1 2021-12-12 Jonathan Wakely <jwakely@redhat.com>
3 * engine.cc: Define INCLUDE_MEMORY instead of INCLUDE_UNIQUE_PTR.
5 2021-12-06 David Malcolm <dmalcolm@redhat.com>
8 * constraint-manager.cc (equiv_class::contains_non_constant_p):
10 (constraint_manager::canonicalize): Call it when determining
12 (selftest::test_purging): New selftest.
13 (selftest::run_constraint_manager_tests): Likewise.
14 * constraint-manager.h (equiv_class::contains_non_constant_p):
17 2021-12-01 David Malcolm <dmalcolm@redhat.com>
20 * region-model-reachability.cc (reachable_regions::handle_parm):
21 Treat all svalues within a compound parm has reachable, and those
24 2021-11-29 David Malcolm <dmalcolm@redhat.com>
27 * store.cc (binding_cluster::can_merge_p): For the "key is bound"
28 vs "key is not bound" merger case, check that the bound svalue
29 is mergeable before merging it to "unknown", rejecting the merger
32 2021-11-19 David Malcolm <dmalcolm@redhat.com>
35 * engine.cc (exploded_graph::get_or_create_node): Pass in
36 m_ext_state to program_state::can_merge_with_p.
37 (exploded_graph::process_worklist): Likewise.
38 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
40 (exploded_graph::process_node): Add missing call to detect_leaks
41 when handling phi nodes.
42 * program-state.cc (program_state::can_merge_with_p): Add
43 "ext_state" param. Pass it and state ptrs to
44 region_model::can_merge_with_p.
45 (selftest::test_program_state_merging): Update for new ext_state
46 param of program_state::can_merge_with_p.
47 (selftest::test_program_state_merging_2): Likewise.
48 * program-state.h (program_state::can_purge_p): Make const.
49 (program_state::can_merge_with_p): Add "ext_state" param.
50 * region-model.cc: Include "analyzer/program-state.h".
51 (region_model::can_merge_with_p): Add params "ext_state",
52 "state_a", and "state_b", use them when creating model_merger
54 (model_merger::mergeable_svalue_p): New.
55 * region-model.h (region_model::can_merge_with_p): Add params
56 "ext_state", "state_a", and "state_b".
57 (model_merger::model_merger) Likewise, initializing new fields.
58 (model_merger::mergeable_svalue_p): New decl.
59 (model_merger::m_ext_state): New field.
60 (model_merger::m_state_a): New field.
61 (model_merger::m_state_b): New field.
62 * svalue.cc (svalue::can_merge_p): Call
63 model_merger::mergeable_svalue_p on both states and reject the
66 2021-11-17 David Malcolm <dmalcolm@redhat.com>
69 * region-model-impl-calls.cc (region_model::impl_call_strchr): New.
70 * region-model-manager.cc
71 (region_model_manager::maybe_fold_unaryop): Simplify cast to
72 pointer type of an existing pointer to a region.
73 * region-model.cc (region_model::on_call_pre): Handle
74 BUILT_IN_STRCHR and "strchr".
75 (write_to_const_diagnostic::emit): Add auto_diagnostic_group. Add
76 alternate wordings for functions and labels.
77 (write_to_const_diagnostic::describe_final_event): Add alternate
78 wordings for functions and labels.
79 (region_model::check_for_writable_region): Handle RK_FUNCTION and
81 * region-model.h (region_model::impl_call_strchr): New decl.
83 2021-11-16 David Malcolm <dmalcolm@redhat.com>
86 * constraint-manager.cc (bounded_range::operator==): Require the
87 types to be the same for equality.
89 2021-11-13 David Malcolm <dmalcolm@redhat.com>
91 * analyzer.opt (Wanalyzer-tainted-allocation-size): New.
92 (Wanalyzer-tainted-divisor): New.
93 (Wanalyzer-tainted-offset): New.
94 (Wanalyzer-tainted-size): New.
95 * engine.cc (impl_region_model_context::get_taint_map): New.
96 * exploded-graph.h (impl_region_model_context::get_taint_map):
98 * program-state.cc (sm_state_map::get_state): Call
99 alt_get_inherited_state.
100 (sm_state_map::impl_set_state): Modify states within
102 (program_state::impl_call_analyzer_dump_state): Undo casts.
103 (selftest::test_program_state_1): Update for new context param of
104 create_region_for_heap_alloc.
