
3748 2022-08-18 Tim Lange <mail@tim-lange.me>
3750 PR analyzer/106181
3751 * analyzer.opt: Add Wanalyzer-imprecise-floating-point-arithmetic.
3752 * region-model.cc (is_any_cast_p): Formatting.
3753 (region_model::check_region_size): Ensure precondition.
3754 (class imprecise_floating_point_arithmetic): New abstract
3755 diagnostic class for all floating-point related warnings.
3756 (class float_as_size_arg): Concrete diagnostic class to complain
3757 about floating-point operands inside the size argument.
3758 (class contains_floating_point_visitor):
3759 New visitor to find floating-point operands inside svalues.
3760 (region_model::check_dynamic_size_for_floats): New function.
3761 (region_model::set_dynamic_extents):
3762 Call to check_dynamic_size_for_floats.
3763 * region-model.h (class region_model):
3764 Add region_model::check_dynamic_size_for_floats.
3766 2022-08-16 Martin Liska <mliska@suse.cz>
3768 * region-model.cc: Fix -Winconsistent-missing-override clang
3769 warning.
3770 * region.h: Likewise.
3772 2022-08-15 David Malcolm <dmalcolm@redhat.com>
3774 PR analyzer/106626
3775 * region-model.cc (buffer_overread::emit): Fix copy&paste error in
3776 direction of the access in the note.
3778 2022-08-15 David Malcolm <dmalcolm@redhat.com>
3780 PR analyzer/106573
3781 * region-model.cc (region_model::on_call_pre): Use check_call_args
3782 when ensuring that we call get_arg_svalue on all args. Remove
3783 redundant call from handling for stdio builtins.
3785 2022-08-15 Immad Mir <mirimmad@outlook.com>
3787 PR analyzer/106551
3788 * sm-fd.cc (check_for_dup): exit early if first
3789 argument is invalid for all dup functions.
3791 2022-08-12 Tim Lange <mail@tim-lange.me>
3793 PR analyzer/106000
3794 * analyzer.opt: Add Wanalyzer-out-of-bounds.
3795 * region-model.cc (class out_of_bounds): Diagnostics base class
3796 for all out-of-bounds diagnostics.
3797 (class past_the_end): Base class derived from out_of_bounds for
3798 the buffer_overflow and buffer_overread diagnostics.
3799 (class buffer_overflow): Buffer overflow diagnostics.
3800 (class buffer_overread): Buffer overread diagnostics.
3801 (class buffer_underflow): Buffer underflow diagnostics.
3802 (class buffer_underread): Buffer overread diagnostics.
3803 (region_model::check_region_bounds): New function to check region
3804 bounds for out-of-bounds accesses.
3805 (region_model::check_region_access):
3806 Add call to check_region_bounds.
3807 (region_model::get_representative_tree): New function that accepts
3808 a region instead of an svalue.
3809 * region-model.h (class region_model):
3810 Add region_model::check_region_bounds.
3811 * region.cc (region::symbolic_p): New predicate.
3812 (offset_region::get_byte_size_sval): Only return the remaining
3813 byte size on offset_regions.
3814 * region.h: Add region::symbolic_p.
3815 * store.cc (byte_range::intersects_p):
3816 Add new function equivalent to bit_range::intersects_p.
3817 (byte_range::exceeds_p): New function.
3818 (byte_range::falls_short_of_p): New function.
3819 * store.h (struct byte_range): Add byte_range::intersects_p,
3820 byte_range::exceeds_p and byte_range::falls_short_of_p.
3822 2022-08-12 Tim Lange <mail@tim-lange.me>
3824 PR analyzer/106539
3825 * region-model-impl-calls.cc (region_model::impl_call_realloc):
3826 Use the result of get_copied_size as the size for the
3827 sized_regions in realloc.
3828 (success_with_move::get_copied_size): New function.
3830 2022-08-11 Immad Mir <mirimmad@outlook.com>
3832 PR analyzer/106551
3833 * sm-fd.cc (check_for_dup): handle the m_start
3834 state when transitioning the state of LHS
3835 of dup, dup2 and dup3 call.
3837 2022-08-09 David Malcolm <dmalcolm@redhat.com>
3839 PR analyzer/106573
3840 * region-model.cc (region_model::on_call_pre): Ensure that we call
3841 get_arg_svalue on all arguments.
3843 2022-08-05 David Malcolm <dmalcolm@redhat.com>
3845 PR analyzer/105947
3846 * analyzer.opt (Wanalyzer-jump-through-null): New option.
3847 * engine.cc (class jump_through_null): New.
3848 (exploded_graph::process_node): Complain about jumps through NULL
3849 function pointers.
3851 2022-08-02 Immad Mir <mirimmad@outlook.com>
3853 PR analyzer/106298
3854 * sm-fd.cc (fd_state_machine::on_open): Add
3855 creat, dup, dup2 and dup3 functions.
3856 (enum dup): New.
3857 (fd_state_machine::valid_to_unchecked_state): New.
3858 (fd_state_machine::on_creat): New.
3859 (fd_state_machine::on_dup): New.
3861 2022-07-28 David Malcolm <dmalcolm@redhat.com>
3863 PR analyzer/105893
3864 * analyzer.opt (Wanalyzer-putenv-of-auto-var): New.
3865 * region-model-impl-calls.cc (class putenv_of_auto_var): New.
3866 (region_model::impl_call_putenv): New.
3867 * region-model.cc (region_model::on_call_pre): Handle putenv.
3868 * region-model.h (region_model::impl_call_putenv): New decl.
3870 2022-07-28 David Malcolm <dmalcolm@redhat.com>
3872 * sm-malloc.cc (free_of_non_heap::emit): Add comment about CWE.
3873 * sm-taint.cc (tainted_size::emit): Likewise.
3875 2022-07-28 David Malcolm <dmalcolm@redhat.com>
3877 * region.h: Add notes to the comment describing the region
3878 class hierarchy.
3880 2022-07-27 Immad Mir <mirimmad@outlook.com>
3882 PR analyzer/106286
3883 * sm-fd.cc:
3884 (fd_diagnostic::get_meaning_for_state_change): New.
3886 2022-07-26 David Malcolm <dmalcolm@redhat.com>
3888 PR analyzer/106319
3889 * store.cc (store::set_value): Don't strip away casts if the
3890 region has NULL type.
3892 2022-07-26 David Malcolm <dmalcolm@redhat.com>
3894 * region.h (code_region::get_element): Remove stray decl.
3895 (function_region::get_element): Likewise.
3897 2022-07-25 Martin Liska <mliska@suse.cz>
3899 * sm-fd.cc: Run dos2unix and fix coding style issues.
3901 2022-07-23 Immad Mir <mirimmad@outlook.com>
3903 * sm-fd.cc (fd_param_diagnostic): New diagnostic class.
3904 (fd_access_mode_mismatch): Change inheritance from fd_diagnostic
3905 to fd_param_diagnostic. Add new overloaded constructor.
3906 (fd_use_after_close): Likewise.
3907 (unchecked_use_of_fd): Likewise and also change name to fd_use_without_check.
3908 (double_close): Change name to fd_double_close.
3909 (enum access_directions): New.
3910 (fd_state_machine::on_stmt): Handle calls to function with the
3911 new three function attributes.
3912 (fd_state_machine::check_for_fd_attrs): New.
3913 (fd_state_machine::on_open): Use the new overloaded constructors
3914 of diagnostic classes.
3916 2022-07-22 David Malcolm <dmalcolm@redhat.com>
3918 PR analyzer/106413
3919 * varargs.cc (region_model::impl_call_va_start): Avoid iterating
3920 through non-existant variadic arguments by initializing the
3921 impl_region to "UNKNOWN" if the va_start occurs in the top-level
3922 function to the analysis.
3924 2022-07-22 David Malcolm <dmalcolm@redhat.com>
3926 PR analyzer/106401
3927 * store.cc (binding_cluster::binding_cluster): Remove overzealous
3928 assertion; we're checking for tracked_p in
3929 store::get_or_create_cluster.
3931 2022-07-22 Tim Lange <mail@tim-lange.me>
3933 PR analyzer/106394
3934 * region-model.cc (capacity_compatible_with_type): Always return true
3935 if alloc_size is zero.
3937 2022-07-21 David Malcolm <dmalcolm@redhat.com>
3939 PR analyzer/106383
3940 * varargs.cc (region_model::impl_call_va_arg): When determining if
3941 we're doing interprocedural analysis, use the stack depth of the
3942 frame in which va_start was called, rather than the current stack
3943 depth.
3945 2022-07-21 David Malcolm <dmalcolm@redhat.com>
3947 * sm-taint.cc (tainted_array_index::emit): Bulletproof against
3948 NULL m_arg.
3949 (tainted_array_index::describe_final_event): Likewise.
3950 (tainted_size::emit): Likewise.
3951 (tainted_size::describe_final_event): Likewise.
3953 2022-07-21 David Malcolm <dmalcolm@redhat.com>
3955 PR analyzer/106374
3956 * region.cc (decl_region::get_svalue_for_initializer): Bail out on
3957 untracked regions.
3959 2022-07-20 David Malcolm <dmalcolm@redhat.com>
3961 PR analyzer/106373
3962 * sm-taint.cc (taint_state_machine::on_condition): Potentially
3963 update the state of the RHS as well as the LHS.
3965 2022-07-20 David Malcolm <dmalcolm@redhat.com>
3967 PR analyzer/106359
3968 * region.h (string_region::tracked_p): New.
3969 * store.cc (binding_cluster::binding_cluster): Move here from
3970 store.h. Add assertion that base_region is tracked_p.
3971 * store.h (binding_cluster::binding_cluster): Move to store.cc.
3973 2022-07-19 David Malcolm <dmalcolm@redhat.com>
3975 PR analyzer/106321
3976 * constraint-manager.h (bounded_ranges::get_count): New.
3977 (bounded_ranges::get_range): New.
3978 * engine.cc (impl_region_model_context::on_bounded_ranges): New.
3979 * exploded-graph.h (impl_region_model_context::on_bounded_ranges):
3980 New decl.
3981 * region-model.cc (region_model::apply_constraints_for_gswitch):
3982 Potentially call ctxt->on_bounded_ranges.
3983 * region-model.h (region_model_context::on_bounded_ranges): New
3984 vfunc.
3985 (noop_region_model_context::on_bounded_ranges): New.
3986 (region_model_context_decorator::on_bounded_ranges): New.
3987 * sm-taint.cc: Include "analyzer/constraint-manager.h".
3988 (taint_state_machine::on_bounded_ranges): New.
3989 * sm.h (state_machine::on_bounded_ranges): New.
3991 2022-07-19 David Malcolm <dmalcolm@redhat.com>
3993 * engine.cc (exploded_graph::process_node): Show any description
3994 of the out-edge when logging it for consideration.
3996 2022-07-15 David Malcolm <dmalcolm@redhat.com>
3998 PR analyzer/106284
3999 * sm-taint.cc (taint_state_machine::on_condition): Handle range
4000 checks optimized by build_range_check.
4002 2022-07-15 Jonathan Wakely <jwakely@redhat.com>
4004 * call-info.cc (call_info::print): Adjust to new label_text API.
4005 * checker-path.cc (checker_event::dump): Likewise.
4006 (region_creation_event::get_desc): Likewise.
4007 (state_change_event::get_desc): Likewise.
4008 (superedge_event::should_filter_p): Likewise.
4009 (start_cfg_edge_event::get_desc): Likewise.
4010 (call_event::get_desc): Likewise.
4011 (return_event::get_desc): Likewise.
4012 (warning_event::get_desc): Likewise.
4013 (checker_path::dump): Likewise.
4014 (checker_path::debug): Likewise.
4015 * diagnostic-manager.cc (diagnostic_manager::prune_for_sm_diagnostic):
4016 Likewise.
4017 (diagnostic_manager::prune_interproc_events): Likewise.
4018 * engine.cc (feasibility_state::maybe_update_for_edge):
4019 Likewise.
4020 * program-state.cc (sm_state_map::to_json): Likewise.
4021 * region-model-impl-calls.cc (region_model::impl_call_analyzer_describe): Likewise.
4022 (region_model::impl_call_analyzer_dump_capacity): Likewise.
4023 * region.cc (region::to_json): Likewise.
4024 * sm-malloc.cc (inform_nonnull_attribute): Likewise.
4025 * store.cc (binding_map::to_json): Likewise.
4026 (store::to_json): Likewise.
4027 * supergraph.cc (superedge::dump): Likewise.
4028 * svalue.cc (svalue::to_json): Likewise.
4030 2022-07-07 David Malcolm <dmalcolm@redhat.com>
4032 * checker-path.cc (start_cfg_edge_event::get_desc): Update for
4033 superedge::get_description returning a label_text.
4034 * engine.cc (feasibility_state::maybe_update_for_edge): Likewise.
4035 * supergraph.cc (superedge::dump): Likewise.
4036 (superedge::get_description): Convert return type from char * to
4037 label_text.
4038 * supergraph.h (superedge::get_description): Likewise.
4040 2022-07-07 David Malcolm <dmalcolm@redhat.com>
4042 * call-info.cc (call_info::print): Update for removal of
4043 label_text::maybe_free in favor of automatic memory management.
4044 * checker-path.cc (checker_event::dump): Likewise.
4045 (checker_event::prepare_for_emission): Likewise.
4046 (state_change_event::get_desc): Likewise.
4047 (superedge_event::should_filter_p): Likewise.
4048 (start_cfg_edge_event::get_desc): Likewise.
4049 (warning_event::get_desc): Likewise.
4050 (checker_path::dump): Likewise.
4051 (checker_path::debug): Likewise.
4052 * diagnostic-manager.cc
4053 (diagnostic_manager::prune_for_sm_diagnostic): Likewise.
4054 (diagnostic_manager::prune_interproc_events): Likewise.
4055 * program-state.cc (sm_state_map::to_json): Likewise.
4056 * region.cc (region::to_json): Likewise.
4057 * sm-malloc.cc (inform_nonnull_attribute): Likewise.
4058 * store.cc (binding_map::to_json): Likewise.
4059 (store::to_json): Likewise.
4060 * svalue.cc (svalue::to_json): Likewise.
4062 2022-07-07 David Malcolm <dmalcolm@redhat.com>
4064 PR analyzer/106225
4065 * sm-taint.cc (taint_state_machine::on_stmt): Move handling of
4066 assignments from division to...
4067 (taint_state_machine::check_for_tainted_divisor): ...this new
4068 function. Reject warning when the divisor is known to be non-zero.
4069 * sm.cc: Include "analyzer/program-state.h".
4070 (sm_context::get_old_region_model): New.
4071 * sm.h (sm_context::get_old_region_model): New decl.
4073 2022-07-06 Immad Mir <mirimmad@outlook.com>
4075 PR analyzer/106184
4076 * sm-fd.cc (fd_state_machine): Change ordering of initialization
4077 of state m_invalid so that the order of initializers is same as
4078 the ordering of the fields in the class decl.
4080 2022-07-06 Immad Mir <mirimmad@outlook.com>
4082 * sm-fd.cc (use_after_close): save the "close" event and
4083 show it where possible.
4085 2022-07-06 David Malcolm <dmalcolm@redhat.com>
4087 PR analyzer/106204
4088 * region-model.cc (within_short_circuited_stmt_p): Move extraction
4089 of assign_stmt to caller.
4090 (due_to_ifn_deferred_init_p): New.
4091 (region_model::check_for_poison): Move extraction of assign_stmt
4092 from within_short_circuited_stmt_p to here. Share logic with
4093 call to due_to_ifn_deferred_init_p.
4095 2022-07-02 Tim Lange <mail@tim-lange.me>
4097 PR analyzer/105900
4098 * analyzer.opt: Added Wanalyzer-allocation-size.
4099 * checker-path.cc (region_creation_event::get_desc): Added call to new
4100 virtual function pending_diagnostic::describe_region_creation_event.
4101 * checker-path.h: Added region_creation_event::get_desc.
4102 * diagnostic-manager.cc (diagnostic_manager::add_event_on_final_node):
4103 New function.
4104 * diagnostic-manager.h:
4105 Added diagnostic_manager::add_event_on_final_node.
4106 * pending-diagnostic.h (struct region_creation): New event_desc struct.
4107 (pending_diagnostic::describe_region_creation_event): Added virtual
4108 function to overwrite description of a region creation.
4109 * region-model.cc (class dubious_allocation_size): New class.
4110 (capacity_compatible_with_type): New helper function.
4111 (class size_visitor): New class.
4112 (struct_or_union_with_inheritance_p): New helper function.
4113 (is_any_cast_p): New helper function.
4114 (region_model::check_region_size): New function.
4115 (region_model::set_value): Added call to
4116 region_model::check_region_size.
4117 * region-model.h (class region_model): New function check_region_size.
4118 * svalue.cc (region_svalue::accept): Changed to post-order traversal.
4119 (initial_svalue::accept): Likewise.
4120 (unaryop_svalue::accept): Likewise.
4121 (binop_svalue::accept): Likewise.
4122 (sub_svalue::accept): Likewise.
4123 (repeated_svalue::accept): Likewise.
4124 (bits_within_svalue::accept): Likewise.
4125 (widening_svalue::accept): Likewise.
4126 (unmergeable_svalue::accept): Likewise.
4127 (compound_svalue::accept): Likewise.
4128 (conjured_svalue::accept): Likewise.
4129 (asm_output_svalue::accept): Likewise.
4130 (const_fn_result_svalue::accept): Likewise.
4132 2022-07-02 Immad Mir <mirimmad17@gmail.com>
4134 PR analyzer/106003
4135 * analyzer.opt (Wanalyzer-fd-leak): New option.
4136 (Wanalyzer-fd-access-mode-mismatch): New option.
4137 (Wanalyzer-fd-use-without-check): New option.
4138 (Wanalyzer-fd-double-close): New option.
4139 (Wanalyzer-fd-use-after-close): New option.
4140 * sm.h (make_fd_state_machine): New decl.
4141 * sm.cc (make_checkers): Call make_fd_state_machine.
4142 * sm-fd.cc: New file.
4144 2022-06-24 David Malcolm <dmalcolm@redhat.com>
4146 * call-string.cc: Add includes of "analyzer/analyzer.h"
4147 and "analyzer/analyzer-logging.h".
4148 (call_string::call_string): Delete copy ctor.
4149 (call_string::operator=): Delete.
4150 (call_string::operator==): Delete.
4151 (call_string::hash): Delete.
4152 (call_string::push_call): Make const, returning the resulting
4153 call_string.
4154 (call_string::pop): Delete.
4155 (call_string::cmp_ptr_ptr): New.
4156 (call_string::validate): Assert that m_parent is non-NULL, or
4157 m_elements is empty.
4158 (call_string::call_string): Move default ctor here from
4159 call-string.h and reimplement. Add ctor taking a parent
4160 and an element.
4161 (call_string::~call_string): New.
4162 (call_string::recursive_log): New.
4163 * call-string.h (call_string::call_string): Move default ctor's
4164 defn to call-string.cc. Delete copy ctor. Add ctor taking a
4165 parent and an element.
4166 (call_string::operator=): Delete.
4167 (call_string::operator==): Delete.
4168 (call_string::hash): Delete.
4169 (call_string::push_call): Make const, returning the resulting
4170 call_string.
4171 (call_string::pop): Delete decl.
4172 (call_string::get_parent): New.
4173 (call_string::cmp_ptr_ptr): New decl.
4174 (call_string::get_top_of_stack): New.
4175 (struct call_string::hashmap_traits_t): New.
4176 (class call_string): Add friend class region_model_manager. Add
4177 DISABLE_COPY_AND_ASSIGN.
4178 (call_string::~call_string): New decl.
4179 (call_string::recursive_log): New decl.
4180 (call_string::m_parent): New field.
4181 (call_string::m_children): New field.
4182 * constraint-manager.cc (selftest::test_many_constants): Pass
4183 model manager to program_point::origin.
4184 * engine.cc (exploded_graph::exploded_graph): Likewise.
4185 (exploded_graph::add_function_entry): Likewise for
4186 program_point::from_function_entry.
4187 (add_tainted_args_callback): Likewise.
4188 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
4189 Update for change to program_point.get_call_string.
4190 (exploded_graph::process_node): Likewise.
4191 (class function_call_string_cluster): Convert m_cs from a
4192 call_string to a const call_string &.
4193 (struct function_call_string): Likewise.
4194 (pod_hash_traits<function_call_string>::hash): Use pointer_hash
4195 for m_cs.
4196 (pod_hash_traits<function_call_string>::equal): Update for change
4197 to m_cs.
4198 (root_cluster::add_node): Update for change to
4199 function_call_string.
4200 (viz_callgraph_node::dump_dot): Update for change to call_string.
4201 * exploded-graph.h (per_call_string_data::m_key): Convert to a
4202 reference.
4203 (struct eg_call_string_hash_map_traits): Delete.
4204 (exploded_graph::call_string_data_map_t): Remove traits class.
4205 * program-point.cc: Move include of "analyzer/call-string.h" to
4206 after "analyzer/analyzer-logging.h".
4207 (program_point::print): Update for conversion of m_call_string to
4208 a pointer.
4209 (program_point::to_json): Likewise.
4210 (program_point::push_to_call_stack): Update for immutability of
4211 call strings.
4212 (program_point::pop_from_call_stack): Likewise.
4213 (program_point::hash): Use pointer hashing for m_call_string.
4214 (program_point::get_function_at_depth): Update for change to
4215 m_call_string.
4216 (program_point::validate): Update for changes to call_string.
4217 (program_point::on_edge): Likewise.
4218 (program_point::origin): Move here from call-string.h. Add
4219 region_model_manager param and use it to get empty call string.
4220 (program_point::from_function_entry): Likewise.
4221 (selftest::test_function_point_ordering): Likewise.
4222 (selftest::test_function_point_ordering): Likewise.
4223 * program-point.h (program_point::program_point): Update for
4224 change to m_call_string.
4225 (program_point::get_call_string): Likewise.
4226 (program_point::get_stack_depth): Likewise.
4227 (program_point::origin): Add region_model_manager param, and move
4228 defn to call-string.cc.
4229 (program_point::from_function_entry): Likewise.
4230 (program_point::empty): Drop call_string.
4231 (program_point::deleted): Likewise.
4232 (program_point::program_point): New private ctor.
4233 (program_point::m_call_string): Convert from call_string to const
4234 call_string *.
4235 * program-state.cc (selftest::test_program_state_merging): Update
4236 for call_string changes.
4237 (selftest::test_program_state_merging_2): Likewise.
4238 * region-model-manager.cc
4239 (region_model_manager::region_model_manager): Construct
4240 m_empty_call_string.
4241 (region_model_manager::log_stats): Log the call strings.
4242 * region-model.cc (assert_region_models_merge): Pass the
4243 region_model_manager when creating program_point instances.
4244 (selftest::test_state_merging): Likewise.
4245 (selftest::test_constraint_merging): Likewise.
4246 (selftest::test_widening_constraints): Likewise.
4247 (selftest::test_iteration_1): Likewise.
4248 * region-model.h (region_model_manager::get_empty_call_string):
4249 New.
4250 (region_model_manager::m_empty_call_string): New.
4251 * sm-signal.cc (register_signal_handler::impl_transition): Update
4252 for changes to call_string.
4254 2022-06-24 David Malcolm <dmalcolm@redhat.com>
4256 * call-string.cc (call_string::calc_recursion_depth): Whitespace
4257 cleanups.
4258 (call_string::cmp): Likewise.
4259 (call_string::get_caller_node): Likewise.
4260 (call_string::validate): Likewise.
4261 * engine.cc (dynamic_call_info_t::add_events_to_path): Likewise.
4262 (exploded_graph::get_per_function_data): Likewise.
4263 (exploded_graph::maybe_create_dynamic_call): Likewise.
4264 (exploded_graph::maybe_create_dynamic_call): Likewise.
4265 (exploded_graph::process_node): Likewise.
4267 2022-06-16 David Malcolm <dmalcolm@redhat.com>
4269 * varargs.cc (va_arg_type_mismatch::emit): Associate the warning
4270 with CWE-686 ("Function Call With Incorrect Argument Type").
4272 2022-06-16 David Malcolm <dmalcolm@redhat.com>
4274 * varargs.cc: Include "diagnostic-metadata.h".
4275 (va_list_exhausted::emit): Associate the warning with
4276 CWE-685 ("Function Call With Incorrect Number of Arguments").
4278 2022-06-16 David Malcolm <dmalcolm@redhat.com>
4280 * sm-file.cc (double_fclose::emit): Associate the warning with
4281 CWE-1341 ("Multiple Releases of Same Resource or Handle").
4283 2022-06-15 David Malcolm <dmalcolm@redhat.com>
4285 PR analyzer/105962
4286 * analyzer.opt (fanalyzer-undo-inlining): New option.
4287 * checker-path.cc: Include "diagnostic-core.h" and
4288 "inlining-iterator.h".
4289 (event_kind_to_string): Handle EK_INLINED_CALL.
4290 (class inlining_info): New class.
4291 (checker_event::checker_event): Move here from checker-path.h.
4292 Store original fndecl and depth, and calculate effective fndecl
4293 and depth based on inlining information.
4294 (checker_event::dump): Emit original depth as well as effective
4295 depth when they differ; likewise for fndecl.
4296 (region_creation_event::get_desc): Use m_effective_fndecl.
4297 (inlined_call_event::get_desc): New.
4298 (inlined_call_event::get_meaning): New.
4299 (checker_path::inject_any_inlined_call_events): New.
4300 * checker-path.h (enum event_kind): Add EK_INLINED_CALL.
4301 (checker_event::checker_event): Make protected, and move
4302 definition to checker-path.cc.
4303 (checker_event::get_fndecl): Use effective fndecl.
4304 (checker_event::get_stack_depth): Use effective stack depth.
4305 (checker_event::get_logical_location): Use effective stack depth.
4306 (checker_event::get_original_stack_depth): New.
4307 (checker_event::m_fndecl): Rename to...
4308 (checker_event::m_original_fndecl): ...this.
4309 (checker_event::m_depth): Rename to...
4310 (checker_event::m_original_depth): ...this.
4311 (checker_event::m_effective_fndecl): New field.
4312 (checker_event::m_effective_depth): New field.
4313 (class inlined_call_event): New checker_event subclass.
4314 (checker_path::inject_any_inlined_call_events): New decl.
4315 * diagnostic-manager.cc: Include "inlining-iterator.h".
4316 (diagnostic_manager::emit_saved_diagnostic): Call
4317 checker_path::inject_any_inlined_call_events.
4318 (diagnostic_manager::prune_for_sm_diagnostic): Handle
4319 EK_INLINED_CALL.
4320 * engine.cc (tainted_args_function_custom_event::get_desc): Use
4321 effective fndecl.
4322 * inlining-iterator.h: New file.
4324 2022-06-15 David Malcolm <dmalcolm@redhat.com>
4326 * diagnostic-manager.cc (saved_diagnostic::dump_dot_id): New.
4327 (saved_diagnostic::dump_as_dot_node): New.
4328 * diagnostic-manager.h (saved_diagnostic::dump_dot_id): New decl.
4329 (saved_diagnostic::dump_as_dot_node): New decl.
4330 * engine.cc (exploded_node::dump_dot): Add nodes for saved
4331 diagnostics.
4333 2022-06-02 David Malcolm <dmalcolm@redhat.com>
4335 * checker-path.cc (checker_event::get_meaning): New.
4336 (function_entry_event::get_meaning): New.
4337 (state_change_event::get_desc): Add dump of meaning of the event
4338 to the -fanalyzer-verbose-state-changes output.
4339 (state_change_event::get_meaning): New.
4340 (cfg_edge_event::get_meaning): New.
4341 (call_event::get_meaning): New.
4342 (return_event::get_meaning): New.
4343 (start_consolidated_cfg_edges_event::get_meaning): New.
4344 (warning_event::get_meaning): New.
4345 * checker-path.h: Include "tree-logical-location.h".
4346 (checker_event::checker_event): Construct m_logical_loc.
4347 (checker_event::get_logical_location): New.
4348 (checker_event::get_meaning): New decl.
4349 (checker_event::m_logical_loc): New.
4350 (function_entry_event::get_meaning): New decl.
4351 (state_change_event::get_meaning): New decl.
4352 (cfg_edge_event::get_meaning): New decl.
4353 (call_event::get_meaning): New decl.
4354 (return_event::get_meaning): New decl.
4355 (start_consolidated_cfg_edges_event::get_meaning): New.
4356 (warning_event::get_meaning): New decl.
4357 * pending-diagnostic.h: Include "diagnostic-path.h".
4358 (pending_diagnostic::get_meaning_for_state_change): New vfunc.
4359 * sm-file.cc (file_diagnostic::get_meaning_for_state_change): New
4360 vfunc impl.
4361 * sm-malloc.cc (malloc_diagnostic::get_meaning_for_state_change):
4362 Likewise.
4363 * sm-sensitive.cc
4364 (exposure_through_output_file::get_meaning_for_state_change):
4365 Likewise.
4366 * sm-taint.cc (taint_diagnostic::get_meaning_for_state_change):
4367 Likewise.
4368 * varargs.cc
4369 (va_list_sm_diagnostic::get_meaning_for_state_change): Likewise.
4371 2022-05-23 David Malcolm <dmalcolm@redhat.com>
4373 * call-info.cc: Add "final" and "override" to all vfunc
4374 implementations that were missing them, as appropriate.
4375 * engine.cc: Likewise.
4376 * region-model.cc: Likewise.
4377 * sm-malloc.cc: Likewise.
4378 * supergraph.h: Likewise.
4379 * svalue.cc: Likewise.
4380 * varargs.cc: Likewise.
4382 2022-05-20 David Malcolm <dmalcolm@redhat.com>
4384 * analyzer-pass.cc: Replace uses of "FINAL" and "OVERRIDE" with
4385 "final" and "override".
4386 * call-info.h: Likewise.
4387 * checker-path.h: Likewise.
4388 * constraint-manager.cc: Likewise.
4389 * diagnostic-manager.cc: Likewise.
4390 * engine.cc: Likewise.
4391 * exploded-graph.h: Likewise.
4392 * feasible-graph.h: Likewise.
4393 * pending-diagnostic.h: Likewise.
4394 * region-model-impl-calls.cc: Likewise.
4395 * region-model.cc: Likewise.
4396 * region-model.h: Likewise.
4397 * region.h: Likewise.
4398 * sm-file.cc: Likewise.
4399 * sm-malloc.cc: Likewise.
4400 * sm-pattern-test.cc: Likewise.
4401 * sm-sensitive.cc: Likewise.
4402 * sm-signal.cc: Likewise.
4403 * sm-taint.cc: Likewise.
4404 * state-purge.h: Likewise.
4405 * store.cc: Likewise.
4406 * store.h: Likewise.
4407 * supergraph.h: Likewise.
4408 * svalue.h: Likewise.
4409 * trimmed-graph.h: Likewise.
4410 * varargs.cc: Likewise.
4412 2022-05-16 David Malcolm <dmalcolm@redhat.com>
4414 PR analyzer/105103
4415 * analyzer.cc (make_label_text_n): New.
4416 * analyzer.h (class var_arg_region): New forward decl.
4417 (make_label_text_n): New decl.
4418 * analyzer.opt (Wanalyzer-va-arg-type-mismatch): New option.
4419 (Wanalyzer-va-list-exhausted): New option.
4420 (Wanalyzer-va-list-leak): New option.
4421 (Wanalyzer-va-list-use-after-va-end): New option.
4422 * checker-path.cc (call_event::get_desc): Split out decl access
4423 into..
4424 (call_event::get_caller_fndecl): ...this new function and...
4425 (call_event::get_callee_fndecl): ...this new function.
4426 * checker-path.h (call_event::get_desc): Drop "FINAL".
4427 (call_event::get_caller_fndecl): New decl.
4428 (call_event::get_callee_fndecl): New decl.
4429 (class call_event): Make fields protected.
4430 * diagnostic-manager.cc (null_assignment_sm_context::warn): New
4431 overload.
4432 (null_assignment_sm_context::get_new_program_state): New.
4433 (diagnostic_manager::add_events_for_superedge): Move case
4434 SUPEREDGE_CALL to a new pending_diagnostic::add_call_event vfunc.
4435 * engine.cc (impl_sm_context::warn): Implement new override.
4436 (impl_sm_context::get_new_program_state): New.
4437 * pending-diagnostic.cc: Include "analyzer/diagnostic-manager.h",
4438 "cpplib.h", "digraph.h", "ordered-hash-map.h", "cfg.h",
4439 "basic-block.h", "gimple.h", "gimple-iterator.h", "cgraph.h"
4440 "analyzer/supergraph.h", "analyzer/program-state.h",
4441 "alloc-pool.h", "fibonacci_heap.h", "shortest-paths.h",
4442 "sbitmap.h", "analyzer/exploded-graph.h", "diagnostic-path.h",
4443 and "analyzer/checker-path.h".
4444 (ht_ident_eq): New.
4445 (fixup_location_in_macro_p): New.
4446 (pending_diagnostic::fixup_location): New.
4447 (pending_diagnostic::add_call_event): New.
4448 * pending-diagnostic.h (pending_diagnostic::fixup_location): Drop
4449 no-op inline implementation in favor of the more complex
4450 implementation above.
4451 (pending_diagnostic::add_call_event): New vfunc.
4452 * region-model-impl-calls.cc: Include "analyzer/sm.h",
4453 "diagnostic-path.h", and "analyzer/pending-diagnostic.h".
4454 * region-model-manager.cc
4455 (region_model_manager::get_var_arg_region): New.
4456 (region_model_manager::log_stats): Log m_var_arg_regions.
4457 * region-model.cc (region_model::on_call_pre): Handle IFN_VA_ARG,
4458 BUILT_IN_VA_START, and BUILT_IN_VA_COPY.
4459 (region_model::on_call_post): Handle BUILT_IN_VA_END.
4460 (region_model::get_representative_path_var_1): Handle RK_VAR_ARG.
4461 (region_model::push_frame): Push variadic arguments.
4462 * region-model.h (region_model_manager::get_var_arg_region): New
4463 decl.
4464 (region_model_manager::m_var_arg_regions): New field.
4465 (region_model::impl_call_va_start): New decl.
4466 (region_model::impl_call_va_copy): New decl.
4467 (region_model::impl_call_va_arg): New decl.
4468 (region_model::impl_call_va_end): New decl.
4469 * region.cc (alloca_region::dump_to_pp): Dump the id.
4470 (var_arg_region::dump_to_pp): New.
4471 (var_arg_region::get_frame_region): New.
4472 * region.h (enum region_kind): Add RK_VAR_ARG.
4473 (region::dyn_cast_var_arg_region): New.
4474 (class var_arg_region): New.
4475 (is_a_helper <const var_arg_region *>::test): New.
4476 (struct default_hash_traits<var_arg_region::key_t>): New.
4477 * sm.cc (make_checkers): Call make_va_list_state_machine.
4478 * sm.h (sm_context::warn): New vfunc.
4479 (sm_context::get_old_svalue): Drop unused decl.
4480 (sm_context::get_new_program_state): New vfunc.
4481 (make_va_list_state_machine): New decl.
4482 * varargs.cc: New file.
4484 2022-05-16 Martin Liska <mliska@suse.cz>
4486 * engine.cc (exploded_node::get_dot_fillcolor): Use ARRAY_SIZE.
4487 * function-set.cc (test_stdio_example): Likewise.
4488 * sm-file.cc (get_file_using_fns): Likewise.
4489 * sm-malloc.cc (malloc_state_machine::unaffected_by_call_p): Likewise.
4490 * sm-signal.cc (get_async_signal_unsafe_fns): Likewise.
4492 2022-05-13 Richard Biener <rguenther@suse.de>
4494 * supergraph.cc: Re-order gimple-fold.h include.
4496 2022-05-11 David Malcolm <dmalcolm@redhat.com>
4498 * checker-path.cc (state_change_event::get_desc): Call maybe_free
4499 on label_text temporaries.
4500 * diagnostic-manager.cc
4501 (diagnostic_manager::prune_for_sm_diagnostic): Likewise.
4502 * engine.cc (exploded_graph::~exploded_graph): Fix leak of
4503 m_per_point_data and m_per_call_string_data values. Simplify
4504 cleanup of m_per_function_stats and m_per_point_data values.
4505 (feasibility_state::maybe_update_for_edge): Fix leak of result of
4506 superedge::get_description.
4507 * region-model-manager.cc
4508 (region_model_manager::~region_model_manager): Move cleanup of
4509 m_setjmp_values to match the ordering of the fields within
4510 region_model_manager. Fix leak of values within
4511 m_repeated_values_map, m_bits_within_values_map,
4512 m_asm_output_values_map, and m_const_fn_result_values_map.
4514 2022-04-28 David Malcolm <dmalcolm@redhat.com>
4516 PR analyzer/105285
4517 * store.cc (binding_cluster::get_any_binding): Handle accessing
4518 sub_svalues of clusters where the base region has a symbolic
4519 binding.
4521 2022-04-28 David Malcolm <dmalcolm@redhat.com>
4523 * diagnostic-manager.cc (epath_finder::process_worklist_item):
4524 Call dump_feasible_path when a path that reaches the the target
4525 enode is found.
4526 (epath_finder::dump_feasible_path): New.
4527 * engine.cc (feasibility_state::dump_to_pp): New.
4528 * exploded-graph.h (feasibility_state::dump_to_pp): New decl.
4529 * feasible-graph.cc (feasible_graph::dump_feasible_path): New.
4530 * feasible-graph.h (feasible_graph::dump_feasible_path): New
4531 decls.
4532 * program-point.cc (function_point::print): Fix missing trailing
4533 newlines.
4534 * program-point.h (program_point::print_source_line): Remove
4535 unimplemented decl.
4537 2022-04-25 David Malcolm <dmalcolm@redhat.com>
4539 PR analyzer/105365
4540 PR analyzer/105366
4541 * svalue.cc
4542 (cmp_cst): Rename to...
4543 (cmp_csts_same_type): ...this. Convert all recursive calls to
4544 calls to...
4545 (cmp_csts_and_types): ....this new function.
4546 (svalue::cmp_ptr): Update for renaming of cmp_cst
4548 2022-04-14 David Malcolm <dmalcolm@redhat.com>
4550 PR analyzer/105264
4551 * region-model-reachability.cc (reachable_regions::handle_parm):
4552 Use maybe_get_deref_base_region rather than just region_svalue, to
4553 handle pointer arithmetic also.
4554 * svalue.cc (svalue::maybe_get_deref_base_region): New.
4555 * svalue.h (svalue::maybe_get_deref_base_region): New decl.
4557 2022-04-14 David Malcolm <dmalcolm@redhat.com>
4559 PR analyzer/105252
4560 * svalue.cc (cmp_cst): When comparing VECTOR_CSTs, compare the
4561 types of the encoded elements before calling cmp_cst on them.
4563 2022-04-09 David Malcolm <dmalcolm@redhat.com>
4565 PR analyzer/103892
4566 * region-model-manager.cc
4567 (region_model_manager::get_unknown_symbolic_region): New,
4568 extracted from...
4569 (region_model_manager::get_field_region): ...here.
4570 (region_model_manager::get_element_region): Use it here.
4571 (region_model_manager::get_offset_region): Likewise.
4572 (region_model_manager::get_sized_region): Likewise.
4573 (region_model_manager::get_cast_region): Likewise.
4574 (region_model_manager::get_bit_range): Likewise.
4575 * region-model.h
4576 (region_model_manager::get_unknown_symbolic_region): New decl.
4577 * region.cc (symbolic_region::symbolic_region): Handle sval_ptr
4578 having NULL type.
4579 (symbolic_region::dump_to_pp): Handle having NULL type.
4581 2022-04-07 David Malcolm <dmalcolm@redhat.com>
4583 PR analyzer/102208
4584 * store.cc (binding_map::remove_overlapping_bindings): Add
4585 "always_overlap" param, using it to generalize to the case where
4586 we want to remove all bindings. Update "uncertainty" logic to
4587 only record maybe-bound values for cases where there is a symbolic
4588 write involved.
4589 (binding_cluster::mark_region_as_unknown): Split param "reg" into
4590 "reg_to_bind" and "reg_for_overlap".
4591 (binding_cluster::maybe_get_compound_binding): Pass "false" to
4592 binding_map::remove_overlapping_bindings new "always_overlap" param.
4593 (binding_cluster::remove_overlapping_bindings): Determine
4594 "always_overlap" and pass it to
4595 binding_map::remove_overlapping_bindings.
4596 (store::set_value): Pass uncertainty to remove_overlapping_bindings
4597 call. Update for new param of
4598 binding_cluster::mark_region_as_unknown, passing both the base
4599 region of the iter_cluster, and the lhs_reg.
4600 (store::mark_region_as_unknown): Update for new param of
4601 binding_cluster::mark_region_as_unknown, passing "reg" for both.
4602 (store::remove_overlapping_bindings): Add param "uncertainty", and
4603 pass it on to call to
4604 binding_cluster::remove_overlapping_bindings.
4605 * store.h (binding_map::remove_overlapping_bindings): Add
4606 "always_overlap" param.
4607 (binding_cluster::mark_region_as_unknown): Split param "reg" into
4608 "reg_to_bind" and "reg_for_overlap".
4609 (store::remove_overlapping_bindings): Add param "uncertainty".
4611 2022-03-29 David Malcolm <dmalcolm@redhat.com>
4613 PR testsuite/105085
4614 * region-model-manager.cc (dump_untracked_region): Skip decls in
4615 the constant pool.
4617 2022-03-29 David Malcolm <dmalcolm@redhat.com>
4619 PR analyzer/105087
4620 * analyzer.h (class conjured_purge): New forward decl.
4621 * region-model-asm.cc (region_model::on_asm_stmt): Add
4622 conjured_purge param to calls binding_cluster::on_asm and
4623 region_model_manager::get_or_create_conjured_svalue.
4624 * region-model-impl-calls.cc
4625 (call_details::get_or_create_conjured_svalue): Likewise for call
4626 to region_model_manager::get_or_create_conjured_svalue.
4627 (region_model::impl_call_fgets): Remove call to
4628 region_model::purge_state_involving, as this is now done
4629 implicitly by call_details::get_or_create_conjured_svalue.
4630 (region_model::impl_call_fread): Likewise.
4631 (region_model::impl_call_strchr): Pass conjured_purge param to
4632 call to region_model_manager::get_or_create_conjured_svalue.
4633 * region-model-manager.cc (conjured_purge::purge): New.
4634 (region_model_manager::get_or_create_conjured_svalue): Add
4635 param "p". Use it to purge state when reusing an existing
4636 conjured_svalue.
4637 * region-model.cc (region_model::on_call_pre): Replace call to
4638 region_model::purge_state_involving with passing conjured_purge
4639 to region_model_manager::get_or_create_conjured_svalue.
4640 (region_model::handle_unrecognized_call): Pass conjured_purge to
4641 store::on_unknown_fncall.
4642 * region-model.h
4643 (region_model_manager::get_or_create_conjured_svalue): Add param
4644 "p".
4645 * store.cc (binding_cluster::on_unknown_fncall): Likewise. Pass
4646 it on to region_model_manager::get_or_create_conjured_svalue.
4647 (binding_cluster::on_asm): Likewise.
4648 (store::on_unknown_fncall): Add param "p" and pass it on to
4649 binding_cluster::on_unknown_fncall.
4650 * store.h (binding_cluster::on_unknown_fncall): Add param p.
4651 (binding_cluster::on_asm): Likewise.
4652 (store::on_unknown_fncall): Likewise.
4653 * svalue.h (class conjured_purge): New.
4655 2022-03-29 David Malcolm <dmalcolm@redhat.com>
4657 PR analyzer/105074
4658 * region.cc (ipa_ref_requires_tracking): Drop "context_fndecl",
4659 instead using the ref->referring to get the cgraph node of the
4660 caller.
4661 (symnode_requires_tracking_p): Likewise.
4663 2022-03-26 David Malcolm <dmalcolm@redhat.com>
4665 PR analyzer/105057
4666 * store.cc (binding_cluster::make_unknown_relative_to): Reject
4667 attempts to create a cluster for untracked base regions.
4668 (store::set_value): Likewise.
4669 (store::fill_region): Likewise.
4670 (store::mark_region_as_unknown): Likewise.
4672 2022-03-25 David Malcolm <dmalcolm@redhat.com>
4674 PR analyzer/104954
4675 * analyzer.opt (-fdump-analyzer-untracked): New option.
4676 * engine.cc (impl_run_checkers): Handle it.
4677 * region-model-asm.cc (region_model::on_asm_stmt): Don't attempt
4678 to clobber regions with !tracked_p ().
4679 * region-model-manager.cc (dump_untracked_region): New.
4680 (region_model_manager::dump_untracked_regions): New.
4681 (frame_region::dump_untracked_regions): New.
4682 * region-model.h (region_model_manager::dump_untracked_regions):
4683 New decl.
4684 * region.cc (ipa_ref_requires_tracking): New.
4685 (symnode_requires_tracking_p): New.
4686 (decl_region::calc_tracked_p): New.
4687 * region.h (region::tracked_p): New vfunc.
4688 (frame_region::dump_untracked_regions): New decl.
4689 (class decl_region): Note that this is also used fo SSA names.
4690 (decl_region::decl_region): Initialize m_tracked.
4691 (decl_region::tracked_p): New.
4692 (decl_region::calc_tracked_p): New decl.
4693 (decl_region::m_tracked): New.
4694 * store.cc (store::get_or_create_cluster): Assert that we
4695 don't try to create clusters for base regions that aren't
4696 trackable.
4697 (store::mark_as_escaped): Don't mark base regions that we're not
4698 tracking.
4700 2022-03-23 David Malcolm <dmalcolm@redhat.com>
4702 PR analyzer/104979
4703 * engine.cc (impl_run_checkers): Create the engine after the
4704 supergraph, and pass the supergraph to the engine.
4705 * region-model.cc (region_model::get_lvalue_1): Pass ctxt to
4706 frame_region::get_region_for_local.
4707 (region_model::update_for_return_gcall): Pass the lvalue for the
4708 result to pop_frame as a tree, rather than as a region.
4709 (region_model::pop_frame): Update for above change, determining
4710 the destination region after the frame is popped and thus with
4711 respect to the caller frame rather than the called frame.
4712 Likewise, set the value of the region to the return value after
4713 the frame is popped.
4714 (engine::engine): Add supergraph pointer.
4715 (selftest::test_stack_frames): Set the DECL_CONTECT of PARM_DECLs.
4716 (selftest::test_get_representative_path_var): Likewise.
4717 (selftest::test_state_merging): Likewise.
4718 * region-model.h (region_model::pop_frame): Convert first param
4719 from a const region * to a tree.
4720 (engine::engine): Add param "sg".
4721 (engine::m_sg): New field.
4722 * region.cc: Include "analyzer/sm.h" and
4723 "analyzer/program-state.h".
4724 (frame_region::get_region_for_local): Add "ctxt" param.
4725 Add assertions that VAR_DECLs are locals, and that expr is for the
4726 correct function.
4727 * region.h (frame_region::get_region_for_local): Add "ctxt" param.
4729 2022-03-23 David Malcolm <dmalcolm@redhat.com>
4731 PR analyzer/105017
4732 * sm-taint.cc (taint_diagnostic::subclass_equal_p): Check
4733 m_has_bounds as well as m_arg.
4734 (tainted_allocation_size::subclass_equal_p): Chain up to base
4735 class implementation. Also check m_mem_space.
4736 (tainted_allocation_size::emit): Add note showing stack-based vs
4737 heap-based allocations.
4739 2022-03-23 David Malcolm <dmalcolm@redhat.com>
4741 PR analyzer/104997
4742 * diagnostic-manager.cc (diagnostic_manager::add_diagnostic):
4743 Convert return type from "void" to "bool", reporting success vs
4744 failure to caller, for both overloads.
4745 * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
4746 Likewise.
4747 * engine.cc (impl_region_model_context::warn): Propagate return
4748 value from diagnostic_manager::add_diagnostic.
4750 2022-03-18 David Malcolm <dmalcolm@redhat.com>
4752 PR analyzer/104943
4753 PR analyzer/104954
4754 PR analyzer/103533
4755 * analyzer.h (class state_purge_per_decl): New forward decl.
4756 * engine.cc (impl_run_checkers): Pass region_model_manager to
4757 state_purge_map ctor.