105 (selftest::test_program_state_merging): Likewise.
106 * region-model-impl-calls.cc (region_model::impl_call_alloca):
108 (region_model::impl_call_calloc): Likewise.
109 (region_model::impl_call_malloc): Likewise.
110 (region_model::impl_call_operator_new): Likewise.
111 (region_model::impl_call_realloc): Likewise.
112 * region-model.cc (region_model::check_region_access): Call
113 check_region_for_taint.
114 (region_model::get_representative_path_var_1): Handle binops.
115 (region_model::create_region_for_heap_alloc): Add "ctxt" param and
116 pass it to set_dynamic_extents.
117 (region_model::create_region_for_alloca): Likewise.
118 (region_model::set_dynamic_extents): Add "ctxt" param and use it
119 to call check_dynamic_size_for_taint.
120 (selftest::test_state_merging): Update for new context param of
121 create_region_for_heap_alloc.
122 (selftest::test_malloc_constraints): Likewise.
123 (selftest::test_malloc): Likewise.
124 (selftest::test_alloca): Likewise for create_region_for_alloca.
125 * region-model.h (region_model::create_region_for_heap_alloc): Add
127 (region_model::create_region_for_alloca): Likewise.
128 (region_model::set_dynamic_extents): Likewise.
129 (region_model::check_dynamic_size_for_taint): New decl.
130 (region_model::check_region_for_taint): New decl.
131 (region_model_context::get_taint_map): New vfunc.
132 (noop_region_model_context::get_taint_map): New.
133 * sm-taint.cc: Remove include of "diagnostic-event-id.h"; add
134 includes of "gimple-iterator.h", "tristate.h", "selftest.h",
135 "ordered-hash-map.h", "cgraph.h", "cfg.h", "digraph.h",
136 "analyzer/supergraph.h", "analyzer/call-string.h",
137 "analyzer/program-point.h", "analyzer/store.h",
138 "analyzer/region-model.h", and "analyzer/program-state.h".
139 (enum bounds): Move to top of file.
140 (class taint_diagnostic): New.
141 (class tainted_array_index): Convert to subclass of taint_diagnostic.
142 (tainted_array_index::emit): Add CWE-129. Reword warning to use
143 "attacker-controlled" rather than "tainted".
144 (tainted_array_index::describe_state_change): Move to
145 taint_diagnostic::describe_state_change.
146 (tainted_array_index::describe_final_event): Reword to use
147 "attacker-controlled" rather than "tainted".
148 (class tainted_offset): New.
149 (class tainted_size): New.
150 (class tainted_divisor): New.
151 (class tainted_allocation_size): New.
152 (taint_state_machine::alt_get_inherited_state): New.
153 (taint_state_machine::on_stmt): In assignment handling, remove
154 ARRAY_REF handling in favor of check_region_for_taint. Add
155 detection of tainted divisors.
156 (taint_state_machine::get_taint): New.
157 (taint_state_machine::combine_states): New.
158 (region_model::check_region_for_taint): New.
159 (region_model::check_dynamic_size_for_taint): New.
160 * sm.h (state_machine::alt_get_inherited_state): New.
162 2021-11-12 David Malcolm <dmalcolm@redhat.com>
164 * engine.cc (exploded_node::on_stmt_pre): Return when handling
165 "__analyzer_dump_state".
167 2021-11-11 Richard Biener <rguenther@suse.de>
169 * supergraph.cc: Include bitmap.h.
171 2021-11-04 David Malcolm <dmalcolm@redhat.com>
173 * program-state.cc (sm_state_map::dump): Use default_tree_printer
176 2021-09-16 Maxim Blinov <maxim.blinov@embecosm.com>
179 * engine.cc (INCLUDE_UNIQUE_PTR): Define.
181 2021-09-08 David Malcolm <dmalcolm@redhat.com>
184 * analyzer.h (compat_types_p): New decl.
185 * constraint-manager.cc
186 (constraint_manager::get_or_add_equiv_class): Guard against NULL
187 type when checking for pointer types.
188 * region-model-impl-calls.cc (region_model::impl_call_realloc):
189 Guard against NULL lhs type/region. Guard against the size value
190 not being of a compatible type for dynamic extents.
191 * region-model.cc (compat_types_p): Make non-static.