4758 * program-point.cc (function_point::final_stmt_p): New.
4759 (function_point::get_next): New.
4760 * program-point.h (function_point::final_stmt_p): New decl.
4761 (function_point::get_next): New decl.
4762 * program-state.cc (program_state::prune_for_point): Generalize to
4763 purge local decls as well as SSA names.
4764 (program_state::can_purge_base_region_p): New.
4765 * program-state.h (program_state::can_purge_base_region_p): New
4766 decl.
4767 * region-model.cc (struct append_ssa_names_cb_data): Rename to...
4768 (struct append_regions_cb_data): ...this.
4769 (region_model::get_ssa_name_regions_for_current_frame): Rename
4770 to...
4771 (region_model::get_regions_for_current_frame): ...this, updating
4772 for other renamings.
4773 (region_model::append_ssa_names_cb): Rename to...
4774 (region_model::append_regions_cb): ...this, and drop the requirement
4775 that the subregion be a SSA name.
4776 * region-model.h (struct append_ssa_names_cb_data): Rename decl
4777 to...
4778 (struct append_regions_cb_data): ...this.
4779 (region_model::get_ssa_name_regions_for_current_frame): Rename
4780 decl to...
4781 (region_model::get_regions_for_current_frame): ...this.
4782 (region_model::append_ssa_names_cb): Rename decl to...
4783 (region_model::append_regions_cb): ...this.
4784 * state-purge.cc: Include "tristate.h", "selftest.h",
4785 "analyzer/store.h", "analyzer/region-model.h", and
4786 "gimple-walk.h".
4787 (get_candidate_for_purging): New.
4788 (class gimple_op_visitor): New.
4789 (my_load_cb): New.
4790 (my_store_cb): New.
4791 (my_addr_cb): New.
4792 (state_purge_map::state_purge_map): Add "mgr" param. Update for
4793 renamings. Find uses of local variables.
4794 (state_purge_map::~state_purge_map): Update for renaming of m_map
4795 to m_ssa_map. Clean up m_decl_map.
4796 (state_purge_map::get_or_create_data_for_decl): New.
4797 (state_purge_per_ssa_name::state_purge_per_ssa_name): Update for
4798 inheriting from state_purge_per_tree.
4799 (state_purge_per_ssa_name::add_to_worklist): Likewise.
4800 (state_purge_per_decl::state_purge_per_decl): New.
4801 (state_purge_per_decl::add_needed_at): New.
4802 (state_purge_per_decl::add_pointed_to_at): New.
4803 (state_purge_per_decl::process_worklists): New.
4804 (state_purge_per_decl::add_to_worklist): New.
4805 (same_binding_p): New.
4806 (fully_overwrites_p): New.
4807 (state_purge_per_decl::process_point_backwards): New.
4808 (state_purge_per_decl::process_point_forwards): New.
4809 (state_purge_per_decl::needed_at_point_p): New.
4810 (state_purge_annotator::print_needed): Generalize to print local
4811 decls as well as SSA names.
4812 * state-purge.h (class state_purge_map): Update leading comment.
4813 (state_purge_map::map_t): Rename to...
4814 (state_purge_map::ssa_map_t): ...this.
4815 (state_purge_map::iterator): Rename to...
4816 (state_purge_map::ssa_iterator): ...this.
4817 (state_purge_map::decl_map_t): New typedef.
4818 (state_purge_map::decl_iterator): New typedef.
4819 (state_purge_map::state_purge_map): Add "mgr" param.
4820 (state_purge_map::get_data_for_ssa_name): Update for renaming.
4821 (state_purge_map::get_any_data_for_decl): New.
4822 (state_purge_map::get_or_create_data_for_decl): New decl.
4823 (state_purge_map::begin): Rename to...
4824 (state_purge_map::begin_ssas): ...this.
4825 (state_purge_map::end): Rename to...
4826 (state_purge_map::end_ssa): ...this.
4827 (state_purge_map::begin_decls): New.
4828 (state_purge_map::end_decls): New.
4829 (state_purge_map::m_map): Rename to...
4830 (state_purge_map::m_ssa_map): ...this.
4831 (state_purge_map::m_decl_map): New field.
4832 (class state_purge_per_tree): New class.
4833 (class state_purge_per_ssa_name): Inherit from state_purge_per_tree.
4834 (state_purge_per_ssa_name::get_function): Move to base class.
4835 (state_purge_per_ssa_name::point_set_t): Likewise.
4836 (state_purge_per_ssa_name::m_fun): Likewise.
4837 (class state_purge_per_decl): New.
4839 2022-03-17 David Malcolm <dmalcolm@redhat.com>
4841 * state-purge.cc (state_purge_annotator::add_node_annotations):
4842 Avoid duplicate before-supernode annotations when returning from
4843 an interprocedural call. Show after-supernode annotations.
4845 2022-03-17 David Malcolm <dmalcolm@redhat.com>
4847 * program-point.cc (program_point::get_next): Fix missing
4848 increment of index.
4850 2022-03-16 David Malcolm <dmalcolm@redhat.com>
4852 PR analyzer/104955
4853 * diagnostic-manager.cc (get_emission_location): New.
4854 (diagnostic_manager::diagnostic_manager): Initialize
4855 m_num_disabled_diagnostics.
4856 (diagnostic_manager::add_diagnostic): Reject diagnostics that
4857 will eventually be rejected due to being disabled.
4858 (diagnostic_manager::emit_saved_diagnostics): Log the number
4859 of disabled diagnostics.
4860 (diagnostic_manager::emit_saved_diagnostic): Split out logic for
4861 determining emission location to get_emission_location.
4862 * diagnostic-manager.h
4863 (diagnostic_manager::m_num_disabled_diagnostics): New field.
4864 * engine.cc (stale_jmp_buf::get_controlling_option): New.
4865 (stale_jmp_buf::emit): Use it.
4866 * pending-diagnostic.h
4867 (pending_diagnostic::get_controlling_option): New vfunc.
4868 * region-model.cc
4869 (poisoned_value_diagnostic::get_controlling_option): New.
4870 (poisoned_value_diagnostic::emit): Use it.
4871 (shift_count_negative_diagnostic::get_controlling_option): New.
4872 (shift_count_negative_diagnostic::emit): Use it.
4873 (shift_count_overflow_diagnostic::get_controlling_option): New.
4874 (shift_count_overflow_diagnostic::emit): Use it.
4875 (dump_path_diagnostic::get_controlling_option): New.
4876 (dump_path_diagnostic::emit): Use it.
4877 (write_to_const_diagnostic::get_controlling_option): New.
4878 (write_to_const_diagnostic::emit): Use it.
4879 (write_to_string_literal_diagnostic::get_controlling_option): New.
4880 (write_to_string_literal_diagnostic::emit): Use it.
4881 * sm-file.cc (double_fclose::get_controlling_option): New.
4882 (double_fclose::emit): Use it.
4883 (file_leak::get_controlling_option): New.
4884 (file_leak::emit): Use it.
4885 * sm-malloc.cc (mismatching_deallocation::get_controlling_option):
4886 New.
4887 (mismatching_deallocation::emit): Use it.
4888 (double_free::get_controlling_option): New.
4889 (double_free::emit): Use it.
4890 (possible_null_deref::get_controlling_option): New.
4891 (possible_null_deref::emit): Use it.
4892 (possible_null_arg::get_controlling_option): New.
4893 (possible_null_arg::emit): Use it.
4894 (null_deref::get_controlling_option): New.
4895 (null_deref::emit): Use it.
4896 (null_arg::get_controlling_option): New.
4897 (null_arg::emit): Use it.
4898 (use_after_free::get_controlling_option): New.
4899 (use_after_free::emit): Use it.
4900 (malloc_leak::get_controlling_option): New.
4901 (malloc_leak::emit): Use it.
4902 (free_of_non_heap::get_controlling_option): New.
4903 (free_of_non_heap::emit): Use it.
4904 * sm-pattern-test.cc (pattern_match::get_controlling_option): New.
4905 (pattern_match::emit): Use it.
4906 * sm-sensitive.cc
4907 (exposure_through_output_file::get_controlling_option): New.
4908 (exposure_through_output_file::emit): Use it.
4909 * sm-signal.cc (signal_unsafe_call::get_controlling_option): New.
4910 (signal_unsafe_call::emit): Use it.
4911 * sm-taint.cc (tainted_array_index::get_controlling_option): New.
4912 (tainted_array_index::emit): Use it.
4913 (tainted_offset::get_controlling_option): New.
4914 (tainted_offset::emit): Use it.
4915 (tainted_size::get_controlling_option): New.
4916 (tainted_size::emit): Use it.
4917 (tainted_divisor::get_controlling_option): New.
4918 (tainted_divisor::emit): Use it.
4919 (tainted_allocation_size::get_controlling_option): New.
4920 (tainted_allocation_size::emit): Use it.
4922 2022-03-15 David Malcolm <dmalcolm@redhat.com>
4924 * store.cc (store::store): Presize m_cluster_map.
4926 2022-03-10 David Malcolm <dmalcolm@redhat.com>
4928 PR analyzer/104863
4929 * constraint-manager.cc (constraint_manager::add_constraint):
4930 Refresh the EC IDs when adding constraints implied by offsets.
4932 2022-03-10 David Malcolm <dmalcolm@redhat.com>
4934 PR analyzer/104793
4935 * analyzer.h (class pending_note): New forward decl.
4936 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
4937 Initialize m_notes.
4938 (saved_diagnostic::operator==): Compare m_notes.
4939 (saved_diagnostic::add_note): New.
4940 (saved_diagnostic::emit_any_notes): New.
4941 (diagnostic_manager::add_note): New.
4942 (diagnostic_manager::emit_saved_diagnostic): Call emit_any_notes
4943 after emitting the warning.
4944 * diagnostic-manager.h (saved_diagnostic::add_note): New decl.
4945 (saved_diagnostic::emit_any_notes): New decl.
4946 (saved_diagnostic::m_notes): New field.
4947 (diagnostic_manager::add_note): New decl.
4948 * engine.cc (impl_region_model_context::add_note): New.
4949 * exploded-graph.h (impl_region_model_context::add_note): New
4950 decl.
4951 * pending-diagnostic.h (class pending_note): New.
4952 (class pending_note_subclass): New template.
4953 * region-model.cc (class reason_attr_access): New.
4954 (check_external_function_for_access_attr): Add class
4955 annotating_ctxt and use it when checking region.
4956 (noop_region_model_context::add_note): New.
4957 * region-model.h (region_model_context::add_note): New vfunc.
4958 (noop_region_model_context::add_note): New decl.
4959 (class region_model_context_decorator): New.
4960 (class note_adding_context): New.
4962 2022-03-10 David Malcolm <dmalcolm@redhat.com>
4964 PR analyzer/104793
4965 * region-model.cc
4966 (region_model::check_external_function_for_access_attr): New.
4967 (region_model::handle_unrecognized_call): Call it.
4968 * region-model.h
4969 (region_model::check_external_function_for_access_attr): New decl.
4970 (region_model::handle_unrecognized_call): New decl.
4972 2022-03-10 David Malcolm <dmalcolm@redhat.com>
4974 * sm-taint.cc (taint_state_machine::check_for_tainted_size_arg):
4975 Avoid generating duplicate saved_diagnostics by only handling the
4976 rdwr_map entry for the ptrarg, not the duplicate entry for the
4977 sizarg.
4979 2022-03-07 David Malcolm <dmalcolm@redhat.com>
4981 PR analyzer/101983
4982 * engine.cc (returning_from_function_p): New.
4983 (impl_region_model_context::on_state_leak): Use it when rejecting
4984 leaks at the return from "main".
4986 2022-03-07 Jakub Jelinek <jakub@redhat.com>
4988 * store.cc: Fix up duplicated word issue in a comment.
4989 * analyzer.cc: Likewise.
4990 * engine.cc: Likewise.
4991 * sm-taint.cc: Likewise.
4993 2022-03-04 David Malcolm <dmalcolm@redhat.com>
4995 PR analyzer/103521
4996 * analyzer.opt (-param=analyzer-max-svalue-depth=): Reduce from 13
4997 to 12.
4999 2022-02-23 David Malcolm <dmalcolm@redhat.com>
5001 PR analyzer/104434
5002 * analyzer.h (class const_fn_result_svalue): New decl.
5003 * region-model-impl-calls.cc (call_details::get_manager): New.
5004 * region-model-manager.cc
5005 (region_model_manager::get_or_create_const_fn_result_svalue): New.
5006 (region_model_manager::log_stats): Log
5007 m_const_fn_result_values_map.
5008 * region-model.cc (const_fn_p): New.
5009 (maybe_get_const_fn_result): New.
5010 (region_model::on_call_pre): Handle fndecls with
5011 __attribute__((const)) by calling the above rather than making
5012 a conjured_svalue.
5013 * region-model.h (visitor::visit_const_fn_result_svalue): New.
5014 (region_model_manager::get_or_create_const_fn_result_svalue): New
5015 decl.
5016 (region_model_manager::const_fn_result_values_map_t): New typedef.
5017 (region_model_manager::m_const_fn_result_values_map): New field.
5018 (call_details::get_manager): New decl.
5019 * svalue.cc (svalue::cmp_ptr): Handle SK_CONST_FN_RESULT.
5020 (const_fn_result_svalue::dump_to_pp): New.
5021 (const_fn_result_svalue::dump_input): New.
5022 (const_fn_result_svalue::accept): New.
5023 * svalue.h (enum svalue_kind): Add SK_CONST_FN_RESULT.
5024 (svalue::dyn_cast_const_fn_result_svalue): New.
5025 (class const_fn_result_svalue): New.
5026 (is_a_helper <const const_fn_result_svalue *>::test): New.
5027 (template <> struct default_hash_traits<const_fn_result_svalue::key_t>):
5028 New.
5030 2022-02-17 David Malcolm <dmalcolm@redhat.com>
5032 PR analyzer/104576
5033 * region-model.cc: Include "calls.h".
5034 (region_model::on_call_pre): Use flags_from_decl_or_type to
5035 generalize check for DECL_PURE_P to also check for ECF_CONST.
5037 2022-02-16 David Malcolm <dmalcolm@redhat.com>
5039 PR analyzer/104560
5040 * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
5041 Add region creation events for globals of interest.
5042 (null_assignment_sm_context::get_old_program_state): New.
5043 (diagnostic_manager::add_events_for_eedge): Move check for
5044 changing dynamic extents from PK_BEFORE_STMT case to after the
5045 switch on the dst_point's kind so that we can emit them for the
5046 final stmt in a basic block.
5047 * engine.cc (impl_sm_context::get_old_program_state): New.
5048 * sm-malloc.cc (malloc_state_machine::get_default_state): Rewrite
5049 detection of m_non_heap to use get_memory_space.
5050 (free_of_non_heap::free_of_non_heap): Add freed_reg param.
5051 (free_of_non_heap::subclass_equal_p): Update for changes to
5052 fields.
5053 (free_of_non_heap::emit): Drop m_kind in favor of
5054 get_memory_space.
5055 (free_of_non_heap::describe_state_change): Remove logic for
5056 detecting alloca.
5057 (free_of_non_heap::mark_interesting_stuff): Add region-creation of
5058 m_freed_reg.
5059 (free_of_non_heap::get_memory_space): New.
5060 (free_of_non_heap::kind): Drop enum.
5061 (free_of_non_heap::m_freed_reg): New field.
5062 (free_of_non_heap::m_kind): Drop field.
5063 (malloc_state_machine::on_stmt): Drop transition to m_non_heap.
5064 (malloc_state_machine::handle_free_of_non_heap): New function,
5065 split out from on_deallocator_call and on_realloc_call, adding
5066 detection of the freed region.
5067 (malloc_state_machine::on_deallocator_call): Use it.
5068 (malloc_state_machine::on_realloc_call): Likewise.
5069 * sm.h (sm_context::get_old_program_state): New vfunc.
5071 2022-02-15 David Malcolm <dmalcolm@redhat.com>
5073 PR analyzer/104524
5074 * region-model-manager.cc
5075 (region_model_manager::maybe_fold_sub_svalue): Only call
5076 get_or_create_cast if type is non-NULL.
5078 2022-02-15 David Malcolm <dmalcolm@redhat.com>
5080 PR analyzer/102692
5081 * exploded-graph.h (impl_region_model_context::get_stmt): New.
5082 * region-model.cc: Include "gimple-ssa.h", "tree-phinodes.h",
5083 "tree-ssa-operands.h", and "ssa-iterators.h".
5084 (within_short_circuited_stmt_p): New.
5085 (region_model::check_for_poison): Don't warn about uninit values
5086 if within_short_circuited_stmt_p.
5087 * region-model.h (region_model_context::get_stmt): New vfunc.
5088 (noop_region_model_context::get_stmt): New.
5090 2022-02-11 David Malcolm <dmalcolm@redhat.com>
5092 PR analyzer/104274
5093 * region-model.cc (region_model::check_for_poison): Ignore
5094 uninitialized uses of empty types.
5096 2022-02-10 David Malcolm <dmalcolm@redhat.com>
5098 PR analyzer/98797
5099 * region-model-manager.cc
5100 (region_model_manager::maybe_fold_sub_svalue): Generalize getting
5101 individual chars of a STRING_CST from element_region to any
5102 subregion which is a concrete access of a single byte from its
5103 parent region.
5104 * region.cc (region::get_relative_concrete_byte_range): New.
5105 * region.h (region::get_relative_concrete_byte_range): New decl.
5107 2022-02-09 David Malcolm <dmalcolm@redhat.com>
5109 PR analyzer/104452
5110 * region-model.cc (selftest::test_bit_range_regions): New.
5111 (selftest::analyzer_region_model_cc_tests): Call it.
5112 * region.h (bit_range_region::key_t::hash): Fix hashing of m_bits
5113 to avoid using uninitialized data.
5115 2022-02-07 David Malcolm <dmalcolm@redhat.com>
5117 PR analyzer/104417
5118 * sm-taint.cc (tainted_allocation_size::tainted_allocation_size):
5119 Remove overzealous assertion.
5120 (tainted_allocation_size::emit): Likewise.
5121 (region_model::check_dynamic_size_for_taint): Likewise.
5123 2022-02-07 David Malcolm <dmalcolm@redhat.com>
5125 PR analyzer/103872
5126 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
5127 Reimplement in terms of a get_store_value followed by a set_value.
5129 2022-02-03 David Malcolm <dmalcolm@redhat.com>
5131 PR analyzer/104369
5132 * engine.cc (exploded_graph::process_node): Use the node for any
5133 diagnostics, avoiding ICE if a bifurcation update adds a
5134 saved_diagnostic, such as for a tainted realloc size.
5135 * region-model-impl-calls.cc
5136 (region_model::impl_call_realloc::success_no_move::update_model):
5137 Require the old pointer to be non-NULL to be able successfully
5138 grow in place. Use model->deref_rvalue rather than maybe_get_region
5139 to support the old pointer being symbolic.
5140 (region_model::impl_call_realloc::success_with_move::update_model):
5141 Likewise. Add a constraint that the new pointer != the old pointer.
5142 Use a sized_region when setting the value of the new region.
5143 Handle the case where we don't know the dynamic size of the old
5144 region by marking the new region as unknown.
5145 * sm-taint.cc (tainted_allocation_size::tainted_allocation_size):
5146 Update assertion to also allow for MEMSPACE_UNKNOWN.
5147 (tainted_allocation_size::emit): Likewise.
5148 (region_model::check_dynamic_size_for_taint): Likewise.
5150 2022-02-03 David Malcolm <dmalcolm@redhat.com>
5152 * region-model-impl-calls.cc (region_model::impl_call_calloc): Use
5153 a sized_region when calling zero_fill_region.
5155 2022-02-02 David Malcolm <dmalcolm@redhat.com>
5157 * region-model.cc (region_model::on_return): Replace usage of
5158 copy_region with get_rvalue/set_value pair.
5159 (region_model::pop_frame): Likewise.
5160 (selftest::test_compound_assignment): Likewise.
5161 * region-model.h (region_model::copy_region): Delete decl.
5162 * region.cc (region_model::copy_region): Delete.
5164 2022-02-02 David Malcolm <dmalcolm@redhat.com>
5166 * region.cc (region::calc_offset): Consolidate effectively
5167 identical cases.
5169 2022-02-02 David Malcolm <dmalcolm@redhat.com>
5171 * analyzer.h (class bit_range_region): New forward decl.
5172 * region-model-manager.cc (region_model_manager::get_bit_range):
5173 New.
5174 (region_model_manager::log_stats): Handle m_bit_range_regions.
5175 * region-model.cc (region_model::get_lvalue_1): Handle
5176 BIT_FIELD_REF.
5177 * region-model.h (region_model_manager::get_bit_range): New decl.
5178 (region_model_manager::m_bit_range_regions): New field.
5179 * region.cc (region::get_base_region): Handle RK_BIT_RANGE.
5180 (region::base_region_p): Likewise.
5181 (region::calc_offset): Likewise.
5182 (bit_range_region::dump_to_pp): New.
5183 (bit_range_region::get_byte_size): New.
5184 (bit_range_region::get_bit_size): New.
5185 (bit_range_region::get_byte_size_sval): New.
5186 (bit_range_region::get_relative_concrete_offset): New.
5187 * region.h (enum region_kind): Add RK_BIT_RANGE.
5188 (region::dyn_cast_bit_range_region): New vfunc.
5189 (class bit_range_region): New.
5190 (is_a_helper <const bit_range_region *>::test): New.
5191 (default_hash_traits<bit_range_region::key_t>): New.
5193 2022-02-02 David Malcolm <dmalcolm@redhat.com>
5195 PR analyzer/104270
5196 * region-model.cc (region_model::on_call_pre): Handle
5197 IFN_DEFERRED_INIT.
5199 2022-01-27 David Malcolm <dmalcolm@redhat.com>
5201 * checker-path.cc (event_kind_to_string): Handle
5202 EK_REGION_CREATION.
5203 (region_creation_event::region_creation_event): New.
5204 (region_creation_event::get_desc): New.
5205 (checker_path::add_region_creation_event): New.
5206 * checker-path.h (enum event_kind): Add EK_REGION_CREATION.
5207 (class region_creation_event): New subclass.
5208 (checker_path::add_region_creation_event): New decl.
5209 * diagnostic-manager.cc
5210 (diagnostic_manager::emit_saved_diagnostic): Pass NULL for new
5211 param to add_events_for_eedge when handling trailing eedge.
5212 (diagnostic_manager::build_emission_path): Create an interesting_t
5213 instance, allow the pending diagnostic to populate it, and pass it
5214 to the calls to add_events_for_eedge.
5215 (diagnostic_manager::add_events_for_eedge): Add "interest" param.
5216 Use it to add region_creation_events for on-stack regions created
5217 within at function entry, and when pertinent dynamically-sized
5218 regions are created.
5219 (diagnostic_manager::prune_for_sm_diagnostic): Add case for
5220 EK_REGION_CREATION.
5221 * diagnostic-manager.h (diagnostic_manager::add_events_for_eedge):
5222 Add "interest" param.
5223 * pending-diagnostic.cc: Include "selftest.h", "tristate.h",
5224 "analyzer/call-string.h", "analyzer/program-point.h",
5225 "analyzer/store.h", and "analyzer/region-model.h".
5226 (interesting_t::add_region_creation): New.
5227 (interesting_t::dump_to_pp): New.
5228 * pending-diagnostic.h (struct interesting_t): New.
5229 (pending_diagnostic::mark_interesting_stuff): New vfunc.
5230 * region-model.cc
5231 (poisoned_value_diagnostic::poisoned_value_diagnostic): Add
5232 (poisoned_value_diagnostic::operator==): Compare m_pkind and
5233 m_src_region fields.
5234 (poisoned_value_diagnostic::mark_interesting_stuff): New.
5235 (poisoned_value_diagnostic::m_src_region): New.
5236 (region_model::check_for_poison): Call
5237 get_region_for_poisoned_expr for uninit values and pass the resul
5238 to the diagnostic.
5239 (region_model::get_region_for_poisoned_expr): New.
5240 (region_model::deref_rvalue): Pass NULL for
5241 poisoned_value_diagnostic's src_region.
5242 * region-model.h (region_model::get_region_for_poisoned_expr): New
5243 decl.
5244 * region.h (frame_region::get_fndecl): New.
5246 2022-01-27 Martin Liska <mliska@suse.cz>
5248 PR analyzer/104247
5249 * constraint-manager.cc (bounded_ranges_manager::log_stats):
5250 Cast to long for format purpose.
5251 * region-model-manager.cc (log_uniq_map): Likewise.
5253 2022-01-26 David Malcolm <dmalcolm@redhat.com>
5255 PR analyzer/104224
5256 * region-model.cc (region_model::check_call_args): New.
5257 (region_model::on_call_pre): Call it when ignoring stdio builtins.
5258 * region-model.h (region_model::check_call_args): New decl
5260 2022-01-26 David Malcolm <dmalcolm@redhat.com>
5262 PR analyzer/94362
5263 * constraint-manager.cc (range::add_bound): Fix tests for
5264 discarding redundant constraints. Perform test for rejecting
5265 unsatisfiable constraints earlier so that they don't update
5266 the object on failure.
5267 (selftest::test_range): New.
5268 (selftest::test_constant_comparisons): Add test coverage for
5269 existing constraints becoming narrower until they are
5270 unsatisfiable.
5271 (selftest::run_constraint_manager_tests): Call test_range.
5273 2022-01-22 David Malcolm <dmalcolm@redhat.com>
5275 PR analyzer/104159
5276 * region-model-manager.cc
5277 (region_model_manager::get_or_create_cast): Bail out if the types
5278 are the same. Don't attempt to handle casts involving vector
5279 types.
5281 2022-01-20 David Malcolm <dmalcolm@redhat.com>
5283 PR analyzer/94362
5284 * constraint-manager.cc (bound::ensure_closed): Convert param to
5285 enum bound_kind.
5286 (range::constrained_to_single_element): Likewise.
5287 (range::add_bound): New.
5288 (constraint_manager::add_constraint): Handle SVAL + OFFSET
5289 compared to a constant.
5290 (constraint_manager::get_ec_bounds): Rewrite in terms of
5291 range::add_bound.
5292 (constraint_manager::eval_condition): Reject if range::add_bound
5293 fails.
5294 (selftest::test_constant_comparisons): Add test coverage for
5295 various impossible combinations of integer comparisons.
5296 * constraint-manager.h (enum bound_kind): New.
5297 (struct bound): Likewise.
5298 (bound::ensure_closed): Convert to param to enum bound_kind.
5299 (struct range): Convert to...
5300 (class range): ...this, making fields private.
5301 (range::add_bound): New decls.
5302 * region-model.cc (region_model::add_constraint): Fail if
5303 constraint_manager::add_constraint fails.
5305 2022-01-18 David Malcolm <dmalcolm@redhat.com>
5307 PR analyzer/104089
5308 * region-model-manager.cc
5309 (region_model_manager::get_or_create_constant_svalue): Assert that
5310 we have a CONSTANT_CLASS_P.
5311 (region_model_manager::maybe_fold_unaryop): Only fold a constant
5312 when fold_unary's result is a constant or a cast of a constant.
5314 2022-01-18 David Malcolm <dmalcolm@redhat.com>
5316 PR analyzer/104062
5317 * region-model-manager.cc
5318 (region_model_manager::maybe_fold_sub_svalue): Avoid casting to
5319 NULL type when folding access to repeated svalue.
5321 2022-01-17 Martin Liska <mliska@suse.cz>
5323 * analyzer.cc (is_special_named_call_p): Rename .c names to .cc.
5324 (is_named_call_p): Likewise.
5325 * region-model-asm.cc (deterministic_p): Likewise.
5326 * region.cc (field_region::get_relative_concrete_offset): Likewise.
5327 * sm-malloc.cc (method_p): Likewise.
5328 * supergraph.cc (superedge::dump_dot): Likewise.
5330 2022-01-14 David Malcolm <dmalcolm@redhat.com>
5332 * sm-taint.cc (taint_state_machine::combine_states): Handle combination
5333 of has_ub and has_lb.
5335 2022-01-14 David Malcolm <dmalcolm@redhat.com>
5337 PR analyzer/104029
5338 * sm-taint.cc (taint_state_machine::alt_get_inherited_state):
5339 Remove gcc_unreachable from default case for unary ops.
5341 2022-01-14 David Malcolm <dmalcolm@redhat.com>
5343 * engine.cc: Include "stringpool.h", "attribs.h", and
5344 "tree-dfa.h".
5345 (mark_params_as_tainted): New.
5346 (class tainted_args_function_custom_event): New.
5347 (class tainted_args_function_info): New.
5348 (exploded_graph::add_function_entry): Handle functions with
5349 "tainted_args" attribute.
5350 (class tainted_args_field_custom_event): New.
5351 (class tainted_args_callback_custom_event): New.
5352 (class tainted_args_call_info): New.
5353 (add_tainted_args_callback): New.
5354 (add_any_callbacks): New.
5355 (exploded_graph::build_initial_worklist): Likewise.
5356 (exploded_graph::build_initial_worklist): Find callbacks that are
5357 reachable from global initializers, calling add_any_callbacks on
5358 them.
5360 2022-01-12 David Malcolm <dmalcolm@redhat.com>
5362 PR analyzer/103940
5363 * engine.cc (impl_sm_context::impl_sm_context): Add
5364 "unknown_side_effects" param and use it to initialize
5365 new m_unknown_side_effects field.
5366 (impl_sm_context::unknown_side_effects_p): New.
5367 (impl_sm_context::m_unknown_side_effects): New.
5368 (exploded_node::on_stmt): Pass unknown_side_effects to sm_ctxt
5369 ctor.
5370 * sm-taint.cc: Include "stringpool.h" and "attribs.h".
5371 (tainted_size::tainted_size): Drop "dir" param.
5372 (tainted_size::get_kind): Drop "FINAL".
5373 (tainted_size::emit): Likewise.
5374 (tainted_size::m_dir): Drop unused field.
5375 (class tainted_access_attrib_size): New subclass.
5376 (taint_state_machine::on_stmt): Call check_for_tainted_size_arg on
5377 external functions with unknown side effects.
5378 (taint_state_machine::check_for_tainted_size_arg): New.
5379 (region_model::check_region_for_taint): Drop "dir" param from
5380 tainted_size ctor.
5381 * sm.h (sm_context::unknown_side_effects_p): New.
5383 2022-01-11 David Malcolm <dmalcolm@redhat.com>
5385 PR analyzer/102692
5386 * diagnostic-manager.cc
5387 (class auto_disable_complexity_checks): Rename to...
5388 (class auto_checking_feasibility): ...this, updating
5389 the calls accordingly.
5390 (epath_finder::explore_feasible_paths): Update for renaming.
5391 * region-model-manager.cc
5392 (region_model_manager::region_model_manager): Update for change from
5393 m_check_complexity to m_checking_feasibility.
5394 (region_model_manager::reject_if_too_complex): Likewise.
5395 (region_model_manager::get_or_create_unknown_svalue): Handle
5396 m_checking_feasibility.
5397 (region_model_manager::create_unique_svalue): New.
5398 (region_model_manager::maybe_fold_binop): Handle BIT_AND_EXPR and
5399 BIT_IOR_EXPRs on booleans where we know the result.
5400 * region-model.cc (test_binop_svalue_folding): Add test coverage
5401 for the above.
5402 * region-model.h (region_model_manager::create_unique_svalue): New
5403 decl.
5404 (region_model_manager::enable_complexity_check): Replace with...
5405 (region_model_manager::begin_checking_feasibility): ...this.
5406 (region_model_manager::disable_complexity_check): Replace with...
5407 (region_model_manager::end_checking_feasibility): ...this.
5408 (region_model_manager::m_check_complexity): Replace with...
5409 (region_model_manager::m_checking_feasibility): ...this.
5410 (region_model_manager::m_managed_dynamic_svalues): New field.
5412 2022-01-08 David Malcolm <dmalcolm@redhat.com>
5414 * engine.cc (impl_run_checkers): Pass logger to engine ctor.
5415 * region-model-manager.cc
5416 (region_model_manager::region_model_manager): Add logger param and
5417 use it to initialize m_logger.
5418 * region-model.cc (engine::engine): New.
5419 * region-model.h (region_model_manager::region_model_manager):
5420 Add logger param.
5421 (region_model_manager::get_logger): New.
5422 (region_model_manager::m_logger): New field.
5423 (engine::engine): New.
5424 * store.cc (store_manager::get_logger): New.
5425 (store::set_value): Log scope. Log when marking a cluster as
5426 unknown due to possible aliasing.
5427 * store.h (store_manager::get_logger): New decl.
5429 2022-01-08 David Malcolm <dmalcolm@redhat.com>
5431 * region-model-impl-calls.cc (cmp_decls): New.
5432 (cmp_decls_ptr_ptr): New.
5433 (region_model::impl_call_analyzer_dump_escaped): New.
5434 * region-model.cc (region_model::on_stmt_pre): Handle
5435 __analyzer_dump_escaped.
5436 * region-model.h (region_model::impl_call_analyzer_dump_escaped):
5437 New decl.
5438 * store.h (binding_cluster::get_base_region): New accessor.
5440 2022-01-08 David Malcolm <dmalcolm@redhat.com>
5442 * region.cc (region::is_named_decl_p): New.
5443 * region.h (region::is_named_decl_p): New decl.
5445 2022-01-06 David Malcolm <dmalcolm@redhat.com>
5447 PR analyzer/103546
5448 * store.cc (store::eval_alias_1): Refactor handling of decl
5449 regions, adding a test for may_be_aliased, rejecting those for
5450 which it returns false.
5452 2021-12-12 Jonathan Wakely <jwakely@redhat.com>
5454 * engine.cc: Define INCLUDE_MEMORY instead of INCLUDE_UNIQUE_PTR.
5456 2021-12-06 David Malcolm <dmalcolm@redhat.com>
5458 PR analyzer/103533
5459 * constraint-manager.cc (equiv_class::contains_non_constant_p):
5460 New.
5461 (constraint_manager::canonicalize): Call it when determining
5462 redundant ECs.
5463 (selftest::test_purging): New selftest.
5464 (selftest::run_constraint_manager_tests): Likewise.
5465 * constraint-manager.h (equiv_class::contains_non_constant_p):
5466 New decl.
5468 2021-12-01 David Malcolm <dmalcolm@redhat.com>
5470 PR analyzer/102471
5471 * region-model-reachability.cc (reachable_regions::handle_parm):
5472 Treat all svalues within a compound parm has reachable, and those
5473 wrapped in a cast.
5475 2021-11-29 David Malcolm <dmalcolm@redhat.com>
5477 PR analyzer/103217
5478 * store.cc (binding_cluster::can_merge_p): For the "key is bound"
5479 vs "key is not bound" merger case, check that the bound svalue
5480 is mergeable before merging it to "unknown", rejecting the merger
5481 otherwise.
5483 2021-11-19 David Malcolm <dmalcolm@redhat.com>
5485 PR analyzer/103217
5486 * engine.cc (exploded_graph::get_or_create_node): Pass in
5487 m_ext_state to program_state::can_merge_with_p.
5488 (exploded_graph::process_worklist): Likewise.
5489 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
5490 Likewise.
5491 (exploded_graph::process_node): Add missing call to detect_leaks
5492 when handling phi nodes.
5493 * program-state.cc (program_state::can_merge_with_p): Add
5494 "ext_state" param. Pass it and state ptrs to
5495 region_model::can_merge_with_p.
5496 (selftest::test_program_state_merging): Update for new ext_state
5497 param of program_state::can_merge_with_p.
5498 (selftest::test_program_state_merging_2): Likewise.
5499 * program-state.h (program_state::can_purge_p): Make const.
5500 (program_state::can_merge_with_p): Add "ext_state" param.
5501 * region-model.cc: Include "analyzer/program-state.h".
5502 (region_model::can_merge_with_p): Add params "ext_state",
5503 "state_a", and "state_b", use them when creating model_merger
5504 object.
5505 (model_merger::mergeable_svalue_p): New.
5506 * region-model.h (region_model::can_merge_with_p): Add params
5507 "ext_state", "state_a", and "state_b".
5508 (model_merger::model_merger) Likewise, initializing new fields.
5509 (model_merger::mergeable_svalue_p): New decl.
5510 (model_merger::m_ext_state): New field.
5511 (model_merger::m_state_a): New field.
5512 (model_merger::m_state_b): New field.
5513 * svalue.cc (svalue::can_merge_p): Call
5514 model_merger::mergeable_svalue_p on both states and reject the
5515 merger accordingly.
5517 2021-11-17 David Malcolm <dmalcolm@redhat.com>
5519 PR analyzer/102695
5520 * region-model-impl-calls.cc (region_model::impl_call_strchr): New.
5521 * region-model-manager.cc
5522 (region_model_manager::maybe_fold_unaryop): Simplify cast to
5523 pointer type of an existing pointer to a region.
5524 * region-model.cc (region_model::on_call_pre): Handle
5525 BUILT_IN_STRCHR and "strchr".
5526 (write_to_const_diagnostic::emit): Add auto_diagnostic_group. Add
5527 alternate wordings for functions and labels.
5528 (write_to_const_diagnostic::describe_final_event): Add alternate
5529 wordings for functions and labels.
5530 (region_model::check_for_writable_region): Handle RK_FUNCTION and
5531 RK_LABEL.
5532 * region-model.h (region_model::impl_call_strchr): New decl.
5534 2021-11-16 David Malcolm <dmalcolm@redhat.com>
5536 PR analyzer/102662
5537 * constraint-manager.cc (bounded_range::operator==): Require the
5538 types to be the same for equality.
5540 2021-11-13 David Malcolm <dmalcolm@redhat.com>
5542 * analyzer.opt (Wanalyzer-tainted-allocation-size): New.
5543 (Wanalyzer-tainted-divisor): New.
5544 (Wanalyzer-tainted-offset): New.
5545 (Wanalyzer-tainted-size): New.
5546 * engine.cc (impl_region_model_context::get_taint_map): New.
5547 * exploded-graph.h (impl_region_model_context::get_taint_map):
5548 New decl.
5549 * program-state.cc (sm_state_map::get_state): Call
5550 alt_get_inherited_state.
5551 (sm_state_map::impl_set_state): Modify states within
5552 compound svalues.
5553 (program_state::impl_call_analyzer_dump_state): Undo casts.
5554 (selftest::test_program_state_1): Update for new context param of
5555 create_region_for_heap_alloc.
5556 (selftest::test_program_state_merging): Likewise.
5557 * region-model-impl-calls.cc (region_model::impl_call_alloca):
5558 Likewise.
5559 (region_model::impl_call_calloc): Likewise.
5560 (region_model::impl_call_malloc): Likewise.
5561 (region_model::impl_call_operator_new): Likewise.
5562 (region_model::impl_call_realloc): Likewise.
5563 * region-model.cc (region_model::check_region_access): Call
5564 check_region_for_taint.
5565 (region_model::get_representative_path_var_1): Handle binops.
5566 (region_model::create_region_for_heap_alloc): Add "ctxt" param and
5567 pass it to set_dynamic_extents.
5568 (region_model::create_region_for_alloca): Likewise.
5569 (region_model::set_dynamic_extents): Add "ctxt" param and use it
5570 to call check_dynamic_size_for_taint.
5571 (selftest::test_state_merging): Update for new context param of
5572 create_region_for_heap_alloc.
5573 (selftest::test_malloc_constraints): Likewise.
5574 (selftest::test_malloc): Likewise.
5575 (selftest::test_alloca): Likewise for create_region_for_alloca.
5576 * region-model.h (region_model::create_region_for_heap_alloc): Add
5577 "ctxt" param.
5578 (region_model::create_region_for_alloca): Likewise.
5579 (region_model::set_dynamic_extents): Likewise.
5580 (region_model::check_dynamic_size_for_taint): New decl.
5581 (region_model::check_region_for_taint): New decl.
5582 (region_model_context::get_taint_map): New vfunc.
5583 (noop_region_model_context::get_taint_map): New.
5584 * sm-taint.cc: Remove include of "diagnostic-event-id.h"; add
5585 includes of "gimple-iterator.h", "tristate.h", "selftest.h",
5586 "ordered-hash-map.h", "cgraph.h", "cfg.h", "digraph.h",
5587 "analyzer/supergraph.h", "analyzer/call-string.h",
5588 "analyzer/program-point.h", "analyzer/store.h",
5589 "analyzer/region-model.h", and "analyzer/program-state.h".
5590 (enum bounds): Move to top of file.
5591 (class taint_diagnostic): New.
5592 (class tainted_array_index): Convert to subclass of taint_diagnostic.
5593 (tainted_array_index::emit): Add CWE-129. Reword warning to use
5594 "attacker-controlled" rather than "tainted".
5595 (tainted_array_index::describe_state_change): Move to
5596 taint_diagnostic::describe_state_change.
5597 (tainted_array_index::describe_final_event): Reword to use
5598 "attacker-controlled" rather than "tainted".
5599 (class tainted_offset): New.
5600 (class tainted_size): New.
5601 (class tainted_divisor): New.
5602 (class tainted_allocation_size): New.
5603 (taint_state_machine::alt_get_inherited_state): New.
5604 (taint_state_machine::on_stmt): In assignment handling, remove
5605 ARRAY_REF handling in favor of check_region_for_taint. Add
5606 detection of tainted divisors.
5607 (taint_state_machine::get_taint): New.
5608 (taint_state_machine::combine_states): New.
5609 (region_model::check_region_for_taint): New.
5610 (region_model::check_dynamic_size_for_taint): New.
5611 * sm.h (state_machine::alt_get_inherited_state): New.
5613 2021-11-12 David Malcolm <dmalcolm@redhat.com>
5615 * engine.cc (exploded_node::on_stmt_pre): Return when handling
5616 "__analyzer_dump_state".
5618 2021-11-11 Richard Biener <rguenther@suse.de>
5620 * supergraph.cc: Include bitmap.h.
5622 2021-11-04 David Malcolm <dmalcolm@redhat.com>
5624 * program-state.cc (sm_state_map::dump): Use default_tree_printer
5625 as format decoder.
5627 2021-09-16 Maxim Blinov <maxim.blinov@embecosm.com>
5629 PR bootstrap/102242
5630 * engine.cc (INCLUDE_UNIQUE_PTR): Define.
5632 2021-09-08 David Malcolm <dmalcolm@redhat.com>
5634 PR analyzer/102225
5635 * analyzer.h (compat_types_p): New decl.
5636 * constraint-manager.cc
5637 (constraint_manager::get_or_add_equiv_class): Guard against NULL
5638 type when checking for pointer types.
5639 * region-model-impl-calls.cc (region_model::impl_call_realloc):
5640 Guard against NULL lhs type/region. Guard against the size value
5641 not being of a compatible type for dynamic extents.
5642 * region-model.cc (compat_types_p): Make non-static.
5644 2021-08-30 David Malcolm <dmalcolm@redhat.com>
5646 PR analyzer/99260
5647 * analyzer.h (class custom_edge_info): New class, adapted from
5648 exploded_edge::custom_info_t. Make member functions const.
5649 Make update_model return bool, converting edge param from
5650 reference to a pointer, and adding a ctxt param.
5651 (class path_context): New class.
5652 * call-info.cc: New file.
5653 * call-info.h: New file.
5654 * engine.cc: Include "analyzer/call-info.h" and <memory>.
5655 (impl_region_model_context::impl_region_model_context): Update for
5656 new m_path_ctxt field.
5657 (impl_region_model_context::bifurcate): New.
5658 (impl_region_model_context::terminate_path): New.
5659 (impl_region_model_context::get_malloc_map): New.
5660 (impl_sm_context::impl_sm_context): Update for new m_path_ctxt
5661 field.
5662 (impl_sm_context::get_fndecl_for_call): Likewise.
5663 (impl_sm_context::set_next_state): Likewise.
5664 (impl_sm_context::warn): Likewise.
5665 (impl_sm_context::is_zero_assignment): Likewise.
5666 (impl_sm_context::get_path_context): New.
5667 (impl_sm_context::m_path_ctxt): New.
5668 (impl_region_model_context::on_condition): Update for new
5669 path_ctxt param. Handle m_enode_for_diag being NULL.
5670 (impl_region_model_context::on_phi): Update for new path_ctxt
5671 param.
5672 (exploded_node::on_stmt): Add path_ctxt param, updating ctor calls
5673 to use it as necessary. Use it to bail out after sm-handling,
5674 if needed.
5675 (exploded_node::detect_leaks): Update for new path_ctxt param.
5676 (dynamic_call_info_t::update_model): Update for conversion of
5677 exploded_edge::custom_info_t to custom_edge_info.
5678 (dynamic_call_info_t::add_events_to_path): Likewise.
5679 (rewind_info_t::update_model): Likewise.
5680 (rewind_info_t::add_events_to_path): Likewise.
5681 (exploded_edge::exploded_edge): Likewise.
5682 (exploded_graph::add_edge): Likewise.
5683 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
5684 Update for new path_ctxt param.
5685 (class impl_path_context): New.
5686 (exploded_graph::process_node): Update for new path_ctxt param.
5687 Create an impl_path_context and pass it to exploded_node::on_stmt.
5688 Use it to terminate iterating stmts if terminate_path is called
5689 on it. After processing a run of stmts, query path_ctxt to
5690 potentially terminate the analysis path, and/or to "bifurcate" the
5691 analysis into multiple additional paths.
5692 (feasibility_state::maybe_update_for_edge): Update for new
5693 update_model ctxt param.
5694 * exploded-graph.h
5695 (impl_region_model_context::impl_region_model_context): Add
5696 path_ctxt param.
5697 (impl_region_model_context::bifurcate): New.
5698 (impl_region_model_context::terminate_path): New
5699 (impl_region_model_context::get_ext_state): New.
5700 (impl_region_model_context::get_malloc_map): New.
5701 (impl_region_model_context::m_path_ctxt): New field.
5702 (exploded_node::on_stmt): Add path_ctxt param.
5703 (class exploded_edge::custom_info_t): Move to analyzer.h, renaming
5704 to custom_edge_info, and making the changes as noted in analyzer.h
5705 above.
5706 (exploded_edge::exploded_edge): Update for these changes to
5707 exploded_edge::custom_info_t.
5708 (exploded_edge::m_custom_info): Likewise.
5709 (class dynamic_call_info_t): Likewise.
5710 (class rewind_info_t): Likewise.
5711 (exploded_graph::add_edge): Likewise.
5712 * program-state.cc (program_state::on_edge): Update for new
5713 path_ctxt param.
5714 (program_state::push_call): Likewise.
5715 (program_state::returning_call): Likewise.
5716 (program_state::prune_for_point): Likewise.
5717 * region-model-impl-calls.cc: Include "analyzer/call-info.h".
5718 (call_details::get_fndecl_for_call): New.
5719 (region_model::impl_call_realloc): Reimplement.
5720 * region-model.cc (region_model::on_call_pre): Move call to
5721 impl_call_realloc to...
5722 (region_model::on_call_post): ...here. Consolidate creation
5723 of call_details instance.
5724 (noop_region_model_context::bifurcate): New.
5725 (noop_region_model_context::terminate_path): New.
5726 * region-model.h (call_details::get_call_stmt): New.
5727 (call_details::get_fndecl_for_call): New.
5728 (region_model::on_realloc_with_move): New.
5729 (region_model_context::bifurcate): New.
5730 (region_model_context::terminate_path): New.
5731 (region_model_context::get_ext_state): New.
5732 (region_model_context::get_malloc_map): New.
5733 (noop_region_model_context::bifurcate): New.
5734 (noop_region_model_context::terminate_path): New.
5735 (noop_region_model_context::get_ext_state): New.
5736 (noop_region_model_context::get_malloc_map): New.
5737 * sm-malloc.cc: Include "analyzer/program-state.h".
5738 (malloc_state_machine::on_realloc_call): Reimplement.
5739 (malloc_state_machine::on_realloc_with_move): New.
5740 (region_model::on_realloc_with_move): New.
5741 * sm-signal.cc (class signal_delivery_edge_info_t): Update for
5742 conversion from exploded_edge::custom_info_t to custom_edge_info.
5743 * sm.h (sm_context::get_path_context): New.
5744 * svalue.cc (svalue::maybe_get_constant): Call
5745 unwrap_any_unmergeable.