193 2021-08-30 David Malcolm <dmalcolm@redhat.com>
196 * analyzer.h (class custom_edge_info): New class, adapted from
197 exploded_edge::custom_info_t. Make member functions const.
198 Make update_model return bool, converting edge param from
199 reference to a pointer, and adding a ctxt param.
200 (class path_context): New class.
201 * call-info.cc: New file.
202 * call-info.h: New file.
203 * engine.cc: Include "analyzer/call-info.h" and <memory>.
204 (impl_region_model_context::impl_region_model_context): Update for
205 new m_path_ctxt field.
206 (impl_region_model_context::bifurcate): New.
207 (impl_region_model_context::terminate_path): New.
208 (impl_region_model_context::get_malloc_map): New.
209 (impl_sm_context::impl_sm_context): Update for new m_path_ctxt
211 (impl_sm_context::get_fndecl_for_call): Likewise.
212 (impl_sm_context::set_next_state): Likewise.
213 (impl_sm_context::warn): Likewise.
214 (impl_sm_context::is_zero_assignment): Likewise.
215 (impl_sm_context::get_path_context): New.
216 (impl_sm_context::m_path_ctxt): New.
217 (impl_region_model_context::on_condition): Update for new
218 path_ctxt param. Handle m_enode_for_diag being NULL.
219 (impl_region_model_context::on_phi): Update for new path_ctxt
221 (exploded_node::on_stmt): Add path_ctxt param, updating ctor calls
222 to use it as necessary. Use it to bail out after sm-handling,
224 (exploded_node::detect_leaks): Update for new path_ctxt param.
225 (dynamic_call_info_t::update_model): Update for conversion of
226 exploded_edge::custom_info_t to custom_edge_info.
227 (dynamic_call_info_t::add_events_to_path): Likewise.
228 (rewind_info_t::update_model): Likewise.
229 (rewind_info_t::add_events_to_path): Likewise.
230 (exploded_edge::exploded_edge): Likewise.
231 (exploded_graph::add_edge): Likewise.
232 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
233 Update for new path_ctxt param.
234 (class impl_path_context): New.
235 (exploded_graph::process_node): Update for new path_ctxt param.
236 Create an impl_path_context and pass it to exploded_node::on_stmt.
237 Use it to terminate iterating stmts if terminate_path is called
238 on it. After processing a run of stmts, query path_ctxt to
239 potentially terminate the analysis path, and/or to "bifurcate" the
240 analysis into multiple additional paths.
241 (feasibility_state::maybe_update_for_edge): Update for new
242 update_model ctxt param.
244 (impl_region_model_context::impl_region_model_context): Add
246 (impl_region_model_context::bifurcate): New.
247 (impl_region_model_context::terminate_path): New
248 (impl_region_model_context::get_ext_state): New.
249 (impl_region_model_context::get_malloc_map): New.
250 (impl_region_model_context::m_path_ctxt): New field.
251 (exploded_node::on_stmt): Add path_ctxt param.
252 (class exploded_edge::custom_info_t): Move to analyzer.h, renaming
253 to custom_edge_info, and making the changes as noted in analyzer.h
255 (exploded_edge::exploded_edge): Update for these changes to
256 exploded_edge::custom_info_t.
257 (exploded_edge::m_custom_info): Likewise.
258 (class dynamic_call_info_t): Likewise.
259 (class rewind_info_t): Likewise.
260 (exploded_graph::add_edge): Likewise.
261 * program-state.cc (program_state::on_edge): Update for new
263 (program_state::push_call): Likewise.
264 (program_state::returning_call): Likewise.
265 (program_state::prune_for_point): Likewise.
266 * region-model-impl-calls.cc: Include "analyzer/call-info.h".
267 (call_details::get_fndecl_for_call): New.
268 (region_model::impl_call_realloc): Reimplement.
269 * region-model.cc (region_model::on_call_pre): Move call to
270 impl_call_realloc to...
271 (region_model::on_call_post): ...here. Consolidate creation
272 of call_details instance.
273 (noop_region_model_context::bifurcate): New.
274 (noop_region_model_context::terminate_path): New.
275 * region-model.h (call_details::get_call_stmt): New.
276 (call_details::get_fndecl_for_call): New.
277 (region_model::on_realloc_with_move): New.
278 (region_model_context::bifurcate): New.
279 (region_model_context::terminate_path): New.
280 (region_model_context::get_ext_state): New.