5747 2021-08-25 Ankur Saini <arsenic@sourceware.org>
5749 PR analyzer/101980
5750 * engine.cc (exploded_graph::maybe_create_dynamic_call): Don't create
5751 calls if max recursion limit is reached.
5753 2021-08-23 David Malcolm <dmalcolm@redhat.com>
5755 * analyzer.h (struct rejected_constraint): Convert to...
5756 (class rejected_constraint): ...this.
5757 (class bounded_ranges): New forward decl.
5758 (class bounded_ranges_manager): New forward decl.
5759 * constraint-manager.cc: Include "analyzer/analyzer-logging.h" and
5760 "tree-pretty-print.h".
5761 (can_plus_one_p): New.
5762 (plus_one): New.
5763 (can_minus_one_p): New.
5764 (minus_one): New.
5765 (bounded_range::bounded_range): New.
5766 (dump_cst): New.
5767 (bounded_range::dump_to_pp): New.
5768 (bounded_range::dump): New.
5769 (bounded_range::to_json): New.
5770 (bounded_range::set_json_attr): New.
5771 (bounded_range::contains_p): New.
5772 (bounded_range::intersects_p): New.
5773 (bounded_range::operator==): New.
5774 (bounded_range::cmp): New.
5775 (bounded_ranges::bounded_ranges): New.
5776 (bounded_ranges::bounded_ranges): New.
5777 (bounded_ranges::bounded_ranges): New.
5778 (bounded_ranges::canonicalize): New.
5779 (bounded_ranges::validate): New.
5780 (bounded_ranges::operator==): New.
5781 (bounded_ranges::dump_to_pp): New.
5782 (bounded_ranges::dump): New.
5783 (bounded_ranges::to_json): New.
5784 (bounded_ranges::eval_condition): New.
5785 (bounded_ranges::contain_p): New.
5786 (bounded_ranges::cmp): New.
5787 (bounded_ranges_manager::~bounded_ranges_manager): New.
5788 (bounded_ranges_manager::get_or_create_empty): New.
5789 (bounded_ranges_manager::get_or_create_point): New.
5790 (bounded_ranges_manager::get_or_create_range): New.
5791 (bounded_ranges_manager::get_or_create_union): New.
5792 (bounded_ranges_manager::get_or_create_intersection): New.
5793 (bounded_ranges_manager::get_or_create_inverse): New.
5794 (bounded_ranges_manager::consolidate): New.
5795 (bounded_ranges_manager::get_or_create_ranges_for_switch): New.
5796 (bounded_ranges_manager::create_ranges_for_switch): New.
5797 (bounded_ranges_manager::make_case_label_ranges): New.
5798 (bounded_ranges_manager::log_stats): New.
5799 (bounded_ranges_constraint::print): New.
5800 (bounded_ranges_constraint::to_json): New.
5801 (bounded_ranges_constraint::operator==): New.
5802 (bounded_ranges_constraint::add_to_hash): New.
5803 (constraint_manager::constraint_manager): Update for new field
5804 m_bounded_ranges_constraints.
5805 (constraint_manager::operator=): Likewise.
5806 (constraint_manager::hash): Likewise.
5807 (constraint_manager::operator==): Likewise.
5808 (constraint_manager::print): Likewise.
5809 (constraint_manager::dump_to_pp): Likewise.
5810 (constraint_manager::to_json): Likewise.
5811 (constraint_manager::add_unknown_constraint): Update the lhs_ec_id
5812 if necessary in existing constraints when combining equivalence
5813 classes. Add similar code for handling
5814 m_bounded_ranges_constraints.
5815 (constraint_manager::add_constraint_internal): Add comment.
5816 (constraint_manager::add_bounded_ranges): New.
5817 (constraint_manager::eval_condition): Use new field
5818 m_bounded_ranges_constraints.
5819 (constraint_manager::purge): Update bounded_ranges_constraint
5820 instances.
5821 (constraint_manager::canonicalize): Update for new field.
5822 (merger_fact_visitor::on_ranges): New.
5823 (constraint_manager::for_each_fact): Use new field
5824 m_bounded_ranges_constraints.
5825 (constraint_manager::validate): Fix off-by-one error needed due
5826 to bug fixed above in add_unknown_constraint. Validate the EC IDs
5827 in m_bounded_ranges_constraints.
5828 (constraint_manager::get_range_manager): New.
5829 (selftest::assert_dump_bounded_range_eq): New.
5830 (ASSERT_DUMP_BOUNDED_RANGE_EQ): New.
5831 (selftest::test_bounded_range): New.
5832 (selftest::assert_dump_bounded_ranges_eq): New.
5833 (ASSERT_DUMP_BOUNDED_RANGES_EQ): New.
5834 (selftest::test_bounded_ranges): New.
5835 (selftest::run_constraint_manager_tests): Call the new selftests.
5836 * constraint-manager.h (struct bounded_range): New.
5837 (struct bounded_ranges): New.
5838 (template <> struct default_hash_traits<bounded_ranges::key_t>): New.
5839 (class bounded_ranges_manager): New.
5840 (fact_visitor::on_ranges): New pure virtual function.
5841 (class bounded_ranges_constraint): New.
5842 (constraint_manager::add_bounded_ranges): New decl.
5843 (constraint_manager::get_range_manager): New decl.
5844 (constraint_manager::m_bounded_ranges_constraints): New field.
5845 * diagnostic-manager.cc (epath_finder::process_worklist_item):
5846 Transfer ownership of rc to add_feasibility_problem.
5847 * engine.cc (feasibility_problem::dump_to_pp): Use get_model.
5848 * feasible-graph.cc (infeasible_node::dump_dot): Update for
5849 conversion of m_rc to a pointer.
5850 (feasible_graph::add_feasibility_problem): Pass RC by pointer and
5851 take ownership.
5852 * feasible-graph.h (infeasible_node::infeasible_node): Pass RC by
5853 pointer and take ownership.
5854 (infeasible_node::~infeasible_node): New.
5855 (infeasible_node::m_rc): Convert to a pointer.
5856 (feasible_graph::add_feasibility_problem): Pass RC by pointer and
5857 take ownership.
5858 * region-model-manager.cc: Include
5859 "analyzer/constraint-manager.h".
5860 (region_model_manager::region_model_manager): Initializer new
5861 field m_range_mgr.
5862 (region_model_manager::~region_model_manager): Delete it.
5863 (region_model_manager::log_stats): Call log_stats on it.
5864 * region-model.cc (region_model::add_constraint): Use new subclass
5865 rejected_op_constraint.
5866 (region_model::apply_constraints_for_gswitch): Reimplement using
5867 bounded_ranges_manager.
5868 (rejected_constraint::dump_to_pp): Convert to...
5869 (rejected_op_constraint::dump_to_pp): ...this.
5870 (rejected_ranges_constraint::dump_to_pp): New.
5871 * region-model.h (struct purge_stats): Add field
5872 m_num_bounded_ranges_constraints.
5873 (region_model_manager::get_range_manager): New.
5874 (region_model_manager::m_range_mgr): New.
5875 (region_model::get_range_manager): New.
5876 (struct rejected_constraint): Split into...
5877 (class rejected_constraint):...this new abstract base class,
5878 and...
5879 (class rejected_op_constraint): ...this new concrete subclass.
5880 (class rejected_ranges_constraint): New.
5881 * supergraph.cc: Include "tree-cfg.h".
5882 (supergraph::supergraph): Drop idx param from add_cfg_edge.
5883 (supergraph::add_cfg_edge): Drop idx param.
5884 (switch_cfg_superedge::switch_cfg_superedge): Move here from
5885 header. Populate m_case_labels with all cases which go to DST.
5886 (switch_cfg_superedge::dump_label_to_pp): Reimplement to use
5887 m_case_labels.
5888 (switch_cfg_superedge::get_case_label): Delete.
5889 * supergraph.h (supergraphadd_cfg_edge): Drop "idx" param.
5890 (switch_cfg_superedge::switch_cfg_superedge): Drop idx param and
5891 move implementation to supergraph.cc.
5892 (switch_cfg_superedge::get_case_label): Delete.
5893 (switch_cfg_superedge::get_case_labels): New.
5894 (switch_cfg_superedge::m_idx): Delete.
5895 (switch_cfg_superedge::m_case_labels): New field.
5897 2021-08-23 David Malcolm <dmalcolm@redhat.com>
5899 PR analyzer/101875
5900 * sm-file.cc (file_diagnostic::describe_state_change): Handle
5901 change.m_expr being NULL.
5903 2021-08-23 David Malcolm <dmalcolm@redhat.com>
5905 PR analyzer/101837
5906 * analyzer.cc (maybe_reconstruct_from_def_stmt): Bail if fn is
5907 NULL, and assert that it's non-NULL before passing it to
5908 build_call_array_loc.
5910 2021-08-23 David Malcolm <dmalcolm@redhat.com>
5912 PR analyzer/101962
5913 * region-model.cc (region_model::eval_condition_without_cm):
5914 Refactor comparison against zero, adding a check for
5915 POINTER_PLUS_EXPR of non-NULL.
5917 2021-08-23 David Malcolm <dmalcolm@redhat.com>
5919 * store.cc (bit_range::intersects_p): New overload.
5920 (bit_range::operator-): New.
5921 (binding_cluster::maybe_get_compound_binding): Handle the partial
5922 overlap case.
5923 (selftest::test_bit_range_intersects_p): Add test coverage for
5924 new overload of bit_range::intersects_p.
5925 * store.h (bit_range::intersects_p): New overload.
5926 (bit_range::operator-): New.
5928 2021-08-23 Ankur Saini <arsenic@sourceware.org>
5930 PR analyzer/102020
5931 * diagnostic-manager.cc
5932 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Fix typo.
5934 2021-08-21 Ankur Saini <arsenic@sourceware.org>
5936 PR analyzer/101980
5937 * diagnostic-manager.cc
5938 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Use
5939 caller_model only when the supergraph_edge doesn't exixt.
5940 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
5941 Likewise.
5942 * engine.cc (exploded_graph::create_dynamic_call): Rename to...
5943 (exploded_graph::maybe_create_dynamic_call): ...this, return call
5944 creation status.
5945 (exploded_graph::process_node): Handle calls which were not dynamically
5946 discovered.
5947 * exploded-graph.h (exploded_graph::create_dynamic_call): Rename to...
5948 (exploded_graph::maybe_create_dynamic_call): ...this.
5949 * region-model.cc (region_model::update_for_gcall): New param, use it
5950 to push call to frame.
5951 (region_model::update_for_call_superedge): Pass callee function to
5952 update_for_gcall.
5953 * region-model.h (region_model::update_for_gcall): New param.
5955 2021-08-18 Ankur Saini <arsenic@sourceware.org>
5957 PR analyzer/97114
5958 * region-model.cc (region_model::get_rvalue_1): Add case for
5959 OBJ_TYPE_REF.
5961 2021-08-18 Ankur Saini <arsenic@sourceware.org>
5963 PR analyzer/100546
5964 * analysis-plan.cc (analysis_plan::use_summary_p): Don't use call
5965 summaries if there is no callgraph edge
5966 * checker-path.cc (call_event::call_event): Handle calls events that
5967 are not represented by a supergraph call edge
5968 (return_event::return_event): Likewise.
5969 (call_event::get_desc): Work with new call_event structure.
5970 (return_event::get_desc): Likeise.
5971 * checker-path.h (call_event::m_src_snode): New field.
5972 (call_event::m_dest_snode): New field.
5973 (return_event::m_src_snode): New field.
5974 (return_event::m_dest_snode): New field.
5975 * diagnostic-manager.cc
5976 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>:
5977 Refactor to work with edges without callgraph edge.
5978 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
5979 Likewise.
5980 * engine.cc (dynamic_call_info_t::update_model): New function.
5981 (dynamic_call_info_t::add_events_to_path): New function.
5982 (exploded_graph::create_dynamic_call): New function.
5983 (exploded_graph::process_node): Work with dynamically discovered calls.
5984 * exploded-graph.h (class dynamic_call_info_t): New class.
5985 (exploded_graph::create_dynamic_call): New decl.
5986 * program-point.cc (program_point::push_to_call_stack): New function.
5987 (program_point::pop_from_call_stack): New function.
5988 * program-point.h (program_point::push_to_call_stack): New decl.
5989 (program_point::pop_from_call_stack): New decl.
5990 * program-state.cc (program_state::push_call): New function.
5991 (program_state::returning_call): New function.
5992 * program-state.h (program_state::push_call): New decl.
5993 (program_state::returning_call): New decl.
5994 * region-model.cc (region_model::update_for_gcall) New function.
5995 (region_model::update_for_return_gcall): New function.
5996 (egion_model::update_for_call_superedge): Get the underlying gcall and
5997 update for gcall.
5998 (region_model::update_for_return_superedge): Likewise.
5999 * region-model.h (region_model::update_for_gcall): New decl.
6000 (region_model::update_for_return_gcall): New decl.
6001 * state-purge.cc (state_purge_per_ssa_name::process_point): Update to
6002 work with calls without underlying cgraph edge.
6003 * supergraph.cc (supergraph::supergraph) Split snodes at every callsite.
6004 * supergraph.h (supernode::get_returning_call) New accessor.
6006 2021-08-04 David Malcolm <dmalcolm@redhat.com>
6008 PR analyzer/101570
6009 * analyzer.cc (maybe_reconstruct_from_def_stmt): Add GIMPLE_ASM
6010 case.
6011 * analyzer.h (class asm_output_svalue): New forward decl.
6012 (class reachable_regions): New forward decl.
6013 * complexity.cc (complexity::from_vec_svalue): New.
6014 * complexity.h (complexity::from_vec_svalue): New decl.
6015 * engine.cc (feasibility_state::maybe_update_for_edge): Handle
6016 asm stmts by calling on_asm_stmt.
6017 * region-model-asm.cc: New file.
6018 * region-model-manager.cc
6019 (region_model_manager::maybe_fold_asm_output_svalue): New.
6020 (region_model_manager::get_or_create_asm_output_svalue): New.
6021 (region_model_manager::log_stats): Log m_asm_output_values_map.
6022 * region-model.cc (region_model::on_stmt_pre): Handle GIMPLE_ASM.
6023 * region-model.h (visitor::visit_asm_output_svalue): New.
6024 (region_model_manager::get_or_create_asm_output_svalue): New decl.
6025 (region_model_manager::maybe_fold_asm_output_svalue): New decl.
6026 (region_model_manager::asm_output_values_map_t): New typedef.
6027 (region_model_manager::m_asm_output_values_map): New field.
6028 (region_model::on_asm_stmt): New.
6029 * store.cc (binding_cluster::on_asm): New.
6030 * store.h (binding_cluster::on_asm): New decl.
6031 * svalue.cc (svalue::cmp_ptr): Handle SK_ASM_OUTPUT.
6032 (asm_output_svalue::dump_to_pp): New.
6033 (asm_output_svalue::dump_input): New.
6034 (asm_output_svalue::input_idx_to_asm_idx): New.
6035 (asm_output_svalue::accept): New.
6036 * svalue.h (enum svalue_kind): Add SK_ASM_OUTPUT.
6037 (svalue::dyn_cast_asm_output_svalue): New.
6038 (class asm_output_svalue): New.
6039 (is_a_helper <const asm_output_svalue *>::test): New.
6040 (struct default_hash_traits<asm_output_svalue::key_t>): New.
6042 2021-08-03 Jakub Jelinek <jakub@redhat.com>
6044 PR analyzer/101721
6045 * sm-malloc.cc (known_allocator_p): Only check DECL_FUNCTION_CODE on
6046 BUILT_IN_NORMAL builtins.
6048 2021-07-29 Ankur Saini <arsenic@sourceware.org>
6050 * call-string.cc (call_string::element_t::operator==): New operator.
6051 (call_String::element_t::operator!=): New operator.
6052 (call_string::element_t::get_caller_function): New function.
6053 (call_string::element_t::get_callee_function): New function.
6054 (call_string::call_string): Refactor to Initialise m_elements.
6055 (call_string::operator=): Refactor to work with m_elements.
6056 (call_string::operator==): Likewise.
6057 (call_string::to_json): Likewise.
6058 (call_string::hash): Refactor to hash e.m_caller.
6059 (call_string::push_call): Refactor to work with m_elements.
6060 (call_string::push_call): New overload to push call via supernodes.
6061 (call_string::pop): Refactor to work with m_elements.
6062 (call_string::calc_recursion_depth): Likewise.
6063 (call_string::cmp): Likewise.
6064 (call_string::validate): Likewise.
6065 (call_string::operator[]): Likewise.
6066 * call-string.h (class supernode): New forward decl.
6067 (struct call_string::element_t): New struct.
6068 (call_string::call_string): Refactor to initialise m_elements.
6069 (call_string::bool empty_p): Refactor to work with m_elements.
6070 (call_string::get_callee_node): New decl.
6071 (call_string::get_caller_node): New decl.
6072 (m_elements): Replaces m_return_edges.
6073 * program-point.cc (program_point::get_function_at_depth): Refactor to
6074 work with new call-string format.
6075 (program_point::validate): Likewise.
6076 (program_point::on_edge): Likewise.
6078 2021-07-28 David Malcolm <dmalcolm@redhat.com>
6080 * region-model.cc (region_model::on_call_pre): Treat
6081 IFN_UBSAN_BOUNDS, BUILT_IN_STACK_SAVE, and BUILT_IN_STACK_RESTORE
6082 as no-ops, rather than handling them as unknown functions.
6084 2021-07-28 David Malcolm <dmalcolm@redhat.com>
6086 * region-model-impl-calls.cc (region_model::impl_call_alloca):
6087 Drop redundant return value.
6088 (region_model::impl_call_builtin_expect): Likewise.
6089 (region_model::impl_call_calloc): Likewise.
6090 (region_model::impl_call_malloc): Likewise.
6091 (region_model::impl_call_memset): Likewise.
6092 (region_model::impl_call_operator_new): Likewise.
6093 (region_model::impl_call_operator_delete): Likewise.
6094 (region_model::impl_call_strlen): Likewise.
6095 * region-model.cc (region_model::on_call_pre): Fix return value of
6096 known functions that don't have unknown side-effects.
6097 * region-model.h (region_model::impl_call_alloca): Drop redundant
6098 return value.
6099 (region_model::impl_call_builtin_expect): Likewise.
6100 (region_model::impl_call_calloc): Likewise.
6101 (region_model::impl_call_malloc): Likewise.
6102 (region_model::impl_call_memset): Likewise.
6103 (region_model::impl_call_strlen): Likewise.
6104 (region_model::impl_call_operator_new): Likewise.
6105 (region_model::impl_call_operator_delete): Likewise.
6107 2021-07-28 Siddhesh Poyarekar <siddhesh@gotplt.org>
6109 * analyzer.cc (is_named_call_p, is_std_named_call_p): Make
6110 first argument a const_tree.
6111 * analyzer.h (is_named_call_p, -s_std_named_call_p): Likewise.
6112 * sm-malloc.cc (known_allocator_p): New function.
6113 (malloc_state_machine::on_stmt): Use it.
6115 2021-07-28 Siddhesh Poyarekar <siddhesh@gotplt.org>
6117 * sm-malloc.cc
6118 (malloc_state_machine::get_or_create_deallocator): Recognize
6119 __builtin_free.
6121 2021-07-26 David Malcolm <dmalcolm@redhat.com>
6123 * region-model.cc (region_model::on_call_pre): Always set conjured
6124 LHS, not just for SSA names.
6126 2021-07-23 David Malcolm <dmalcolm@redhat.com>
6128 * diagnostic-manager.cc
6129 (class auto_disable_complexity_checks): New.
6130 (epath_finder::explore_feasible_paths): Use it to disable
6131 complexity checks whilst processing the worklist.
6132 * region-model-manager.cc
6133 (region_model_manager::region_model_manager): Initialize
6134 m_check_complexity.
6135 (region_model_manager::reject_if_too_complex): Bail if
6136 m_check_complexity is false.
6137 * region-model.h
6138 (region_model_manager::enable_complexity_check): New.
6139 (region_model_manager::disable_complexity_check): New.
6140 (region_model_manager::m_check_complexity): New.
6142 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6144 PR analyzer/101547
6145 * sm-file.cc (file_leak::emit): Handle m_arg being NULL.
6146 (file_leak::describe_final_event): Handle ev.m_expr being NULL.
6148 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6150 PR analyzer/101522
6151 * store.cc (binding_cluster::purge_state_involving): Don't change
6152 m_map whilst iterating through it.
6154 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6156 * region-model.cc (region_model::handle_phi): Add "old_state"
6157 param and use it.
6158 (region_model::update_for_phis): Update so that all of the phi
6159 stmts are effectively handled simultaneously, rather than in
6160 order.
6161 * region-model.h (region_model::handle_phi): Add "old_state"
6162 param.
6163 * state-purge.cc (self_referential_phi_p): Replace with...
6164 (name_used_by_phis_p): ...this new function.
6165 (state_purge_per_ssa_name::process_point): Update to use the
6166 above, so that all phi stmts at a basic block are effectively
6167 considered simultaneously, and only consider the phi arguments for
6168 the pertinent in-edge.
6169 * supergraph.cc (cfg_superedge::get_phi_arg_idx): New.
6170 (cfg_superedge::get_phi_arg): Use the above.
6171 * supergraph.h (cfg_superedge::get_phi_arg_idx): New decl.
6173 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6175 * state-purge.cc (state_purge_annotator::add_node_annotations):
6176 Rather than erroneously always using the NULL in-edge, determine
6177 each relevant in-edge, and print the appropriate data for each
6178 in-edge. Use print_needed to print the data as comma-separated
6179 lists of SSA names.
6180 (print_vec_of_names): Add "within_table" param and use it.
6181 (state_purge_annotator::add_stmt_annotations): Factor out
6182 collation and printing code into...
6183 (state_purge_annotator::print_needed): ...this new function.
6184 * state-purge.h (state_purge_annotator::print_needed): New decl.
6186 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6188 * program-point.cc (function_point::print): Show src BB index at
6189 BEFORE_SUPERNODE.
6191 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6193 * svalue.cc (infix_p): New.
6194 (binop_svalue::dump_to_pp): Use it to print MIN_EXPR and MAX_EXPR
6195 in prefix form, rather than infix.
6197 2021-07-19 David Malcolm <dmalcolm@redhat.com>
6199 PR analyzer/101503
6200 * constraint-manager.cc (constraint_manager::add_constraint): Use
6201 can_have_associated_state_p rather than testing for unknown.
6202 (constraint_manager::get_or_add_equiv_class): Likewise.
6203 * program-state.cc (sm_state_map::set_state): Likewise.
6204 (sm_state_map::impl_set_state): Add assertion.
6205 * region-model-manager.cc
6206 (region_model_manager::maybe_fold_unaryop): Handle poisoned
6207 values.
6208 (region_model_manager::maybe_fold_binop): Move handling of unknown
6209 values...
6210 (region_model_manager::get_or_create_binop): ...to here, and
6211 generalize to use can_have_associated_state_p.
6212 (region_model_manager::maybe_fold_sub_svalue): Use
6213 can_have_associated_state_p rather than testing for unknown.
6214 (region_model_manager::maybe_fold_repeated_svalue): Use unknown
6215 when the size or repeated value is "unknown"/"poisoned".
6216 * region-model.cc (region_model::purge_state_involving): Reject
6217 attempts to purge unknown/poisoned svalues, as these svalues
6218 should not have state associated with them.
6219 * svalue.cc (sub_svalue::sub_svalue): Assert that we're building
6220 on top of an svalue with can_have_associated_state_p.
6221 (repeated_svalue::repeated_svalue): Likewise.
6222 (bits_within_svalue::bits_within_svalue): Likewise.
6223 * svalue.h (svalue::can_have_associated_state_p): New.
6224 (unknown_svalue::can_have_associated_state_p): New.
6225 (poisoned_svalue::can_have_associated_state_p): New.
6226 (unaryop_svalue::unaryop_svalue): Assert that we're building on
6227 top of an svalue with can_have_associated_state_p.
6228 (binop_svalue::binop_svalue): Likewise.
6229 (widening_svalue::widening_svalue): Likewise.
6231 2021-07-16 David Malcolm <dmalcolm@redhat.com>
6233 * analyzer.h (enum access_direction): New.
6234 * engine.cc (exploded_node::on_longjmp): Update for new param of
6235 get_store_value.
6236 * program-state.cc (program_state::prune_for_point): Likewise.
6237 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
6238 Replace call to check_for_writable_region with call to
6239 check_region_for_write.
6240 (region_model::impl_call_memset): Likewise.
6241 (region_model::impl_call_strcpy): Likewise.
6242 * region-model-reachability.cc (reachable_regions::add): Update
6243 for new param of get_store_value.
6244 * region-model.cc (region_model::get_rvalue_1): Likewise, also for
6245 get_rvalue_for_bits.
6246 (region_model::get_store_value): Add ctxt param and use it to call
6247 check_region_for_read.
6248 (region_model::get_rvalue_for_bits): Add ctxt param and use it to
6249 call get_store_value.
6250 (region_model::check_region_access): New.
6251 (region_model::check_region_for_write): New.
6252 (region_model::check_region_for_read): New.
6253 (region_model::set_value): Update comment. Replace call to
6254 check_for_writable_region with call to check_region_for_write.
6255 * region-model.h (region_model::get_rvalue_for_bits): Add ctxt
6256 param.
6257 (region_model::get_store_value): Add ctxt param.
6258 (region_model::check_region_access): New decl.
6259 (region_model::check_region_for_write): New decl.
6260 (region_model::check_region_for_read): New decl.
6261 * region.cc (region_model::copy_region): Update call to
6262 get_store_value.
6263 * svalue.cc (initial_svalue::implicitly_live_p): Likewise.
6265 2021-07-16 David Malcolm <dmalcolm@redhat.com>
6267 * engine.cc (exploded_node::on_stmt_pre): Handle
6268 __analyzer_dump_state.
6269 * program-state.cc (extrinsic_state::get_sm_idx_by_name): New.
6270 (program_state::impl_call_analyzer_dump_state): New.
6271 * program-state.h (extrinsic_state::get_sm_idx_by_name): New decl.
6272 (program_state::impl_call_analyzer_dump_state): New decl.
6273 * region-model-impl-calls.cc
6274 (call_details::get_arg_string_literal): New.
6275 * region-model.h (call_details::get_arg_string_literal): New decl.
6277 2021-07-16 David Malcolm <dmalcolm@redhat.com>
6279 * program-state.cc (program_state::detect_leaks): Simplify using
6280 svalue::maybe_get_region.
6281 * region-model-impl-calls.cc (region_model::impl_call_fgets): Likewise.
6282 (region_model::impl_call_fread): Likewise.
6283 (region_model::impl_call_free): Likewise.
6284 (region_model::impl_call_operator_delete): Likewise.
6285 * region-model.cc (selftest::test_stack_frames): Likewise.
6286 (selftest::test_state_merging): Likewise.
6287 * svalue.cc (svalue::maybe_get_region): New.
6288 * svalue.h (svalue::maybe_get_region): New decl.
6290 2021-07-15 David Malcolm <dmalcolm@redhat.com>
6292 * svalue.h (is_a_helper <placeholder_svalue *>::test): Make
6293 param and template param const.
6294 (is_a_helper <widening_svalue *>::test): Likewise.
6295 (is_a_helper <compound_svalue *>::test): Likewise.
6296 (is_a_helper <conjured_svalue *>::test): Likewise.
6298 2021-07-15 David Malcolm <dmalcolm@redhat.com>
6300 PR analyzer/95006
6301 PR analyzer/94713
6302 PR analyzer/94714
6303 * analyzer.cc (maybe_reconstruct_from_def_stmt): Split out
6304 GIMPLE_ASSIGN case into...
6305 (get_diagnostic_tree_for_gassign_1): New.
6306 (get_diagnostic_tree_for_gassign): New.
6307 * analyzer.h (get_diagnostic_tree_for_gassign): New decl.
6308 * analyzer.opt (Wanalyzer-write-to-string-literal): New.
6309 * constraint-manager.cc (class svalue_purger): New.
6310 (constraint_manager::purge_state_involving): New.
6311 * constraint-manager.h
6312 (constraint_manager::purge_state_involving): New.
6313 * diagnostic-manager.cc (saved_diagnostic::supercedes_p): New.
6314 (dedupe_winners::handle_interactions): New.
6315 (diagnostic_manager::emit_saved_diagnostics): Call it.
6316 * diagnostic-manager.h (saved_diagnostic::supercedes_p): New decl.
6317 * engine.cc (impl_region_model_context::warn): Convert return type
6318 to bool. Return false if the diagnostic isn't saved.
6319 (impl_region_model_context::purge_state_involving): New.
6320 (impl_sm_context::get_state): Use NULL ctxt when querying old
6321 rvalue.
6322 (impl_sm_context::set_next_state): Use new sval when querying old
6323 state.
6324 (class dump_path_diagnostic): Move to region-model.cc
6325 (exploded_node::on_stmt): Move to on_stmt_pre and on_stmt_post.
6326 Remove call to purge_state_involving.
6327 (exploded_node::on_stmt_pre): New, based on the above. Move most
6328 of it to region_model::on_stmt_pre.
6329 (exploded_node::on_stmt_post): Likewise, moving to
6330 region_model::on_stmt_post.
6331 (class stale_jmp_buf): Fix parent class to use curiously recurring
6332 template pattern.
6333 (feasibility_state::maybe_update_for_edge): Call on_call_pre and
6334 on_call_post on gcalls.
6335 * exploded-graph.h (impl_region_model_context::warn): Return bool.
6336 (impl_region_model_context::purge_state_involving): New decl.
6337 (exploded_node::on_stmt_pre): New decl.
6338 (exploded_node::on_stmt_post): New decl.
6339 * pending-diagnostic.h (pending_diagnostic::use_of_uninit_p): New.
6340 (pending_diagnostic::supercedes_p): New.
6341 * program-state.cc (sm_state_map::get_state): Inherit state for
6342 conjured_svalue as well as initial_svalue.
6343 (sm_state_map::purge_state_involving): Also support SK_CONJURED.
6344 * region-model-impl-calls.cc (call_details::get_uncertainty):
6345 Handle m_ctxt being NULL.
6346 (call_details::get_or_create_conjured_svalue): New.
6347 (region_model::impl_call_fgets): New.
6348 (region_model::impl_call_fread): New.
6349 * region-model-manager.cc
6350 (region_model_manager::get_or_create_initial_value): Return an
6351 uninitialized poisoned value for regions that can't have initial
6352 values.
6353 * region-model-reachability.cc
6354 (reachable_regions::mark_escaped_clusters): Handle ctxt being
6355 NULL.
6356 * region-model.cc (region_to_value_map::purge_state_involving): New.
6357 (poisoned_value_diagnostic::use_of_uninit_p): New.
6358 (poisoned_value_diagnostic::emit): Handle POISON_KIND_UNINIT.
6359 (poisoned_value_diagnostic::describe_final_event): Likewise.
6360 (region_model::check_for_poison): New.
6361 (region_model::on_assignment): Call it.
6362 (class dump_path_diagnostic): Move here from engine.cc.
6363 (region_model::on_stmt_pre): New, based on exploded_node::on_stmt.
6364 (region_model::on_call_pre): Move the setting of the LHS to a
6365 conjured svalue to before the checks for specific functions.
6366 Handle "fgets", "fgets_unlocked", and "fread".
6367 (region_model::purge_state_involving): New.
6368 (region_model::handle_unrecognized_call): Handle ctxt being NULL.
6369 (region_model::get_rvalue): Call check_for_poison.
6370 (selftest::test_stack_frames): Use NULL for context when getting
6371 uninitialized rvalue.
6372 (selftest::test_alloca): Likewise.
6373 * region-model.h (region_to_value_map::purge_state_involving): New
6374 decl.
6375 (call_details::get_or_create_conjured_svalue): New decl.
6376 (region_model::on_stmt_pre): New decl.
6377 (region_model::purge_state_involving): New decl.
6378 (region_model::impl_call_fgets): New decl.
6379 (region_model::impl_call_fread): New decl.
6380 (region_model::check_for_poison): New decl.
6381 (region_model_context::warn): Return bool.
6382 (region_model_context::purge_state_involving): New.
6383 (noop_region_model_context::warn): Return bool.
6384 (noop_region_model_context::purge_state_involving): New.
6385 (test_region_model_context:: warn): Return bool.
6386 * region.cc (region::get_memory_space): New.
6387 (region::can_have_initial_svalue_p): New.
6388 (region::involves_p): New.
6389 * region.h (enum memory_space): New.
6390 (region::get_memory_space): New decl.
6391 (region::can_have_initial_svalue_p): New decl.
6392 (region::involves_p): New decl.
6393 * sm-malloc.cc (use_after_free::supercedes_p): New.
6394 * store.cc (binding_cluster::purge_state_involving): New.
6395 (store::purge_state_involving): New.
6396 * store.h (class symbolic_binding): New forward decl.
6397 (binding_key::dyn_cast_symbolic_binding): New.
6398 (symbolic_binding::dyn_cast_symbolic_binding): New.
6399 (binding_cluster::purge_state_involving): New.
6400 (store::purge_state_involving): New.
6401 * svalue.cc (svalue::can_merge_p): Reject attempts to merge
6402 poisoned svalues with other svalues, so that we identify
6403 paths in which a variable is conditionally uninitialized.
6404 (involvement_visitor::visit_conjured_svalue): New.
6405 (svalue::involves_p): Also handle SK_CONJURED.
6406 (poison_kind_to_str): Handle POISON_KIND_UNINIT.
6407 (poisoned_svalue::maybe_fold_bits_within): New.
6408 * svalue.h (enum poison_kind): Add POISON_KIND_UNINIT.
6409 (poisoned_svalue::maybe_fold_bits_within): New decl.
6411 2021-07-15 David Malcolm <dmalcolm@redhat.com>
6413 * analyzer.opt (fdump-analyzer-exploded-paths): New.
6414 * diagnostic-manager.cc
6415 (diagnostic_manager::emit_saved_diagnostic): Implement it.
6416 * engine.cc (exploded_path::dump_to_pp): Add ext_state param and
6417 use it to dump states if non-NULL.
6418 (exploded_path::dump): Likewise.
6419 (exploded_path::dump_to_file): New.
6420 * exploded-graph.h (exploded_path::dump_to_pp): Add ext_state
6421 param.
6422 (exploded_path::dump): Likewise.
6423 (exploded_path::dump): Likewise.
6424 (exploded_path::dump_to_file): New.
6426 2021-07-15 David Malcolm <dmalcolm@redhat.com>
6428 * analyzer.cc (fixup_tree_for_diagnostic_1): Use DECL_DEBUG_EXPR
6429 if it's available.
6430 * engine.cc (readability): Likewise.
6432 2021-07-15 David Malcolm <dmalcolm@redhat.com>
6434 * state-purge.cc (self_referential_phi_p): New.
6435 (state_purge_per_ssa_name::process_point): Don't purge an SSA name
6436 at its def-stmt if the def-stmt is self-referential.
6438 2021-07-07 David Malcolm <dmalcolm@redhat.com>
6440 * diagnostic-manager.cc (null_assignment_sm_context::get_state):
6441 New overload.
6442 (null_assignment_sm_context::set_next_state): New overload.
6443 (null_assignment_sm_context::get_diagnostic_tree): New.
6444 * engine.cc (impl_sm_context::get_state): New overload.
6445 (impl_sm_context::set_next_state): New overload.
6446 (impl_sm_context::get_diagnostic_tree): New overload.
6447 (impl_region_model_context::on_condition): Convert params from
6448 tree to const svalue *.
6449 * exploded-graph.h (impl_region_model_context::on_condition):
6450 Likewise.
6451 * region-model.cc (region_model::on_call_pre): Move handling of
6452 internal calls to before checking for get_fndecl_for_call.
6453 (region_model::add_constraints_from_binop): New.
6454 (region_model::add_constraint): Split out into a new overload
6455 working on const svalue * rather than tree. Call
6456 add_constraints_from_binop. Drop call to
6457 add_any_constraints_from_ssa_def_stmt.
6458 (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
6459 (region_model::add_any_constraints_from_gassign): Delete.
6460 (region_model::add_any_constraints_from_gcall): Delete.
6461 * region-model.h
6462 (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
6463 (region_model::add_any_constraints_from_gassign): Delete.
6464 (region_model::add_any_constraints_from_gcall): Delete.
6465 (region_model::add_constraint): Add overload decl.
6466 (region_model::add_constraints_from_binop): New decl.
6467 (region_model_context::on_condition): Convert params from tree to
6468 const svalue *.
6469 (noop_region_model_context::on_condition): Likewise.
6470 * sm-file.cc (fileptr_state_machine::condition): Likewise.
6471 * sm-malloc.cc (malloc_state_machine::on_condition): Likewise.
6472 * sm-pattern-test.cc: Include tristate.h, selftest.h,
6473 analyzer/call-string.h, analyzer/program-point.h,
6474 analyzer/store.h, and analyzer/region-model.h.
6475 (pattern_test_state_machine::on_condition): Convert params from tree to
6476 const svalue *.
6477 * sm-sensitive.cc (sensitive_state_machine::on_condition): Delete.
6478 * sm-signal.cc (signal_state_machine::on_condition): Delete.
6479 * sm-taint.cc (taint_state_machine::on_condition): Convert params
6480 from tree to const svalue *.
6481 * sm.cc: Include tristate.h, selftest.h, analyzer/call-string.h,
6482 analyzer/program-point.h, analyzer/store.h, and
6483 analyzer/region-model.h.
6484 (any_pointer_p): Add overload taking const svalue *sval.
6485 * sm.h (any_pointer_p): Add overload taking const svalue *sval.
6486 (state_machine::on_condition): Convert params from tree to
6487 const svalue *. Provide no-op default implementation.
6488 (sm_context::get_state): Add overload taking const svalue *sval.
6489 (sm_context::set_next_state): Likewise.
6490 (sm_context::on_transition): Likewise.
6491 (sm_context::get_diagnostic_tree): Likewise.
6492 * svalue.cc (svalue::all_zeroes_p): New.
6493 (constant_svalue::all_zeroes_p): New.
6494 (repeated_svalue::all_zeroes_p): Convert to vfunc.
6495 * svalue.h (svalue::all_zeroes_p): New decl.
6496 (constant_svalue::all_zeroes_p): New decl.
6497 (repeated_svalue::all_zeroes_p): Convert decl to vfunc.
6499 2021-06-30 David Malcolm <dmalcolm@redhat.com>
6501 PR analyzer/95006
6502 * analyzer.h (class repeated_svalue): New forward decl.
6503 (class bits_within_svalue): New forward decl.
6504 (class sized_region): New forward decl.
6505 (get_field_at_bit_offset): New forward decl.
6506 * engine.cc (exploded_graph::get_or_create_node): Validate the
6507 merged state.
6508 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
6509 Validate the states at each stage.
6510 * program-state.cc (program_state::validate): Validate
6511 m_region_model.
6512 * region-model-impl-calls.cc (region_model::impl_call_memset):
6513 Replace special-case logic for handling constant sizes with
6514 a call to fill_region of a sized_region with the given fill value.
6515 * region-model-manager.cc (maybe_undo_optimize_bit_field_compare):
6516 Drop DK_direct.
6517 (region_model_manager::maybe_fold_sub_svalue): Fold element-based
6518 subregions of an initial value into initial values of an element.
6519 Fold subvalues of repeated svalues.
6520 (region_model_manager::maybe_fold_repeated_svalue): New.
6521 (region_model_manager::get_or_create_repeated_svalue): New.
6522 (get_bit_range_for_field): New.
6523 (get_byte_range_for_field): New.
6524 (get_field_at_byte_range): New.
6525 (region_model_manager::maybe_fold_bits_within_svalue): New.
6526 (region_model_manager::get_or_create_bits_within): New.
6527 (region_model_manager::get_sized_region): New.
6528 (region_model_manager::log_stats): Update for addition of
6529 m_repeated_values_map, m_bits_within_values_map, and
6530 m_sized_regions.
6531 * region-model.cc (region_model::validate): New.
6532 (region_model::on_assignment): Drop enum binding_kind.
6533 (region_model::get_initial_value_for_global): Likewise.
6534 (region_model::get_rvalue_for_bits): Replace body with call to
6535 get_or_create_bits_within.
6536 (region_model::get_capacity): Handle RK_SIZED.
6537 (region_model::set_value): Drop enum binding_kind.
6538 (region_model::fill_region): New.
6539 (region_model::get_representative_path_var_1): Handle RK_SIZED.
6540 * region-model.h (visitor::visit_repeated_svalue): New.
6541 (visitor::visit_bits_within_svalue): New.
6542 (region_model_manager::get_or_create_repeated_svalue): New decl.
6543 (region_model_manager::get_or_create_bits_within): New decl.
6544 (region_model_manager::get_sized_region): New decl.
6545 (region_model_manager::maybe_fold_repeated_svalue): New decl.
6546 (region_model_manager::maybe_fold_bits_within_svalue): New decl.
6547 (region_model_manager::repeated_values_map_t): New typedef.
6548 (region_model_manager::m_repeated_values_map): New field.
6549 (region_model_manager::bits_within_values_map_t): New typedef.
6550 (region_model_manager::m_bits_within_values_map): New field.
6551 (region_model_manager::m_sized_regions): New field.
6552 (region_model::fill_region): New decl.
6553 * region.cc (region::get_base_region): Handle RK_SIZED.
6554 (region::base_region_p): Likewise.
6555 (region::get_byte_size_sval): New.
6556 (get_field_at_bit_offset): Make non-static.
6557 (region::calc_offset): Move implementation of cases to
6558 get_relative_concrete_offset vfunc implementations. Handle
6559 RK_SIZED.
6560 (region::get_relative_concrete_offset): New.
6561 (decl_region::get_svalue_for_initializer): Drop enum binding_kind.
6562 (field_region::get_relative_concrete_offset): New, from
6563 region::calc_offset.
6564 (element_region::get_relative_concrete_offset): Likewise.
6565 (offset_region::get_relative_concrete_offset): Likewise.
6566 (sized_region::accept): New.
6567 (sized_region::dump_to_pp): New.
6568 (sized_region::get_byte_size): New.
6569 (sized_region::get_bit_size): New.
6570 * region.h (enum region_kind): Add RK_SIZED.
6571 (region::dyn_cast_sized_region): New.
6572 (region::get_byte_size): Make virtual.
6573 (region::get_bit_size): Likewise.
6574 (region::get_byte_size_sval): New decl.
6575 (region::get_relative_concrete_offset): New decl.
6576 (field_region::get_relative_concrete_offset): New decl.
6577 (element_region::get_relative_concrete_offset): Likewise.
6578 (offset_region::get_relative_concrete_offset): Likewise.
6579 (class sized_region): New.
6580 * store.cc (binding_kind_to_string): Delete.
6581 (binding_key::make): Drop enum binding_kind.
6582 (binding_key::dump_to_pp): Delete.
6583 (binding_key::cmp_ptrs): Drop enum binding_kind.
6584 (bit_range::contains_p): New.
6585 (byte_range::dump): New.
6586 (byte_range::contains_p): New.
6587 (byte_range::cmp): New.
6588 (concrete_binding::dump_to_pp): Drop enum binding_kind.
6589 (concrete_binding::cmp_ptr_ptr): Likewise.
6590 (symbolic_binding::dump_to_pp): Likewise.
6591 (symbolic_binding::cmp_ptr_ptr): Likewise.
6592 (binding_map::apply_ctor_val_to_range): Likewise.
6593 (binding_map::apply_ctor_pair_to_child_region): Likewise.
6594 (binding_map::get_overlapping_bindings): New.
6595 (binding_map::remove_overlapping_bindings): New.
6596 (binding_cluster::validate): New.
6597 (binding_cluster::bind): Drop enum binding_kind.
6598 (binding_cluster::bind_compound_sval): Likewise.
6599 (binding_cluster::purge_region): Likewise.
6600 (binding_cluster::zero_fill_region): Reimplement in terms of...
6601 (binding_cluster::fill_region): New.
6602 (binding_cluster::mark_region_as_unknown): Drop enum binding_kind.
6603 (binding_cluster::get_binding): Likewise.
6604 (binding_cluster::get_binding_recursive): Likewise.
6605 (binding_cluster::get_any_binding): Likewise.
6606 (binding_cluster::maybe_get_compound_binding): Reimplement.
6607 (binding_cluster::get_overlapping_bindings): Delete.
6608 (binding_cluster::remove_overlapping_bindings): Reimplement in
6609 terms of binding_map::remove_overlapping_bindings.
6610 (binding_cluster::can_merge_p): Update for removal of
6611 enum binding_kind.
6612 (binding_cluster::on_unknown_fncall): Drop enum binding_kind.
6613 (binding_cluster::maybe_get_simple_value): Likewise.
6614 (store_manager::get_concrete_binding): Likewise.
6615 (store_manager::get_symbolic_binding): Likewise.
6616 (store::validate): New.
6617 (store::set_value): Drop enum binding_kind.
6618 (store::zero_fill_region): Reimplement in terms of...
6619 (store::fill_region): New.
6620 (selftest::test_binding_key_overlap): Drop enum binding_kind.
6621 * store.h (enum binding_kind): Delete.
6622 (binding_kind_to_string): Delete decl.
6623 (binding_key::make): Drop enum binding_kind.
6624 (binding_key::dump_to_pp): Make pure virtual.
6625 (binding_key::get_kind): Delete.
6626 (binding_key::mark_deleted): Delete.
6627 (binding_key::mark_empty): Delete.
6628 (binding_key::is_deleted): Delete.
6629 (binding_key::is_empty): Delete.
6630 (binding_key::binding_key): Delete.
6631 (binding_key::impl_hash): Delete.
6632 (binding_key::impl_eq): Delete.
6633 (binding_key::m_kind): Delete.
6634 (bit_range::get_last_bit_offset): New.
6635 (bit_range::contains_p): New.
6636 (byte_range::contains_p): New.
6637 (byte_range::operator==): New.
6638 (byte_range::get_start_byte_offset): New.
6639 (byte_range::get_next_byte_offset): New.
6640 (byte_range::get_last_byte_offset): New.
6641 (byte_range::as_bit_range): New.
6642 (byte_range::cmp): New.
6643 (concrete_binding::concrete_binding): Drop enum binding_kind.
6644 (concrete_binding::hash): Likewise.
6645 (concrete_binding::operator==): Likewise.
6646 (concrete_binding::mark_deleted): New.
6647 (concrete_binding::mark_empty): New.
6648 (concrete_binding::is_deleted): New.
6649 (concrete_binding::is_empty): New.
6650 (default_hash_traits<ana::concrete_binding>::empty_zero_p): Make false.
6651 (symbolic_binding::symbolic_binding): Drop enum binding_kind.
6652 (symbolic_binding::hash): Likewise.
6653 (symbolic_binding::operator==): Likewise.
6654 (symbolic_binding::mark_deleted): New.
6655 (symbolic_binding::mark_empty): New.
6656 (symbolic_binding::is_deleted): New.
6657 (symbolic_binding::is_empty): New.
6658 (binding_map::remove_overlapping_bindings): New decl.
6659 (binding_map::get_overlapping_bindings): New decl.
6660 (binding_cluster::validate): New decl.
6661 (binding_cluster::bind): Drop enum binding_kind.
6662 (binding_cluster::fill_region): New decl.
6663 (binding_cluster::get_binding): Drop enum binding_kind.
6664 (binding_cluster::get_binding_recursive): Likewise.
6665 (binding_cluster::get_overlapping_bindings): Delete.
6666 (store::validate): New decl.
6667 (store::set_value): Drop enum binding_kind.
6668 (store::fill_region): New decl.
6669 (store_manager::get_concrete_binding): Drop enum binding_kind.
6670 (store_manager::get_symbolic_binding): Likewise.
6671 * svalue.cc (svalue::cmp_ptr): Handle SK_REPEATED and
6672 SK_BITS_WITHIN.
6673 (svalue::extract_bit_range): New.
6674 (svalue::maybe_fold_bits_within): New.
6675 (constant_svalue::maybe_fold_bits_within): New.
6676 (unknown_svalue::maybe_fold_bits_within): New.
6677 (unaryop_svalue::maybe_fold_bits_within): New.
6678 (repeated_svalue::repeated_svalue): New.
6679 (repeated_svalue::dump_to_pp): New.
6680 (repeated_svalue::accept): New.
6681 (repeated_svalue::all_zeroes_p): New.
6682 (repeated_svalue::maybe_fold_bits_within): New.
6683 (bits_within_svalue::bits_within_svalue): New.
6684 (bits_within_svalue::dump_to_pp): New.
6685 (bits_within_svalue::maybe_fold_bits_within): New.
6686 (bits_within_svalue::accept): New.
6687 (bits_within_svalue::implicitly_live_p): New.
6688 (compound_svalue::maybe_fold_bits_within): New.
6689 * svalue.h (enum svalue_kind): Add SK_REPEATED and SK_BITS_WITHIN.
6690 (svalue::dyn_cast_repeated_svalue): New.
6691 (svalue::dyn_cast_bits_within_svalue): New.
6692 (svalue::extract_bit_range): New decl.
6693 (svalue::maybe_fold_bits_within): New vfunc decl.
6694 (region_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6695 (region_svalue::key_t::is_empty): Likewise.
6696 (default_hash_traits<region_svalue::key_t>::empty_zero_p): Make false.
6697 (constant_svalue::maybe_fold_bits_within): New.
6698 (unknown_svalue::maybe_fold_bits_within): New.
6699 (poisoned_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6700 (poisoned_svalue::key_t::is_empty): Likewise.
6701 (default_hash_traits<poisoned_svalue::key_t>::empty_zero_p): Make
6702 false.
6703 (setjmp_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6704 (setjmp_svalue::key_t::is_empty): Likewise.
6705 (default_hash_traits<setjmp_svalue::key_t>::empty_zero_p): Make
6706 false.
6707 (unaryop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6708 (unaryop_svalue::key_t::is_empty): Likewise.
6709 (unaryop_svalue::maybe_fold_bits_within): New.
6710 (default_hash_traits<unaryop_svalue::key_t>::empty_zero_p): Make
6711 false.
6712 (binop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6713 (binop_svalue::key_t::is_empty): Likewise.
6714 (default_hash_traits<binop_svalue::key_t>::empty_zero_p): Make
6715 false.
6716 (sub_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6717 (sub_svalue::key_t::is_empty): Likewise.
6718 (default_hash_traits<sub_svalue::key_t>::empty_zero_p): Make
6719 false.
6720 (class repeated_svalue): New.
6721 (is_a_helper <const repeated_svalue *>::test): New.
6722 (struct default_hash_traits<repeated_svalue::key_t>): New.
6723 (class bits_within_svalue): New.
6724 (is_a_helper <const bits_within_svalue *>::test): New.
6725 (struct default_hash_traits<bits_within_svalue::key_t>): New.
6726 (widening_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6727 (widening_svalue::key_t::is_empty): Likewise.
6728 (default_hash_traits<widening_svalue::key_t>::empty_zero_p): Make
6729 false.
6730 (compound_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6731 (compound_svalue::key_t::is_empty): Likewise.
6732 (compound_svalue::maybe_fold_bits_within): New.
6733 (default_hash_traits<compound_svalue::key_t>::empty_zero_p): Make
6734 false.
6736 2021-06-28 David Malcolm <dmalcolm@redhat.com>
6738 * analyzer.h (byte_offset_t): New typedef.
6739 * store.cc (bit_range::dump_to_pp): Dump as a byte range if
6740 possible.
6741 (bit_range::as_byte_range): New.
6742 (byte_range::dump_to_pp): New.
6743 * store.h (class byte_range): New forward decl.
6744 (struct bit_range): Add comment.
6745 (bit_range::as_byte_range): New decl.
6746 (struct byte_range): New.
6748 2021-06-22 David Malcolm <dmalcolm@redhat.com>
6750 PR analyzer/101143
6751 * region-model.cc (compat_types_p): New function.
6752 (region_model::create_region_for_heap_alloc): Convert assertion to
6753 an error check.
6754 (region_model::create_region_for_alloca): Likewise.
6756 2021-06-18 David Malcolm <dmalcolm@redhat.com>
6758 * store.cc (binding_cluster::get_any_binding): Make symbolic reads
6759 from a cluster with concrete bindings return unknown.
6761 2021-06-18 David Malcolm <dmalcolm@redhat.com>
6763 * region-model-manager.cc
6764 (region_model_manager::get_or_create_int_cst): New.
6765 (region_model_manager::maybe_undo_optimize_bit_field_compare): Use
6766 it to simplify away a local tree.
6767 * region-model.cc (region_model::on_setjmp): Likewise.
6768 (region_model::on_longjmp): Likewise.
6769 * region-model.h (region_model_manager::get_or_create_int_cst):
6770 New decl.
6771 * store.cc (binding_cluster::zero_fill_region): Use it to simplify
6772 away a local tree.
6774 2021-06-18 David Malcolm <dmalcolm@redhat.com>
6776 * checker-path.cc (class custom_event): Make abstract to allow for
6777 custom vfuncs, splitting existing implementation into...
6778 (class precanned_custom_event): New subclass.
6779 (custom_event::get_desc): Move to...
6780 (precanned_custom_event::get_desc): ...subclass.
6781 * checker-path.h (class custom_event): Make abstract to allow for
6782 custom vfuncs, splitting existing implementation into...
6783 (class precanned_custom_event): New subclass.
6784 * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
6785 Use precanned_custom_event.
6786 * engine.cc
6787 (stale_jmp_buf::maybe_add_custom_events_for_superedge): Likewise.
6788 * sm-signal.cc (signal_delivery_edge_info_t::add_events_to_path):
6789 Likewise.
6791 2021-06-15 David Malcolm <dmalcolm@redhat.com>
6793 PR analyzer/99212
6794 PR analyzer/101082
6795 * engine.cc: Include "target.h".
6796 (impl_run_checkers): Log BITS_BIG_ENDIAN, BYTES_BIG_ENDIAN, and
6797 WORDS_BIG_ENDIAN.
6798 * region-model-manager.cc
6799 (region_model_manager::maybe_fold_binop): Move support for masking
6800 via ARG0 & CST into...
6801 (region_model_manager::maybe_undo_optimize_bit_field_compare):
6802 ...this new function. Flatten by converting from nested
6803 conditionals to a series of early return statements to reject
6804 failures. Reject if type is not unsigned_char_type_node.
6805 Handle BYTES_BIG_ENDIAN when determining which bits are bound
6806 in the binding_map.
6807 * region-model.h
6808 (region_model_manager::maybe_undo_optimize_bit_field_compare):
6809 New decl.
6810 * store.cc (bit_range::dump): New function.
6811 * store.h (bit_range::dump): New decl.
6813 2021-06-15 David Malcolm <dmalcolm@redhat.com>
6815 * engine.cc (exploded_node::on_stmt): Handle __analyzer_dump_capacity.
6816 (exploded_node::on_stmt): Drop m_sm_changes from on_stmt_flags.
6817 (state_change_requires_new_enode_p): New function...
6818 (exploded_graph::process_node): Call it, rather than querying
6819 flags.m_sm_changes, so that dynamic-extent differences can also
6820 trigger the splitting of nodes.
6821 * exploded-graph.h (struct on_stmt_flags): Drop field m_sm_changes.
6822 * program-state.cc (program_state::detect_leaks): Purge dead
6823 heap-allocated regions from dynamic extents.
6824 (selftest::test_program_state_1): Fix type of "size_in_bytes".
6825 (selftest::test_program_state_merging): Likewise.
6826 * region-model-impl-calls.cc
6827 (region_model::impl_call_analyzer_dump_capacity): New.
6828 (region_model::impl_call_free): Remove dynamic extents from the
6829 freed region.
6830 * region-model-reachability.h
6831 (reachable_regions::begin_mutable_base_regs): New.
6832 (reachable_regions::end_mutable_base_regs): New.
6833 * region-model.cc: Include "tree-object-size.h".
6834 (region_model::region_model): Support new field m_dynamic_extents.
6835 (region_model::operator=): Likewise.
6836 (region_model::operator==): Likewise.
6837 (region_model::dump_to_pp): Dump sizes of dynamic regions.
6838 (region_model::handle_unrecognized_call): Purge dynamic extents
6839 from any regions that have escaped mutably:.
6840 (region_model::get_capacity): New function.
6841 (region_model::add_constraint): Unset dynamic extents when a
6842 heap-allocated region's address is NULL.
6843 (region_model::unbind_region_and_descendents): Purge dynamic
6844 extents of unbound regions.
6845 (region_model::can_merge_with_p): Call
6846 m_dynamic_extents.can_merge_with_p.
6847 (region_model::create_region_for_heap_alloc): Assert that
6848 size_in_bytes's type is compatible with size_type_node. Update
6849 for renaming of record_dynamic_extents to set_dynamic_extents.
6850 (region_model::create_region_for_alloca): Likewise.
6851 (region_model::record_dynamic_extents): Rename to...
6852 (region_model::set_dynamic_extents): ...this. Assert that
6853 size_in_bytes's type is compatible with size_type_node. Add it
6854 to the m_dynamic_extents map.
6855 (region_model::get_dynamic_extents): New.
6856 (region_model::unset_dynamic_extents): New.
6857 (selftest::test_state_merging): Fix type of "size".
6858 (selftest::test_malloc_constraints): Likewise.
6859 (selftest::test_malloc): Verify dynamic extents.
6860 (selftest::test_alloca): Likewise.
6861 * region-model.h (region_to_value_map::is_empty): New.
6862 (region_model::dynamic_extents_t): New typedef.
6863 (region_model::impl_call_analyzer_dump_capacity): New decl.
6864 (region_model::get_dynamic_extents): New function.
6865 (region_model::get_dynamic_extents): New decl.
6866 (region_model::set_dynamic_extents): New decl.
6867 (region_model::unset_dynamic_extents): New decl.
6868 (region_model::get_capacity): New decl.
6869 (region_model::record_dynamic_extents): Rename to set_dynamic_extents.
6870 (region_model::m_dynamic_extents): New field.
6872 2021-06-15 David Malcolm <dmalcolm@redhat.com>
6874 * region-model.cc (region_to_value_map::operator=): New.
6875 (region_to_value_map::operator==): New.
6876 (region_to_value_map::dump_to_pp): New.
6877 (region_to_value_map::dump): New.
6878 (region_to_value_map::can_merge_with_p): New.
6879 * region-model.h (class region_to_value_map): New class.
6881 2021-06-13 Trevor Saunders <tbsaunde@tbsaunde.org>
6883 * call-string.cc (call_string::call_string): Use range based for
6884 to iterate over vec<>.
6885 (call_string::to_json): Likewise.
6886 (call_string::hash): Likewise.
6887 (call_string::calc_recursion_depth): Likewise.
6888 * checker-path.cc (checker_path::fixup_locations): Likewise.
6889 * constraint-manager.cc (equiv_class::equiv_class): Likewise.
6890 (equiv_class::to_json): Likewise.
6891 (equiv_class::hash): Likewise.
6892 (constraint_manager::to_json): Likewise.
6893 * engine.cc (impl_region_model_context::on_svalue_leak):
6894 Likewise.
6895 (on_liveness_change): Likewise.
6896 (impl_region_model_context::on_unknown_change): Likewise.
6897 * program-state.cc (sm_state_map::set_state): Likewise.
6898 * region-model.cc (test_canonicalization_4): Likewise.
6900 2021-06-11 David Malcolm <dmalcolm@redhat.com>
6902 * engine.cc (worklist::key_t::cmp): Move sort by call_string to
6903 before SCC.
6905 2021-06-09 David Malcolm <dmalcolm@redhat.com>
6907 * region-model.cc (region_model::get_lvalue_1): Make const.
6908 (region_model::get_lvalue): Likewise.
6909 (region_model::get_rvalue_1): Likewise.
6910 (region_model::get_rvalue): Likewise.
6911 (region_model::deref_rvalue): Likewise.
6912 (region_model::get_rvalue_for_bits): Likewise.
6913 * region-model.h (region_model::get_lvalue): Likewise.
6914 (region_model::get_rvalue): Likewise.
6915 (region_model::deref_rvalue): Likewise.
6916 (region_model::get_rvalue_for_bits): Likewise.
6917 (region_model::get_lvalue_1): Likewise.
6918 (region_model::get_rvalue_1): Likewise.
6920 2021-06-08 David Malcolm <dmalcolm@redhat.com>
6922 PR analyzer/99212
6923 * region-model-manager.cc
6924 (region_model_manager::maybe_fold_binop): Add support for folding
6925 BIT_AND_EXPR of compound_svalue and a mask constant.
6926 * region-model.cc (region_model::get_rvalue_1): Implement
6927 BIT_FIELD_REF in terms of...
6928 (region_model::get_rvalue_for_bits): New function.
6929 * region-model.h (region_model::get_rvalue_for_bits): New decl.
6930 * store.cc (bit_range::from_mask): New function.
6931 (selftest::test_bit_range_intersects_p): New selftest.
6932 (selftest::assert_bit_range_from_mask_eq): New.
6933 (ASSERT_BIT_RANGE_FROM_MASK_EQ): New macro.
6934 (selftest::assert_no_bit_range_from_mask_eq): New.
6935 (ASSERT_NO_BIT_RANGE_FROM_MASK): New macro.
6936 (selftest::test_bit_range_from_mask): New selftest.
6937 (selftest::analyzer_store_cc_tests): Call the new selftests.
6938 * store.h (bit_range::intersects_p): New.
6939 (bit_range::from_mask): New decl.
6940 (concrete_binding::get_bit_range): New accessor.
6941 (store_manager::get_concrete_binding): New overload taking
6942 const bit_range &.
6944 2021-06-08 David Malcolm <dmalcolm@redhat.com>
6946 * analyzer.h (int_size_in_bits): New decl.
6947 * region.cc (int_size_in_bits): New function.
6948 (region::get_bit_size): Reimplement in terms of the above.
6950 2021-06-08 David Malcolm <dmalcolm@redhat.com>
6952 * store.cc (concrete_binding::dump_to_pp): Move bulk of
6953 implementation to...
6954 (bit_range::dump_to_pp): ...this new function.
6955 (bit_range::cmp): New.
6956 (concrete_binding::overlaps_p): Update for use of bit_range.
6957 (concrete_binding::cmp_ptr_ptr): Likewise.
6958 * store.h (struct bit_range): New.
6959 (class concrete_binding): Replace fields m_start_bit_offset and
6960 m_size_in_bits with new field m_bit_range.
6962 2021-06-08 David Malcolm <dmalcolm@redhat.com>
6964 * svalue.h (conjured_svalue::iterator_t): Delete.
6966 2021-06-03 David Malcolm <dmalcolm@redhat.com>
6968 * store.h (store::get_direct_binding): Remove unused decl.
6969 (store::get_default_binding): Likewise.
6971 2021-06-03 David Malcolm <dmalcolm@redhat.com>
6973 * svalue.cc (poisoned_svalue::dump_to_pp): Dump type.
6974 (compound_svalue::dump_to_pp): Dump any type.
6976 2021-05-18 David Malcolm <dmalcolm@redhat.com>
6978 PR analyzer/100615
6979 * sm-malloc.cc: Include "analyzer/function-set.h".
6980 (malloc_state_machine::on_stmt): Call unaffected_by_call_p and
6981 bail on the functions it recognizes.
6982 (malloc_state_machine::unaffected_by_call_p): New.
6984 2021-05-10 Martin Liska <mliska@suse.cz>
6986 * sm-file.cc (is_file_using_fn_p): Use startswith
6987 function instead of strncmp.
6989 2021-05-10 Martin Liska <mliska@suse.cz>
6991 * program-state.cc (program_state::operator=): Remove
6992 __cplusplus >= 201103.
6993 (program_state::program_state): Likewise.
6994 * program-state.h: Likewise.
6995 * region-model.h (class region_model): Remove dead code.
6997 2021-04-24 David Malcolm <dmalcolm@redhat.com>
6999 PR analyzer/100244
7000 * sm-malloc.cc (free_of_non_heap::describe_state_change):
7001 Bulletproof against change.m_expr being NULL.
7003 2021-04-13 David Malcolm <dmalcolm@redhat.com>
7005 PR analyzer/98599
7006 * supergraph.cc (saved_uids::make_uid_unique): New.
7007 (saved_uids::restore_uids): New.
7008 (supergraph::supergraph): Replace assignments to stmt->uid with
7009 calls to m_stmt_uids.make_uid_unique.
7010 (supergraph::~supergraph): New.
7011 * supergraph.h (class saved_uids): New.
7012 (supergraph::~supergraph): New decl.
7013 (supergraph::m_stmt_uids): New field.
7015 2021-04-10 David Malcolm <dmalcolm@redhat.com>
7017 PR analyzer/100011
7018 * region-model.cc (region_model::on_assignment): Avoid NULL
7019 dereference if ctxt is NULL when assigning from a STRING_CST.
7021 2021-04-08 David Malcolm <dmalcolm@redhat.com>
7023 PR analyzer/99042
7024 PR analyzer/99774
7025 * engine.cc
7026 (impl_region_model_context::impl_region_model_context): Add
7027 uncertainty param and use it to initialize m_uncertainty.
7028 (impl_region_model_context::get_uncertainty): New.
7029 (impl_sm_context::get_fndecl_for_call): Add NULL for new
7030 uncertainty param when constructing impl_region_model_context.
7031 (impl_sm_context::get_state): Likewise.
7032 (impl_sm_context::set_next_state): Likewise.
7033 (impl_sm_context::warn): Likewise.
7034 (exploded_node::on_stmt): Add uncertainty param
7035 and use it when constructing impl_region_model_context.
7036 (exploded_node::on_edge): Add uncertainty param and pass
7037 to on_edge call.
7038 (exploded_node::detect_leaks): Create uncertainty_t and pass to
7039 impl_region_model_context.
7040 (exploded_graph::get_or_create_node): Create uncertainty_t and
7041 pass to prune_for_point.
7042 (maybe_process_run_of_before_supernode_enodes): Create
7043 uncertainty_t and pass to impl_region_model_context.
7044 (exploded_graph::process_node): Create uncertainty_t instances and
7045 pass around as needed.
7046 * exploded-graph.h
7047 (impl_region_model_context::impl_region_model_context): Add
7048 uncertainty param.
7049 (impl_region_model_context::get_uncertainty): New decl.
7050 (impl_region_model_context::m_uncertainty): New field.
7051 (exploded_node::on_stmt): Add uncertainty param.
7052 (exploded_node::on_edge): Likewise.
7053 * program-state.cc (sm_state_map::on_liveness_change): Get
7054 uncertainty from context and use it to unset sm-state from
7055 svalues as appropriate.
7056 (program_state::on_edge): Add uncertainty param and use it when
7057 constructing impl_region_model_context. Fix indentation.
7058 (program_state::prune_for_point): Add uncertainty param and use it
7059 when constructing impl_region_model_context.
7060 (program_state::detect_leaks): Get any uncertainty from ctxt and
7061 use it to get maybe-live svalues for dest_state, rather than
7062 definitely-live ones; use this when determining which svalues
7063 have leaked.
7064 (selftest::test_program_state_merging): Create uncertainty_t and
7065 pass to impl_region_model_context.
7066 * program-state.h (program_state::on_edge): Add uncertainty param.
7067 (program_state::prune_for_point): Likewise.
7068 * region-model-impl-calls.cc (call_details::get_uncertainty): New.
7069 (region_model::impl_call_memcpy): Pass uncertainty to
7070 mark_region_as_unknown call.
7071 (region_model::impl_call_memset): Likewise.
7072 (region_model::impl_call_strcpy): Likewise.
7073 * region-model-reachability.cc (reachable_regions::handle_sval):
7074 Also add sval to m_mutable_svals.
7075 * region-model.cc (region_model::on_assignment): Pass any
7076 uncertainty from ctxt to the store::set_value call.
7077 (region_model::handle_unrecognized_call): Get any uncertainty from
7078 ctxt and use it to record mutable svalues at the unknown call.
7079 (region_model::get_reachable_svalues): Add uncertainty param and
7080 use it to mark any maybe-bound svalues as being reachable.
7081 (region_model::set_value): Pass any uncertainty from ctxt to the
7082 store::set_value call.
7083 (region_model::mark_region_as_unknown): Add uncertainty param and
7084 pass it on to the store::mark_region_as_unknown call.
7085 (region_model::update_for_call_summary): Add uncertainty param and
7086 pass it on to the region_model::mark_region_as_unknown call.
7087 * region-model.h (call_details::get_uncertainty): New decl.
7088 (region_model::get_reachable_svalues): Add uncertainty param.
7089 (region_model::mark_region_as_unknown): Add uncertainty param.
7090 (region_model_context::get_uncertainty): New vfunc.
7091 (noop_region_model_context::get_uncertainty): New vfunc
7092 implementation.
7093 * store.cc (dump_svalue_set): New.
7094 (uncertainty_t::dump_to_pp): New.
7095 (uncertainty_t::dump): New.
7096 (binding_cluster::clobber_region): Pass NULL for uncertainty to
7097 remove_overlapping_bindings.
7098 (binding_cluster::mark_region_as_unknown): Add uncertainty param
7099 and pass it to remove_overlapping_bindings.
7100 (binding_cluster::remove_overlapping_bindings): Add uncertainty param.
7101 Use it to record any svalues that were in clobbered bindings.
7102 (store::set_value): Add uncertainty param. Pass it to
7103 binding_cluster::mark_region_as_unknown when handling symbolic
7104 regions.
7105 (store::mark_region_as_unknown): Add uncertainty param and pass it
7106 to binding_cluster::mark_region_as_unknown.
7107 (store::remove_overlapping_bindings): Add uncertainty param and
7108 pass it to binding_cluster::remove_overlapping_bindings.
7109 * store.h (binding_cluster::mark_region_as_unknown): Add
7110 uncertainty param.
7111 (binding_cluster::remove_overlapping_bindings): Likewise.
7112 (store::set_value): Likewise.
7113 (store::mark_region_as_unknown): Likewise.
7115 2021-04-05 David Malcolm <dmalcolm@redhat.com>
7117 PR analyzer/99906
7118 * analyzer.cc (maybe_reconstruct_from_def_stmt): Fix NULL
7119 dereference on calls with zero arguments.
7120 * sm-malloc.cc (malloc_state_machine::on_stmt): When handling
7121 __attribute__((nonnull)), only call get_diagnostic_tree if the
7122 result will be used.
7124 2021-04-05 David Malcolm <dmalcolm@redhat.com>
7126 PR analyzer/99886
7127 * diagnostic-manager.cc
7128 (diagnostic_manager::prune_interproc_events): Use signed integers
7129 when subtracting one from path->num_events ().
7130 (diagnostic_manager::consolidate_conditions): Likewise. Convert
7131 next_idx to a signed int.
7133 2021-04-01 David Malcolm <dmalcolm@redhat.com>
7135 * diagnostic-manager.cc (diagnostic_manager::add_diagnostic): Make
7136 enode param non-constant, and call add_diagnostic on it. Add
7137 enode index to log message.
7138 (diagnostic_manager::add_diagnostic): Make enode param
7139 non-constant.
7140 * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
7141 Likewise for both decls.
7142 * engine.cc
7143 (impl_region_model_context::impl_region_model_context): Likewise
7144 for enode_for_diag.
7145 (impl_sm_context::impl_sm_context): Likewise.
7146 (impl_sm_context::m_enode_for_diag): Likewise.
7147 (exploded_node::dump_dot): Don't pass the diagnostic manager
7148 to dump_saved_diagnostics.
7149 (exploded_node::dump_saved_diagnostics): Drop param. Iterate
7150 directly through all saved diagnostics for the enode, rather
7151 than all saved diagnostics in the diagnostic_manager and
7152 filtering.
7153 (exploded_node::on_stmt): Make non-const.
7154 (exploded_node::on_edge): Likewise.
7155 (exploded_node::on_longjmp): Likewise.
7156 (exploded_node::detect_leaks): Likewise.
7157 (exploded_graph::get_or_create_node): Make enode_for_diag param
7158 non-const.
7159 (exploded_graph_annotator::print_enode): Iterate
7160 directly through all saved diagnostics for the enode, rather
7161 than all saved diagnostics in the diagnostic_manager and
7162 filtering.
7163 * exploded-graph.h
7164 (impl_region_model_context::impl_region_model_context): Make
7165 enode_for_diag param non-constant.
7166 (impl_region_model_context::m_enode_for_diag): Likewise.
7167 (exploded_node::dump_saved_diagnostics): Drop param.
7168 (exploded_node::on_stmt): Make non-const.
7169 (exploded_node::on_edge): Likewise.
7170 (exploded_node::on_longjmp): Likewise.
7171 (exploded_node::detect_leaks): Likewise.
7172 (exploded_node::add_diagnostic): New.
7173 (exploded_node::get_num_diagnostics): New.
7174 (exploded_node::get_saved_diagnostic): New.
7175 (exploded_node::m_saved_diagnostics): New.
7176 (exploded_graph::get_or_create_node): Make enode_for_diag param
7177 non-constant.
7178 * feasible-graph.cc (feasible_node::dump_dot): Drop
7179 diagnostic_manager from call to dump_saved_diagnostics.
7180 * program-state.cc (program_state::on_edge): Convert enode param
7181 to non-const pointer.
7182 (program_state::prune_for_point): Likewise for enode_for_diag
7183 param.
7184 * program-state.h (program_state::on_edge): Convert enode param
7185 to non-const pointer.
7186 (program_state::prune_for_point): Likewise for enode_for_diag
7187 param.
7189 2021-03-31 David Malcolm <dmalcolm@redhat.com>
7191 PR analyzer/99771
7192 * analyzer.cc (maybe_reconstruct_from_def_stmt): New.
7193 (fixup_tree_for_diagnostic_1): New.
7194 (fixup_tree_for_diagnostic): New.
7195 * analyzer.h (fixup_tree_for_diagnostic): New decl.
7196 * checker-path.cc (call_event::get_desc): Call
7197 fixup_tree_for_diagnostic and use it for the call_with_state call.
7198 (warning_event::get_desc): Likewise for the final_event and
7199 make_label_text calls.
7200 * engine.cc (impl_region_model_context::on_state_leak): Likewise
7201 for the on_leak and add_diagnostic calls.
7202 * region-model.cc (region_model::get_representative_tree):
7203 Likewise for the result.
7205 2021-03-30 David Malcolm <dmalcolm@redhat.com>
7207 * region.h (region::dump_to_pp): Remove old decl.
7209 2021-03-30 David Malcolm <dmalcolm@redhat.com>
7211 * sm-file.cc (fileptr_state_machine::on_stmt): Only call
7212 get_diagnostic_tree if the result will be used.
7213 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
7214 (malloc_state_machine::on_deallocator_call): Likewise.
7215 (malloc_state_machine::on_realloc_call): Likewise.
7216 (malloc_state_machine::on_realloc_call): Likewise.
7217 * sm-sensitive.cc
7218 (sensitive_state_machine::warn_for_any_exposure): Likewise.
7219 * sm-taint.cc (taint_state_machine::on_stmt): Likewise.
7221 2021-03-25 David Malcolm <dmalcolm@redhat.com>
7223 PR analyzer/93695
7224 PR analyzer/99044
7225 PR analyzer/99716
7226 * engine.cc (exploded_node::on_stmt): Clear sm-state involving
7227 an SSA name at the def-stmt of that SSA name.
7228 * program-state.cc (sm_state_map::purge_state_involving): New.
7229 * program-state.h (sm_state_map::purge_state_involving): New decl.
7230 * region-model.cc (selftest::test_involves_p): New.
7231 (selftest::analyzer_region_model_cc_tests): Call it.
7232 * svalue.cc (class involvement_visitor): New class
7233 (svalue::involves_p): New.
7234 * svalue.h (svalue::involves_p): New decl.
7236 2021-03-19 David Malcolm <dmalcolm@redhat.com>
7238 PR analyzer/99614
7239 * diagnostic-manager.cc (class epath_finder): Add
7240 DISABLE_COPY_AND_ASSIGN.
7242 2021-03-15 Martin Liska <mliska@suse.cz>
7244 * sm-file.cc (get_file_using_fns): Add missing comma in initializer.
7246 2021-03-11 David Malcolm <dmalcolm@redhat.com>
7248 PR analyzer/96374
7249 * analyzer.opt (-param=analyzer-max-infeasible-edges=): New param.
7250 (fdump-analyzer-feasibility): New flag.
7251 * diagnostic-manager.cc: Include "analyzer/trimmed-graph.h" and
7252 "analyzer/feasible-graph.h".
7253 (epath_finder::epath_finder): Convert m_sep to a pointer and
7254 only create it if !flag_analyzer_feasibility.
7255 (epath_finder::~epath_finder): New.
7256 (epath_finder::m_sep): Convert to a pointer.
7257 (epath_finder::get_best_epath): Add param "diag_idx" and use it
7258 when logging. Rather than finding the shortest path and then
7259 checking feasibility, instead use explore_feasible_paths unless
7260 !flag_analyzer_feasibility, in which case simply use the shortest
7261 path, and note if it is infeasible. Update for m_sep becoming a
7262 pointer.
7263 (class feasible_worklist): New.
7264 (epath_finder::explore_feasible_paths): New.
7265 (epath_finder::process_worklist_item): New.
7266 (class dump_eg_with_shortest_path): New.
7267 (epath_finder::dump_trimmed_graph): New.
7268 (epath_finder::dump_feasible_graph): New.
7269 (saved_diagnostic::saved_diagnostic): Add "idx" param, using it
7270 on new field m_idx.
7271 (saved_diagnostic::to_json): Dump m_idx.
7272 (saved_diagnostic::calc_best_epath): Pass m_idx to get_best_epath.
7273 Remove assertion that m_problem was set when m_best_epath is NULL.
7274 (diagnostic_manager::add_diagnostic): Pass an index when created
7275 saved_diagnostic instances.
7276 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add
7277 "idx" param.
7278 (saved_diagnostic::get_index): New accessor.
7279 (saved_diagnostic::m_idx): New field.
7280 * engine.cc (exploded_node::dump_dot): Call args.dump_extra_info.
7281 Move code to...
7282 (exploded_node::dump_processed_stmts): ...this new function and...
7283 (exploded_node::dump_saved_diagnostics): ...this new function.
7284 Add index of each diagnostic.
7285 (exploded_edge::dump_dot): Move bulk of code to...
7286 (exploded_edge::dump_dot_label): ...this new function.
7287 * exploded-graph.h (eg_traits::dump_args_t::dump_extra_info): New
7288 vfunc.
7289 (exploded_node::dump_processed_stmts): New decl.
7290 (exploded_node::dump_saved_diagnostics): New decl.
7291 (exploded_edge::dump_dot_label): New decl.
7292 * feasible-graph.cc: New file.
7293 * feasible-graph.h: New file.
7294 * trimmed-graph.cc: New file.
7295 * trimmed-graph.h: New file.
7297 2021-03-11 David Malcolm <dmalcolm@redhat.com>
7299 * diagnostic-manager.cc (epath_finder::epath_finder):
7300 Update shortest_paths init for new param.
7302 2021-03-10 David Malcolm <dmalcolm@redhat.com>
7304 PR analyzer/96374
7305 * engine.cc (exploded_path::feasible_p): Move "snodes_visited" and
7306 "model" locals into a new class feasibility_state. Move heart
7307 of per-edge processing into
7308 feasibility_state::maybe_update_for_edge.
7309 (feasibility_state::feasibility_state): New.
7310 (feasibility_state::maybe_update_for_edge): New, based on loop
7311 body in exploded_path::feasible_p.
7312 * exploded-graph.h (class feasibility_state): New.
7314 2021-03-10 David Malcolm <dmalcolm@redhat.com>
7316 * supergraph.h
7317 (callgraph_superedge::dyn_cast_callgraph_superedge): New.
7318 (call_superedge::dyn_cast_callgraph_superedge): Delete.
7319 (return_superedge::dyn_cast_callgraph_superedge): Delete.
7321 2021-03-02 Martin Liska <mliska@suse.cz>
7323 * diagnostic-manager.cc (diagnostic_manager::emit_saved_diagnostics):
7324 Do not pass engine.
7326 2021-02-26 David Malcolm <dmalcolm@redhat.com>
7328 * engine.cc (exploded_path::exploded_path): New copy-ctor.
7329 * exploded-graph.h (exploded_path::operator=): Drop decl.
7331 2021-02-26 David Malcolm <dmalcolm@redhat.com>
7333 PR analyzer/96374
7334 * diagnostic-manager.cc (class epath_finder): New.
7335 (epath_finder::get_best_epath): New.
7336 (saved_diagnostic::saved_diagnostic): Update for replacement of
7337 m_state and m_epath_length with m_best_epath.
7338 (saved_diagnostic::~saved_diagnostic): Delete m_best_epath.
7339 (saved_diagnostic::to_json): Update "path_length" to be optional.
7340 (saved_diagnostic::calc_best_epath): New, based on
7341 dedupe_winners::add and parts of dedupe_key::dedupe_key.
7342 (saved_diagnostic::get_epath_length): New.
7343 (saved_diagnostic::add_duplicate): New.
7344 (dedupe_key::dedupe_key): Drop epath param. Move invocation of
7345 stmt_finder to saved_diagnostic::calc_best_epath.
7346 (class dedupe_candidate): Delete.
7347 (class dedupe_hash_map_traits): Update to use saved_diagnotic *
7348 rather than dedupe_candidate * as the value_type/compare_type.
7349 (dedupe_winners::~dedupe_winners): Don't delete the values.
7350 (dedupe_winners::add): Convert param from shortest_exploded_paths to
7351 epath_finder. Drop "eg" param. Drop dedupe_candidate, moving
7352 path generation and feasiblity checking to
7353 epath_finder::get_best_epath. Update winner-selection for move
7354 of epaths from dedupe_candidate to saved_diagnostic.
7355 (dedupe_winners::emit_best): Update for removal of class
7356 dedupe_candidate.
7357 (dedupe_winners::map_t): Update to use saved_diagnotic * rather
7358 than dedupe_candidate * as the value_type/compare_type.
7359 (diagnostic_manager::emit_saved_diagnostics): Move
7360 shortest_exploded_paths instance into epath_finder and pass that
7361 around instead.
7362 (diagnostic_manager::emit_saved_diagnostic): Drop epath, stmt
7363 and num_dupes params, instead getting these from the
7364 saved_diagnostic. Use correct location in inform_n call.
7365 * diagnostic-manager.h (class epath_finder): New forward decl.
7366 (saved_diagnostic::status): Drop enum.
7367 (saved_diagnostic::set_feasible): Drop.
7368 (saved_diagnostic::set_infeasible): Drop.
7369 (saved_diagnostic::get_status): Drop.
7370 (saved_diagnostic::calc_best_epath): New decl.
7371 (saved_diagnostic::get_best_epath): New decl.
7372 (saved_diagnostic::get_epath_length): New decl.
7373 (saved_diagnostic::set_epath_length): Drop.
7374 (saved_diagnostic::get_epath_length): Drop inline implementation.
7375 (saved_diagnostic::add_duplicate): New.
7376 (saved_diagnostic::get_num_dupes): New.
7377 (saved_diagnostic::m_d): Document ownership.
7378 (saved_diagnostic::m_trailing_eedge): Make const.
7379 (saved_diagnostic::m_status): Drop field.
7380 (saved_diagnostic::m_epath_length): Drop field.
7381 (saved_diagnostic::m_best_epath): New field.
7382 (saved_diagnostic::m_problem): Document ownership.
7383 (saved_diagnostic::m_duplicates): New field.
7384 (diagnostic_manager::emit_saved_diagnostic): Drop params epath,
7385 stmt, and num_dupes.
7386 * engine.cc (exploded_graph_annotator::print_saved_diagnostic):
7387 Update for changes to saved_diagnostic class.
7388 * exploded-graph.h (exploded_path::feasible_p): Drop unused
7389 overloaded decl.
7391 2021-02-25 David Malcolm <dmalcolm@redhat.com>
7393 PR analyzer/99193
7394 * region-model-impl-calls.cc (region_model::impl_call_realloc): New.
7395 * region-model.cc (region_model::on_call_pre): Call it.
7396 * region-model.h (region_model::impl_call_realloc): New decl.
7397 * sm-malloc.cc (enum wording): Add WORDING_REALLOCATED.
7398 (malloc_state_machine::m_realloc): New field.
7399 (use_after_free::describe_state_change): Add case for
7400 WORDING_REALLOCATED.
7401 (use_after_free::describe_final_event): Likewise.
7402 (malloc_state_machine::malloc_state_machine): Initialize
7403 m_realloc.
7404 (malloc_state_machine::on_stmt): Handle realloc by calling...
7405 (malloc_state_machine::on_realloc_call): New.
7407 2021-02-22 David Malcolm <dmalcolm@redhat.com>
7409 PR analyzer/99196
7410 * engine.cc (exploded_node::on_stmt): Provide terminate_path
7411 flag as a way for on_call_pre to terminate the current analysis
7412 path.
7413 * region-model-impl-calls.cc (call_details::num_args): New.
7414 (region_model::impl_call_error): New.
7415 * region-model.cc (region_model::on_call_pre): Add param
7416 "out_terminate_path". Handle "error" and "error_at_line".
7417 * region-model.h (call_details::num_args): New decl.
7418 (region_model::on_call_pre): Add param "out_terminate_path".
7419 (region_model::impl_call_error): New decl.
7421 2021-02-17 David Malcolm <dmalcolm@redhat.com>
7423 PR analyzer/98969
7424 * constraint-manager.cc (dead_svalue_purger::should_purge_p):
7425 Update for change to svalue::live_p.
7426 * program-state.cc (sm_state_map::on_liveness_change): Likewise.
7427 (program_state::detect_leaks): Likewise.
7428 * region-model-reachability.cc (reachable_regions::init_cluster):
7429 When dealing with a symbolic region, if the underlying pointer is
7430 implicitly live, add the region to the reachable regions.
7431 * region-model.cc (region_model::compare_initial_and_pointer):
7432 Move logic for detecting initial values of params to
7433 initial_svalue::initial_value_of_param_p.
7434 * svalue.cc (svalue::live_p): Convert "live_svalues" from a
7435 reference to a pointer; support it being NULL.
7436 (svalue::implicitly_live_p): Convert first param from a
7437 refererence to a pointer.
7438 (region_svalue::implicitly_live_p): Likewise.
7439 (constant_svalue::implicitly_live_p): Likewise.
7440 (initial_svalue::implicitly_live_p): Likewise. Treat the initial
7441 values of params for the top level frame as still live.
7442 (initial_svalue::initial_value_of_param_p): New function, taken
7443 from a test in region_model::compare_initial_and_pointer.
7444 (unaryop_svalue::implicitly_live_p): Convert first param from a
7445 refererence to a pointer.
7446 (binop_svalue::implicitly_live_p): Likewise.
7447 (sub_svalue::implicitly_live_p): Likewise.
7448 (unmergeable_svalue::implicitly_live_p): Likewise.
7449 * svalue.h (svalue::live_p): Likewise.
7450 (svalue::implicitly_live_p): Likewise.
7451 (region_svalue::implicitly_live_p): Likewise.
7452 (constant_svalue::implicitly_live_p): Likewise.
7453 (initial_svalue::implicitly_live_p): Likewise.
7454 (initial_svalue::initial_value_of_param_p): New decl.
7455 (unaryop_svalue::implicitly_live_p): Convert first param from a
7456 refererence to a pointer.
7457 (binop_svalue::implicitly_live_p): Likewise.
7458 (sub_svalue::implicitly_live_p): Likewise.
7459 (unmergeable_svalue::implicitly_live_p): Likewise.
7461 2021-02-12 David Malcolm <dmalcolm@redhat.com>
7463 PR analyzer/98969
7464 * engine.cc (readability): Add names for the various arbitrary
7465 values. Handle NOP_EXPR and INTEGER_CST.
7466 (readability_comparator): Combine the readability tests for
7467 tree and stack depth, rather than performing them sequentially.
7468 (impl_region_model_context::on_state_leak): Strip off top-level
7469 casts.
7470 * region-model.cc (region_model::get_representative_path_var): Add
7471 type-checking, moving the bulk of the implementation to...
7472 (region_model::get_representative_path_var_1): ...here. Respect
7473 types in casts by recursing and re-adding the cast, rather than
7474 merely stripping them off. Use the correct type when handling
7475 region_svalue.
7476 (region_model::get_representative_tree): Strip off any top-level
7477 cast.
7478 (region_model::get_representative_path_var): Add type-checking,
7479 moving the bulk of the implementation to...
7480 (region_model::get_representative_path_var_1): ...here.
7481 * region-model.h (region_model::get_representative_path_var_1):
7482 New decl
7483 (region_model::get_representative_path_var_1): New decl.
7484 * store.cc (append_pathvar_with_type): New.
7485 (binding_cluster::get_representative_path_vars): Cast path_vars
7486 to the correct type when adding them to *OUT_PVS.
7488 2021-02-09 David Malcolm <dmalcolm@redhat.com>
7490 PR analyzer/98575
7491 * sm-file.cc (is_file_using_fn_p): Support "_IO_"-prefixed
7492 variants.
7494 2021-02-09 David Malcolm <dmalcolm@redhat.com>
7496 PR analyzer/98575
7497 * store.cc (store::set_value): Treat a pointer written to *UNKNOWN
7498 as having escaped.
7500 2021-02-02 David Malcolm <dmalcolm@redhat.com>
7502 PR analyzer/93355
7503 PR analyzer/96374
7504 * engine.cc (toplevel_function_p): Simplify so that
7505 we only reject functions with a "__analyzer_" prefix.
7506 (add_any_callbacks): Delete.
7507 (exploded_graph::build_initial_worklist): Update for
7508 dropped param of toplevel_function_p.
7509 (exploded_graph::build_initial_worklist): Don't bother
7510 looking for callbacks that are reachable from global
7511 initializers.
7513 2021-02-01 David Malcolm <dmalcolm@redhat.com>
7515 PR analyzer/98918
7516 * region-model-manager.cc
7517 (region_model_manager::get_or_create_initial_value):
7518 Fold the initial value of *UNKNOWN_PTR to an UNKNOWN value.
7519 (region_model_manager::get_field_region): Fold the value
7520 of UNKNOWN_PTR->FIELD to *UNKNOWN_PTR_OF_&FIELD_TYPE.
7522 2021-01-29 David Malcolm <dmalcolm@redhat.com>
7524 * checker-path.cc (event_kind_to_string): Handle
7525 EK_START_CONSOLIDATED_CFG_EDGES and
7526 EK_END_CONSOLIDATED_CFG_EDGES.
7527 (start_consolidated_cfg_edges_event::get_desc): New.
7528 (checker_path::cfg_edge_pair_at_p): New.
7529 * checker-path.h (enum event_kind): Add
7530 EK_START_CONSOLIDATED_CFG_EDGES and
7531 EK_END_CONSOLIDATED_CFG_EDGES.
7532 (class start_consolidated_cfg_edges_event): New class.
7533 (class end_consolidated_cfg_edges_event): New class.
7534 (checker_path::delete_events): New.
7535 (checker_path::replace_event): New.
7536 (checker_path::cfg_edge_pair_at_p): New decl.
7537 * diagnostic-manager.cc (diagnostic_manager::prune_path): Call
7538 consolidate_conditions.
7539 (same_line_as_p): New.
7540 (diagnostic_manager::consolidate_conditions): New.
7541 * diagnostic-manager.h
7542 (diagnostic_manager::consolidate_conditions): New decl.
7544 2021-01-18 David Malcolm <dmalcolm@redhat.com>
7546 * analyzer.h (is_std_named_call_p): New decl.
7547 * diagnostic-manager.cc (path_builder::get_sm): New.
7548 (state_change_event_creator::state_change_event_creator): Add "pb"
7549 param.
7550 (state_change_event_creator::on_global_state_change): Don't consider
7551 state changes affecting other state_machines.
7552 (state_change_event_creator::on_state_change): Likewise.
7553 (state_change_event_creator::m_pb): New field.
7554 (diagnostic_manager::add_events_for_eedge): Pass pb to visitor
7555 ctor.
7556 * region-model-impl-calls.cc
7557 (region_model::impl_deallocation_call): New.
7558 * region-model.cc: Include "attribs.h".
7559 (region_model::on_call_post): Handle fndecls referenced by
7560 __attribute__((deallocated_by(FOO))).
7561 * region-model.h (region_model::impl_deallocation_call): New decl.
7562 * sm-malloc.cc: Include "stringpool.h" and "attribs.h". Add
7563 leading comment.
7564 (class api): Delete.
7565 (enum resource_state): Update comment for change from api to
7566 deallocator and deallocator_set.
7567 (allocation_state::allocation_state): Drop api param. Add
7568 "deallocators" and "deallocator".
7569 (allocation_state::m_api): Drop field in favor of...
7570 (allocation_state::m_deallocators): New field.
7571 (allocation_state::m_deallocator): New field.
7572 (enum wording): Add WORDING_DEALLOCATED.
7573 (struct deallocator): New.
7574 (struct standard_deallocator): New.
7575 (struct custom_deallocator): New.
7576 (struct deallocator_set): New.
7577 (struct custom_deallocator_set): New.
7578 (struct standard_deallocator_set): New.
7579 (struct deallocator_set_map_traits): New.
7580 (malloc_state_machine::m_malloc): Drop field
7581 (malloc_state_machine::m_scalar_new): Likewise.
7582 (malloc_state_machine::m_vector_new): Likewise.
7583 (malloc_state_machine::m_free): New field
7584 (malloc_state_machine::m_scalar_delete): Likewise.
7585 (malloc_state_machine::m_vector_delete): Likewise.
7586 (malloc_state_machine::deallocator_map_t): New typedef.
7587 (malloc_state_machine::m_deallocator_map): New field.
7588 (malloc_state_machine::deallocator_set_cache_t): New typedef.
7589 (malloc_state_machine::m_custom_deallocator_set_cache): New field.
7590 (malloc_state_machine::custom_deallocator_set_map_t): New typedef.
7591 (malloc_state_machine::m_custom_deallocator_set_map): New field.
7592 (malloc_state_machine::m_dynamic_sets): New field.
7593 (malloc_state_machine::m_dynamic_deallocators): New field.
7594 (api::api): Delete.
7595 (deallocator::deallocator): New ctor.
7596 (deallocator::hash): New.
7597 (deallocator::dump_to_pp): New.
7598 (deallocator::cmp): New.
7599 (deallocator::cmp_ptr_ptr): New.
7600 (standard_deallocator::standard_deallocator): New ctor.
7601 (deallocator_set::deallocator_set): New ctor.
7602 (deallocator_set::dump): New.
7603 (custom_deallocator_set::custom_deallocator_set): New ctor.
7604 (custom_deallocator_set::contains_p): New.
7605 (custom_deallocator_set::maybe_get_single): New.
7606 (custom_deallocator_set::dump_to_pp): New.
7607 (standard_deallocator_set::standard_deallocator_set): New ctor.
7608 (standard_deallocator_set::contains_p): New.
7609 (standard_deallocator_set::maybe_get_single): New.
7610 (standard_deallocator_set::dump_to_pp): New.
7611 (start_p): New.
7612 (class mismatching_deallocation): Update for conversion from api
7613 to deallocator_set and deallocator.
7614 (double_free::emit): Use %qs.
7615 (class use_after_free): Update for conversion from api to
7616 deallocator_set and deallocator.
7617 (malloc_leak::describe_state_change): Only emit "allocated here" on
7618 a start->nonnull transition, rather than on other transitions to
7619 nonnull.
7620 (allocation_state::dump_to_pp): Update for conversion from api to
7621 deallocator_set.
7622 (allocation_state::get_nonnull): Likewise.
7623 (malloc_state_machine::malloc_state_machine): Likewise.
7624 (malloc_state_machine::~malloc_state_machine): New.
7625 (malloc_state_machine::add_state): Update for conversion from api
7626 to deallocator_set.
7627 (malloc_state_machine::get_or_create_custom_deallocator_set): New.
7628 (malloc_state_machine::maybe_create_custom_deallocator_set): New.
7629 (malloc_state_machine::get_or_create_deallocator): New.
7630 (malloc_state_machine::on_stmt): Update for conversion from api
7631 to deallocator_set. Handle "__attribute__((malloc(FOO)))", and
7632 the special attribute set on FOO.
7633 (malloc_state_machine::on_allocator_call): Update for conversion
7634 from api to deallocator_set. Add "returns_nonnull" param and use
7635 it to affect which state to transition to.
7636 (malloc_state_machine::on_deallocator_call): Update for conversion
7637 from api to deallocator_set.
7639 2021-01-14 David Malcolm <dmalcolm@redhat.com>
7641 * engine.cc (strongly_connected_components::to_json): New.
7642 (worklist::to_json): New.
7643 (exploded_graph::to_json): JSON-ify the worklist.
7644 * exploded-graph.h (strongly_connected_components::to_json): New
7645 decl.
7646 (worklist::to_json): New decl.
7647 * store.cc (store::to_json): Fix comment.
7648 * supergraph.cc (supernode::to_json): Fix reference to
7649 "returning_call" in comment. Add optional "fun" to JSON.
7650 (edge_kind_to_string): New.
7651 (superedge::to_json): Add "kind" to JSON.
7653 2021-01-14 David Malcolm <dmalcolm@redhat.com>
7655 PR analyzer/98679
7656 * analyzer.h (region_offset::operator==): Make const.
7657 * pending-diagnostic.h (pending_diagnostic::equal_p): Likewise.
7658 * store.h (binding_cluster::for_each_value): Likewise.
7659 (binding_cluster::for_each_binding): Likewise.
7661 2021-01-12 David Malcolm <dmalcolm@redhat.com>
7663 PR analyzer/98628
7664 * store.cc (binding_cluster::make_unknown_relative_to): Don't mark
7665 dereferenced unknown pointers as having escaped.
7667 2021-01-07 David Malcolm <dmalcolm@redhat.com>
7669 PR analyzer/98580
7670 * region.cc (decl_region::get_svalue_for_initializer): Gracefully
7671 handle when LTO writes out DECL_INITIAL as error_mark_node.
7673 2021-01-07 David Malcolm <dmalcolm@redhat.com>
7675 PR analyzer/97074
7676 * store.cc (binding_cluster::can_merge_p): Add "out_store" param
7677 and pass to calls to binding_cluster::make_unknown_relative_to.
7678 (binding_cluster::make_unknown_relative_to): Add "out_store"
7679 param. Use it to mark base regions that are pointed to by
7680 pointers that become unknown as having escaped.
7681 (store::can_merge_p): Pass out_store to
7682 binding_cluster::can_merge_p.
7683 * store.h (binding_cluster::can_merge_p): Add "out_store" param.
7684 (binding_cluster::make_unknown_relative_to): Likewise.
7685 * svalue.cc (region_svalue::implicitly_live_p): New vfunc.
7686 * svalue.h (region_svalue::implicitly_live_p): New vfunc decl.
7688 2021-01-07 David Malcolm <dmalcolm@redhat.com>
7690 PR analyzer/98564
7691 * engine.cc (exploded_path::feasible_p): Add missing call to
7692 bitmap_clear.
7694 2021-01-06 David Malcolm <dmalcolm@redhat.com>
7696 PR analyzer/97072
7697 * region-model-reachability.cc (reachable_regions::init_cluster):
7698 Convert symbolic region handling to a switch statement. Add cases
7699 to handle SK_UNKNOWN and SK_CONJURED.
7701 2021-01-05 David Malcolm <dmalcolm@redhat.com>
7703 PR analyzer/98293
7704 * store.cc (binding_map::apply_ctor_to_region): When "index" is
7705 NULL, iterate through the fields for RECORD_TYPEs, rather than
7706 creating an INTEGER_CST index.
7708 2020-11-30 David Malcolm <dmalcolm@redhat.com>
7710 * analyzer-pass.cc: Include "analyzer/analyzer.h" for the
7711 declaration of sorry_no_analyzer; include "tree.h" and
7712 "function.h" as these are needed by it.
7714 2020-11-30 David Malcolm <dmalcolm@redhat.com>
7716 * analyzer-pass.cc (pass_analyzer::execute): Move sorry call to...
7717 (sorry_no_analyzer): New.
7718 * analyzer.h (class state_machine): New forward decl.
7719 (class logger): New forward decl.
7720 (class plugin_analyzer_init_iface): New.
7721 (sorry_no_analyzer): New decl.
7722 * checker-path.cc (checker_path::fixup_locations): New.
7723 * checker-path.h (checker_event::set_location): New.
7724 (checker_path::fixup_locations): New decl.
7725 * diagnostic-manager.cc
7726 (diagnostic_manager::emit_saved_diagnostic): Call
7727 checker_path::fixup_locations, and call fixup_location
7728 on the primary location.
7729 * engine.cc: Include "plugin.h".
7730 (class plugin_analyzer_init_impl): New.
7731 (impl_run_checkers): Invoke PLUGIN_ANALYZER_INIT callbacks.
7732 * pending-diagnostic.h (pending_diagnostic::fixup_location): New
7733 vfunc.
7735 2020-11-18 David Malcolm <dmalcolm@redhat.com>
7737 PR analyzer/97893
7738 * sm-malloc.cc (null_deref::emit): Use CWE-476 rather than
7739 CWE-690, as this isn't due to an unchecked return value.
7740 (null_arg::emit): Likewise.
7742 2020-11-12 David Malcolm <dmalcolm@redhat.com>
7744 * checker-path.h (checker_event::get_id_ptr): New.
7745 * diagnostic-manager.cc (path_builder::path_builder): Add "sd"
7746 param and use it to initialize new field "m_sd".
7747 (path_builder::get_pending_diagnostic): New.
7748 (path_builder::m_sd): New field.
7749 (diagnostic_manager::emit_saved_diagnostic): Pass sd to
7750 path_builder ctor.
7751 (diagnostic_manager::add_events_for_superedge): Call new
7752 maybe_add_custom_events_for_superedge vfunc.
7753 * engine.cc (stale_jmp_buf::stale_jmp_buf): Add "setjmp_point"
7754 param and use it to initialize new field "m_setjmp_point".
7755 Initialize new field "m_stack_pop_event".
7756 (stale_jmp_buf::maybe_add_custom_events_for_superedge): New vfunc
7757 implementation.
7758 (stale_jmp_buf::describe_final_event): New vfunc implementation.
7759 (stale_jmp_buf::m_setjmp_point): New field.
7760 (stale_jmp_buf::m_stack_pop_event): New field.
7761 (exploded_node::on_longjmp): Pass setjmp_point to stale_jmp_buf
7762 ctor.
7763 * pending-diagnostic.h
7764 (pending_diagnostic::maybe_add_custom_events_for_superedge): New
7765 vfunc.
7767 2020-11-12 David Malcolm <dmalcolm@redhat.com>
7769 PR tree-optimization/97424
7770 * analyzer.opt (Wanalyzer-shift-count-negative): New.
7771 (Wanalyzer-shift-count-overflow): New.
7772 * region-model.cc (class shift_count_negative_diagnostic): New.
7773 (class shift_count_overflow_diagnostic): New.
7774 (region_model::get_gassign_result): Complain about shift counts that
7775 are negative or are >= the operand's type's width.
7777 2020-11-10 Martin Liska <mliska@suse.cz>
7779 * constraint-manager.cc (constraint_manager::merge): Remove
7780 unused code.
7781 * constraint-manager.h: Likewise.
7782 * program-state.cc (sm_state_map::sm_state_map): Likewise.
7783 (program_state::program_state): Likewise.
7784 (test_sm_state_map): Likewise.
7785 * program-state.h: Likewise.
7786 * region-model-reachability.cc (reachable_regions::reachable_regions): Likewise.
7787 * region-model-reachability.h: Likewise.
7788 * region-model.cc (region_model::handle_unrecognized_call): Likewise.
7789 (region_model::get_reachable_svalues): Likewise.
7790 (region_model::can_merge_with_p): Likewise.
7792 2020-11-05 David Malcolm <dmalcolm@redhat.com>
7794 PR analyzer/97668
7795 * svalue.cc (cmp_cst): Handle COMPLEX_CST.
7797 2020-10-29 David Malcolm <dmalcolm@redhat.com>
7799 * program-state.cc (sm_state_map::on_liveness_change): Sort the
7800 leaking svalues before calling on_state_leak.
7801 (program_state::detect_leaks): Likewise when calling
7802 on_svalue_leak.
7803 * region-model-reachability.cc
7804 (reachable_regions::mark_escaped_clusters): Likewise when
7805 calling on_escaped_function.
7807 2020-10-29 David Malcolm <dmalcolm@redhat.com>
7809 PR analyzer/97608
7810 * region-model-reachability.cc (reachable_regions::handle_sval):
7811 Operands of reachable reversible operations are reachable.
7813 2020-10-29 David Malcolm <dmalcolm@redhat.com>
7815 * analyzer.h (class state_machine): New forward decl.
7816 (class logger): Likewise.
7817 (class visitor): Likewise.
7818 * complexity.cc: New file, taken from svalue.cc.
7819 * complexity.h: New file, taken from region-model.h.
7820 * region-model.h: Include "analyzer/svalue.h" and
7821 "analyzer/region.h". Move struct complexity to complexity.h.
7822 Move svalue, its subclasses and supporting decls to svalue.h.
7823 Move region, its subclasses and supporting decls to region.h.
7824 * region.cc: Include "analyzer/region.h".
7825 (symbolic_region::symbolic_region): Move here from region-model.h.
7826 * region.h: New file, based on material from region-model.h.
7827 * svalue.cc: Include "analyzer/svalue.h".
7828 (complexity::complexity): Move to complexity.cc.
7829 (complexity::from_pair): Likewise.
7830 * svalue.h: New file, based on material from region-model.h.
7832 2020-10-29 David Malcolm <dmalcolm@redhat.com>
7834 * program-state.cc (sm_state_map::print): Guard the printing of
7835 the origin pointer with !flag_dump_noaddr.
7836 * region.cc (string_region::dump_to_pp): Likewise for
7837 m_string_cst.
7839 2020-10-27 David Malcolm <dmalcolm@redhat.com>
7841 PR analyzer/97568
7842 * region-model.cc (region_model::get_initial_value_for_global):
7843 Move check that !DECL_EXTERNAL from here to...
7844 * region.cc (decl_region::get_svalue_for_initializer): ...here,
7845 using it to reject zero initialization.
7847 2020-10-27 Markus Böck <markus.boeck02@gmail.com>
7849 PR analyzer/96608
7850 * store.h (hash): Cast to intptr_t instead of long
7852 2020-10-27 David Malcolm <dmalcolm@redhat.com>
7854 * constraint-manager.cc (svalue_cmp_by_ptr): Delete.
7855 (equiv_class::canonicalize): Use svalue::cmp_ptr_ptr instead.
7856 (equiv_class_cmp): Eliminate pointer comparison.
7857 * diagnostic-manager.cc (dedupe_key::comparator): If they are at
7858 the same location, also compare epath ength and pending_diagnostic
7859 kind.
7860 * engine.cc (readability_comparator): If two path_vars have the
7861 same readability, then impose an arbitrary ordering on them.
7862 (worklist::key_t::cmp): If two points have the same plan ordering,
7863 continue the comparison. Call sm_state_map::cmp rather than
7864 comparing hash values.
7865 * program-state.cc (sm_state_map::entry_t::cmp): New.
7866 (sm_state_map::cmp): New.
7867 * program-state.h (sm_state_map::entry_t::cmp): New decl.
7868 (sm_state_map::elements): New.
7869 (sm_state_map::cmp): New.
7871 2020-10-27 David Malcolm <dmalcolm@redhat.com>
7873 * engine.cc (setjmp_record::cmp): New.
7874 (supernode_cluster::dump_dot): Avoid embedding pointer in cluster
7875 name.
7876 (supernode_cluster::cmp_ptr_ptr): New.
7877 (function_call_string_cluster::dump_dot): Avoid embedding pointer
7878 in cluster name. Sort m_map when dumping child clusters.
7879 (function_call_string_cluster::cmp_ptr_ptr): New.
7880 (root_cluster::dump_dot): Sort m_map when dumping child clusters.
7881 * program-point.cc (function_point::cmp): New.
7882 (function_point::cmp_ptr): New.
7883 * program-point.h (function_point::cmp): New decl.
7884 (function_point::cmp_ptr): New decl.
7885 * program-state.cc (sm_state_map::print): Sort the values. Guard
7886 the printing of pointers with !flag_dump_noaddr.
7887 (program_state::prune_for_point): Sort the regions.
7888 (log_set_of_svalues): Sort the values. Guard the printing of
7889 pointers with !flag_dump_noaddr.
7890 * region-model-manager.cc (log_uniq_map): Sort the values.
7891 * region-model-reachability.cc (dump_set): New function template.
7892 (reachable_regions::dump_to_pp): Use it.
7893 * region-model.h (svalue::cmp_ptr): New decl.
7894 (svalue::cmp_ptr_ptr): New decl.
7895 (setjmp_record::cmp): New decl.
7896 (placeholder_svalue::get_name): New accessor.
7897 (widening_svalue::get_point): New accessor.
7898 (compound_svalue::get_map): New accessor.
7899 (conjured_svalue::get_stmt): New accessor.
7900 (conjured_svalue::get_id_region): New accessor.
7901 (region::cmp_ptrs): Rename to...
7902 (region::cmp_ptr_ptr): ...this.
7903 * region.cc (region::cmp_ptrs): Rename to...
7904 (region::cmp_ptr_ptr): ...this.
7905 * state-purge.cc
7906 (state_purge_per_ssa_name::state_purge_per_ssa_name): Sort
7907 m_points_needing_name when dumping.
7908 * store.cc (concrete_binding::cmp_ptr_ptr): New.
7909 (symbolic_binding::cmp_ptr_ptr): New.
7910 (binding_map::cmp): New.
7911 (get_sorted_parent_regions): Update for renaming of
7912 region::cmp_ptrs to region::cmp_ptr_ptr.
7913 (store::dump_to_pp): Likewise.
7914 (store::to_json): Likewise.
7915 (store::can_merge_p): Sort the base regions before considering
7916 them.
7917 * store.h (concrete_binding::cmp_ptr_ptr): New decl.
7918 (symbolic_binding::cmp_ptr_ptr): New decl.
7919 (binding_map::cmp): New decl.
7920 * supergraph.cc (supergraph::supergraph): Assign UIDs to the
7921 gimple stmts.
7922 * svalue.cc (cmp_cst): New.
7923 (svalue::cmp_ptr): New.
7924 (svalue::cmp_ptr_ptr): New.
7926 2020-10-27 David Malcolm <dmalcolm@redhat.com>
7928 * engine.cc (exploded_graph::get_or_create_node): Fix off-by-one
7929 when imposing param_analyzer_max_enodes_per_program_point limit.
7931 2020-10-27 David Malcolm <dmalcolm@redhat.com>
7933 * region-model.cc (region_model::get_representative_path_var):
7934 Implement case RK_LABEL.
7935 * region-model.h (label_region::get_label): New accessor.
7937 2020-10-22 David Malcolm <dmalcolm@redhat.com>
7939 PR analyzer/97514
7940 * engine.cc (exploded_graph::add_function_entry): Handle failure
7941 to create an enode, rather than asserting.
7943 2020-10-22 David Malcolm <dmalcolm@redhat.com>
7945 PR analyzer/97489
7946 * engine.cc (exploded_graph::add_function_entry): Assert that we
7947 have a function body.
7948 (exploded_graph::on_escaped_function): Reject fndecls that don't
7949 have a function body.
7951 2020-10-14 David Malcolm <dmalcolm@redhat.com>
7953 PR analyzer/93388
7954 * region-model.cc (region_model::get_initial_value_for_global):
7955 Fall back to returning an initial_svalue if
7956 decl_region::get_svalue_for_initializer fails.
7957 * region.cc (decl_region::get_svalue_for_initializer): Don't
7958 attempt to create a compound_svalue if the region has an unknown
7959 size.
7961 2020-10-14 David Malcolm <dmalcolm@redhat.com>
7963 PR analyzer/93723
7964 * store.cc (binding_map::apply_ctor_to_region): Remove redundant
7965 assertion.
7967 2020-10-12 David Malcolm <dmalcolm@redhat.com>
7969 PR analyzer/97258
7970 * engine.cc (impl_region_model_context::on_escaped_function): New
7971 vfunc.
7972 (exploded_graph::add_function_entry): Use m_functions_with_enodes
7973 to implement idempotency.
7974 (add_any_callbacks): New.
7975 (exploded_graph::build_initial_worklist): Use the above to find
7976 callbacks that are reachable from global initializers.
7977 (exploded_graph::on_escaped_function): New.
7978 * exploded-graph.h
7979 (impl_region_model_context::on_escaped_function): New decl.
7980 (exploded_graph::on_escaped_function): New decl.
7981 (exploded_graph::m_functions_with_enodes): New field.
7982 * region-model-reachability.cc
7983 (reachable_regions::reachable_regions): Replace "store" param with
7984 "model" param; use it to initialize m_model.
7985 (reachable_regions::add): When getting the svalue for the region,
7986 call get_store_value on the model rather than using an initial
7987 value.
7988 (reachable_regions::mark_escaped_clusters): Add ctxt param and
7989 use it to call on_escaped_function when a function_region escapes.
7990 * region-model-reachability.h
7991 (reachable_regions::reachable_regions): Replace "store" param with
7992 "model" param.
7993 (reachable_regions::mark_escaped_clusters): Add ctxt param.
7994 (reachable_regions::m_model): New field.
7995 * region-model.cc (region_model::handle_unrecognized_call): Update
7996 for change in reachable_regions ctor.
7997 (region_model::handle_unrecognized_call): Pass ctxt to
7998 mark_escaped_clusters.
7999 (region_model::get_reachable_svalues): Update for change in
8000 reachable_regions ctor.
8001 (region_model::get_initial_value_for_global): Read-only variables
8002 keep their initial values.
8003 * region-model.h (region_model_context::on_escaped_function): New
8004 vfunc.
8005 (noop_region_model_context::on_escaped_function): New.
8007 2020-10-12 David Malcolm <dmalcolm@redhat.com>
8009 * analyzer.opt (Wanalyzer-write-to-const): New.
8010 (Wanalyzer-write-to-string-literal): New.
8011 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
8012 Call check_for_writable_region.
8013 (region_model::impl_call_memset): Likewise.
8014 (region_model::impl_call_strcpy): Likewise.
8015 * region-model.cc (class write_to_const_diagnostic): New.
8016 (class write_to_string_literal_diagnostic): New.
8017 (region_model::check_for_writable_region): New.
8018 (region_model::set_value): Call check_for_writable_region.
8019 * region-model.h (region_model::check_for_writable_region): New
8020 decl.
8022 2020-10-07 David Malcolm <dmalcolm@redhat.com>
8024 PR analyzer/97116
8025 * sm-malloc.cc (method_p): New.
8026 (describe_argument_index): New.
8027 (inform_nonnull_attribute): Use describe_argument_index.
8028 (possible_null_arg::describe_final_event): Likewise.
8029 (null_arg::describe_final_event): Likewise.
8031 2020-09-29 David Malcolm <dmalcolm@redhat.com>
8033 PR analyzer/95188
8034 * engine.cc (stmt_requires_new_enode_p): Split enodes before
8035 "signal" calls.
8037 2020-09-29 David Malcolm <dmalcolm@redhat.com>
8039 * constraint-manager.cc
8040 (constraint_manager::add_constraint_internal): Whitespace fixes.
8041 Silence -Wsign-compare warning.
8042 * engine.cc (maybe_process_run_of_before_supernode_enodes):
8043 Silence -Wsign-compare warning.
8045 2020-09-28 David Malcolm <dmalcolm@redhat.com>
8047 * region-model.h (binop_svalue::dyn_cast_binop_svalue): Remove
8048 redundant "virtual". Add FINAL OVERRIDE.
8049 (widening_svalue::dyn_cast_widening_svalue): Add FINAL OVERRIDE.
8050 (compound_svalue::dyn_cast_compound_svalue): Likewise.
8051 (conjured_svalue::dyn_cast_conjured_svalue): Likewise.
8053 2020-09-28 David Malcolm <dmalcolm@redhat.com>
8055 * diagnostic-manager.cc (null_assignment_sm_context::m_visitor):
8056 Remove unused field.
8058 2020-09-28 David Malcolm <dmalcolm@redhat.com>
8060 PR analyzer/97233
8061 * analyzer.cc (is_longjmp_call_p): Require the initial argument
8062 to be a pointer.
8063 * engine.cc (exploded_node::on_longjmp): Likewise.
8065 2020-09-28 David Malcolm <dmalcolm@redhat.com>
8067 * program-state.cc (sm_state_map::print): Update check
8068 for m_global_state being the start state.
8070 2020-09-26 David Malcolm <dmalcolm@redhat.com>
8072 PR analyzer/96646
8073 PR analyzer/96841
8074 * region-model.cc (region_model::get_representative_path_var):
8075 When handling offset_region, wrap the MEM_REF's first argument in
8076 an ADDR_EXPR of pointer type, rather than simply using the tree
8077 for the parent region. Require the MEM_REF's second argument to
8078 be an integer constant.
8080 2020-09-24 David Malcolm <dmalcolm@redhat.com>
8082 * analyzer.h (struct rejected_constraint): New decl.
8083 * analyzer.opt (fanalyzer-feasibility): New option.
8084 * diagnostic-manager.cc (path_builder::path_builder): Add
8085 "problem" param and use it to initialize new field.
8086 (path_builder::get_feasibility_problem): New accessor.
8087 (path_builder::m_feasibility_problem): New field.
8088 (dedupe_winners::add): Remove inversion of logic in "if" clause,
8089 swapping if/else suites. In the !feasible_p suite, inspect
8090 flag_analyzer_feasibility and add code to handle when this
8091 is off, accepting the infeasible path, but recording the
8092 feasibility_problem.
8093 (diagnostic_manager::emit_saved_diagnostic): Pass the
8094 feasibility_problem to the path_builder.
8095 (diagnostic_manager::add_events_for_eedge): If we have
8096 a feasibility_problem at this edge, use it to add a custom event.
8097 * engine.cc (exploded_path::feasible_p): Pass a
8098 rejected_constraint ** to model.maybe_update_for_edge and transfer
8099 ownership of any created instance to any feasibility_problem.
8100 (feasibility_problem::dump_to_pp): New.
8101 * exploded-graph.h (feasibility_problem::feasibility_problem):
8102 Drop "model" param; add rejected_constraint * param.
8103 (feasibility_problem::~feasibility_problem): New.
8104 (feasibility_problem::dump_to_pp): New decl.
8105 (feasibility_problem::m_model): Drop field.
8106 (feasibility_problem::m_rc): New field.
8107 * program-point.cc (function_point::get_location): Handle
8108 PK_BEFORE_SUPERNODE and PK_AFTER_SUPERNODE.
8109 * program-state.cc (program_state::on_edge): Pass NULL to new
8110 param of region_model::maybe_update_for_edge.
8111 * region-model.cc (region_model::add_constraint): New overload
8112 adding a rejected_constraint ** param.
8113 (region_model::maybe_update_for_edge): Add rejected_constraint **
8114 param and pass it to the various apply_constraints_for_ calls.
8115 (region_model::apply_constraints_for_gcond): Add
8116 rejected_constraint ** param and pass it to add_constraint calls.
8117 (region_model::apply_constraints_for_gswitch): Likewise.
8118 (region_model::apply_constraints_for_exception): Likewise.
8119 (rejected_constraint::dump_to_pp): New.
8120 * region-model.h (region_model::maybe_update_for_edge):
8121 Add rejected_constraint ** param.
8122 (region_model::add_constraint): New overload adding a
8123 rejected_constraint ** param.
8124 (region_model::apply_constraints_for_gcond): Add
8125 rejected_constraint ** param.
8126 (region_model::apply_constraints_for_gswitch): Likewise.
8127 (region_model::apply_constraints_for_exception): Likewise.
8128 (struct rejected_constraint): New.
8130 2020-09-23 David Malcolm <dmalcolm@redhat.com>
8132 PR analyzer/97178
8133 * engine.cc (impl_run_checkers): Update for change to ext_state
8134 ctor.
8135 * program-state.cc (selftest::test_sm_state_map): Pass an engine
8136 instance to ext_state ctor.
8137 (selftest::test_program_state_1): Likewise.
8138 (selftest::test_program_state_2): Likewise.
8139 (selftest::test_program_state_merging): Likewise.
8140 (selftest::test_program_state_merging_2): Likewise.
8141 * program-state.h (extrinsic_state::extrinsic_state): Remove NULL
8142 default value for "eng" param.
8144 2020-09-23 Tobias Burnus <tobias@codesourcery.com>
8146 * analyzer-logging.cc: Guard '#pragma ... ignored "-Wformat-diag"'
8147 by '#if __GNUC__ >= 10'
8148 * analyzer.h: Likewise.
8149 * call-string.cc: Likewise.
8151 2020-09-23 David Malcolm <dmalcolm@redhat.com>
8153 * engine.cc (exploded_node::on_stmt): Replace sequence of dyn_cast
8154 with switch.
8156 2020-09-22 David Malcolm <dmalcolm@redhat.com>
8158 * analysis-plan.cc: Include "json.h".
8159 * analyzer.opt (fdump-analyzer-json): New.
8160 * call-string.cc: Include "json.h".
8161 (call_string::to_json): New.
8162 * call-string.h (call_string::to_json): New decl.
8163 * checker-path.cc: Include "json.h".
8164 * constraint-manager.cc: Include "json.h".
8165 (equiv_class::to_json): New.
8166 (constraint::to_json): New.
8167 (constraint_manager::to_json): New.
8168 * constraint-manager.h (equiv_class::to_json): New decl.
8169 (constraint::to_json): New decl.
8170 (constraint_manager::to_json): New decl.
8171 * diagnostic-manager.cc: Include "json.h".
8172 (saved_diagnostic::to_json): New.
8173 (diagnostic_manager::to_json): New.
8174 * diagnostic-manager.h (saved_diagnostic::to_json): New decl.
8175 (diagnostic_manager::to_json): New decl.
8176 * engine.cc: Include "json.h", <zlib.h>.
8177 (exploded_node::status_to_str): New.
8178 (exploded_node::to_json): New.
8179 (exploded_edge::to_json): New.
8180 (exploded_graph::to_json): New.
8181 (dump_analyzer_json): New.
8182 (impl_run_checkers): Call it.
8183 * exploded-graph.h (exploded_node::status_to_str): New decl.
8184 (exploded_node::to_json): New.
8185 (exploded_edge::to_json): New.
8186 (exploded_graph::to_json): New.
8187 * pending-diagnostic.cc: Include "json.h".
8188 * program-point.cc: Include "json.h".
8189 (program_point::to_json): New.
8190 * program-point.h (program_point::to_json): New decl.
8191 * program-state.cc: Include "json.h".
8192 (extrinsic_state::to_json): New.
8193 (sm_state_map::to_json): New.
8194 (program_state::to_json): New.
8195 * program-state.h (extrinsic_state::to_json): New decl.
8196 (sm_state_map::to_json): New decl.
8197 (program_state::to_json): New decl.
8198 * region-model-impl-calls.cc: Include "json.h".
8199 * region-model-manager.cc: Include "json.h".
8200 * region-model-reachability.cc: Include "json.h".
8201 * region-model.cc: Include "json.h".
8202 * region-model.h (svalue::to_json): New decl.
8203 (region::to_json): New decl.
8204 * region.cc: Include "json.h".
8205 (region::to_json: New.
8206 * sm-file.cc: Include "json.h".
8207 * sm-malloc.cc: Include "json.h".
8208 * sm-pattern-test.cc: Include "json.h".
8209 * sm-sensitive.cc: Include "json.h".
8210 * sm-signal.cc: Include "json.h".
8211 (signal_delivery_edge_info_t::to_json): New.
8212 * sm-taint.cc: Include "json.h".
8213 * sm.cc: Include "diagnostic.h", "tree-diagnostic.h", and
8214 "json.h".
8215 (state_machine::state::to_json): New.
8216 (state_machine::to_json): New.
8217 * sm.h (state_machine::state::to_json): New.
8218 (state_machine::to_json): New.
8219 * state-purge.cc: Include "json.h".
8220 * store.cc: Include "json.h".
8221 (binding_key::get_desc): New.
8222 (binding_map::to_json): New.
8223 (binding_cluster::to_json): New.
8224 (store::to_json): New.
8225 * store.h (binding_key::get_desc): New decl.
8226 (binding_map::to_json): New decl.
8227 (binding_cluster::to_json): New decl.
8228 (store::to_json): New decl.
8229 * supergraph.cc: Include "json.h".
8230 (supergraph::to_json): New.
8231 (supernode::to_json): New.
8232 (superedge::to_json): New.
8233 * supergraph.h (supergraph::to_json): New decl.
8234 (supernode::to_json): New decl.
8235 (superedge::to_json): New decl.
8236 * svalue.cc: Include "json.h".
8237 (svalue::to_json): New.
8239 2020-09-21 David Malcolm <dmalcolm@redhat.com>
8241 PR analyzer/97130
8242 * region-model-impl-calls.cc (call_details::get_arg_type): New.
8243 * region-model.cc (region_model::on_call_pre): Check that the
8244 initial arg is a pointer before calling impl_call_memset and
8245 impl_call_strlen.
8246 * region-model.h (call_details::get_arg_type): New decl.
8248 2020-09-21 David Malcolm <dmalcolm@redhat.com>
8250 PR analyzer/93355
8251 * sm-malloc.cc (malloc_state_machine::get_default_state): Look at
8252 the base region when considering pointers. Treat pointers to
8253 decls as being non-heap.
8255 2020-09-18 David Malcolm <dmalcolm@redhat.com>
8257 * checker-path.cc (warning_event::get_desc): Handle global state
8258 changes.
8260 2020-09-18 David Malcolm <dmalcolm@redhat.com>
8262 * sm-malloc.cc (malloc_state_machine::on_stmt): Handle strdup and
8263 strndup as being malloc-like allocators.
8265 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8267 * engine.cc (strongly_connected_components::strong_connect): Only
8268 consider intraprocedural edges when creating SCCs.
8269 (worklist::key_t::cmp): Add comment. Treat call_string
8270 differences as more important than differences of program_point
8271 within a supernode.
8273 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8275 * engine.cc (supernode_cluster::dump_dot): Show the SCC id
8276 in the per-supernode clusters in FILENAME.eg.dot output.
8277 (exploded_graph_annotator::add_node_annotations):
8278 Show the SCC of the supernode in FILENAME.supernode.eg.dot output.
8279 * exploded-graph.h (worklist::scc_id): New.
8280 (exploded_graph::get_scc_id): New.
8282 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8284 * engine.cc (exploded_node::dump_dot): Show STATUS_BULK_MERGED.
8285 (exploded_graph::process_worklist): Call
8286 maybe_process_run_of_before_supernode_enodes.
8287 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
8288 New.
8289 (exploded_graph_annotator::print_enode): Show STATUS_BULK_MERGED.
8290 * exploded-graph.h (enum exploded_node::status): Add
8291 STATUS_BULK_MERGED.
8293 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8295 * engine.cc
8296 (exploded_graph::process_node) <case PK_BEFORE_SUPERNODE>:
8297 Simplify by using program_point::get_next.
8298 * program-point.cc (program_point::get_next): New.
8299 * program-point.h (program_point::get_next): New decl.
8301 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8303 * engine.cc (exploded_graph::get_or_create_node): Show the
8304 program point when issuing -Wanalyzer-too-complex due to hitting
8305 the per-program-point limit.
8307 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8309 * region-model.cc (region_model::on_call_pre): Treat getchar as
8310 having no side-effects.
8312 2020-09-15 David Malcolm <dmalcolm@redhat.com>
8314 PR analyzer/96650
8315 * constraint-manager.cc (merger_fact_visitor::on_fact): Replace
8316 assertion that add_constraint succeeded with an assertion that
8317 if it fails, -fanalyzer-transitivity is off.
8319 2020-09-14 David Malcolm <dmalcolm@redhat.com>
8321 * analyzer.opt (-param=analyzer-max-constraints=): New param.
8322 * constraint-manager.cc
8323 (constraint_manager::add_constraint_internal): Silently reject
8324 attempts to add constraints when the above limit is reached.
8326 2020-09-14 David Malcolm <dmalcolm@redhat.com>
8328 PR analyzer/96653
8329 * constraint-manager.cc
8330 (constraint_manager::get_or_add_equiv_class): Don't accumulate
8331 transitive closure of all constraints on constants.
8333 2020-09-14 David Malcolm <dmalcolm@redhat.com>
8335 PR analyzer/97029
8336 * analyzer.cc (is_setjmp_call_p): Require the initial arg to be a
8337 pointer.
8338 * region-model.cc (region_model::deref_rvalue): Assert that the
8339 svalue is of pointer type.
8341 2020-09-11 David Malcolm <dmalcolm@redhat.com>
8343 PR analyzer/96798
8344 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
8345 New.
8346 (region_model::impl_call_strcpy): New.
8347 * region-model.cc (region_model::on_call_pre): Flag unhandled
8348 builtins that are non-pure as having unknown side-effects.
8349 Implement BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_STRCPY,
8350 BUILT_IN_STRCPY_CHK, BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED,
8351 BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_FPUTC,
8352 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
8353 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
8354 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR,
8355 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED,
8356 BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF.
8357 * region-model.h (region_model::impl_call_memcpy): New decl.
8358 (region_model::impl_call_strcpy): New decl.
8360 2020-09-09 David Malcolm <dmalcolm@redhat.com>
8362 PR analyzer/94355
8363 * analyzer.opt (Wanalyzer-mismatching-deallocation): New warning.
8364 * region-model-impl-calls.cc
8365 (region_model::impl_call_operator_new): New.
8366 (region_model::impl_call_operator_delete): New.
8367 * region-model.cc (region_model::on_call_pre): Detect operator new
8368 and operator delete.
8369 (region_model::on_call_post): Likewise.
8370 (region_model::maybe_update_for_edge): Detect EH edges and call...
8371 (region_model::apply_constraints_for_exception): New function.
8372 * region-model.h (region_model::impl_call_operator_new): New decl.
8373 (region_model::impl_call_operator_delete): New decl.
8374 (region_model::apply_constraints_for_exception): New decl.
8375 * sm-malloc.cc (enum resource_state): New.
8376 (struct allocation_state): New state subclass.
8377 (enum wording): New.
8378 (struct api): New.
8379 (malloc_state_machine::custom_data_t): New typedef.
8380 (malloc_state_machine::add_state): New decl.
8381 (malloc_state_machine::m_unchecked)
8382 (malloc_state_machine::m_nonnull)
8383 (malloc_state_machine::m_freed): Delete these states in favor
8384 of...
8385 (malloc_state_machine::m_malloc)
8386 (malloc_state_machine::m_scalar_new)
8387 (malloc_state_machine::m_vector_new): ...this new api instances,
8388 which own their own versions of these states.
8389 (malloc_state_machine::on_allocator_call): New decl.
8390 (malloc_state_machine::on_deallocator_call): New decl.
8391 (api::api): New ctor.
8392 (dyn_cast_allocation_state): New.
8393 (as_a_allocation_state): New.
8394 (get_rs): New.
8395 (unchecked_p): New.
8396 (nonnull_p): New.
8397 (freed_p): New.
8398 (malloc_diagnostic::describe_state_change): Use unchecked_p and
8399 nonnull_p.
8400 (class mismatching_deallocation): New.
8401 (double_free::double_free): Add funcname param for initializing
8402 m_funcname.
8403 (double_free::emit): Use m_funcname in warning message rather
8404 than hardcoding "free".
8405 (double_free::describe_state_change): Likewise. Use freed_p.
8406 (double_free::describe_call_with_state): Use freed_p.
8407 (double_free::describe_final_event): Use m_funcname in message
8408 rather than hardcoding "free".
8409 (double_free::m_funcname): New field.
8410 (possible_null::describe_state_change): Use unchecked_p.
8411 (possible_null::describe_return_of_state): Likewise.
8412 (use_after_free::use_after_free): Add param for initializing m_api.
8413 (use_after_free::emit): Use m_api->m_dealloc_funcname in message
8414 rather than hardcoding "free".
8415 (use_after_free::describe_state_change): Use freed_p. Change the
8416 wording of the message based on the API.
8417 (use_after_free::describe_final_event): Use
8418 m_api->m_dealloc_funcname in message rather than hardcoding
8419 "free". Change the wording of the message based on the API.
8420 (use_after_free::m_api): New field.
8421 (malloc_leak::describe_state_change): Use unchecked_p. Update
8422 for renaming of m_malloc_event to m_alloc_event.
8423 (malloc_leak::describe_final_event): Update for renaming of
8424 m_malloc_event to m_alloc_event.
8425 (malloc_leak::m_malloc_event): Rename...
8426 (malloc_leak::m_alloc_event): ...to this.
8427 (free_of_non_heap::free_of_non_heap): Add param for initializing
8428 m_funcname.
8429 (free_of_non_heap::emit): Use m_funcname in message rather than
8430 hardcoding "free".
8431 (free_of_non_heap::describe_final_event): Likewise.
8432 (free_of_non_heap::m_funcname): New field.
8433 (allocation_state::dump_to_pp): New.
8434 (allocation_state::get_nonnull): New.
8435 (malloc_state_machine::malloc_state_machine): Update for changes
8436 to state fields and new api fields.
8437 (malloc_state_machine::add_state): New.
8438 (malloc_state_machine::on_stmt): Move malloc/calloc handling to
8439 on_allocator_call and call it, passing in the API pointer.
8440 Likewise for free, moving it to on_deallocator_call. Handle calls
8441 to operator new and delete in an analogous way. Use unchecked_p
8442 when testing for possibly-null-arg and possibly-null-deref, and
8443 transition to the non-null for the correct API. Remove redundant
8444 node param from call to on_zero_assignment. Use freed_p for
8445 use-after-free check, and pass in API.
8446 (malloc_state_machine::on_allocator_call): New, based on code in
8447 on_stmt.
8448 (malloc_state_machine::on_deallocator_call): Likewise.
8449 (malloc_state_machine::on_phi): Mark node param with
8450 ATTRIBUTE_UNUSED; don't pass it to on_zero_assignment.
8451 (malloc_state_machine::on_condition): Mark node param with
8452 ATTRIBUTE_UNUSED. Replace on_transition calls with get_state and
8453 set_next_state pairs, transitioning to the non-null state for the
8454 appropriate API.
8455 (malloc_state_machine::can_purge_p): Port to new state approach.
8456 (malloc_state_machine::on_zero_assignment): Replace on_transition
8457 calls with get_state and set_next_state pairs. Drop redundant
8458 node param.
8459 * sm.h (state_machine::add_custom_state): New.
8461 2020-09-09 David Malcolm <dmalcolm@redhat.com>
8463 * diagnostic-manager.cc
8464 (null_assignment_sm_context::warn_for_state): Replace with...
8465 (null_assignment_sm_context::warn): ...this.
8466 * engine.cc (impl_sm_context::warn_for_state): Replace with...
8467 (impl_sm_context::warn): ...this.
8468 * sm-file.cc (fileptr_state_machine::on_stmt): Replace
8469 warn_for_state and on_transition calls with a get_state
8470 test guarding warn and set_next_state calls.
8471 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
8472 * sm-pattern-test.cc (pattern_test_state_machine::on_condition):
8473 Replace warn_for_state call with warn call.
8474 * sm-sensitive.cc
8475 (sensitive_state_machine::warn_for_any_exposure): Replace
8476 warn_for_state call with a get_state test guarding a warn call.
8477 * sm-signal.cc (signal_state_machine::on_stmt): Likewise.
8478 * sm-taint.cc (taint_state_machine::on_stmt): Replace
8479 warn_for_state and on_transition calls with a get_state
8480 test guarding warn and set_next_state calls.
8481 * sm.h (sm_context::warn_for_state): Replace with...
8482 (sm_context::warn): ...this.
8484 2020-09-09 David Malcolm <dmalcolm@redhat.com>
8486 * diagnostic-manager.cc
8487 (null_assignment_sm_context::null_assignment_sm_context): Add old_state
8488 and ext_state params, initializing m_old_state and m_ext_state.
8489 (null_assignment_sm_context::on_transition): Split into...
8490 (null_assignment_sm_context::get_state): ...this new vfunc
8491 implementation and...
8492 (null_assignment_sm_context::set_next_state): ...this new vfunc
8493 implementation.
8494 (null_assignment_sm_context::m_old_state): New field.
8495 (null_assignment_sm_context::m_ext_state): New field.
8496 (diagnostic_manager::add_events_for_eedge): Pass in old state and
8497 ext_state when creating sm_ctxt.
8498 * engine.cc (impl_sm_context::on_transition): Split into...
8499 (impl_sm_context::get_state): ...this new vfunc
8500 implementation and...
8501 (impl_sm_context::set_next_state): ...this new vfunc
8502 implementation.
8503 * sm.h (sm_context::get_state): New pure virtual function.
8504 (sm_context::set_next_state): Likewise.
8505 (sm_context::on_transition): Convert from a pure virtual function
8506 to a regular function implemented in terms of get_state and
8507 set_next_state.
8509 2020-09-09 David Malcolm <dmalcolm@redhat.com>
8511 * checker-path.cc (state_change_event::get_desc): Update
8512 state_machine::get_state_name calls to state::get_name.
8513 (warning_event::get_desc): Likewise.
8514 * diagnostic-manager.cc
8515 (null_assignment_sm_context::on_transition): Update comparison
8516 against 0 with comparison with m_sm.get_start_state.
8517 (diagnostic_manager::prune_for_sm_diagnostic): Update
8518 state_machine::get_state_name calls to state::get_name.
8519 * engine.cc (impl_sm_context::on_transition): Likewise.
8520 (exploded_node::get_dot_fillcolor): Use get_id when summing
8521 the sm states.
8522 * program-state.cc (sm_state_map::sm_state_map): Don't hardcode
8523 0 as the start state when initializing m_global_state.
8524 (sm_state_map::print): Use dump_to_pp rather than get_state_name
8525 when dumping states.
8526 (sm_state_map::is_empty_p): Don't hardcode 0 as the start state
8527 when examining m_global_state.
8528 (sm_state_map::hash): Use get_id when hashing states.
8529 (selftest::test_sm_state_map): Use state objects rather than
8530 arbitrary hardcoded integers.
8531 (selftest::test_program_state_merging): Likewise.
8532 (selftest::test_program_state_merging_2): Likewise.
8533 * sm-file.cc (fileptr_state_machine::m_start): Move to base class.
8534 (file_diagnostic::describe_state_change): Use get_start_state.
8535 (fileptr_state_machine::fileptr_state_machine): Drop m_start
8536 initialization.
8537 * sm-malloc.cc (malloc_state_machine::m_start): Move to base
8538 class.
8539 (malloc_diagnostic::describe_state_change): Use get_start_state.
8540 (possible_null::describe_state_change): Likewise.
8541 (malloc_state_machine::malloc_state_machine): Drop m_start
8542 initialization.
8543 * sm-pattern-test.cc (pattern_test_state_machine::m_start): Move
8544 to base class.
8545 (pattern_test_state_machine::pattern_test_state_machine): Drop
8546 m_start initialization.
8547 * sm-sensitive.cc (sensitive_state_machine::m_start): Move to base
8548 class.
8549 (sensitive_state_machine::sensitive_state_machine): Drop m_start
8550 initialization.
8551 * sm-signal.cc (signal_state_machine::m_start): Move to base
8552 class.
8553 (signal_state_machine::signal_state_machine): Drop m_start
8554 initialization.
8555 * sm-taint.cc (taint_state_machine::m_start): Move to base class.
8556 (taint_state_machine::taint_state_machine): Drop m_start
8557 initialization.
8558 * sm.cc (state_machine::state::dump_to_pp): New.
8559 (state_machine::state_machine): Move here from sm.h. Initialize
8560 m_next_state_id and m_start.
8561 (state_machine::add_state): Reimplement in terms of state objects.
8562 (state_machine::get_state_name): Delete.
8563 (state_machine::get_state_by_name): Reimplement in terms of state
8564 objects. Make const.
8565 (state_machine::validate): Delete.
8566 (state_machine::dump_to_pp): Reimplement in terms of state
8567 objects.
8568 * sm.h (state_machine::state): New class.
8569 (state_machine::state_t): Convert typedef from "unsigned" to
8570 "const state_machine::state *".
8571 (state_machine::state_machine): Move to sm.cc.
8572 (state_machine::get_default_state): Use m_start rather than
8573 hardcoding 0.
8574 (state_machine::get_state_name): Delete.
8575 (state_machine::get_state_by_name): Make const.
8576 (state_machine::get_start_state): New accessor.
8577 (state_machine::alloc_state_id): New.
8578 (state_machine::m_state_names): Drop in favor of...
8579 (state_machine::m_states): New field
8580 (state_machine::m_start): New field
8581 (start_start_p): Delete.
8583 2020-09-08 David Malcolm <dmalcolm@redhat.com>
8585 PR analyzer/96949
8586 * store.cc (binding_map::apply_ctor_val_to_range): Add
8587 error-handling for the cases where we have symbolic offsets.
8589 2020-09-08 David Malcolm <dmalcolm@redhat.com>
8591 PR analyzer/96950
8592 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
8593 where min_index == max_index.
8594 (binding_map::apply_ctor_val_to_range): Replace assertion that we
8595 don't have a CONSTRUCTOR value with error-handling.
8597 2020-09-08 David Malcolm <dmalcolm@redhat.com>
8599 PR analyzer/96962
8600 * region-model.cc (region_model::on_call_pre): Fix guard on switch
8601 on built-ins to only consider BUILT_IN_NORMAL, rather than other
8602 kinds of build-ins.
8604 2020-09-01 David Malcolm <dmalcolm@redhat.com>
8606 PR analyzer/96792
8607 * region-model.cc (region_model::deref_rvalue): Add the constraint
8608 that PTR_SVAL is non-NULL.
8610 2020-08-31 David Malcolm <dmalcolm@redhat.com>
8612 PR analyzer/96798
8613 * region-model.cc (region_model::on_call_pre): Handle
8614 BUILT_IN_MEMSET_CHK.
8616 2020-08-31 David Malcolm <dmalcolm@redhat.com>
8618 * region-model.cc (region_model::on_call_pre): Gather handling of
8619 builtins and of internal fns into switch statements. Handle
8620 "alloca" and BUILT_IN_ALLOCA_WITH_ALIGN.
8622 2020-08-31 David Malcolm <dmalcolm@redhat.com>
8624 PR analyzer/96860
8625 * region.cc (decl_region::get_svalue_for_constructor): Support
8626 apply_ctor_to_region failing.
8627 * store.cc (binding_map::apply_ctor_to_region): Add failure
8628 handling.
8629 (binding_map::apply_ctor_val_to_range): Likewise.
8630 (binding_map::apply_ctor_pair_to_child_region): Likewise. Replace
8631 assertion that child_base_offset is not symbolic with error
8632 handling.
8633 * store.h (binding_map::apply_ctor_to_region): Convert return type
8634 from void to bool.
8635 (binding_map::apply_ctor_val_to_range): Likewise.
8636 (binding_map::apply_ctor_pair_to_child_region): Likewise.
8638 2020-08-31 David Malcolm <dmalcolm@redhat.com>
8640 PR analyzer/96763
8641 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
8642 by calling a new binding_map::apply_ctor_val_to_range subroutine.
8643 Split out the existing non-CONSTRUCTOR-handling code to a new
8644 apply_ctor_pair_to_child_region subroutine.
8645 (binding_map::apply_ctor_val_to_range): New.
8646 (binding_map::apply_ctor_pair_to_child_region): New, split out
8647 from binding_map::apply_ctor_to_region as noted above.
8648 * store.h (binding_map::apply_ctor_val_to_range): New decl.
8649 (binding_map::apply_ctor_pair_to_child_region): New decl.
8651 2020-08-31 David Malcolm <dmalcolm@redhat.com>
8653 PR analyzer/96764
8654 * region-model-manager.cc
8655 (region_model_manager::maybe_fold_unaryop): Handle VIEW_CONVERT_EXPR.
8656 (region_model_manager::get_or_create_cast): Move logic for
8657 real->integer casting to...
8658 (get_code_for_cast): ...this new function, and add logic for
8659 real->non-integer casts.
8660 (region_model_manager::maybe_fold_sub_svalue): Handle
8661 VIEW_CONVERT_EXPR.
8662 * region-model.cc
8663 (region_model::add_any_constraints_from_gassign): Likewise.
8664 * svalue.cc (svalue::maybe_undo_cast): Likewise.
8665 (unaryop_svalue::dump_to_pp): Likewise.
8667 2020-08-26 David Malcolm <dmalcolm@redhat.com>
8669 PR analyzer/94858
8670 * region-model-manager.cc
8671 (region_model_manager::get_or_create_widening_svalue): Assert that
8672 neither of the inputs are themselves widenings.
8673 * store.cc (store::eval_alias_1): The initial value of a pointer
8674 can't point to a region that was allocated on the heap after the
8675 beginning of the path. A widened pointer value can't alias anything
8676 that the initial pointer value can't alias.
8677 * svalue.cc (svalue::can_merge_p): Merge BINOP (X, OP, CST) with X
8678 to a widening svalue. Merge
8679 BINOP(WIDENING(BASE, BINOP(BASE, X)), X) and BINOP(BASE, X) to
8680 to the LHS of the first BINOP.
8682 2020-08-26 David Malcolm <dmalcolm@redhat.com>
8684 PR analyzer/96777
8685 * region-model.h (class compound_svalue): Document that all keys
8686 must be concrete.
8687 (compound_svalue::compound_svalue): Move definition to svalue.cc.
8688 * store.cc (binding_map::apply_ctor_to_region): Handle
8689 initializers for trailing arrays with incomplete size.
8690 * svalue.cc (compound_svalue::compound_svalue): Move definition
8691 here from region-model.h. Add assertion that all keys are
8692 concrete.
8694 2020-08-22 David Malcolm <dmalcolm@redhat.com>
8696 PR analyzer/94851
8697 * region-model-manager.cc
8698 (region_model_manager::maybe_fold_binop): Fold bitwise "& 0" to 0.
8700 2020-08-22 David Malcolm <dmalcolm@redhat.com>
8702 * store.cc (store::eval_alias): Make const. Split out 2nd half
8703 into store::eval_alias_1 and call it twice for symmetry, avoiding
8704 test duplication.
8705 (store::eval_alias_1): New function, split out from the above.
8706 * store.h (store::eval_alias): Make const.
8707 (store::eval_alias_1): New decl.
8709 2020-08-22 David Malcolm <dmalcolm@redhat.com>
8711 * region-model.cc (region_model::push_frame): Bind the default
8712 SSA name for each parm if it exists, falling back to the parm
8713 itself otherwise, rather than doing both.
8715 2020-08-20 David Malcolm <dmalcolm@redhat.com>
8717 PR analyzer/96723
8718 * region-model-manager.cc
8719 (region_model_manager::get_field_region): Assert that field is a
8720 FIELD_DECL.
8721 * region.cc (region::get_subregions_for_binding): In
8722 union-handling, filter the TYPE_FIELDS traversal to just FIELD_DECLs.
8724 2020-08-20 David Malcolm <dmalcolm@redhat.com>
8726 PR analyzer/96713
8727 * region-model.cc (region_model::get_gassign_result): For
8728 comparisons, only use eval_condition when the lhs has boolean
8729 type, and use get_or_create_constant_svalue on the boolean
8730 constants directly rather than via get_rvalue.
8732 2020-08-19 David Malcolm <dmalcolm@redhat.com>
8734 PR analyzer/96643
8735 * region-model.cc (region_model::deref_rvalue): Rather than
8736 attempting to handle all svalue kinds in the switch, only cover
8737 the special cases, and move symbolic-region handling to after
8738 the switch, thus implicitly handling the missing case SK_COMPOUND.
8740 2020-08-19 David Malcolm <dmalcolm@redhat.com>
8742 PR analyzer/96705
8743 * region-model-manager.cc
8744 (region_model_manager::maybe_fold_binop): Check that we have an
8745 integral type before calling build_int_cst.
8747 2020-08-19 David Malcolm <dmalcolm@redhat.com>
8749 PR analyzer/96699
8750 * region-model-manager.cc
8751 (region_model_manager::get_or_create_cast): Use FIX_TRUNC_EXPR for
8752 casting from REAL_TYPE to INTEGER_TYPE.
8754 2020-08-19 David Malcolm <dmalcolm@redhat.com>
8756 PR analyzer/96651
8757 * region-model.cc (region_model::called_from_main_p): New.
8758 (region_model::get_store_value): Move handling for globals into...
8759 (region_model::get_initial_value_for_global): ...this new
8760 function, and add logic for extracting values from decl
8761 initializers.
8762 * region-model.h (decl_region::get_svalue_for_constructor): New
8763 decl.
8764 (decl_region::get_svalue_for_initializer): New decl.
8765 (region_model::called_from_main_p): New decl.
8766 (region_model::get_initial_value_for_global): New.
8767 * region.cc (decl_region::maybe_get_constant_value): Move logic
8768 for getting an svalue from a CONSTRUCTOR node to...
8769 (decl_region::get_svalue_for_constructor): ...this new function.
8770 (decl_region::get_svalue_for_initializer): New.
8771 * store.cc (get_svalue_for_ctor_val): Rewrite in terms of
8772 region_model::get_rvalue.
8773 * store.h (binding_cluster::get_map): New accessor.
8775 2020-08-19 David Malcolm <dmalcolm@redhat.com>
8777 PR analyzer/96648
8778 * region.cc (get_field_at_bit_offset): Gracefully handle negative
8779 values for bit_offset.
8781 2020-08-18 David Malcolm <dmalcolm@redhat.com>
8783 * region-model.cc (region_model::get_rvalue_1): Fix name of local.
8785 2020-08-18 David Malcolm <dmalcolm@redhat.com>
8787 PR analyzer/96641
8788 * region-model.cc (region_model::get_rvalue_1): Handle
8789 unrecognized tree codes by returning "UNKNOWN.
8791 2020-08-18 David Malcolm <dmalcolm@redhat.com>
8793 PR analyzer/96640
8794 * region-model.cc (region_model::get_gassign_result): Handle various
8795 VEC_* tree codes by returning UNKNOWN.
8796 (region_model::on_assignment): Handle unrecognized tree codes by
8797 setting lhs to an unknown value, rather than issuing a "sorry" and
8798 asserting.
8800 2020-08-17 David Malcolm <dmalcolm@redhat.com>
8802 PR analyzer/96644
8803 * region-model-manager.cc (get_region_for_unexpected_tree_code):
8804 Handle ctxt being NULL.
8806 2020-08-17 David Malcolm <dmalcolm@redhat.com>
8808 PR analyzer/96639
8809 * region.cc (region::get_subregions_for_binding): Check for "type"
8810 being NULL.
8812 2020-08-17 David Malcolm <dmalcolm@redhat.com>
8814 PR analyzer/96642
8815 * store.cc (get_svalue_for_ctor_val): New.
8816 (binding_map::apply_ctor_to_region): Call it.
8818 2020-08-14 David Malcolm <dmalcolm@redhat.com>
8820 PR testsuite/96609
8821 PR analyzer/96616
8822 * region-model.cc (region_model::get_store_value): Call
8823 maybe_get_constant_value on decl_regions first.
8824 * region-model.h (decl_region::maybe_get_constant_value): New decl.
8825 * region.cc (decl_region::get_stack_depth): Likewise.
8826 (decl_region::maybe_get_constant_value): New.
8827 * store.cc (get_subregion_within_ctor): New.
8828 (binding_map::apply_ctor_to_region): New.
8829 * store.h (binding_map::apply_ctor_to_region): New decl.
8831 2020-08-14 David Malcolm <dmalcolm@redhat.com>
8833 PR analyzer/96611
8834 * store.cc (store::mark_as_escaped): Reject attempts to
8835 get a cluster for an unknown pointer.
8837 2020-08-13 David Malcolm <dmalcolm@redhat.com>
8839 PR analyzer/93032
8840 PR analyzer/93938
8841 PR analyzer/94011
8842 PR analyzer/94099
8843 PR analyzer/94399
8844 PR analyzer/94458
8845 PR analyzer/94503
8846 PR analyzer/94640
8847 PR analyzer/94688
8848 PR analyzer/94689
8849 PR analyzer/94839
8850 PR analyzer/95026
8851 PR analyzer/95042
8852 PR analyzer/95240
8853 * analyzer-logging.cc: Ignore "-Wformat-diag".
8854 (logger::enter_scope): Use inc_indent in both overloads.
8855 (logger::exit_scope): Use dec_indent.
8856 * analyzer-logging.h (logger::inc_indent): New.
8857 (logger::dec_indent): New.
8858 * analyzer-selftests.cc (run_analyzer_selftests): Call
8859 analyzer_store_cc_tests.
8860 * analyzer-selftests.h (analyzer_store_cc_tests): New decl.
8861 * analyzer.cc (get_stmt_location): New function.
8862 * analyzer.h (class initial_svalue): New forward decl.
8863 (class unaryop_svalue): New forward decl.
8864 (class binop_svalue): New forward decl.
8865 (class sub_svalue): New forward decl.
8866 (class unmergeable_svalue): New forward decl.
8867 (class placeholder_svalue): New forward decl.
8868 (class widening_svalue): New forward decl.
8869 (class compound_svalue): New forward decl.
8870 (class conjured_svalue): New forward decl.
8871 (svalue_set): New typedef.
8872 (class map_region): Delete.
8873 (class array_region): Delete.
8874 (class frame_region): New forward decl.
8875 (class function_region): New forward decl.
8876 (class label_region): New forward decl.
8877 (class decl_region): New forward decl.
8878 (class element_region): New forward decl.
8879 (class offset_region): New forward decl.
8880 (class cast_region): New forward decl.
8881 (class field_region): New forward decl.
8882 (class string_region): New forward decl.
8883 (class region_model_manager): New forward decl.
8884 (class store_manager): New forward decl.
8885 (class store): New forward decl.
8886 (class call_details): New forward decl.
8887 (struct svalue_id_merger_mapping): Delete.
8888 (struct canonicalization): Delete.
8889 (class function_point): New forward decl.
8890 (class engine): New forward decl.
8891 (dump_tree): New function decl.
8892 (print_quoted_type): New function decl.
8893 (readability_comparator): New function decl.
8894 (tree_cmp): New function decl.
8895 (class path_var): Move here from region-model.h
8896 (bit_offset_t, bit_size_t, byte_size_t): New typedefs.
8897 (class region_offset): New class.
8898 (get_stmt_location): New decl.
8899 (struct member_function_hash_traits): New struct.
8900 (class consolidation_map): New class.
8901 Ignore "-Wformat-diag".
8902 * analyzer.opt (-param=analyzer-max-svalue-depth=): New param.
8903 (-param=analyzer-max-enodes-for-full-dump=): New param.
8904 * call-string.cc: Ignore -Wformat-diag.
8905 * checker-path.cc: Move includes of "analyzer/call-string.h" and
8906 "analyzer/program-point.h" to before "analyzer/region-model.h",
8907 and also include "analyzer/store.h" before it.
8908 (state_change_event::state_change_event): Replace "tree var" param
8909 with "const svalue *sval". Convert "origin" param from tree to
8910 "const svalue *".
8911 (state_change_event::get_desc): Call get_representative_tree to
8912 convert the var and origin from const svalue * to tree. Use
8913 svalue::get_desc rather than %qE when describing state changes.
8914 (checker_path::add_final_event): Use get_stmt_location.
8915 * checker-path.h (state_change_event::state_change_event): Port
8916 from tree to const svalue *.
8917 (state_change_event::get_lvalue): Delete.
8918 (state_change_event::get_dest_function): New.
8919 (state_change_event::m_var): Replace with...
8920 (state_change_event::m_sval): ...this.
8921 (state_change_event::m_origin): Convert from tree to
8922 const svalue *.
8923 * constraint-manager.cc: Include "analyzer/call-string.h",
8924 "analyzer/program-point.h", and "analyzer/store.h" before
8925 "analyzer/region-model.h".
8926 (struct bound, struct range): Move to constraint-manager.h.
8927 (compare_constants): New function.
8928 (range::dump): Rename to...
8929 (range::dump_to_pp): ...this. Support NULL constants.
8930 (range::dump): Reintroduce for dumping to stderr.
8931 (range::constrained_to_single_element): Return result, rather than
8932 writing to *OUT.
8933 (range::eval_condition): New.
8934 (range::below_lower_bound): New.
8935 (range::above_upper_bound): New.
8936 (equiv_class::equiv_class): Port from svalue_id to const svalue *.
8937 (equiv_class::print): Likewise.
8938 (equiv_class::hash): Likewise.
8939 (equiv_class::operator==): Port from svalue_id to const svalue *.
8940 (equiv_class::add): Port from svalue_id to const svalue *. Drop
8941 "cm" param.
8942 (equiv_class::del): Port from svalue_id to const svalue *.
8943 (equiv_class::get_representative): Likewise.
8944 (equiv_class::remap_svalue_ids): Delete.
8945 (svalue_id_cmp_by_id): Rename to...
8946 (svalue_cmp_by_ptr): ...this, porting from svalue_id to
8947 const svalue *.
8948 (equiv_class::canonicalize): Update qsort comparator.
8949 (constraint::implied_by): New.
8950 (constraint_manager::constraint_manager): Copy m_mgr in copy ctor.
8951 (constraint_manager::dump_to_pp): Add "multiline" param
8952 (constraint_manager::dump): Pass "true" for "multiline".
8953 (constraint_manager::add_constraint): Port from svalue_id to
8954 const svalue *. Split out second part into...
8955 (constraint_manager::add_unknown_constraint): ...this new
8956 function. Remove self-constraints when merging equivalence
8957 classes.
8958 (constraint_manager::add_constraint_internal): Remove constraints
8959 that would be implied by the new constraint. Port from svalue_id
8960 to const svalue *.
8961 (constraint_manager::get_equiv_class_by_sid): Rename to...
8962 (constraint_manager::get_equiv_class_by_svalue): ...this, porting
8963 from svalue_id to const svalue *.
8964 (constraint_manager::get_or_add_equiv_class): Port from svalue_id
8965 to const svalue *.
8966 (constraint_manager::eval_condition): Make const. Call
8967 compare_constants and return early if it provides a known result.
8968 (constraint_manager::get_ec_bounds): New.
8969 (constraint_manager::eval_condition): New overloads. Make
8970 existing one const, and use compare_constants.
8971 (constraint_manager::purge): Convert "p" param to a template
8972 rather that an abstract base class. Port from svalue_id to
8973 const svalue *.
8974 (class dead_svalue_purger): New class.
8975 (constraint_manager::remap_svalue_ids): Delete.
8976 (constraint_manager::on_liveness_change): New.
8977 (equiv_class_cmp): Port from svalue_id to const svalue *.
8978 (constraint_manager::canonicalize): Likewise. Combine with
8979 purging of redundant equivalence classes and constraints.
8980 (class cleaned_constraint_manager): Delete.
8981 (class merger_fact_visitor): Make "m_cm_b" const. Add "m_merger"
8982 field.
8983 (merger_fact_visitor::fact): Port from svalue_id to const svalue *.
8984 Add special case for widening.
8985 (constraint_manager::merge): Port from svalue_id to const svalue *.
8986 (constraint_manager::clean_merger_input): Delete.
8987 (constraint_manager::for_each_fact): Port from svalue_id to
8988 const svalue *.
8989 (constraint_manager::validate): Likewise.
8990 (selftest::test_constraint_conditions): Provide a
8991 region_model_manager when creating region_model instances.
8992 Add test for self-equality not creating equivalence classes.
8993 (selftest::test_transitivity): Provide a region_model_manager when
8994 creating region_model instances. Verify that EC-merging happens
8995 when constraints are implied.
8996 (selftest::test_constant_comparisons): Provide a
8997 region_model_manager when creating region_model instances.
8998 (selftest::test_constraint_impl): Likewise. Remove over-specified
8999 assertions.
9000 (selftest::test_equality): Provide a region_model_manager when
9001 creating region_model instances.
9002 (selftest::test_many_constants): Likewise. Provide a
9003 program_point when testing merging.
9004 (selftest::run_constraint_manager_tests): Move call to
9005 test_constant_comparisons to outside the transitivity guard.
9006 * constraint-manager.h (struct bound): Move here from
9007 constraint-manager.cc.
9008 (struct range): Likewise.
9009 (struct::eval_condition): New decl.
9010 (struct::below_lower_bound): New decl.
9011 (struct::above_upper_bound): New decl.
9012 (equiv_class::add): Port from svalue_id to const svalue *.
9013 (equiv_class::del): Likewise.
9014 (equiv_class::get_representative): Likewise.
9015 (equiv_class::remap_svalue_ids): Drop.
9016 (equiv_class::m_cst_sid): Convert to..
9017 (equiv_class::m_cst_sval): ...this.
9018 (equiv_class::m_vars): Port from svalue_id to const svalue *.
9019 (constraint::bool implied_by): New decl.
9020 (fact_visitor::on_fact): Port from svalue_id to const svalue *.
9021 (constraint_manager::constraint_manager): Add mgr param.
9022 (constraint_manager::clone): Delete.
9023 (constraint_manager::maybe_get_constant): Delete.
9024 (constraint_manager::get_sid_for_constant): Delete.
9025 (constraint_manager::get_num_svalues): Delete.
9026 (constraint_manager::dump_to_pp): Add "multiline" param.
9027 (constraint_manager::get_equiv_class): Port from svalue_id to
9028 const svalue *.
9029 (constraint_manager::add_constraint): Likewise.
9030 (constraint_manager::get_equiv_class_by_sid): Rename to...
9031 (constraint_manager::get_equiv_class_by_svalue): ...this, porting
9032 from svalue_id to const svalue *.
9033 (constraint_manager::add_unknown_constraint): New decl.
9034 (constraint_manager::get_or_add_equiv_class): Port from svalue_id
9035 to const svalue *.
9036 (constraint_manager::eval_condition): Likewise. Add overloads.
9037 (constraint_manager::get_ec_bounds): New decl.
9038 (constraint_manager::purge): Convert to template.
9039 (constraint_manager::remap_svalue_ids): Delete.
9040 (constraint_manager::on_liveness_change): New decl.
9041 (constraint_manager::canonicalize): Drop param.
9042 (constraint_manager::clean_merger_input): Delete.
9043 (constraint_manager::m_mgr): New field.
9044 * diagnostic-manager.cc: Move includes of
9045 "analyzer/call-string.h" and "analyzer/program-point.h" to before
9046 "analyzer/region-model.h", and also include "analyzer/store.h"
9047 before it.
9048 (saved_diagnostic::saved_diagnostic): Add "sval" param.
9049 (diagnostic_manager::diagnostic_manager): Add engine param.
9050 (diagnostic_manager::add_diagnostic): Add "sval" param, passing it
9051 to saved_diagnostic ctor. Update overload to pass NULL for it.
9052 (dedupe_winners::dedupe_winners): Add engine param.
9053 (dedupe_winners::add): Add "eg" param. Pass m_engine to
9054 feasible_p.
9055 (dedupe_winner::m_engine): New field.
9056 (diagnostic_manager::emit_saved_diagnostics): Pass engine to
9057 dedupe_winners. Pass &eg when adding candidates. Pass svalue
9058 rather than tree to prune_path. Use get_stmt_location to get
9059 primary location of diagnostic.
9060 (diagnostic_manager::emit_saved_diagnostic): Likewise.
9061 (get_any_origin): Drop.
9062 (state_change_event_creator::on_global_state_change): Pass NULL
9063 const svalue * rather than NULL_TREE trees to state_change_event
9064 ctor.
9065 (state_change_event_creator::on_state_change): Port from tree and
9066 svalue_id to const svalue *.
9067 (for_each_state_change): Port from svalue_id to const svalue *.
9068 (struct null_assignment_sm_context): New.
9069 (diagnostic_manager::add_events_for_eedge): Add state change
9070 events for assignment to NULL.
9071 (diagnostic_manager::prune_path): Update param from tree to
9072 const svalue *.
9073 (diagnostic_manager::prune_for_sm_diagnostic): Port from tracking
9074 by tree to by const svalue *.
9075 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add sval
9076 param.
9077 (saved_diagnostic::m_sval): New field.
9078 (diagnostic_manager::diagnostic_manager): Add engine param.
9079 (diagnostic_manager::get_engine): New.
9080 (diagnostic_manager::add_diagnostic): Add "sval" param.
9081 (diagnostic_manager::prune_path): Likewise.
9082 (diagnostic_manager::prune_for_sm_diagnostic): New overload.
9083 (diagnostic_manager::m_eng): New field.
9084 * engine.cc: Move includes of "analyzer/call-string.h" and
9085 "analyzer/program-point.h" to before "analyzer/region-model.h",
9086 and also include "analyzer/store.h" before it.
9087 (impl_region_model_context::impl_region_model_context): Update for
9088 removal of m_change field.
9089 (impl_region_model_context::remap_svalue_ids): Delete.
9090 (impl_region_model_context::on_svalue_leak): New.
9091 (impl_region_model_context::on_svalue_purge): Delete.
9092 (impl_region_model_context::on_liveness_change): New.
9093 (impl_region_model_context::on_unknown_change): Update param
9094 from svalue_id to const svalue *. Add is_mutable param.
9095 (setjmp_svalue::compare_fields): Delete.
9096 (setjmp_svalue::accept): New.
9097 (setjmp_svalue::add_to_hash): Delete.
9098 (setjmp_svalue::dump_to_pp): New.
9099 (setjmp_svalue::print_details): Delete.
9100 (impl_sm_context::impl_sm_context): Drop "change" param.
9101 (impl_sm_context::get_fndecl_for_call): Drop "m_change".
9102 (impl_sm_context::on_transition): Drop ATTRIBUTE_UNUSED from
9103 "stmt" param. Drop m_change. Port from svalue_id to
9104 const svalue *.
9105 (impl_sm_context::warn_for_state): Drop m_change. Port from
9106 svalue_id to const svalue *.
9107 (impl_sm_context::get_readable_tree): Rename to...
9108 (impl_sm_context::get_diagnostic_tree): ...this. Port from
9109 svalue_id to const svalue *.
9110 (impl_sm_context::is_zero_assignment): New.
9111 (impl_sm_context::m_change): Delete field.
9112 (leak_stmt_finder::find_stmt): Handle m_var being NULL.
9113 (readability): Increase penalty for MEM_REF. For SSA_NAMEs,
9114 slightly favor the underlying var over the SSA name. Heavily
9115 penalize temporaries. Handle RESULT_DECL.
9116 (readability_comparator): Make non-static. Consider stack depths.
9117 (impl_region_model_context::on_state_leak): Convert from svalue_id
9118 to const svalue *, updating for region_model changes. Use
9119 id_equal.
9120 (impl_region_model_context::on_inherited_svalue): Delete.
9121 (impl_region_model_context::on_cast): Delete.
9122 (impl_region_model_context::on_condition): Drop m_change.
9123 (impl_region_model_context::on_phi): Likewise.
9124 (impl_region_model_context::on_unexpected_tree_code): Handle t
9125 being NULL.
9126 (point_and_state::validate): Update stack checking for
9127 region_model changes.
9128 (eg_traits::dump_args_t::show_enode_details_p): New.
9129 (exploded_node::exploded_node): Initialize m_num_processed_stmts.
9130 (exploded_node::get_processed_stmt): New function.
9131 (exploded_node::get_dot_fillcolor): Add more colors.
9132 (exploded_node::dump_dot): Guard the printing of the point and
9133 state with show_enode_details_p. Print the processed stmts for
9134 this enode after the initial state.
9135 (exploded_node::dump_to_pp): Pass true for new multiline param
9136 of program_state::dump_to_pp.
9137 (exploded_node::on_stmt): Drop "change" param. Log the stmt.
9138 Set input_location. Implement __analyzer_describe. Update
9139 implementation of __analyzer_dump and __analyzer_eval.
9140 Remove purging of sm-state for unknown fncalls from here.
9141 (exploded_node::on_edge): Drop "change" param.
9142 (exploded_node::on_longjmp): Port from region_id/svalue_id to
9143 const region */const svalue *. Call program_state::detect_leaks.
9144 Drop state_change.
9145 (exploded_node::detect_leaks): Update for changes to region_model.
9146 Call program_state::detect_leaks.
9147 (exploded_edge::exploded_edge): Drop ext_state and change params.
9148 (exploded_edge::dump_dot): "args" is no longer used. Drop dumping
9149 of m_change.
9150 (exploded_graph::exploded_graph): Pass engine to
9151 m_diagnostic_manager ctor. Use program_point::origin.
9152 (exploded_graph::add_function_entry): Drop ctxt. Use
9153 program_state::push_frame. Drop state_change.
9154 (exploded_graph::get_or_create_node): Drop "change" param. Add
9155 "enode_for_diag" param. Update dumping calls for API changes.
9156 Pass point to can_merge_with_p. Show enode indices
9157 within -Wanalyzer-too-complex diagnostic for hitting the per-point
9158 limit.
9159 (exploded_graph::add_edge): Drop "change" param. Log which nodes
9160 are being connected. Update for changes to exploded_edge ctor.
9161 (exploded_graph::get_per_program_point_data): New.
9162 (exploded_graph::process_worklist): Pass point to
9163 can_merge_with_p. Drop state_change. Update dumping call for API
9164 change.
9165 (exploded_graph::process_node): Drop state_change. Split the
9166 node in-place if an sm-state-change occurs. Update
9167 m_num_processed_stmts. Update dumping calls for API change.
9168 (exploded_graph::log_stats): Call engine::log_stats.
9169 (exploded_graph::dump_states_for_supernode): Update dumping
9170 call.
9171 (exploded_path::feasible_p): Add "eng" and "eg" params.
9172 Rename "i" to "end_idx". Pass the manager to the region_model
9173 ctor. Update for every processed stmt in the enode, not just the
9174 first. Keep track of which snodes have been visited, and call
9175 loop_replay_fixup when revisiting one.
9176 (enode_label::get_text): Update dump call for new param.
9177 (exploded_graph::dump_exploded_nodes): Likewise.
9178 (exploded_graph::get_node_by_index): New.
9179 (impl_run_checkers): Create engine instance and pass its address
9180 to extrinsic_state ctor.
9181 * exploded-graph.h
9182 (impl_region_model_context::impl_region_model_context): Drop
9183 "change" params.
9184 (impl_region_model_context::void remap_svalue_ids): Delete.
9185 (impl_region_model_context::on_svalue_purge): Delete.
9186 (impl_region_model_context::on_svalue_leak): New.
9187 (impl_region_model_context::on_liveness_change): New.
9188 (impl_region_model_context::on_state_leak): Update signature.
9189 (impl_region_model_context::on_inherited_svalue): Delete.
9190 (impl_region_model_context::on_cast): Delete.
9191 (impl_region_model_context::on_unknown_change): Update signature.
9192 (impl_region_model_context::m_change): Delete.
9193 (eg_traits::dump_args_t::show_enode_details_p): New.
9194 (exploded_node::on_stmt): Drop "change" param.
9195 (exploded_node::on_edge): Likewise.
9196 (exploded_node::get_processed_stmt): New decl.
9197 (exploded_node::m_num_processed_stmts): New field.
9198 (exploded_edge::exploded_edge): Drop ext_state and change params.
9199 (exploded_edge::m_change): Delete.
9200 (exploded_graph::get_engine): New accessor.
9201 (exploded_graph::get_or_create_node): Drop "change" param. Add
9202 "enode_for_diag" param.
9203 (exploded_graph::add_edge): Drop "change" param.
9204 (exploded_graph::get_per_program_point_data): New decl.
9205 (exploded_graph::get_node_by_index): New decl.
9206 (exploded_path::feasible_p): Add "eng" and "eg" params.
9207 * program-point.cc: Include "analyzer/store.h" before including
9208 "analyzer/region-model.h".
9209 (function_point::function_point): Move here from
9210 program-point.h.
9211 (function_point::get_function): Likewise.
9212 (function_point::from_function_entry): Likewise.
9213 (function_point::before_supernode): Likewise.
9214 (function_point::next_stmt): New function.
9215 * program-point.h (function_point::function_point): Move
9216 implementation from here to program-point.cc.
9217 (function_point::get_function): Likewise.
9218 (function_point::from_function_entry): Likewise.
9219 (function_point::before_supernode): Likewise.
9220 (function_point::next_stmt): New decl.
9221 (program_point::operator!=): New.
9222 (program_point::origin): New.
9223 (program_point::next_stmt): New.
9224 (program_point::m_function_point): Make non-const.
9225 * program-state.cc: Move includes of "analyzer/call-string.h" and
9226 "analyzer/program-point.h" to before "analyzer/region-model.h",
9227 and also include "analyzer/store.h" before it.
9228 (extrinsic_state::get_model_manager): New.
9229 (sm_state_map::sm_state_map): Pass in sm and sm_idx to ctor,
9230 rather than pass the around.
9231 (sm_state_map::clone_with_remapping): Delete.
9232 (sm_state_map::print): Remove "sm" param in favor of "m_sm". Add
9233 "simple" and "multiline" params and support multiline vs single
9234 line dumping.
9235 (sm_state_map::dump): Remove "sm" param in favor of "m_sm". Add
9236 "simple" param.
9237 (sm_state_map::hash): Port from svalue_id to const svalue *.
9238 (sm_state_map::operator==): Likewise.
9239 (sm_state_map::get_state): Likewise. Call canonicalize_svalue on
9240 input. Handle inheritance of sm-state. Call get_default_state.
9241 (sm_state_map::get_origin): Port from svalue_id to const svalue *.
9242 (sm_state_map::set_state): Likewise. Pass in ext_state. Reject
9243 attempts to set state on UNKNOWN.
9244 (sm_state_map::impl_set_state): Port from svalue_id to
9245 const svalue *. Pass in ext_state. Call canonicalize_svalue on
9246 input.
9247 (sm_state_map::purge_for_unknown_fncall): Delete.
9248 (sm_state_map::on_svalue_leak): New.
9249 (sm_state_map::remap_svalue_ids): Delete.
9250 (sm_state_map::on_liveness_change): New.
9251 (sm_state_map::on_unknown_change): Reimplement.
9252 (sm_state_map::on_svalue_purge): Delete.
9253 (sm_state_map::on_inherited_svalue): Delete.
9254 (sm_state_map::on_cast): Delete.
9255 (sm_state_map::validate): Delete.
9256 (sm_state_map::canonicalize_svalue): New.
9257 (program_state::program_state): Update to pass manager to
9258 region_model's ctor. Constify num_states and pass state machine
9259 and index to sm_state_map ctor.
9260 (program_state::print): Update for changes to dump API.
9261 (program_state::dump_to_pp): Ignore the summarize param. Add
9262 "multiline" param.
9263 (program_state::dump_to_file): Add "multiline" param.
9264 (program_state::dump): Pass "true" for new "multiline" param.
9265 (program_state::push_frame): New.
9266 (program_state::on_edge): Drop "change" param. Call
9267 program_state::detect_leaks.
9268 (program_state::prune_for_point): Add enode_for_diag param.
9269 Reimplement based on store class. Call detect_leaks
9270 (program_state::remap_svalue_ids): Delete.
9271 (program_state::get_representative_tree): Port from svalue_id to
9272 const svalue *.
9273 (program_state::can_merge_with_p): Add "point" param. Add early
9274 reject for sm-differences. Drop id remapping.
9275 (program_state::validate): Drop region model and sm_state_map
9276 validation.
9277 (state_change::sm_change::dump): Delete.
9278 (state_change::sm_change::remap_svalue_ids): Delete.
9279 (state_change::sm_change::on_svalue_purge): Delete.
9280 (log_set_of_svalues): New.
9281 (state_change::sm_change::validate): Delete.
9282 (state_change::state_change): Delete.
9283 (state_change::add_sm_change): Delete.
9284 (state_change::affects_p): Delete.
9285 (state_change::dump): Delete.
9286 (state_change::remap_svalue_ids): Delete.
9287 (state_change::on_svalue_purge): Delete.
9288 (state_change::validate): Delete.
9289 (selftest::assert_dump_eq): Delete.
9290 (ASSERT_DUMP_EQ): Delete.
9291 (selftest::test_sm_state_map): Update for changes to region_model
9292 and sm_state_map, porting from svalue_id to const svalue *.
9293 (selftest::test_program_state_dumping): Likewise. Drop test of
9294 dumping, renaming to...
9295 (selftest::test_program_state_1): ...this.
9296 (selftest::test_program_state_dumping_2): Likewise, renaming to...
9297 (selftest::test_program_state_2): ...this.
9298 (selftest::test_program_state_merging): Update for changes to
9299 region_model.
9300 (selftest::test_program_state_merging_2): Likewise.
9301 (selftest::analyzer_program_state_cc_tests): Update for renamed
9302 tests.
9303 * program-state.h (extrinsic_state::extrinsic_state): Add logger
9304 and engine params.
9305 (extrinsic_state::get_logger): New accessor.
9306 (extrinsic_state::get_engine): New accessor.
9307 (extrinsic_state::get_model_manager): New accessor.
9308 (extrinsic_state::m_logger): New field.
9309 (extrinsic_state::m_engine): New field.
9310 (struct default_hash_traits<svalue_id>): Delete.
9311 (pod_hash_traits<svalue_id>::hash): Delete.
9312 (pod_hash_traits<svalue_id>::equal): Delete.
9313 (pod_hash_traits<svalue_id>::mark_deleted): Delete.
9314 (pod_hash_traits<svalue_id>::mark_empty): Delete.
9315 (pod_hash_traits<svalue_id>::is_deleted): Delete.
9316 (pod_hash_traits<svalue_id>::is_empty): Delete.
9317 (sm_state_map::entry_t::entry_t): Port from svalue_id to
9318 const svalue *.
9319 (sm_state_map::entry_t::m_origin): Likewise.
9320 (sm_state_map::map_t): Likewise.
9321 (sm_state_map::sm_state_map): Add state_machine and index params.
9322 (sm_state_map::clone_with_remapping): Delete.
9323 (sm_state_map::print): Drop sm param; add simple and multiline
9324 params.
9325 (sm_state_map::dump): Drop sm param; add simple param.
9326 (sm_state_map::get_state): Port from svalue_id to const svalue *.
9327 Add ext_state param.
9328 (sm_state_map::get_origin): Likewise.
9329 (sm_state_map::set_state): Likewise.
9330 (sm_state_map::impl_set_state): Likewise.
9331 (sm_state_map::purge_for_unknown_fncall): Delete.
9332 (sm_state_map::remap_svalue_ids): Delete.
9333 (sm_state_map::on_svalue_purge): Delete.
9334 (sm_state_map::on_svalue_leak): New.
9335 (sm_state_map::on_liveness_change): New.
9336 (sm_state_map::on_inherited_svalue): Delete.
9337 (sm_state_map::on_cast): Delete.
9338 (sm_state_map::validate): Delete.
9339 (sm_state_map::on_unknown_change): Port from svalue_id to
9340 const svalue *. Add is_mutable and ext_state params.
9341 (sm_state_map::canonicalize_svalue): New.
9342 (sm_state_map::m_sm): New field.
9343 (sm_state_map::m_sm_idx): New field.
9344 (program_state::operator=): Delete.
9345 (program_state::dump_to_pp): Drop "summarize" param, adding
9346 "simple" and "multiline".
9347 (program_state::dump_to_file): Likewise.
9348 (program_state::dump): Rename "summarize" to "simple".
9349 (program_state::push_frame): New.
9350 (program_state::get_current_function): New.
9351 (program_state::on_edge): Drop "change" param.
9352 (program_state::prune_for_point): Likewise. Add enode_for_diag
9353 param.
9354 (program_state::remap_svalue_ids): Delete.
9355 (program_state::get_representative_tree): Port from svalue_id to
9356 const svalue *.
9357 (program_state::can_purge_p): Likewise. Pass ext_state to get_state.
9358 (program_state::can_merge_with_p): Add point param.
9359 (program_state::detect_leaks): New.
9360 (state_change_visitor::on_state_change): Port from tree and
9361 svalue_id to a pair of const svalue *.
9362 (class state_change): Delete.
9363 * region.cc: New file.
9364 * region-model-impl-calls.cc: New file.
9365 * region-model-manager.cc: New file.
9366 * region-model-reachability.cc: New file.
9367 * region-model-reachability.h: New file.
9368 * region-model.cc: Include "analyzer/call-string.h",
9369 "analyzer/program-point.h", and "analyzer/store.h" before
9370 "analyzer/region-model.h". Include
9371 "analyzer/region-model-reachability.h".
9372 (dump_tree): Make non-static.
9373 (dump_quoted_tree): Make non-static.
9374 (print_quoted_type): Make non-static.
9375 (path_var::dump): Delete.
9376 (dump_separator): Delete.
9377 (class impl_constraint_manager): Delete.
9378 (svalue_id::print): Delete.
9379 (svalue_id::dump_node_name_to_pp): Delete.
9380 (svalue_id::validate): Delete.
9381 (region_id::print): Delete.
9382 (region_id::dump_node_name_to_pp): Delete.
9383 (region_id::validate): Delete.
9384 (region_id_set::region_id_set): Delete.
9385 (svalue_id_set::svalue_id_set): Delete.
9386 (svalue::operator==): Delete.
9387 (svalue::hash): Delete.
9388 (svalue::print): Delete.
9389 (svalue::dump_dot_to_pp): Delete.
9390 (svalue::remap_region_ids): Delete.
9391 (svalue::walk_for_canonicalization): Delete.
9392 (svalue::get_child_sid): Delete.
9393 (svalue::maybe_get_constant): Delete.
9394 (region_svalue::compare_fields): Delete.
9395 (region_svalue::add_to_hash): Delete.
9396 (region_svalue::print_details): Delete.
9397 (region_svalue::dump_dot_to_pp): Delete.
9398 (region_svalue::remap_region_ids): Delete.
9399 (region_svalue::merge_values): Delete.
9400 (region_svalue::walk_for_canonicalization): Delete.
9401 (region_svalue::eval_condition): Delete.
9402 (constant_svalue::compare_fields): Delete.
9403 (constant_svalue::add_to_hash): Delete.
9404 (constant_svalue::merge_values): Delete.
9405 (constant_svalue::eval_condition): Move to svalue.cc.
9406 (constant_svalue::print_details): Delete.
9407 (constant_svalue::get_child_sid): Delete.
9408 (unknown_svalue::compare_fields): Delete.
9409 (unknown_svalue::add_to_hash): Delete.
9410 (unknown_svalue::print_details): Delete.
9411 (poison_kind_to_str): Move to svalue.cc.
9412 (poisoned_svalue::compare_fields): Delete.
9413 (poisoned_svalue::add_to_hash): Delete.
9414 (poisoned_svalue::print_details): Delete.
9415 (region_kind_to_str): Move to region.cc and reimplement.
9416 (region::operator==): Delete.
9417 (region::get_parent_region): Delete.
9418 (region::set_value): Delete.
9419 (region::become_active_view): Delete.
9420 (region::deactivate_any_active_view): Delete.
9421 (region::deactivate_view): Delete.
9422 (region::get_value): Delete.
9423 (region::get_inherited_child_sid): Delete.
9424 (region_model::copy_region): Delete.
9425 (region_model::copy_struct_region): Delete.
9426 (region_model::copy_union_region): Delete.
9427 (region_model::copy_array_region): Delete.
9428 (region::hash): Delete.
9429 (region::print): Delete.
9430 (region::dump_dot_to_pp): Delete.
9431 (region::dump_to_pp): Delete.
9432 (region::dump_child_label): Delete.
9433 (region::validate): Delete.
9434 (region::remap_svalue_ids): Delete.
9435 (region::remap_region_ids): Delete.
9436 (region::add_view): Delete.
9437 (region::get_view): Delete.
9438 (region::region): Move to region.cc.
9439 (region::add_to_hash): Delete.
9440 (region::print_fields): Delete.
9441 (region::non_null_p): Delete.
9442 (primitive_region::clone): Delete.
9443 (primitive_region::walk_for_canonicalization): Delete.
9444 (map_region::map_region): Delete.
9445 (map_region::compare_fields): Delete.
9446 (map_region::print_fields): Delete.
9447 (map_region::validate): Delete.
9448 (map_region::dump_dot_to_pp): Delete.
9449 (map_region::dump_child_label): Delete.
9450 (map_region::get_or_create): Delete.
9451 (map_region::get): Delete.
9452 (map_region::add_to_hash): Delete.
9453 (map_region::remap_region_ids): Delete.
9454 (map_region::unbind): Delete.
9455 (map_region::get_tree_for_child_region): Delete.
9456 (map_region::get_tree_for_child_region): Delete.
9457 (tree_cmp): Move to region.cc.
9458 (map_region::can_merge_p): Delete.
9459 (map_region::walk_for_canonicalization): Delete.
9460 (map_region::get_value_by_name): Delete.
9461 (struct_or_union_region::valid_key_p): Delete.
9462 (struct_or_union_region::compare_fields): Delete.
9463 (struct_region::clone): Delete.
9464 (struct_region::compare_fields): Delete.
9465 (union_region::clone): Delete.
9466 (union_region::compare_fields): Delete.
9467 (frame_region::compare_fields): Delete.
9468 (frame_region::clone): Delete.
9469 (frame_region::valid_key_p): Delete.
9470 (frame_region::print_fields): Delete.
9471 (frame_region::add_to_hash): Delete.
9472 (globals_region::compare_fields): Delete.
9473 (globals_region::clone): Delete.
9474 (globals_region::valid_key_p): Delete.
9475 (code_region::compare_fields): Delete.
9476 (code_region::clone): Delete.
9477 (code_region::valid_key_p): Delete.
9478 (array_region::array_region): Delete.
9479 (array_region::get_element): Delete.
9480 (array_region::clone): Delete.
9481 (array_region::compare_fields): Delete.
9482 (array_region::print_fields): Delete.
9483 (array_region::validate): Delete.
9484 (array_region::dump_dot_to_pp): Delete.
9485 (array_region::dump_child_label): Delete.
9486 (array_region::get_or_create): Delete.
9487 (array_region::get): Delete.
9488 (array_region::add_to_hash): Delete.
9489 (array_region::remap_region_ids): Delete.
9490 (array_region::get_key_for_child_region): Delete.
9491 (array_region::key_cmp): Delete.
9492 (array_region::walk_for_canonicalization): Delete.
9493 (array_region::key_from_constant): Delete.
9494 (array_region::constant_from_key): Delete.
9495 (function_region::compare_fields): Delete.
9496 (function_region::clone): Delete.
9497 (function_region::valid_key_p): Delete.
9498 (stack_region::stack_region): Delete.
9499 (stack_region::compare_fields): Delete.
9500 (stack_region::clone): Delete.
9501 (stack_region::print_fields): Delete.
9502 (stack_region::dump_child_label): Delete.
9503 (stack_region::validate): Delete.
9504 (stack_region::push_frame): Delete.
9505 (stack_region::get_current_frame_id): Delete.
9506 (stack_region::pop_frame): Delete.
9507 (stack_region::add_to_hash): Delete.
9508 (stack_region::remap_region_ids): Delete.
9509 (stack_region::can_merge_p): Delete.
9510 (stack_region::walk_for_canonicalization): Delete.
9511 (stack_region::get_value_by_name): Delete.
9512 (heap_region::heap_region): Delete.
9513 (heap_region::compare_fields): Delete.
9514 (heap_region::clone): Delete.
9515 (heap_region::walk_for_canonicalization): Delete.
9516 (root_region::root_region): Delete.
9517 (root_region::compare_fields): Delete.
9518 (root_region::clone): Delete.
9519 (root_region::print_fields): Delete.
9520 (root_region::validate): Delete.
9521 (root_region::dump_child_label): Delete.
9522 (root_region::push_frame): Delete.
9523 (root_region::get_current_frame_id): Delete.
9524 (root_region::pop_frame): Delete.
9525 (root_region::ensure_stack_region): Delete.
9526 (root_region::get_stack_region): Delete.
9527 (root_region::ensure_globals_region): Delete.
9528 (root_region::get_code_region): Delete.
9529 (root_region::ensure_code_region): Delete.
9530 (root_region::get_globals_region): Delete.
9531 (root_region::ensure_heap_region): Delete.
9532 (root_region::get_heap_region): Delete.
9533 (root_region::remap_region_ids): Delete.
9534 (root_region::can_merge_p): Delete.
9535 (root_region::add_to_hash): Delete.
9536 (root_region::walk_for_canonicalization): Delete.
9537 (root_region::get_value_by_name): Delete.
9538 (symbolic_region::symbolic_region): Delete.
9539 (symbolic_region::compare_fields): Delete.
9540 (symbolic_region::clone): Delete.
9541 (symbolic_region::walk_for_canonicalization): Delete.
9542 (symbolic_region::print_fields): Delete.
9543 (region_model::region_model): Add region_model_manager * param.
9544 Reimplement in terms of store, dropping impl_constraint_manager
9545 subclass.
9546 (region_model::operator=): Reimplement in terms of store
9547 (region_model::operator==): Likewise.
9548 (region_model::hash): Likewise.
9549 (region_model::print): Delete.
9550 (region_model::print_svalue): Delete.
9551 (region_model::dump_dot_to_pp): Delete.
9552 (region_model::dump_dot_to_file): Delete.
9553 (region_model::dump_dot): Delete.
9554 (region_model::dump_to_pp): Replace "summarize" param with
9555 "simple" and "multiline". Port to store-based implementation.
9556 (region_model::dump): Replace "summarize" param with "simple" and
9557 "multiline".
9558 (dump_vec_of_tree): Delete.
9559 (region_model::dump_summary_of_rep_path_vars): Delete.
9560 (region_model::validate): Delete.
9561 (svalue_id_cmp_by_constant_svalue_model): Delete.
9562 (svalue_id_cmp_by_constant_svalue): Delete.
9563 (region_model::canonicalize): Drop "ctxt" param. Reimplement in
9564 terms of store and constraints.
9565 (region_model::canonicalized_p): Remove NULL arg to canonicalize.
9566 (region_model::loop_replay_fixup): New.
9567 (poisoned_value_diagnostic::emit): Tweak wording of warnings.
9568 (region_model::check_for_poison): Delete.
9569 (region_model::get_gassign_result): New.
9570 (region_model::on_assignment): Port to store-based implementation.
9571 (region_model::on_call_pre): Delete calls to check_for_poison.
9572 Move implementations to region-model-impl-calls.c and port to
9573 store-based implementation.
9574 (region_model::on_call_post): Likewise.
9575 (class reachable_regions): Move to region-model-reachability.h/cc
9576 and port to store-based implementation.
9577 (region_model::handle_unrecognized_call): Port to store-based
9578 implementation.
9579 (region_model::get_reachable_svalues): New.
9580 (region_model::on_setjmp): Port to store-based implementation.
9581 (region_model::on_longjmp): Likewise.
9582 (region_model::handle_phi): Drop is_back_edge param and the logic
9583 using it.
9584 (region_model::get_lvalue_1): Port from region_id to const region *.
9585 (region_model::make_region_for_unexpected_tree_code): Delete.
9586 (assert_compat_types): If the check fails, use internal_error to
9587 show the types.
9588 (region_model::get_lvalue): Port from region_id to const region *.
9589 (region_model::get_rvalue_1): Port from svalue_id to const svalue *.
9590 (region_model::get_rvalue): Likewise.
9591 (region_model::get_or_create_ptr_svalue): Delete.
9592 (region_model::get_or_create_constant_svalue): Delete.
9593 (region_model::get_svalue_for_fndecl): Delete.
9594 (region_model::get_region_for_fndecl): Delete.
9595 (region_model::get_svalue_for_label): Delete.
9596 (region_model::get_region_for_label): Delete.
9597 (build_cast): Delete.
9598 (region_model::maybe_cast_1): Delete.
9599 (region_model::maybe_cast): Delete.
9600 (region_model::get_field_region): Delete.
9601 (region_model::get_store_value): New.
9602 (region_model::region_exists_p): New.
9603 (region_model::deref_rvalue): Port from svalue_id to const svalue *.
9604 (region_model::set_value): Likewise.
9605 (region_model::clobber_region): New.
9606 (region_model::purge_region): New.
9607 (region_model::zero_fill_region): New.
9608 (region_model::mark_region_as_unknown): New.
9609 (region_model::eval_condition): Port from svalue_id to
9610 const svalue *.
9611 (region_model::eval_condition_without_cm): Likewise.
9612 (region_model::compare_initial_and_pointer): New.
9613 (region_model::add_constraint): Port from svalue_id to
9614 const svalue *.
9615 (region_model::maybe_get_constant): Delete.
9616 (region_model::get_representative_path_var): New.
9617 (region_model::add_new_malloc_region): Delete.
9618 (region_model::get_representative_tree): Port to const svalue *.
9619 (region_model::get_representative_path_var): Port to
9620 const region *.
9621 (region_model::get_path_vars_for_svalue): Delete.
9622 (region_model::set_to_new_unknown_value): Delete.
9623 (region_model::update_for_phis): Don't pass is_back_edge to handle_phi.
9624 (region_model::update_for_call_superedge): Port from svalue_id to
9625 const svalue *.
9626 (region_model::update_for_return_superedge): Port to store-based
9627 implementation.
9628 (region_model::update_for_call_summary): Replace
9629 set_to_new_unknown_value with mark_region_as_unknown.
9630 (region_model::get_root_region): Delete.
9631 (region_model::get_stack_region_id): Delete.
9632 (region_model::push_frame): Delete.
9633 (region_model::get_current_frame_id): Delete.
9634 (region_model::get_current_function): Delete.
9635 (region_model::pop_frame): Delete.
9636 (region_model::on_top_level_param): New.
9637 (region_model::get_stack_depth): Delete.
9638 (region_model::get_function_at_depth): Delete.
9639 (region_model::get_globals_region_id): Delete.
9640 (region_model::add_svalue): Delete.
9641 (region_model::replace_svalue): Delete.
9642 (region_model::add_region): Delete.
9643 (region_model::get_svalue): Delete.
9644 (region_model::get_region): Delete.
9645 (make_region_for_type): Delete.
9646 (region_model::add_region_for_type): Delete.
9647 (region_model::on_top_level_param): New.
9648 (class restrict_to_used_svalues): Delete.
9649 (region_model::purge_unused_svalues): Delete.
9650 (region_model::push_frame): New.
9651 (region_model::remap_svalue_ids): Delete.
9652 (region_model::remap_region_ids): Delete.
9653 (region_model::purge_regions): Delete.
9654 (region_model::get_descendents): Delete.
9655 (region_model::delete_region_and_descendents): Delete.
9656 (region_model::poison_any_pointers_to_bad_regions): Delete.
9657 (region_model::can_merge_with_p): Delete.
9658 (region_model::get_current_function): New.
9659 (region_model::get_value_by_name): Delete.
9660 (region_model::convert_byte_offset_to_array_index): Delete.
9661 (region_model::pop_frame): New.
9662 (region_model::get_or_create_mem_ref): Delete.
9663 (region_model::get_stack_depth): New.
9664 (region_model::get_frame_at_index): New.
9665 (region_model::unbind_region_and_descendents): New.
9666 (struct bad_pointer_finder): New.
9667 (region_model::get_or_create_pointer_plus_expr): Delete.
9668 (region_model::poison_any_pointers_to_descendents): New.
9669 (region_model::get_or_create_view): Delete.
9670 (region_model::can_merge_with_p): New.
9671 (region_model::get_fndecl_for_call): Port from svalue_id to
9672 const svalue *.
9673 (struct append_ssa_names_cb_data): New.
9674 (get_ssa_name_regions_for_current_frame): New.
9675 (region_model::append_ssa_names_cb): New.
9676 (model_merger::dump_to_pp): Add "simple" param. Drop dumping of
9677 remappings.
9678 (model_merger::dump): Add "simple" param to both overloads.
9679 (model_merger::can_merge_values_p): Delete.
9680 (model_merger::record_regions): Delete.
9681 (model_merger::record_svalues): Delete.
9682 (svalue_id_merger_mapping::svalue_id_merger_mapping): Delete.
9683 (svalue_id_merger_mapping::dump_to_pp): Delete.
9684 (svalue_id_merger_mapping::dump): Delete.
9685 (region_model::create_region_for_heap_alloc): New.
9686 (region_model::create_region_for_alloca): New.
9687 (region_model::record_dynamic_extents): New.
9688 (canonicalization::canonicalization): Delete.
9689 (canonicalization::walk_rid): Delete.
9690 (canonicalization::walk_sid): Delete.
9691 (canonicalization::dump_to_pp): Delete.
9692 (canonicalization::dump): Delete.
9693 (inchash::add): Delete overloads for svalue_id and region_id.
9694 (engine::log_stats): New.
9695 (assert_condition): Add overload comparing svalues.
9696 (assert_dump_eq): Pass "true" for multiline.
9697 (selftest::test_dump): Update for rewrite of region_model.
9698 (selftest::test_dump_2): Rename to...
9699 (selftest::test_struct): ...this. Provide a region_model_manager
9700 when creating region_model instance. Remove dump test. Add
9701 checks for get_offset.
9702 (selftest::test_dump_3): Rename to...
9703 (selftest::test_array_1): ...this. Provide a region_model_manager
9704 when creating region_model instance. Remove dump test.
9705 (selftest::test_get_representative_tree): Port from svalue_id to
9706 new API. Add test coverage for various expressions.
9707 (selftest::test_unique_constants): Provide a region_model_manager
9708 for the region_model. Add test coverage for comparing const vs
9709 non-const.
9710 (selftest::test_svalue_equality): Delete.
9711 (selftest::test_region_equality): Delete.
9712 (selftest::test_unique_unknowns): New.
9713 (class purge_all_svalue_ids): Delete.
9714 (class purge_one_svalue_id): Delete.
9715 (selftest::test_purging_by_criteria): Delete.
9716 (selftest::test_initial_svalue_folding): New.
9717 (selftest::test_unaryop_svalue_folding): New.
9718 (selftest::test_binop_svalue_folding): New.
9719 (selftest::test_sub_svalue_folding): New.
9720 (selftest::test_purge_unused_svalues): Delete.
9721 (selftest::test_descendent_of_p): New.
9722 (selftest::test_assignment): Provide a region_model_manager for
9723 the region_model. Drop the dump test.
9724 (selftest::test_compound_assignment): Likewise.
9725 (selftest::test_stack_frames): Port to new implementation.
9726 (selftest::test_get_representative_path_var): Likewise.
9727 (selftest::test_canonicalization_1): Rename to...
9728 (selftest::test_equality_1): ...this. Port to new API, and add
9729 (selftest::test_canonicalization_2): Provide a
9730 region_model_manager when creating region_model instances.
9731 Remove redundant canicalization.
9732 (selftest::test_canonicalization_3): Provide a
9733 region_model_manager when creating region_model instances.
9734 Remove param from calls to region_model::canonicalize.
9735 (selftest::test_canonicalization_4): Likewise.
9736 (selftest::assert_region_models_merge): Constify
9737 out_merged_svalue. Port to new API.
9738 (selftest::test_state_merging): Provide a
9739 region_model_manager when creating region_model instances.
9740 Provide a program_point point when merging them. Replace
9741 set_to_new_unknown_value with usage of placeholder_svalues.
9742 Drop get_value_by_name. Port from svalue_id to const svalue *.
9743 Add test of heap allocation.
9744 (selftest::test_constraint_merging): Provide a
9745 region_model_manager when creating region_model instances.
9746 Provide a program_point point when merging them. Eliminate use
9747 of set_to_new_unknown_value.
9748 (selftest::test_widening_constraints): New.
9749 (selftest::test_iteration_1): New.
9750 (selftest::test_malloc_constraints): Port to store-based
9751 implementation.
9752 (selftest::test_var): New test.
9753 (selftest::test_array_2): New test.
9754 (selftest::test_mem_ref): New test.
9755 (selftest::test_POINTER_PLUS_EXPR_then_MEM_REF): New.
9756 (selftest::test_malloc): New.
9757 (selftest::test_alloca): New.
9758 (selftest::analyzer_region_model_cc_tests): Update for renamings.
9759 Call new functions.
9760 * region-model.h (class path_var): Move to analyzer.h.
9761 (class svalue_id): Delete.
9762 (class region_id): Delete.
9763 (class id_map): Delete.
9764 (svalue_id_map): Delete.
9765 (region_id_map): Delete.
9766 (id_map<T>::id_map): Delete.
9767 (id_map<T>::put): Delete.
9768 (id_map<T>::get_dst_for_src): Delete.
9769 (id_map<T>::get_src_for_dst): Delete.
9770 (id_map<T>::dump_to_pp): Delete.
9771 (id_map<T>::dump): Delete.
9772 (id_map<T>::update): Delete.
9773 (one_way_svalue_id_map): Delete.
9774 (one_way_region_id_map): Delete.
9775 (class region_id_set): Delete.
9776 (class svalue_id_set): Delete.
9777 (struct complexity): New.
9778 (class visitor): New.
9779 (enum svalue_kind): Add SK_SETJMP, SK_INITIAL, SK_UNARYOP,
9780 SK_BINOP, SK_SUB,SK_UNMERGEABLE, SK_PLACEHOLDER, SK_WIDENING,
9781 SK_COMPOUND, and SK_CONJURED.
9782 (svalue::operator==): Delete.
9783 (svalue::operator!=): Delete.
9784 (svalue::clone): Delete.
9785 (svalue::hash): Delete.
9786 (svalue::dump_dot_to_pp): Delete.
9787 (svalue::dump_to_pp): New.
9788 (svalue::dump): New.
9789 (svalue::get_desc): New.
9790 (svalue::dyn_cast_initial_svalue): New.
9791 (svalue::dyn_cast_unaryop_svalue): New.
9792 (svalue::dyn_cast_binop_svalue): New.
9793 (svalue::dyn_cast_sub_svalue): New.
9794 (svalue::dyn_cast_unmergeable_svalue): New.
9795 (svalue::dyn_cast_widening_svalue): New.
9796 (svalue::dyn_cast_compound_svalue): New.
9797 (svalue::dyn_cast_conjured_svalue): New.
9798 (svalue::maybe_undo_cast): New.
9799 (svalue::unwrap_any_unmergeable): New.
9800 (svalue::remap_region_ids): Delete
9801 (svalue::can_merge_p): New.
9802 (svalue::walk_for_canonicalization): Delete
9803 (svalue::get_complexity): New.
9804 (svalue::get_child_sid): Delete
9805 (svalue::accept): New.
9806 (svalue::live_p): New.
9807 (svalue::implicitly_live_p): New.
9808 (svalue::svalue): Add complexity param.
9809 (svalue::add_to_hash): Delete
9810 (svalue::print_details): Delete
9811 (svalue::m_complexity): New field.
9812 (region_svalue::key_t): New struct.
9813 (region_svalue::region_svalue): Port from region_id to
9814 const region_id *. Add complexity.
9815 (region_svalue::compare_fields): Delete.
9816 (region_svalue::clone): Delete.
9817 (region_svalue::dump_dot_to_pp): Delete.
9818 (region_svalue::get_pointee): Port from region_id to
9819 const region_id *.
9820 (region_svalue::remap_region_ids): Delete.
9821 (region_svalue::merge_values): Delete.
9822 (region_svalue::dump_to_pp): New.
9823 (region_svalue::accept): New.
9824 (region_svalue::walk_for_canonicalization): Delete.
9825 (region_svalue::eval_condition): Make params const.
9826 (region_svalue::add_to_hash): Delete.
9827 (region_svalue::print_details): Delete.
9828 (region_svalue::m_rid): Replace with...
9829 (region_svalue::m_reg): ...this.
9830 (is_a_helper <region_svalue *>::test): Convert to...
9831 (is_a_helper <const region_svalue *>::test): ...this.
9832 (template <> struct default_hash_traits<region_svalue::key_t>):
9833 New.
9834 (constant_svalue::constant_svalue): Add complexity.
9835 (constant_svalue::compare_fields): Delete.
9836 (constant_svalue::clone): Delete.
9837 (constant_svalue::add_to_hash): Delete.
9838 (constant_svalue::dump_to_pp): New.
9839 (constant_svalue::accept): New.
9840 (constant_svalue::implicitly_live_p): New.
9841 (constant_svalue::merge_values): Delete.
9842 (constant_svalue::eval_condition): Make params const.
9843 (constant_svalue::get_child_sid): Delete.
9844 (constant_svalue::print_details): Delete.
9845 (is_a_helper <constant_svalue *>::test): Convert to...
9846 (is_a_helper <const constant_svalue *>::test): ...this.
9847 (class unknown_svalue): Update leading comment.
9848 (unknown_svalue::unknown_svalue): Add complexity.
9849 (unknown_svalue::compare_fields): Delete.
9850 (unknown_svalue::add_to_hash): Delete.
9851 (unknown_svalue::dyn_cast_unknown_svalue): Delete.
9852 (unknown_svalue::print_details): Delete.
9853 (unknown_svalue::dump_to_pp): New.
9854 (unknown_svalue::accept): New.
9855 (poisoned_svalue::key_t): New struct.
9856 (poisoned_svalue::poisoned_svalue): Add complexity.
9857 (poisoned_svalue::compare_fields): Delete.
9858 (poisoned_svalue::clone): Delete.
9859 (poisoned_svalue::add_to_hash): Delete.
9860 (poisoned_svalue::dump_to_pp): New.
9861 (poisoned_svalue::accept): New.
9862 (poisoned_svalue::print_details): Delete.
9863 (is_a_helper <poisoned_svalue *>::test): Convert to...
9864 (is_a_helper <const poisoned_svalue *>::test): ...this.
9865 (template <> struct default_hash_traits<poisoned_svalue::key_t>):
9866 New.
9867 (setjmp_record::add_to_hash): New.
9868 (setjmp_svalue::key_t): New struct.
9869 (setjmp_svalue::compare_fields): Delete.
9870 (setjmp_svalue::clone): Delete.
9871 (setjmp_svalue::add_to_hash): Delete.
9872 (setjmp_svalue::setjmp_svalue): Add complexity.
9873 (setjmp_svalue::dump_to_pp): New.
9874 (setjmp_svalue::accept): New.
9875 (setjmp_svalue::void print_details): Delete.
9876 (is_a_helper <const setjmp_svalue *>::test): New.
9877 (template <> struct default_hash_traits<setjmp_svalue::key_t>): New.
9878 (class initial_svalue : public svalue): New.
9879 (is_a_helper <const initial_svalue *>::test): New.
9880 (class unaryop_svalue): New.
9881 (is_a_helper <const unaryop_svalue *>::test): New.
9882 (template <> struct default_hash_traits<unaryop_svalue::key_t>): New.
9883 (class binop_svalue): New.
9884 (is_a_helper <const binop_svalue *>::test): New.
9885 (template <> struct default_hash_traits<binop_svalue::key_t>): New.
9886 (class sub_svalue): New.
9887 (is_a_helper <const sub_svalue *>::test): New.
9888 (template <> struct default_hash_traits<sub_svalue::key_t>): New.
9889 (class unmergeable_svalue): New.
9890 (is_a_helper <const unmergeable_svalue *>::test): New.
9891 (class placeholder_svalue): New.
9892 (is_a_helper <placeholder_svalue *>::test): New.
9893 (class widening_svalue): New.
9894 (is_a_helper <widening_svalue *>::test): New.
9895 (template <> struct default_hash_traits<widening_svalue::key_t>): New.
9896 (class compound_svalue): New.
9897 (is_a_helper <compound_svalue *>::test): New.
9898 (template <> struct default_hash_traits<compound_svalue::key_t>): New.
9899 (class conjured_svalue): New.
9900 (is_a_helper <conjured_svalue *>::test): New.
9901 (template <> struct default_hash_traits<conjured_svalue::key_t>): New.
9902 (enum region_kind): Delete RK_PRIMITIVE, RK_STRUCT, RK_UNION, and
9903 RK_ARRAY. Add RK_LABEL, RK_DECL, RK_FIELD, RK_ELEMENT, RK_OFFSET,
9904 RK_CAST, RK_HEAP_ALLOCATED, RK_ALLOCA, RK_STRING, and RK_UNKNOWN.
9905 (region_kind_to_str): Delete.
9906 (region::~region): Move implementation to region.cc.
9907 (region::operator==): Delete.
9908 (region::operator!=): Delete.
9909 (region::clone): Delete.
9910 (region::get_id): New.
9911 (region::cmp_ids): New.
9912 (region::dyn_cast_map_region): Delete.
9913 (region::dyn_cast_array_region): Delete.
9914 (region::region_id get_parent): Delete.
9915 (region::get_parent_region): Convert to a simple accessor.
9916 (region::void set_value): Delete.
9917 (region::svalue_id get_value): Delete.
9918 (region::svalue_id get_value_direct): Delete.
9919 (region::svalue_id get_inherited_child_sid): Delete.
9920 (region::dyn_cast_frame_region): New.
9921 (region::dyn_cast_function_region): New.
9922 (region::dyn_cast_decl_region): New.
9923 (region::dyn_cast_field_region): New.
9924 (region::dyn_cast_element_region): New.
9925 (region::dyn_cast_offset_region): New.
9926 (region::dyn_cast_cast_region): New.
9927 (region::dyn_cast_string_region): New.
9928 (region::accept): New.
9929 (region::get_base_region): New.
9930 (region::base_region_p): New.
9931 (region::descendent_of_p): New.
9932 (region::maybe_get_frame_region): New.
9933 (region::maybe_get_decl): New.
9934 (region::hash): Delete.
9935 (region::rint): Delete.
9936 (region::dump_dot_to_pp): Delete.
9937 (region::get_desc): New.
9938 (region::dump_to_pp): Convert to vfunc, changing signature.
9939 (region::dump_child_label): Delete.
9940 (region::remap_svalue_ids): Delete.
9941 (region::remap_region_ids): Delete.
9942 (region::dump): New.
9943 (region::walk_for_canonicalization): Delete.
9944 (region::non_null_p): Drop region_model param.
9945 (region::add_view): Delete.
9946 (region::get_view): Delete.
9947 (region::get_active_view): Delete.
9948 (region::is_view_p): Delete.
9949 (region::cmp_ptrs): New.
9950 (region::validate): Delete.
9951 (region::get_offset): New.
9952 (region::get_byte_size): New.
9953 (region::get_bit_size): New.
9954 (region::get_subregions_for_binding): New.
9955 (region::region): Add complexity param. Convert parent from
9956 region_id to const region *. Drop svalue_id. Drop copy ctor.
9957 (region::symbolic_for_unknown_ptr_p): New.
9958 (region::add_to_hash): Delete.
9959 (region::print_fields): Delete.
9960 (region::get_complexity): New accessor.
9961 (region::become_active_view): Delete.
9962 (region::deactivate_any_active_view): Delete.
9963 (region::deactivate_view): Delete.
9964 (region::calc_offset): New.
9965 (region::m_parent_rid): Delete.
9966 (region::m_sval_id): Delete.
9967 (region::m_complexity): New.
9968 (region::m_id): New.
9969 (region::m_parent): New.
9970 (region::m_view_rids): Delete.
9971 (region::m_is_view): Delete.
9972 (region::m_active_view_rid): Delete.
9973 (region::m_cached_offset): New.
9974 (is_a_helper <region *>::test): Convert to...
9975 (is_a_helper <const region *>::test): ... this.
9976 (class primitive_region): Delete.
9977 (class space_region): New.
9978 (class map_region): Delete.
9979 (is_a_helper <map_region *>::test): Delete.
9980 (class frame_region): Reimplement.
9981 (template <> struct default_hash_traits<frame_region::key_t>):
9982 New.
9983 (class globals_region): Reimplement.
9984 (is_a_helper <globals_region *>::test): Convert to...
9985 (is_a_helper <const globals_region *>::test): ...this.
9986 (class struct_or_union_region): Delete.
9987 (is_a_helper <struct_or_union_region *>::test): Delete.
9988 (class code_region): Reimplement.
9989 (is_a_helper <const code_region *>::test): New.
9990 (class struct_region): Delete.
9991 (is_a_helper <struct_region *>::test): Delete.
9992 (class function_region): Reimplement.
9993 (is_a_helper <function_region *>::test): Convert to...
9994 (is_a_helper <const function_region *>::test): ...this.
9995 (class union_region): Delete.
9996 (is_a_helper <union_region *>::test): Delete.
9997 (class label_region): New.
9998 (is_a_helper <const label_region *>::test): New.
9999 (class scope_region): Delete.
10000 (class stack_region): Reimplement.
10001 (is_a_helper <stack_region *>::test): Convert to...
10002 (is_a_helper <const stack_region *>::test): ...this.
10003 (class heap_region): Reimplement.
10004 (is_a_helper <heap_region *>::test): Convert to...
10005 (is_a_helper <const heap_region *>::test): ...this.
10006 (class root_region): Reimplement.
10007 (is_a_helper <root_region *>::test): Convert to...
10008 (is_a_helper <const root_region *>::test): ...this.
10009 (class symbolic_region): Reimplement.
10010 (is_a_helper <const symbolic_region *>::test): New.
10011 (template <> struct default_hash_traits<symbolic_region::key_t>):
10012 New.
10013 (class decl_region): New.
10014 (is_a_helper <const decl_region *>::test): New.
10015 (class field_region): New.
10016 (template <> struct default_hash_traits<field_region::key_t>): New.
10017 (class array_region): Delete.
10018 (class element_region): New.
10019 (is_a_helper <array_region *>::test): Delete.
10020 (is_a_helper <const element_region *>::test): New.
10021 (template <> struct default_hash_traits<element_region::key_t>):
10022 New.
10023 (class offset_region): New.
10024 (is_a_helper <const offset_region *>::test): New.
10025 (template <> struct default_hash_traits<offset_region::key_t>):
10026 New.
10027 (class cast_region): New.
10028 (is_a_helper <const cast_region *>::test): New.
10029 (template <> struct default_hash_traits<cast_region::key_t>): New.
10030 (class heap_allocated_region): New.
10031 (class alloca_region): New.
10032 (class string_region): New.
10033 (is_a_helper <const string_region *>::test): New.
10034 (class unknown_region): New.
10035 (class region_model_manager): New.
10036 (struct append_ssa_names_cb_data): New.
10037 (class call_details): New.
10038 (region_model::region_model): Add region_model_manager param.
10039 (region_model::print_svalue): Delete.
10040 (region_model::dump_dot_to_pp): Delete.
10041 (region_model::dump_dot_to_file): Delete.
10042 (region_model::dump_dot): Delete.
10043 (region_model::dump_to_pp): Drop summarize param in favor of
10044 simple and multiline.
10045 (region_model::dump): Likewise.
10046 (region_model::summarize_to_pp): Delete.
10047 (region_model::summarize): Delete.
10048 (region_model::void canonicalize): Drop ctxt param.
10049 (region_model::void check_for_poison): Delete.
10050 (region_model::get_gassign_result): New.
10051 (region_model::impl_call_alloca): New.
10052 (region_model::impl_call_analyzer_describe): New.
10053 (region_model::impl_call_analyzer_eval): New.
10054 (region_model::impl_call_builtin_expect): New.
10055 (region_model::impl_call_calloc): New.
10056 (region_model::impl_call_free): New.
10057 (region_model::impl_call_malloc): New.
10058 (region_model::impl_call_memset): New.
10059 (region_model::impl_call_strlen): New.
10060 (region_model::get_reachable_svalues): New.
10061 (region_model::handle_phi): Drop is_back_edge param.
10062 (region_model::region_id get_root_rid): Delete.
10063 (region_model::root_region *get_root_region): Delete.
10064 (region_model::region_id get_stack_region_id): Delete.
10065 (region_model::push_frame): Convert from region_id and svalue_id
10066 to const region * and const svalue *.
10067 (region_model::get_current_frame_id): Replace with...
10068 (region_model::get_current_frame): ...this.
10069 (region_model::pop_frame): Convert from region_id to
10070 const region *. Drop purge and stats param. Add out_result.
10071 (region_model::function *get_function_at_depth): Delete.
10072 (region_model::get_globals_region_id): Delete.
10073 (region_model::add_svalue): Delete.
10074 (region_model::replace_svalue): Delete.
10075 (region_model::add_region): Delete.
10076 (region_model::add_region_for_type): Delete.
10077 (region_model::get_svalue): Delete.
10078 (region_model::get_region): Delete.
10079 (region_model::get_lvalue): Convert from region_id to
10080 const region *.
10081 (region_model::get_rvalue): Convert from svalue_id to
10082 const svalue *.
10083 (region_model::get_or_create_ptr_svalue): Delete.
10084 (region_model::get_or_create_constant_svalue): Delete.
10085 (region_model::get_svalue_for_fndecl): Delete.
10086 (region_model::get_svalue_for_label): Delete.
10087 (region_model::get_region_for_fndecl): Delete.
10088 (region_model::get_region_for_label): Delete.
10089 (region_model::get_frame_at_index (int index) const;): New.
10090 (region_model::maybe_cast): Delete.
10091 (region_model::maybe_cast_1): Delete.
10092 (region_model::get_field_region): Delete.
10093 (region_model::id deref_rvalue): Convert from region_id and
10094 svalue_id to const region * and const svalue *. Drop overload,
10095 passing in both a tree and an svalue.
10096 (region_model::set_value): Convert from region_id and svalue_id to
10097 const region * and const svalue *.
10098 (region_model::set_to_new_unknown_value): Delete.
10099 (region_model::clobber_region (const region *reg);): New.
10100 (region_model::purge_region (const region *reg);): New.
10101 (region_model::zero_fill_region (const region *reg);): New.
10102 (region_model::mark_region_as_unknown (const region *reg);): New.
10103 (region_model::copy_region): Convert from region_id to
10104 const region *.
10105 (region_model::eval_condition): Convert from svalue_id to
10106 const svalue *.
10107 (region_model::eval_condition_without_cm): Likewise.
10108 (region_model::compare_initial_and_pointer): New.
10109 (region_model:maybe_get_constant): Delete.
10110 (region_model::add_new_malloc_region): Delete.
10111 (region_model::get_representative_tree): Convert from svalue_id to
10112 const svalue *.
10113 (region_model::get_representative_path_var): Delete decl taking a
10114 region_id in favor of two decls, for svalue vs region, with an
10115 svalue_set to ensure termination.
10116 (region_model::get_path_vars_for_svalue): Delete.
10117 (region_model::create_region_for_heap_alloc): New.
10118 (region_model::create_region_for_alloca): New.
10119 (region_model::purge_unused_svalues): Delete.
10120 (region_model::remap_svalue_ids): Delete.
10121 (region_model::remap_region_ids): Delete.
10122 (region_model::purge_regions): Delete.
10123 (region_model::get_num_svalues): Delete.
10124 (region_model::get_num_regions): Delete.
10125 (region_model::get_descendents): Delete.
10126 (region_model::get_store): New.
10127 (region_model::delete_region_and_descendents): Delete.
10128 (region_model::get_manager): New.
10129 (region_model::unbind_region_and_descendents): New.
10130 (region_model::can_merge_with_p): Add point param. Drop
10131 svalue_id_merger_mapping.
10132 (region_model::get_value_by_name): Delete.
10133 (region_model::convert_byte_offset_to_array_index): Delete.
10134 (region_model::get_or_create_mem_ref): Delete.
10135 (region_model::get_or_create_pointer_plus_expr): Delete.
10136 (region_model::get_or_create_view): Delete.
10137 (region_model::get_lvalue_1): Convert from region_id to
10138 const region *.
10139 (region_model::get_rvalue_1): Convert from svalue_id to
10140 const svalue *.
10141 (region_model::get_ssa_name_regions_for_current_frame): New.
10142 (region_model::append_ssa_names_cb): New.
10143 (region_model::get_store_value): New.
10144 (region_model::copy_struct_region): Delete.
10145 (region_model::copy_union_region): Delete.
10146 (region_model::copy_array_region): Delete.
10147 (region_model::region_exists_p): New.
10148 (region_model::make_region_for_unexpected_tree_code): Delete.
10149 (region_model::loop_replay_fixup): New.
10150 (region_model::poison_any_pointers_to_bad_regions): Delete.
10151 (region_model::poison_any_pointers_to_descendents): New.
10152 (region_model::dump_summary_of_rep_path_vars): Delete.
10153 (region_model::on_top_level_param): New.
10154 (region_model::record_dynamic_extents): New.
10155 (region_model::m_mgr;): New.
10156 (region_model::m_store;): New.
10157 (region_model::m_svalues;): Delete.
10158 (region_model::m_regions;): Delete.
10159 (region_model::m_root_rid;): Delete.
10160 (region_model::m_current_frame;): New.
10161 (region_model_context::remap_svalue_ids): Delete.
10162 (region_model_context::can_purge_p): Delete.
10163 (region_model_context::on_svalue_leak): New.
10164 (region_model_context::on_svalue_purge): Delete.
10165 (region_model_context::on_liveness_change): New.
10166 (region_model_context::on_inherited_svalue): Delete.
10167 (region_model_context::on_cast): Delete.
10168 (region_model_context::on_unknown_change): Convert from svalue_id to
10169 const svalue * and add is_mutable.
10170 (class noop_region_model_context): Update for region_model_context
10171 changes.
10172 (model_merger::model_merger): Add program_point. Drop
10173 svalue_id_merger_mapping.
10174 (model_merger::dump_to_pp): Add "simple" param.
10175 (model_merger::dump): Likewise.
10176 (model_merger::get_region_a): Delete.
10177 (model_merger::get_region_b): Delete.
10178 (model_merger::can_merge_values_p): Delete.
10179 (model_merger::record_regions): Delete.
10180 (model_merger::record_svalues): Delete.
10181 (model_merger::m_point): New field.
10182 (model_merger::m_map_regions_from_a_to_m): Delete.
10183 (model_merger::m_map_regions_from_b_to_m): Delete.
10184 (model_merger::m_sid_mapping): Delete.
10185 (struct svalue_id_merger_mapping): Delete.
10186 (class engine): New.
10187 (struct canonicalization): Delete.
10188 (inchash::add): Delete decls for hashing svalue_id and region_id.
10189 (test_region_model_context::on_unexpected_tree_code): Require t to
10190 be non-NULL.
10191 (selftest::assert_condition): Add overload comparing a pair of
10192 const svalue *.
10193 * sm-file.cc: Include "tristate.h", "selftest.h",
10194 "analyzer/call-string.h", "analyzer/program-point.h",
10195 "analyzer/store.h", and "analyzer/region-model.h".
10196 (fileptr_state_machine::get_default_state): New.
10197 (fileptr_state_machine::on_stmt): Remove calls to
10198 get_readable_tree in favor of get_diagnostic_tree.
10199 * sm-malloc.cc: Include "tristate.h", "selftest.h",
10200 "analyzer/call-string.h", "analyzer/program-point.h",
10201 "analyzer/store.h", and "analyzer/region-model.h".
10202 (malloc_state_machine::get_default_state): New.
10203 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New.
10204 (malloc_diagnostic::describe_state_change): Handle change.m_expr
10205 being NULL.
10206 (null_arg::emit): Avoid printing "NULL '0'".
10207 (null_arg::describe_final_event): Avoid printing "(0) NULL".
10208 (malloc_leak::emit): Handle m_arg being NULL.
10209 (malloc_leak::describe_final_event): Handle ev.m_expr being NULL.
10210 (malloc_state_machine::on_stmt): Don't call get_readable_tree.
10211 Call get_diagnostic_tree when creating pending diagnostics.
10212 Update for is_zero_assignment becoming a member function of
10213 sm_ctxt.
10214 Don't transition to m_non_heap for ADDR_EXPR(MEM_REF()).
10215 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New
10216 vfunc implementation.
10217 * sm-sensitive.cc (sensitive_state_machine::warn_for_any_exposure): Call
10218 get_diagnostic_tree and pass the result to warn_for_state.
10219 * sm-signal.cc: Move includes of "analyzer/call-string.h" and
10220 "analyzer/program-point.h" to before "analyzer/region-model.h",
10221 and also include "analyzer/store.h" before it.
10222 (signal_unsafe_call::describe_state_change): Use
10223 get_dest_function to get handler.
10224 (update_model_for_signal_handler): Pass manager to region_model
10225 ctor.
10226 (register_signal_handler::impl_transition): Update for changes to
10227 get_or_create_node and add_edge.
10228 * sm-taint.cc (taint_state_machine::on_stmt): Remove calls to
10229 get_readable_tree, replacing them when calling warn_for_state with
10230 calls to get_diagnostic_tree.
10231 * sm.cc (is_zero_assignment): Delete.
10232 (any_pointer_p): Move to within namespace ana.
10233 * sm.h (is_zero_assignment): Remove decl.
10234 (any_pointer_p): Move decl to within namespace ana.
10235 (state_machine::get_default_state): New vfunc.
10236 (state_machine::reset_when_passed_to_unknown_fn_p): New vfunc.
10237 (sm_context::get_readable_tree): Rename to...
10238 (sm_context::get_diagnostic_tree): ...this.
10239 (sm_context::is_zero_assignment): New vfunc.
10240 * store.cc: New file.
10241 * store.h: New file.
10242 * svalue.cc: New file.
10244 2020-05-22 Mark Wielaard <mark@klomp.org>
10246 * sm-signal.cc(signal_unsafe_call::emit): Possibly add
10247 gcc_rich_location note for replacement.
10248 (signal_unsafe_call::get_replacement_fn): New private function.
10249 (get_async_signal_unsafe_fns): Add "exit".
10251 2020-04-28 David Malcolm <dmalcolm@redhat.com>
10253 PR analyzer/94816
10254 * engine.cc (impl_region_model_context::on_unexpected_tree_code):
10255 Handle NULL tree.
10256 * region-model.cc (region_model::add_region_for_type): Handle
10257 NULL type.
10258 * region-model.h
10259 (test_region_model_context::on_unexpected_tree_code): Handle NULL
10260 tree.
10262 2020-04-28 David Malcolm <dmalcolm@redhat.com>
10264 PR analyzer/94447
10265 PR analyzer/94639
10266 PR analyzer/94732
10267 PR analyzer/94754
10268 * analyzer.opt (Wanalyzer-use-of-uninitialized-value): Delete.
10269 * program-state.cc (selftest::test_program_state_dumping): Update
10270 expected dump result for removal of "uninit".
10271 * region-model.cc (poison_kind_to_str): Delete POISON_KIND_UNINIT
10272 case.
10273 (root_region::ensure_stack_region): Initialize stack with null
10274 svalue_id rather than with a typeless POISON_KIND_UNINIT value.
10275 (root_region::ensure_heap_region): Likewise for the heap.
10276 (region_model::dump_summary_of_rep_path_vars): Remove
10277 summarization of uninit values.
10278 (region_model::validate): Remove check that the stack has a
10279 POISON_KIND_UNINIT value.
10280 (poisoned_value_diagnostic::emit): Remove POISON_KIND_UNINIT
10281 case.
10282 (poisoned_value_diagnostic::describe_final_event): Likewise.
10283 (selftest::test_dump): Update expected dump result for removal of
10284 "uninit".
10285 (selftest::test_svalue_equality): Remove "uninit" and "freed".
10286 * region-model.h (enum poison_kind): Remove POISON_KIND_UNINIT.
10288 2020-04-01 David Malcolm <dmalcolm@redhat.com>
10290 PR analyzer/94378
10291 * checker-path.cc: Include "bitmap.h".
10292 * constraint-manager.cc: Likewise.
10293 * diagnostic-manager.cc: Likewise.
10294 * engine.cc: Likewise.
10295 (exploded_node::detect_leaks): Pass null region_id to pop_frame.
10296 * program-point.cc: Include "bitmap.h".
10297 * program-state.cc: Likewise.
10298 * region-model.cc (id_set<region_id>::id_set): Convert to...
10299 (region_id_set::region_id_set): ...this.
10300 (svalue_id_set::svalue_id_set): New ctor.
10301 (region_model::copy_region): New function.
10302 (region_model::copy_struct_region): New function.
10303 (region_model::copy_union_region): New function.
10304 (region_model::copy_array_region): New function.
10305 (stack_region::pop_frame): Drop return value. Add
10306 "result_dst_rid" param; if it is non-null, use copy_region to copy
10307 the result to it. Rather than capture and pass a single "known
10308 used" return value to be used by purge_unused_values, instead
10309 gather and pass a set of known used return values.
10310 (root_region::pop_frame): Drop return value. Add "result_dst_rid"
10311 param.
10312 (region_model::on_assignment): Use copy_region.
10313 (region_model::on_return): Likewise for the result.
10314 (region_model::on_longjmp): Pass null for pop_frame's
10315 result_dst_rid.
10316 (region_model::update_for_return_superedge): Pass the region for the
10317 return value of the call, if any, to pop_frame, rather than setting
10318 the lvalue for the lhs of the result.
10319 (region_model::pop_frame): Drop return value. Add
10320 "result_dst_rid" param.
10321 (region_model::purge_unused_svalues): Convert third param from an
10322 svalue_id * to an svalue_id_set *, updating the initial populating
10323 of the "used" bitmap accordingly. Don't remap it when done.
10324 (struct selftest::coord_test): New selftest fixture, extracted from...
10325 (selftest::test_dump_2): ...here.
10326 (selftest::test_compound_assignment): New selftest.
10327 (selftest::test_stack_frames): Pass null to new param of pop_frame.
10328 (selftest::analyzer_region_model_cc_tests): Call the new selftest.
10329 * region-model.h (class id_set): Delete template.
10330 (class region_id_set): Reimplement, using old id_set implementation.
10331 (class svalue_id_set): Likewise. Convert from auto_sbitmap to
10332 auto_bitmap.
10333 (region::get_active_view): New accessor.
10334 (stack_region::pop_frame): Drop return value. Add
10335 "result_dst_rid" param.
10336 (root_region::pop_frame): Likewise.
10337 (region_model::pop_frame): Likewise.
10338 (region_model::copy_region): New decl.
10339 (region_model::purge_unused_svalues): Convert third param from an
10340 svalue_id * to an svalue_id_set *.
10341 (region_model::copy_struct_region): New decl.
10342 (region_model::copy_union_region): New decl.
10343 (region_model::copy_array_region): New decl.
10345 2020-03-27 David Malcolm <dmalcolm@redhat.com>
10347 * program-state.cc (selftest::test_program_state_dumping): Update
10348 expected dump to include symbolic_region's possibly_null field.
10349 * region-model.cc (symbolic_region::print_fields): New vfunc
10350 implementation.
10351 (region_model::add_constraint): Clear m_possibly_null from
10352 symbolic_regions now known to be non-NULL.
10353 (selftest::test_malloc_constraints): New selftest.
10354 (selftest::analyzer_region_model_cc_tests): Call it.
10355 * region-model.h (region::dyn_cast_symbolic_region): Add non-const
10356 overload.
10357 (symbolic_region::dyn_cast_symbolic_region): Implement it.
10358 (symbolic_region::print_fields): New vfunc override decl.
10360 2020-03-27 David Malcolm <dmalcolm@redhat.com>
10362 * analyzer.h (class feasibility_problem): New forward decl.
10363 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
10364 Initialize new fields m_status, m_epath_length, and m_problem.
10365 (saved_diagnostic::~saved_diagnostic): Delete m_problem.
10366 (dedupe_candidate::dedupe_candidate): Convert "sd" param from a
10367 const ref to a mutable ptr.
10368 (dedupe_winners::add): Convert "sd" param from a const ref to a
10369 mutable ptr. Record the length of the exploded_path. Record the
10370 feasibility/infeasibility of sd into sd, capturing a
10371 feasibility_problem when feasible_p fails, and storing it in sd.
10372 (diagnostic_manager::emit_saved_diagnostics): Update for pass by
10373 ptr rather than by const ref.
10374 * diagnostic-manager.h (class saved_diagnostic): Add new enum
10375 status. Add fields m_status, m_epath_length and m_problem.
10376 (saved_diagnostic::set_feasible): New member function.
10377 (saved_diagnostic::set_infeasible): New member function.
10378 (saved_diagnostic::get_feasibility_problem): New accessor.
10379 (saved_diagnostic::get_status): New accessor.
10380 (saved_diagnostic::set_epath_length): New member function.
10381 (saved_diagnostic::get_epath_length): New accessor.
10382 * engine.cc: Include "gimple-pretty-print.h".
10383 (exploded_path::feasible_p): Add OUT param and, if non-NULL, write
10384 a new feasibility_problem to it on failure.
10385 (viz_callgraph_node::dump_dot): Convert begin_tr calls to
10386 begin_trtd. Convert end_tr calls to end_tdtr.
10387 (class exploded_graph_annotator): New subclass of dot_annotator.
10388 (impl_run_checkers): Add a second -fdump-analyzer-supergraph dump
10389 after the analysis runs, using exploded_graph_annotator. dumping
10390 to DUMP_BASE_NAME.supergraph-eg.dot.
10391 * exploded-graph.h (exploded_node::get_dot_fillcolor): Make
10392 public.
10393 (exploded_path::feasible_p): Add OUT param.
10394 (class feasibility_problem): New class.
10395 * state-purge.cc (state_purge_annotator::add_node_annotations):
10396 Return a bool, add a "within_table" param.
10397 (print_vec_of_names): Convert begin_tr calls to begin_trtd.
10398 Convert end_tr calls to end_tdtr.
10399 (state_purge_annotator::add_stmt_annotations): Add "within_row"
10400 param.
10401 * state-purge.h ((state_purge_annotator::add_node_annotations):
10402 Return a bool, add a "within_table" param.
10403 (state_purge_annotator::add_stmt_annotations): Add "within_row"
10404 param.
10405 * supergraph.cc (supernode::dump_dot): Call add_node_annotations
10406 twice: as before, passing false for "within_table", then again
10407 with true when within the TABLE element. Convert some begin_tr
10408 calls to begin_trtd, and some end_tr calls to end_tdtr.
10409 Repeat each add_stmt_annotations call, distinguishing between
10410 calls that add TRs and those that add TDs to an existing TR.
10411 Add a call to add_after_node_annotations.
10412 * supergraph.h (dot_annotator::add_node_annotations): Add a
10413 "within_table" param.
10414 (dot_annotator::add_stmt_annotations): Add a "within_row" param.
10415 (dot_annotator::add_after_node_annotations): New vfunc.
10417 2020-03-27 David Malcolm <dmalcolm@redhat.com>
10419 * diagnostic-manager.cc (dedupe_winners::add): Show the
10420 exploded_node index in the log messages.
10421 (diagnostic_manager::emit_saved_diagnostics): Log a summary of
10422 m_saved_diagnostics at entry.
10424 2020-03-27 David Malcolm <dmalcolm@redhat.com>
10426 * supergraph.cc (superedge::dump): Add space before description;
10427 move newline to non-pretty_printer overload.
10429 2020-03-18 David Malcolm <dmalcolm@redhat.com>
10431 * region-model.cc: Include "stor-layout.h".
10432 (region_model::dump_to_pp): Rather than calling
10433 dump_summary_of_map on each of the current frame and the globals,
10434 instead get a vec of representative path_vars for all regions,
10435 and then dump a summary of all of them.
10436 (region_model::dump_summary_of_map): Delete, rewriting into...
10437 (region_model::dump_summary_of_rep_path_vars): ...this new
10438 function, working on a vec of path_vars.
10439 (region_model::set_value): New overload.
10440 (region_model::get_representative_path_var): Rename
10441 "parent_region" local to "parent_reg" and consolidate with other
10442 local. Guard test for grandparent being stack on parent_reg being
10443 non-NULL. Move handling for parent being an array_region to
10444 within guard for parent_reg being non-NULL.
10445 (selftest::make_test_compound_type): New function.
10446 (selftest::test_dump_2): New selftest.
10447 (selftest::test_dump_3): New selftest.
10448 (selftest::test_stack_frames): Update expected output from
10449 simplified dump to show "a" and "b" from parent frame and "y" in
10450 child frame.
10451 (selftest::analyzer_region_model_cc_tests): Call test_dump_2 and
10452 test_dump_3.
10453 * region-model.h (region_model::set_value): New overload decl.
10454 (region_model::dump_summary_of_map): Delete.
10455 (region_model::dump_summary_of_rep_path_vars): New.
10457 2020-03-18 David Malcolm <dmalcolm@redhat.com>
10459 * region-model.h (class noop_region_model_context): New subclass
10460 of region_model_context.
10461 (class tentative_region_model_context): Inherit from
10462 noop_region_model_context rather than from region_model_context;
10463 drop redundant vfunc implementations.
10464 (class test_region_model_context): Likewise.
10466 2020-03-18 David Malcolm <dmalcolm@redhat.com>
10468 * engine.cc (exploded_node::exploded_node): Move implementation
10469 here from header; accept point_and_state by const reference rather
10470 than by value.
10471 * exploded-graph.h (exploded_node::exploded_node): Pass
10472 point_and_state by const reference rather than by value. Move
10473 body to engine.cc.
10475 2020-03-18 Jakub Jelinek <jakub@redhat.com>
10477 * sm-malloc.cc (malloc_state_machine::on_stmt): Fix up duplicated word
10478 issue in a comment.
10479 * region-model.cc (region_model::make_region_for_unexpected_tree_code,
10480 region_model::delete_region_and_descendents): Likewise.
10481 * engine.cc (class exploded_cluster): Likewise.
10482 * diagnostic-manager.cc (class path_builder): Likewise.
10484 2020-03-13 David Malcolm <dmalcolm@redhat.com>
10486 PR analyzer/94099
10487 PR analyzer/94105
10488 * diagnostic-manager.cc (for_each_state_change): Bulletproof
10489 against errors in get_rvalue by passing a
10490 tentative_region_model_context and rejecting if there's an error.
10491 * region-model.cc (region_model::get_lvalue_1): When handling
10492 ARRAY_REF, handle results of error-handling. Handle NOP_EXPR.
10494 2020-03-06 David Malcolm <dmalcolm@redhat.com>
10496 * analyzer.h (class array_region): New forward decl.
10497 * program-state.cc (selftest::test_program_state_dumping_2): New.
10498 (selftest::analyzer_program_state_cc_tests): Call it.
10499 * region-model.cc (array_region::constant_from_key): New.
10500 (region_model::get_representative_tree): Handle region_svalue by
10501 generating an ADDR_EXPR.
10502 (region_model::get_representative_path_var): In view handling,
10503 remove erroneous TREE_TYPE when determining the type of the tree.
10504 Handle array regions and STRING_CST.
10505 (selftest::assert_dump_tree_eq): New.
10506 (ASSERT_DUMP_TREE_EQ): New macro.
10507 (selftest::test_get_representative_tree): New selftest.
10508 (selftest::analyzer_region_model_cc_tests): Call it.
10509 * region-model.h (region::dyn_cast_array_region): New vfunc.
10510 (array_region::dyn_cast_array_region): New vfunc implementation.
10511 (array_region::constant_from_key): New decl.
10513 2020-03-06 David Malcolm <dmalcolm@redhat.com>
10515 * analyzer.h (dump_quoted_tree): New decl.
10516 * engine.cc (exploded_node::dump_dot): Pass region model to
10517 sm_state_map::print.
10518 * program-state.cc: Include diagnostic-core.h.
10519 (sm_state_map::print): Add "model" param and use it to print
10520 representative trees. Only print origin information if non-null.
10521 (sm_state_map::dump): Pass NULL for model to print call.
10522 (program_state::print): Pass region model to sm_state_map::print.
10523 (program_state::dump_to_pp): Use spaces rather than newlines when
10524 summarizing. Pass region_model to sm_state_map::print.
10525 (ana::selftest::assert_dump_eq): New function.
10526 (ASSERT_DUMP_EQ): New macro.
10527 (ana::selftest::test_program_state_dumping): New function.
10528 (ana::selftest::analyzer_program_state_cc_tests): Call it.
10529 * program-state.h (program_state::print): Add model param.
10530 * region-model.cc (dump_quoted_tree): New function.
10531 (map_region::print_fields): Use dump_quoted_tree rather than
10532 %qE to avoid lang-dependent output.
10533 (map_region::dump_child_label): Likewise.
10534 (region_model::dump_summary_of_map): For SK_REGION, when
10535 get_representative_path_var fails, print the region id rather than
10536 erroneously printing NULL.
10537 * sm.cc (state_machine::get_state_by_name): New function.
10538 * sm.h (state_machine::get_state_by_name): New decl.
10540 2020-03-04 David Malcolm <dmalcolm@redhat.com>
10542 * region-model.cc (region::validate): Convert model param from ptr
10543 to reference. Update comment to reflect that it's now a vfunc.
10544 (map_region::validate): New vfunc implementation.
10545 (array_region::validate): New vfunc implementation.
10546 (stack_region::validate): New vfunc implementation.
10547 (root_region::validate): New vfunc implementation.
10548 (region_model::validate): Pass a reference rather than a pointer
10549 to the region::validate vfunc.
10550 * region-model.h (region::validate): Make virtual. Convert model
10551 param from ptr to reference.
10552 (map_region::validate): New vfunc decl.
10553 (array_region::validate): New vfunc decl.
10554 (stack_region::validate): New vfunc decl.
10555 (root_region::validate): New vfunc decl.
10557 2020-03-04 David Malcolm <dmalcolm@redhat.com>
10559 PR analyzer/93993
10560 * region-model.cc (region_model::on_call_pre): Handle
10561 BUILT_IN_EXPECT and its variants.
10562 (region_model::add_any_constraints_from_ssa_def_stmt): Split out
10563 gassign handling into add_any_constraints_from_gassign; add gcall
10564 handling.
10565 (region_model::add_any_constraints_from_gassign): New function,
10566 based on the above. Add handling for NOP_EXPR.
10567 (region_model::add_any_constraints_from_gcall): New function.
10568 (region_model::get_representative_path_var): Handle views.
10569 * region-model.h
10570 (region_model::add_any_constraints_from_ssa_def_stmt): New decl.
10571 (region_model::add_any_constraints_from_gassign): New decl.
10573 2020-03-04 David Malcolm <dmalcolm@redhat.com>
10575 PR analyzer/93993
10576 * checker-path.h (state_change_event::get_lvalue): Add ctxt param
10577 and pass it to region_model::get_value call.
10578 * diagnostic-manager.cc (get_any_origin): Pass a
10579 tentative_region_model_context to the calls to get_lvalue and reject
10580 the comparison if errors occur.
10581 (can_be_expr_of_interest_p): New function.
10582 (diagnostic_manager::prune_for_sm_diagnostic): Replace checks for
10583 CONSTANT_CLASS_P with calls to update_for_unsuitable_sm_exprs.
10584 Pass a tentative_region_model_context to the calls to
10585 state_change_event::get_lvalue and reject the comparison if errors
10586 occur.
10587 (diagnostic_manager::update_for_unsuitable_sm_exprs): New.
10588 * diagnostic-manager.h
10589 (diagnostic_manager::update_for_unsuitable_sm_exprs): New decl.
10590 * region-model.h (class tentative_region_model_context): New class.
10592 2020-03-04 David Malcolm <dmalcolm@redhat.com>
10594 * engine.cc (worklist::worklist): Remove unused field m_eg.
10595 (class viz_callgraph_edge): Remove unused field m_call_sedge.
10596 (class viz_callgraph): Remove unused field m_sg.
10597 * exploded-graph.h (worklist::::m_eg): Remove unused field.
10599 2020-03-02 David Malcolm <dmalcolm@redhat.com>
10601 * analyzer.opt (fanalyzer-show-duplicate-count): New option.
10602 * diagnostic-manager.cc
10603 (diagnostic_manager::emit_saved_diagnostic): Use the above to
10604 guard the printing of the duplicate count.
10606 2020-03-02 David Malcolm <dmalcolm@redhat.com>
10608 PR analyzer/93959
10609 * analyzer.cc (is_std_function_p): New function.
10610 (is_std_named_call_p): New functions.
10611 * analyzer.h (is_std_named_call_p): New decl.
10612 * sm-malloc.cc (malloc_state_machine::on_stmt): Check for "std::"
10613 variants when checking for malloc, calloc and free.
10615 2020-02-26 David Malcolm <dmalcolm@redhat.com>
10617 PR analyzer/93950
10618 * diagnostic-manager.cc
10619 (diagnostic_manager::prune_for_sm_diagnostic): Assert that var is
10620 either NULL or not a constant. When updating var, bulletproof
10621 against constant values.
10623 2020-02-26 David Malcolm <dmalcolm@redhat.com>
10625 PR analyzer/93947
10626 * region-model.cc (region_model::get_fndecl_for_call): Gracefully
10627 fail for fn_decls that don't have a cgraph_node.
10629 2020-02-26 David Malcolm <dmalcolm@redhat.com>
10631 * bar-chart.cc: New file.
10632 * bar-chart.h: New file.
10633 * engine.cc: Include "analyzer/bar-chart.h".
10634 (stats::log): Only log the m_num_nodes kinds that are non-zero.
10635 (stats::dump): Likewise when dumping.
10636 (stats::get_total_enodes): New.
10637 (exploded_graph::get_or_create_node): Increment the per-point-data
10638 m_excess_enodes when hitting the per-program-point limit on
10639 enodes.
10640 (exploded_graph::print_bar_charts): New.
10641 (exploded_graph::log_stats): Log the number of unprocessed enodes
10642 in the worklist. Call print_bar_charts.
10643 (exploded_graph::dump_stats): Print the number of unprocessed
10644 enodes in the worklist.
10645 * exploded-graph.h (stats::get_total_enodes): New decl.
10646 (struct per_program_point_data): Add field m_excess_enodes.
10647 (exploded_graph::print_bar_charts): New decl.
10648 * supergraph.cc (superedge::dump): New.
10649 (superedge::dump): New.
10650 * supergraph.h (supernode::get_function): New.
10651 (superedge::dump): New decl.
10652 (superedge::dump): New decl.
10654 2020-02-24 David Malcolm <dmalcolm@redhat.com>
10656 * engine.cc (exploded_graph::get_or_create_node): Dump the
10657 program_state to the pp, rather than to stderr.
10659 2020-02-24 David Malcolm <dmalcolm@redhat.com>
10661 PR analyzer/93032
10662 * sm.cc (make_checkers): Require the "taint" checker to be
10663 explicitly enabled.
10665 2020-02-24 David Malcolm <dmalcolm@redhat.com>
10667 PR analyzer/93899
10668 * engine.cc
10669 (impl_region_model_context::impl_region_model_context): Add logger
10670 param.
10671 * engine.cc (exploded_graph::add_function_entry): Create an
10672 impl_region_model_context and pass it to the push_frame call.
10673 Bail if the resulting state is invalid.
10674 (exploded_graph::build_initial_worklist): Likewise.
10675 (exploded_graph::build_initial_worklist): Handle the case where
10676 add_function_entry fails.
10677 * exploded-graph.h
10678 (impl_region_model_context::impl_region_model_context): Add logger
10679 param.
10680 * region-model.cc (map_region::get_or_create): Add ctxt param and
10681 pass it to add_region_for_type.
10682 (map_region::can_merge_p): Pass NULL as a ctxt to call to
10683 get_or_create.
10684 (array_region::get_element): Pass ctxt to call to get_or_create.
10685 (array_region::get_or_create): Add ctxt param and pass it to
10686 add_region_for_type.
10687 (root_region::push_frame): Pass ctxt to get_or_create calls.
10688 (region_model::get_lvalue_1): Likewise.
10689 (region_model::make_region_for_unexpected_tree_code): Assert that
10690 ctxt is non-NULL.
10691 (region_model::get_rvalue_1): Pass ctxt to get_svalue_for_fndecl
10692 and get_svalue_for_label calls.
10693 (region_model::get_svalue_for_fndecl): Add ctxt param and pass it
10694 to get_region_for_fndecl.
10695 (region_model::get_region_for_fndecl): Add ctxt param and pass it
10696 to get_or_create.
10697 (region_model::get_svalue_for_label): Add ctxt param and pass it
10698 to get_region_for_label.
10699 (region_model::get_region_for_label): Add ctxt param and pass it
10700 to get_region_for_fndecl and get_or_create.
10701 (region_model::get_field_region): Add ctxt param and pass it to
10702 get_or_create_view and get_or_create.
10703 (make_region_for_type): Replace gcc_unreachable with return NULL.
10704 (region_model::add_region_for_type): Add ctxt param. Handle a
10705 return of NULL from make_region_for_type by calling
10706 make_region_for_unexpected_tree_code.
10707 (region_model::get_or_create_mem_ref): Pass ctxt to calls to
10708 get_or_create_view.
10709 (region_model::get_or_create_view): Add ctxt param and pass it to
10710 add_region_for_type.
10711 (selftest::test_state_merging): Pass ctxt to get_or_create_view.
10712 * region-model.h (region_model::get_or_create): Add ctxt param.
10713 (region_model::add_region_for_type): Likewise.
10714 (region_model::get_svalue_for_fndecl): Likewise.
10715 (region_model::get_svalue_for_label): Likewise.
10716 (region_model::get_region_for_fndecl): Likewise.
10717 (region_model::get_region_for_label): Likewise.
10718 (region_model::get_field_region): Likewise.
10719 (region_model::get_or_create_view): Likewise.
10721 2020-02-24 David Malcolm <dmalcolm@redhat.com>
10723 * checker-path.cc (superedge_event::should_filter_p): Update
10724 filter for empty descriptions to cover verbosity level 3 as well
10725 as 2.
10726 * diagnostic-manager.cc: Include "analyzer/reachability.h".
10727 (class path_builder): New class.
10728 (diagnostic_manager::emit_saved_diagnostic): Create a path_builder
10729 and pass it to build_emission_path, rather passing eg; similarly
10730 for add_events_for_eedge and ext_state.
10731 (diagnostic_manager::build_emission_path): Replace "eg" param
10732 with a path_builder, pass it to add_events_for_eedge.
10733 (diagnostic_manager::add_events_for_eedge): Replace ext_state
10734 param with path_builder; pass it to add_events_for_superedge.
10735 (diagnostic_manager::significant_edge_p): New.
10736 (diagnostic_manager::add_events_for_superedge): Add path_builder
10737 param. Reject insignificant edges at verbosity levels below 3.
10738 (diagnostic_manager::prune_for_sm_diagnostic): Update highest
10739 verbosity level to 4.
10740 * diagnostic-manager.h (class path_builder): New forward decl.
10741 (diagnostic_manager::build_emission_path): Replace "eg" param
10742 with a path_builder.
10743 (diagnostic_manager::add_events_for_eedge): Replace ext_state
10744 param with path_builder.
10745 (diagnostic_manager::significant_edge_p): New.
10746 (diagnostic_manager::add_events_for_superedge): Add path_builder
10747 param.
10748 * reachability.h: New file.
10750 2020-02-18 David Malcolm <dmalcolm@redhat.com>
10752 PR analyzer/93692
10753 * analyzer.opt (fdump-analyzer-callgraph): Rewrite description.
10755 2020-02-18 David Malcolm <dmalcolm@redhat.com>
10757 PR analyzer/93777
10758 * region-model.cc (region_model::maybe_cast_1): Replace assertion
10759 that build_cast returns non-NULL with a conditional, falling
10760 through to the logic which returns a new unknown value of the
10761 desired type if it fails.
10763 2020-02-18 David Malcolm <dmalcolm@redhat.com>
10765 PR analyzer/93778
10766 * engine.cc (impl_region_model_context::on_unknown_tree_code):
10767 Rename to...
10768 (impl_region_model_context::on_unexpected_tree_code): ...this and
10769 convert first argument from path_var to tree.
10770 (exploded_node::on_stmt): Pass ctxt to purge_for_unknown_fncall.
10771 * exploded-graph.h (region_model_context::on_unknown_tree_code):
10772 Rename to...
10773 (region_model_context::on_unexpected_tree_code): ...this and
10774 convert first argument from path_var to tree.
10775 * program-state.cc (sm_state_map::purge_for_unknown_fncall): Add
10776 ctxt param and pass on to calls to get_rvalue.
10777 * program-state.h (sm_state_map::purge_for_unknown_fncall): Add
10778 ctxt param.
10779 * region-model.cc (region_model::handle_unrecognized_call): Pass
10780 ctxt on to call to get_rvalue.
10781 (region_model::get_lvalue_1): Move body of default case to
10782 region_model::make_region_for_unexpected_tree_code and call it.
10783 Within COMPONENT_REF case, reject attempts to handle types other
10784 than RECORD_TYPE and UNION_TYPE.
10785 (region_model::make_region_for_unexpected_tree_code): New
10786 function, based on default case of region_model::get_lvalue_1.
10787 * region-model.h
10788 (region_model::make_region_for_unexpected_tree_code): New decl.
10789 (region_model::on_unknown_tree_code): Rename to...
10790 (region_model::on_unexpected_tree_code): ...this and convert first
10791 argument from path_var to tree.
10792 (class test_region_model_context): Update vfunc implementation for
10793 above change.
10795 2020-02-18 David Malcolm <dmalcolm@redhat.com>
10797 PR analyzer/93774
10798 * region-model.cc
10799 (region_model::convert_byte_offset_to_array_index): Use
10800 int_size_in_bytes before calling size_in_bytes, to gracefully fail
10801 on incomplete types.
10803 2020-02-17 David Malcolm <dmalcolm@redhat.com>
10805 PR analyzer/93775
10806 * region-model.cc (region_model::get_fndecl_for_call): Handle the
10807 case where the code_region's get_tree_for_child_region returns
10808 NULL.
10810 2020-02-17 David Malcolm <dmalcolm@redhat.com>
10812 PR analyzer/93388
10813 * engine.cc (impl_region_model_context::on_unknown_tree_code):
10814 New.
10815 (exploded_graph::get_or_create_node): Reject invalid states.
10816 * exploded-graph.h
10817 (impl_region_model_context::on_unknown_tree_code): New decl.
10818 (point_and_state::point_and_state): Assert that the state is
10819 valid.
10820 * program-state.cc (program_state::program_state): Initialize
10821 m_valid to true.
10822 (program_state::operator=): Copy m_valid.
10823 (program_state::program_state): Likewise for move constructor.
10824 (program_state::print): Print m_valid.
10825 (program_state::dump_to_pp): Likewise.
10826 * program-state.h (program_state::m_valid): New field.
10827 * region-model.cc (region_model::get_lvalue_1): Implement the
10828 default case by returning a new symbolic region and calling
10829 the context's on_unknown_tree_code, rather than issuing an
10830 internal_error. Implement VIEW_CONVERT_EXPR.
10831 * region-model.h (region_model_context::on_unknown_tree_code): New
10832 vfunc.
10833 (test_region_model_context::on_unknown_tree_code): New.
10835 2020-02-17 David Malcolm <dmalcolm@redhat.com>
10837 * sm-malloc.cc (malloc_diagnostic::describe_state_change): For
10838 transition to the "null" state, only say "assuming" when
10839 transitioning from the "unchecked" state.
10841 2020-02-17 David Malcolm <dmalcolm@redhat.com>
10843 * diagnostic-manager.h (diagnostic_manager::get_saved_diagnostic):
10844 Add const overload.
10845 * engine.cc (exploded_node::dump_dot): Dump saved_diagnostics.
10846 * exploded-graph.h (exploded_graph::get_diagnostic_manager): Add
10847 const overload.
10849 2020-02-11 David Malcolm <dmalcolm@redhat.com>
10851 PR analyzer/93288
10852 * analysis-plan.cc (analysis_plan::use_summary_p): Look through
10853 the ultimate_alias_target when getting the called function.
10854 * engine.cc (exploded_node::on_stmt): Rename second "ctxt" to
10855 "sm_ctxt". Use the region_model's get_fndecl_for_call rather than
10856 gimple_call_fndecl.
10857 * region-model.cc (region_model::get_fndecl_for_call): Use
10858 ultimate_alias_target on fndecl.
10859 * supergraph.cc (get_ultimate_function_for_cgraph_edge): New
10860 function.
10861 (supergraph_call_edge): Use it when rejecting edges without
10862 functions.
10863 (supergraph::supergraph): Use it to get the function for the
10864 cgraph_edge when building interprocedural superedges.
10865 (callgraph_superedge::get_callee_function): Use it.
10866 * supergraph.h (supergraph::get_num_snodes): Make param const.
10867 (supergraph::function_to_num_snodes_t): Make first type param
10868 const.
10870 2020-02-11 David Malcolm <dmalcolm@redhat.com>
10872 PR analyzer/93374
10873 * engine.cc (exploded_edge::exploded_edge): Add ext_state param
10874 and pass it to change.validate.
10875 (exploded_graph::get_or_create_node): Move purging of change
10876 svalues to also cover the case of reusing an existing enode.
10877 (exploded_graph::add_edge): Pass m_ext_state to exploded_edge's
10878 ctor.
10879 * exploded-graph.h (exploded_edge::exploded_edge): Add ext_state
10880 param.
10881 * program-state.cc (state_change::sm_change::validate): Likewise.
10882 Assert that m_sm_idx is sane. Use ext_state to validate
10883 m_old_state and m_new_state.
10884 (state_change::validate): Add ext_state param and pass it to
10885 the sm_change validate calls.
10886 * program-state.h (state_change::sm_change::validate): Add
10887 ext_state param.
10888 (state_change::validate): Likewise.
10890 2020-02-11 David Malcolm <dmalcolm@redhat.com>
10892 PR analyzer/93669
10893 * engine.cc (exploded_graph::dump_exploded_nodes): Handle missing
10894 case of STATUS_WORKLIST in implementation of
10895 "__analyzer_dump_exploded_nodes".
10897 2020-02-11 David Malcolm <dmalcolm@redhat.com>
10899 PR analyzer/93649
10900 * constraint-manager.cc (constraint_manager::add_constraint): When
10901 merging equivalence classes and updating m_constant, also update
10902 m_cst_sid.
10903 (constraint_manager::validate): If m_constant is non-NULL assert
10904 that m_cst_sid is non-null and is valid.
10906 2020-02-11 David Malcolm <dmalcolm@redhat.com>
10908 PR analyzer/93657
10909 * analyzer.opt (fdump-analyzer): Reword description.
10910 (fdump-analyzer-stderr): Likewise.
10912 2020-02-11 David Malcolm <dmalcolm@redhat.com>
10914 * region-model.cc (print_quoted_type): New function.
10915 (svalue::print): Use it to replace %qT.
10916 (region::dump_to_pp): Likewise.
10917 (region::dump_child_label): Likewise.
10918 (region::print_fields): Likewise.
10920 2020-02-10 David Malcolm <dmalcolm@redhat.com>
10922 PR analyzer/93659
10923 * analyzer.opt (-param=analyzer-max-recursion-depth=): Fix "tha"
10924 -> "that" typo.
10925 (Wanalyzer-use-of-uninitialized-value): Fix "initialized" ->
10926 "uninitialized" typo.
10928 2020-02-10 David Malcolm <dmalcolm@redhat.com>
10930 PR analyzer/93350
10931 * region-model.cc (region_model::get_lvalue_1):
10932 Handle BIT_FIELD_REF.
10933 (make_region_for_type): Handle VECTOR_TYPE.
10935 2020-02-10 David Malcolm <dmalcolm@redhat.com>
10937 PR analyzer/93647
10938 * diagnostic-manager.cc
10939 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof against
10940 VAR being constant.
10941 * region-model.cc (region_model::get_lvalue_1): Provide a better
10942 error message when encountering an unhandled tree code.
10944 2020-02-10 David Malcolm <dmalcolm@redhat.com>
10946 PR analyzer/93405
10947 * region-model.cc (region_model::get_lvalue_1): Implement
10948 CONST_DECL.
10950 2020-02-06 David Malcolm <dmalcolm@redhat.com>
10952 * region-model.cc (region_model::maybe_cast_1): Attempt to provide
10953 a region_svalue if either type is a pointer, rather than if both
10954 types are pointers.
10956 2020-02-05 David Malcolm <dmalcolm@redhat.com>
10958 * engine.cc (exploded_node::dump_dot): Show merger enodes.
10959 (worklist::add_node): Assert that the node's m_status is
10960 STATUS_WORKLIST.
10961 (exploded_graph::process_worklist): Likewise for nodes from the
10962 worklist. Set status of merged nodes to STATUS_MERGER.
10963 (exploded_graph::process_node): Set status of node to
10964 STATUS_PROCESSED.
10965 (exploded_graph::dump_exploded_nodes): Rework handling of
10966 "__analyzer_dump_exploded_nodes", splitting enodes by status into
10967 "processed" and "merger", showing the count of just the processed
10968 enodes at the call, rather than the count of all enodes.
10969 * exploded-graph.h (exploded_node::status): New enum.
10970 (exploded_node::exploded_node): Initialize m_status to
10971 STATUS_WORKLIST.
10972 (exploded_node::get_status): New getter.
10973 (exploded_node::set_status): New setter.
10975 2020-02-04 David Malcolm <dmalcolm@redhat.com>
10977 PR analyzer/93543
10978 * engine.cc (pod_hash_traits<function_call_string>::mark_empty):
10979 Eliminate reinterpret_cast.
10980 (pod_hash_traits<function_call_string>::is_empty): Likewise.
10982 2020-02-03 David Malcolm <dmalcolm@redhat.com>
10984 * constraint-manager.cc (range::constrained_to_single_element):
10985 Replace fold_build2 with fold_binary. Remove unnecessary newline.
10986 (constraint_manager::get_or_add_equiv_class): Replace fold_build2
10987 with fold_binary in two places, and remove out-of-date comment.
10988 (constraint_manager::eval_condition): Replace fold_build2 with
10989 fold_binary.
10990 * region-model.cc (constant_svalue::eval_condition): Likewise.
10991 (region_model::on_assignment): Likewise.
10993 2020-02-03 David Malcolm <dmalcolm@redhat.com>
10995 PR analyzer/93544
10996 * diagnostic-manager.cc
10997 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof
10998 against bad choices due to bad paths.
10999 * engine.cc (impl_region_model_context::on_phi): New.
11000 * exploded-graph.h (impl_region_model_context::on_phi): New decl.
11001 * region-model.cc (region_model::on_longjmp): Likewise.
11002 (region_model::handle_phi): Add phi param. Call the ctxt's on_phi
11003 vfunc.
11004 (region_model::update_for_phis): Pass phi to handle_phi.
11005 * region-model.h (region_model::handle_phi): Add phi param.
11006 (region_model_context::on_phi): New vfunc.
11007 (test_region_model_context::on_phi): New.
11008 * sm-malloc.cc (malloc_state_machine::on_phi): New.
11009 (malloc_state_machine::on_zero_assignment): New.
11010 * sm.h (state_machine::on_phi): New vfunc.
11012 2020-02-03 David Malcolm <dmalcolm@redhat.com>
11014 * engine.cc (supernode_cluster::dump_dot): Show BB index as
11015 well as SN index.
11016 * supergraph.cc (supernode::dump_dot): Likewise.
11018 2020-02-03 David Malcolm <dmalcolm@redhat.com>
11020 PR analyzer/93546
11021 * region-model.cc (region_model::on_call_pre): Update for new
11022 param of symbolic_region ctor.
11023 (region_model::deref_rvalue): Likewise.
11024 (region_model::add_new_malloc_region): Likewise.
11025 (make_region_for_type): Likewise, preserving type.
11026 * region-model.h (symbolic_region::symbolic_region): Add "type"
11027 param and pass it to base class ctor.
11029 2020-02-03 David Malcolm <dmalcolm@redhat.com>
11031 PR analyzer/93547
11032 * constraint-manager.cc
11033 (constraint_manager::get_or_add_equiv_class): Ensure types are
11034 compatible before comparing constants.
11036 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11038 PR analyzer/93457
11039 * region-model.cc (make_region_for_type): Use VOID_TYPE_P rather
11040 than checking against void_type_node.
11042 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11044 PR analyzer/93373
11045 * region-model.cc (ASSERT_COMPAT_TYPES): Convert to...
11046 (assert_compat_types): ...this, and bail when either type is NULL,
11047 or when VOID_TYPE_P (dst_type).
11048 (region_model::get_lvalue): Update for above conversion.
11049 (region_model::get_rvalue): Likewise.
11051 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11053 PR analyzer/93379
11054 * region-model.cc (region_model::update_for_return_superedge):
11055 Move check for null result so that it also guards setting the
11056 lhs.
11058 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11060 PR analyzer/93438
11061 * region-model.cc (stack_region::can_merge_p): Split into a two
11062 pass approach, creating all stack regions first, then populating
11063 them.
11064 (selftest::test_state_merging): Add test coverage for (a) the case
11065 of self-merging a model in which a local in an older stack frame
11066 points to a local in a more recent stack frame (which previously
11067 would ICE), and (b) the case of self-merging a model in which a
11068 local points to a global (which previously worked OK).
11070 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11072 * analyzer.cc (is_named_call_p): Replace tests for fndecl being
11073 extern at file scope and having a non-NULL DECL_NAME with a call
11074 to maybe_special_function_p.
11075 * function-set.cc (function_set::contains_decl_p): Add call to
11076 maybe_special_function_p.
11078 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11080 PR analyzer/93450
11081 * constraint-manager.cc
11082 (constraint_manager::get_or_add_equiv_class): Only compare constants
11083 if their types are compatible.
11084 * region-model.cc (constant_svalue::eval_condition): Replace check
11085 for identical types with call to types_compatible_p.
11087 2020-01-30 David Malcolm <dmalcolm@redhat.com>
11089 * program-state.cc (extrinsic_state::dump_to_pp): New.
11090 (extrinsic_state::dump_to_file): New.
11091 (extrinsic_state::dump): New.
11092 * program-state.h (extrinsic_state::dump_to_pp): New decl.
11093 (extrinsic_state::dump_to_file): New decl.
11094 (extrinsic_state::dump): New decl.
11095 * sm.cc: Include "pretty-print.h".
11096 (state_machine::dump_to_pp): New.
11097 * sm.h (state_machine::dump_to_pp): New decl.
11099 2020-01-30 David Malcolm <dmalcolm@redhat.com>
11101 * diagnostic-manager.cc (for_each_state_change): Use
11102 extrinsic_state::get_num_checkers rather than accessing m_checkers
11103 directly.
11104 * program-state.cc (program_state::program_state): Likewise.
11105 * program-state.h (extrinsic_state::m_checkers): Make private.
11107 2020-01-30 David Malcolm <dmalcolm@redhat.com>
11109 PR analyzer/93356
11110 * region-model.cc (region_model::eval_condition): In both
11111 overloads, bail out immediately on floating-point types.
11112 (region_model::eval_condition_without_cm): Likewise.
11113 (region_model::add_constraint): Likewise.
11115 2020-01-30 David Malcolm <dmalcolm@redhat.com>
11117 PR analyzer/93450
11118 * program-state.cc (sm_state_map::set_state): For the overload
11119 taking an svalue_id, bail out if the set_state on the ec does
11120 nothing. Convert the latter's return type from void to bool,
11121 returning true if anything changed.
11122 (sm_state_map::impl_set_state): Convert the return type from void
11123 to bool, returning true if the state changed.
11124 * program-state.h (sm_state_map::set_state): Convert return type
11125 from void to bool.
11126 (sm_state_map::impl_set_state): Likewise.
11127 * region-model.cc (constant_svalue::eval_condition): Only call
11128 fold_build2 if the types are the same.
11130 2020-01-29 Jakub Jelinek <jakub@redhat.com>
11132 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Remove.
11133 * constraint-manager.cc: Include diagnostic-core.h before graphviz.h.
11134 (range::dump, equiv_class::print): Don't use PUSH_IGNORE_WFORMAT or
11135 POP_IGNORE_WFORMAT.
11136 * state-purge.cc: Include diagnostic-core.h before
11137 gimple-pretty-print.h.
11138 (state_purge_annotator::add_node_annotations, print_vec_of_names):
11139 Don't use PUSH_IGNORE_WFORMAT or POP_IGNORE_WFORMAT.
11140 * region-model.cc: Move diagnostic-core.h include before graphviz.h.
11141 (path_var::dump, svalue::print, constant_svalue::print_details,
11142 region::dump_to_pp, region::dump_child_label, region::print_fields,
11143 map_region::print_fields, map_region::dump_dot_to_pp,
11144 map_region::dump_child_label, array_region::print_fields,
11145 array_region::dump_dot_to_pp): Don't use PUSH_IGNORE_WFORMAT or
11146 POP_IGNORE_WFORMAT.
11148 2020-01-28 David Malcolm <dmalcolm@redhat.com>
11150 PR analyzer/93316
11151 * engine.cc (rewind_info_t::update_model): Get the longjmp call
11152 stmt via get_longjmp_call () rather than assuming it is the last
11153 stmt in the longjmp's supernode.
11154 (rewind_info_t::add_events_to_path): Get the location_t for the
11155 rewind_from_longjmp_event via get_longjmp_call () rather than from
11156 the supernode's get_end_location ().
11158 2020-01-28 David Malcolm <dmalcolm@redhat.com>
11160 * region-model.cc (poisoned_value_diagnostic::emit): Update for
11161 renaming of warning_at overload to warning_meta.
11162 * sm-file.cc (file_leak::emit): Likewise.
11163 * sm-malloc.cc (double_free::emit): Likewise.
11164 (possible_null_deref::emit): Likewise.
11165 (possible_null_arg::emit): Likewise.
11166 (null_deref::emit): Likewise.
11167 (null_arg::emit): Likewise.
11168 (use_after_free::emit): Likewise.
11169 (malloc_leak::emit): Likewise.
11170 (free_of_non_heap::emit): Likewise.
11171 * sm-sensitive.cc (exposure_through_output_file::emit): Likewise.
11172 * sm-signal.cc (signal_unsafe_call::emit): Likewise.
11173 * sm-taint.cc (tainted_array_index::emit): Likewise.
11175 2020-01-27 David Malcolm <dmalcolm@redhat.com>
11177 PR analyzer/93451
11178 * region-model.cc (tree_cmp): For the REAL_CST case, impose an
11179 arbitrary order on NaNs relative to other NaNs and to non-NaNs;
11180 const-correctness tweak.
11181 (ana::selftests::build_real_cst_from_string): New function.
11182 (ana::selftests::append_interesting_constants): New function.
11183 (ana::selftests::test_tree_cmp_on_constants): New test.
11184 (ana::selftests::test_canonicalization_4): New test.
11185 (ana::selftests::analyzer_region_model_cc_tests): Call the new
11186 tests.
11188 2020-01-27 David Malcolm <dmalcolm@redhat.com>
11190 PR analyzer/93349
11191 * engine.cc (run_checkers): Save and restore input_location.
11193 2020-01-27 David Malcolm <dmalcolm@redhat.com>
11195 * call-string.cc (call_string::cmp_1): Delete, moving body to...
11196 (call_string::cmp): ...here.
11197 * call-string.h (call_string::cmp_1): Delete decl.
11198 * engine.cc (worklist::key_t::cmp_1): Delete, moving body to...
11199 (worklist::key_t::cmp): ...here. Implement hash comparisons
11200 via comparison rather than subtraction to avoid overflow issues.
11201 * exploded-graph.h (worklist::key_t::cmp_1): Delete decl.
11202 * region-model.cc (tree_cmp): Eliminate buggy checking for
11203 symmetry.
11205 2020-01-27 David Malcolm <dmalcolm@redhat.com>
11207 * analyzer.cc (is_named_call_p): Check that fndecl is "extern"
11208 and at file scope. Potentially disregard prefix _ or __ in
11209 fndecl's name. Bail if the identifier is NULL.
11210 (is_setjmp_call_p): Expect a gcall rather than plain gimple.
11211 Remove special-case check for leading prefix, and also check for
11212 sigsetjmp.
11213 (is_longjmp_call_p): Also check for siglongjmp.
11214 (get_user_facing_name): New function.
11215 * analyzer.h (is_setjmp_call_p): Expect a gcall rather than plain
11216 gimple.
11217 (get_user_facing_name): New decl.
11218 * checker-path.cc (setjmp_event::get_desc): Use
11219 get_user_facing_name to avoid hardcoding the function name.
11220 (rewind_event::rewind_event): Add rewind_info param, using it to
11221 initialize new m_rewind_info field, and strengthen the assertion.
11222 (rewind_from_longjmp_event::get_desc): Use get_user_facing_name to
11223 avoid hardcoding the function name.
11224 (rewind_to_setjmp_event::get_desc): Likewise.
11225 * checker-path.h (setjmp_event::setjmp_event): Add setjmp_call
11226 param and use it to initialize...
11227 (setjmp_event::m_setjmp_call): New field.
11228 (rewind_event::rewind_event): Add rewind_info param.
11229 (rewind_event::m_rewind_info): New protected field.
11230 (rewind_from_longjmp_event::rewind_from_longjmp_event): Add
11231 rewind_info param.
11232 (class rewind_to_setjmp_event): Move rewind_info field to parent
11233 class.
11234 * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
11235 Update setjmp-handling for is_setjmp_call_p requiring a gcall;
11236 pass the call to the new setjmp_event.
11237 * engine.cc (exploded_node::on_stmt): Update for is_setjmp_call_p
11238 requiring a gcall.
11239 (stale_jmp_buf::emit): Use get_user_facing_name to avoid
11240 hardcoding the function names.
11241 (exploded_node::on_longjmp): Pass the longjmp_call when
11242 constructing rewind_info.
11243 (rewind_info_t::add_events_to_path): Pass the rewind_info_t to the
11244 rewind_from_longjmp_event's ctor.
11245 * exploded-graph.h (rewind_info_t::rewind_info_t): Add
11246 longjmp_call param.
11247 (rewind_info_t::get_longjmp_call): New.
11248 (rewind_info_t::m_longjmp_call): New.
11249 * region-model.cc (region_model::on_setjmp): Update comment to
11250 indicate this is also for sigsetjmp.
11251 * region-model.h (struct setjmp_record): Likewise.
11252 (class setjmp_svalue): Likewise.
11254 2020-01-27 David Malcolm <dmalcolm@redhat.com>
11256 PR analyzer/93276
11257 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Guard these
11258 macros with GCC_VERSION >= 4006, making them no-op otherwise.
11259 * engine.cc (exploded_edge::exploded_edge): Specify template for
11260 base class initializer.
11261 (exploded_graph::add_edge): Specify template when chaining up to
11262 base class add_edge implementation.
11263 (viz_callgraph_node::dump_dot): Drop redundant "typename".
11264 (viz_callgraph_edge::viz_callgraph_edge): Specify template for
11265 base class initializer.
11266 * program-state.cc (sm_state_map::clone_with_remapping): Drop
11267 redundant "typename".
11268 (sm_state_map::print): Likewise.
11269 (sm_state_map::hash): Likewise.
11270 (sm_state_map::operator==): Likewise.
11271 (sm_state_map::remap_svalue_ids): Likewise.
11272 (sm_state_map::on_svalue_purge): Likewise.
11273 (sm_state_map::validate): Likewise.
11274 * program-state.h (sm_state_map::iterator_t): Likewise.
11275 * supergraph.h (superedge::superedge): Specify template for base
11276 class initializer.
11278 2020-01-23 David Malcolm <dmalcolm@redhat.com>
11280 PR analyzer/93375
11281 * supergraph.cc (callgraph_superedge::get_arg_for_parm): Fail
11282 gracefully is the number of parameters at the callee exceeds the
11283 number of arguments at the call stmt.
11284 (callgraph_superedge::get_parm_for_arg): Likewise.
11286 2020-01-22 David Malcolm <dmalcolm@redhat.com>
11288 PR analyzer/93382
11289 * program-state.cc (sm_state_map::on_svalue_purge): If the
11290 entry survives, but the origin is being purged, then reset the
11291 origin to null.
11293 2020-01-22 David Malcolm <dmalcolm@redhat.com>
11295 * sm-signal.cc: Fix nesting of CHECKING_P and namespace ana.
11297 2020-01-22 David Malcolm <dmalcolm@redhat.com>
11299 PR analyzer/93378
11300 * engine.cc (setjmp_svalue::compare_fields): Update for
11301 replacement of m_enode with m_setjmp_record.
11302 (setjmp_svalue::add_to_hash): Likewise.
11303 (setjmp_svalue::get_index): Rename...
11304 (setjmp_svalue::get_enode_index): ...to this.
11305 (setjmp_svalue::print_details): Update for replacement of m_enode
11306 with m_setjmp_record.
11307 (exploded_node::on_longjmp): Likewise.
11308 * exploded-graph.h (rewind_info_t::m_enode_origin): Replace...
11309 (rewind_info_t::m_setjmp_record): ...with this.
11310 (rewind_info_t::rewind_info_t): Update for replacement of m_enode
11311 with m_setjmp_record.
11312 (rewind_info_t::get_setjmp_point): Likewise.
11313 (rewind_info_t::get_setjmp_call): Likewise.
11314 * region-model.cc (region_model::dump_summary_of_map): Likewise.
11315 (region_model::on_setjmp): Likewise.
11316 * region-model.h (struct setjmp_record): New struct.
11317 (setjmp_svalue::m_enode): Replace...
11318 (setjmp_svalue::m_setjmp_record): ...with this.
11319 (setjmp_svalue::setjmp_svalue): Update for replacement of m_enode
11320 with m_setjmp_record.
11321 (setjmp_svalue::clone): Likewise.
11322 (setjmp_svalue::get_index): Rename...
11323 (setjmp_svalue::get_enode_index): ...to this.
11324 (setjmp_svalue::get_exploded_node): Replace...
11325 (setjmp_svalue::get_setjmp_record): ...with this.
11327 2020-01-22 David Malcolm <dmalcolm@redhat.com>
11329 PR analyzer/93316
11330 * analyzer.cc (is_setjmp_call_p): Check for "setjmp" as well as
11331 "_setjmp".
11333 2020-01-22 David Malcolm <dmalcolm@redhat.com>
11335 PR analyzer/93307
11336 * analysis-plan.h: Wrap everything namespace "ana".
11337 * analyzer-logging.cc: Likewise.
11338 * analyzer-logging.h: Likewise.
11339 * analyzer-pass.cc (pass_analyzer::execute): Update for "ana"
11340 namespace.
11341 * analyzer-selftests.cc: Wrap everything namespace "ana".
11342 * analyzer-selftests.h: Likewise.
11343 * analyzer.h: Likewise for forward decls of types.
11344 * call-string.h: Likewise.
11345 * checker-path.cc: Likewise.
11346 * checker-path.h: Likewise.
11347 * constraint-manager.cc: Likewise.
11348 * constraint-manager.h: Likewise.
11349 * diagnostic-manager.cc: Likewise.
11350 * diagnostic-manager.h: Likewise.
11351 * engine.cc: Likewise.
11352 * engine.h: Likewise.
11353 * exploded-graph.h: Likewise.
11354 * function-set.cc: Likewise.
11355 * function-set.h: Likewise.
11356 * pending-diagnostic.cc: Likewise.
11357 * pending-diagnostic.h: Likewise.
11358 * program-point.cc: Likewise.
11359 * program-point.h: Likewise.
11360 * program-state.cc: Likewise.
11361 * program-state.h: Likewise.
11362 * region-model.cc: Likewise.
11363 * region-model.h: Likewise.
11364 * sm-file.cc: Likewise.
11365 * sm-malloc.cc: Likewise.
11366 * sm-pattern-test.cc: Likewise.
11367 * sm-sensitive.cc: Likewise.
11368 * sm-signal.cc: Likewise.
11369 * sm-taint.cc: Likewise.
11370 * sm.cc: Likewise.
11371 * sm.h: Likewise.
11372 * state-purge.h: Likewise.
11373 * supergraph.cc: Likewise.
11374 * supergraph.h: Likewise.
11376 2020-01-21 David Malcolm <dmalcolm@redhat.com>
11378 PR analyzer/93352
11379 * region-model.cc (int_cmp): Rename to...
11380 (array_region::key_cmp): ...this, using key_t rather than int.
11381 Rewrite in terms of comparisons rather than subtraction to
11382 ensure qsort is anti-symmetric when handling extreme values.
11383 (array_region::walk_for_canonicalization): Update for above
11384 renaming.
11385 * region-model.h (array_region::key_cmp): New decl.
11387 2020-01-17 David Malcolm <dmalcolm@redhat.com>
11389 PR analyzer/93290
11390 * region-model.cc (region_model::eval_condition_without_cm): Avoid
11391 gcc_unreachable for unexpected operations for the case where
11392 we're comparing an svalue against itself.
11394 2020-01-17 David Malcolm <dmalcolm@redhat.com>
11396 PR analyzer/93281
11397 * region-model.cc
11398 (region_model::convert_byte_offset_to_array_index): Convert to
11399 ssizetype before dividing by byte_size. Use fold_binary rather
11400 than fold_build2 to avoid needlessly constructing a tree for the
11401 non-const case.
11403 2020-01-15 David Malcolm <dmalcolm@redhat.com>
11405 * engine.cc (class impl_region_model_context): Fix comment.
11407 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11409 PR analyzer/93212
11410 * region-model.cc (make_region_for_type): Use
11411 FUNC_OR_METHOD_TYPE_P rather than comparing against FUNCTION_TYPE.
11412 * region-model.h (function_region::function_region): Likewise.
11414 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11416 * program-state.cc (sm_state_map::clone_with_remapping): Copy
11417 m_global_state.
11418 (selftest::test_program_state_merging_2): New selftest.
11419 (selftest::analyzer_program_state_cc_tests): Call it.
11421 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11423 * checker-path.h (checker_path::get_checker_event): New function.
11424 (checker_path): Add DISABLE_COPY_AND_ASSIGN; make fields private.
11425 * diagnostic-manager.cc
11426 (diagnostic_manager::prune_for_sm_diagnostic): Replace direct
11427 access to checker_path::m_events with accessor functions. Fix
11428 overlong line.
11429 (diagnostic_manager::prune_interproc_events): Replace direct
11430 access to checker_path::m_events with accessor functions.
11431 (diagnostic_manager::finish_pruning): Likewise.
11433 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11435 * checker-path.h (checker_event::clone): Delete vfunc decl.
11436 (debug_event::clone): Delete vfunc impl.
11437 (custom_event::clone): Delete vfunc impl.
11438 (statement_event::clone): Delete vfunc impl.
11439 (function_entry_event::clone): Delete vfunc impl.
11440 (state_change_event::clone): Delete vfunc impl.
11441 (start_cfg_edge_event::clone): Delete vfunc impl.
11442 (end_cfg_edge_event::clone): Delete vfunc impl.
11443 (call_event::clone): Delete vfunc impl.
11444 (return_event::clone): Delete vfunc impl.
11445 (setjmp_event::clone): Delete vfunc impl.
11446 (rewind_from_longjmp_event::clone): Delete vfunc impl.
11447 (rewind_to_setjmp_event::clone): Delete vfunc impl.
11448 (warning_event::clone): Delete vfunc impl.
11450 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11452 * supergraph.cc (supernode::dump_dot): Ensure that the TABLE
11453 element has at least one TR.
11455 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11457 PR analyzer/58237
11458 * engine.cc (leak_stmt_finder::find_stmt): Use get_pure_location
11459 when comparing against UNKNOWN_LOCATION.
11460 (stmt_requires_new_enode_p): Likewise.
11461 (exploded_graph::dump_exploded_nodes): Likewise.
11462 * supergraph.cc (supernode::get_start_location): Likewise.
11463 (supernode::get_end_location): Likewise.
11465 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11467 PR analyzer/58237
11468 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
11469 selftest::analyzer_sm_file_cc_tests.
11470 * analyzer-selftests.h (selftest::analyzer_sm_file_cc_tests): New
11471 decl.
11472 * sm-file.cc: Include "analyzer/function-set.h" and
11473 "analyzer/analyzer-selftests.h".
11474 (get_file_using_fns): New function.
11475 (is_file_using_fn_p): New function.
11476 (fileptr_state_machine::on_stmt): Return true for known functions.
11477 (selftest::analyzer_sm_file_cc_tests): New function.
11479 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11481 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
11482 selftest::analyzer_sm_signal_cc_tests.
11483 * analyzer-selftests.h (selftest::analyzer_sm_signal_cc_tests):
11484 New decl.
11485 * sm-signal.cc: Include "analyzer/function-set.h" and
11486 "analyzer/analyzer-selftests.h".
11487 (get_async_signal_unsafe_fns): New function.
11488 (signal_unsafe_p): Reimplement in terms of the above.
11489 (selftest::analyzer_sm_signal_cc_tests): New function.
11491 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11493 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
11494 selftest::analyzer_function_set_cc_tests.
11495 * analyzer-selftests.h (selftest::analyzer_function_set_cc_tests):
11496 New decl.
11497 * function-set.cc: New file.
11498 * function-set.h: New file.
11500 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11502 * analyzer.h (fndecl_has_gimple_body_p): New decl.
11503 * engine.cc (impl_region_model_context::on_unknown_change): New
11504 function.
11505 (fndecl_has_gimple_body_p): Make non-static.
11506 (exploded_node::on_stmt): Treat __analyzer_dump_exploded_nodes as
11507 known. Track whether we have a call with unknown side-effects and
11508 pass it to on_call_post.
11509 * exploded-graph.h (impl_region_model_context::on_unknown_change):
11510 New decl.
11511 * program-state.cc (sm_state_map::on_unknown_change): New function.
11512 * program-state.h (sm_state_map::on_unknown_change): New decl.
11513 * region-model.cc: Include "bitmap.h".
11514 (region_model::on_call_pre): Return a bool, capturing whether the
11515 call has unknown side effects.
11516 (region_model::on_call_post): Add arg "bool unknown_side_effects"
11517 and if true, call handle_unrecognized_call.
11518 (class reachable_regions): New class.
11519 (region_model::handle_unrecognized_call): New function.
11520 * region-model.h (region_model::on_call_pre): Return a bool.
11521 (region_model::on_call_post): Add arg "bool unknown_side_effects".
11522 (region_model::handle_unrecognized_call): New decl.
11523 (region_model_context::on_unknown_change): New vfunc.
11524 (test_region_model_context::on_unknown_change): New function.
11526 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11528 * diagnostic-manager.cc (saved_diagnostic::operator==): Move here
11529 from header. Replace pointer equality test on m_var with call to
11530 pending_diagnostic::same_tree_p.
11531 * diagnostic-manager.h (saved_diagnostic::operator==): Move to
11532 diagnostic-manager.cc.
11533 * pending-diagnostic.cc (pending_diagnostic::same_tree_p): New.
11534 * pending-diagnostic.h (pending_diagnostic::same_tree_p): New.
11535 * sm-file.cc (file_diagnostic::subclass_equal_p): Replace pointer
11536 equality on m_arg with call to pending_diagnostic::same_tree_p.
11537 * sm-malloc.cc (malloc_diagnostic::subclass_equal_p): Likewise.
11538 (possible_null_arg::subclass_equal_p): Likewise.
11539 (null_arg::subclass_equal_p): Likewise.
11540 (free_of_non_heap::subclass_equal_p): Likewise.
11541 * sm-pattern-test.cc (pattern_match::operator==): Likewise.
11542 * sm-sensitive.cc (exposure_through_output_file::operator==):
11543 Likewise.
11544 * sm-taint.cc (tainted_array_index::operator==): Likewise.
11546 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11548 * diagnostic-manager.cc (dedupe_winners::add): Add logging
11549 of deduplication decisions made.
11551 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11553 * ChangeLog: New file.
11554 * analyzer-selftests.cc: New file.
11555 * analyzer-selftests.h: New file.
11556 * analyzer.opt: New file.
11557 * analysis-plan.cc: New file.
11558 * analysis-plan.h: New file.
11559 * analyzer-logging.cc: New file.
11560 * analyzer-logging.h: New file.
11561 * analyzer-pass.cc: New file.
11562 * analyzer.cc: New file.
11563 * analyzer.h: New file.
11564 * call-string.cc: New file.
11565 * call-string.h: New file.
11566 * checker-path.cc: New file.
11567 * checker-path.h: New file.
11568 * constraint-manager.cc: New file.
11569 * constraint-manager.h: New file.
11570 * diagnostic-manager.cc: New file.
11571 * diagnostic-manager.h: New file.
11572 * engine.cc: New file.
11573 * engine.h: New file.
11574 * exploded-graph.h: New file.
11575 * pending-diagnostic.cc: New file.
11576 * pending-diagnostic.h: New file.
11577 * program-point.cc: New file.
11578 * program-point.h: New file.
11579 * program-state.cc: New file.
11580 * program-state.h: New file.
11581 * region-model.cc: New file.
11582 * region-model.h: New file.
11583 * sm-file.cc: New file.
11584 * sm-malloc.cc: New file.
11585 * sm-malloc.dot: New file.
11586 * sm-pattern-test.cc: New file.
11587 * sm-sensitive.cc: New file.
11588 * sm-signal.cc: New file.
11589 * sm-taint.cc: New file.
11590 * sm.cc: New file.
11591 * sm.h: New file.
11592 * state-purge.cc: New file.
11593 * state-purge.h: New file.
11594 * supergraph.cc: New file.
11595 * supergraph.h: New file.
11597 2019-12-13 David Malcolm <dmalcolm@redhat.com>
11599 * Initial creation
11601 \f
11602 Copyright (C) 2019-2024 Free Software Foundation, Inc.
11604 Copying and distribution of this file, with or without modification,
11605 are permitted in any medium without royalty provided the copyright
11606 notice and this notice are preserved.