281 (region_model_context::get_malloc_map): New.
282 (noop_region_model_context::bifurcate): New.
283 (noop_region_model_context::terminate_path): New.
284 (noop_region_model_context::get_ext_state): New.
285 (noop_region_model_context::get_malloc_map): New.
286 * sm-malloc.cc: Include "analyzer/program-state.h".
287 (malloc_state_machine::on_realloc_call): Reimplement.
288 (malloc_state_machine::on_realloc_with_move): New.
289 (region_model::on_realloc_with_move): New.
290 * sm-signal.cc (class signal_delivery_edge_info_t): Update for
291 conversion from exploded_edge::custom_info_t to custom_edge_info.
292 * sm.h (sm_context::get_path_context): New.
293 * svalue.cc (svalue::maybe_get_constant): Call
294 unwrap_any_unmergeable.
296 2021-08-25 Ankur Saini <arsenic@sourceware.org>
299 * engine.cc (exploded_graph::maybe_create_dynamic_call): Don't create
300 calls if max recursion limit is reached.
302 2021-08-23 David Malcolm <dmalcolm@redhat.com>
304 * analyzer.h (struct rejected_constraint): Convert to...
305 (class rejected_constraint): ...this.
306 (class bounded_ranges): New forward decl.
307 (class bounded_ranges_manager): New forward decl.
308 * constraint-manager.cc: Include "analyzer/analyzer-logging.h" and
309 "tree-pretty-print.h".
310 (can_plus_one_p): New.
312 (can_minus_one_p): New.
314 (bounded_range::bounded_range): New.
316 (bounded_range::dump_to_pp): New.
317 (bounded_range::dump): New.
318 (bounded_range::to_json): New.
319 (bounded_range::set_json_attr): New.
320 (bounded_range::contains_p): New.
321 (bounded_range::intersects_p): New.
322 (bounded_range::operator==): New.
323 (bounded_range::cmp): New.
324 (bounded_ranges::bounded_ranges): New.
325 (bounded_ranges::bounded_ranges): New.
326 (bounded_ranges::bounded_ranges): New.
327 (bounded_ranges::canonicalize): New.
328 (bounded_ranges::validate): New.
329 (bounded_ranges::operator==): New.
330 (bounded_ranges::dump_to_pp): New.
331 (bounded_ranges::dump): New.
332 (bounded_ranges::to_json): New.
333 (bounded_ranges::eval_condition): New.
334 (bounded_ranges::contain_p): New.
335 (bounded_ranges::cmp): New.
336 (bounded_ranges_manager::~bounded_ranges_manager): New.
337 (bounded_ranges_manager::get_or_create_empty): New.
338 (bounded_ranges_manager::get_or_create_point): New.
339 (bounded_ranges_manager::get_or_create_range): New.
340 (bounded_ranges_manager::get_or_create_union): New.
341 (bounded_ranges_manager::get_or_create_intersection): New.
342 (bounded_ranges_manager::get_or_create_inverse): New.
343 (bounded_ranges_manager::consolidate): New.
344 (bounded_ranges_manager::get_or_create_ranges_for_switch): New.
345 (bounded_ranges_manager::create_ranges_for_switch): New.
346 (bounded_ranges_manager::make_case_label_ranges): New.
347 (bounded_ranges_manager::log_stats): New.
348 (bounded_ranges_constraint::print): New.
349 (bounded_ranges_constraint::to_json): New.
350 (bounded_ranges_constraint::operator==): New.
351 (bounded_ranges_constraint::add_to_hash): New.
352 (constraint_manager::constraint_manager): Update for new field
353 m_bounded_ranges_constraints.
354 (constraint_manager::operator=): Likewise.
355 (constraint_manager::hash): Likewise.
356 (constraint_manager::operator==): Likewise.
357 (constraint_manager::print): Likewise.
358 (constraint_manager::dump_to_pp): Likewise.
359 (constraint_manager::to_json): Likewise.
360 (constraint_manager::add_unknown_constraint): Update the lhs_ec_id
361 if necessary in existing constraints when combining equivalence
362 classes. Add similar code for handling
363 m_bounded_ranges_constraints.
364 (constraint_manager::add_constraint_internal): Add comment.
365 (constraint_manager::add_bounded_ranges): New.
366 (constraint_manager::eval_condition): Use new field
367 m_bounded_ranges_constraints.
368 (constraint_manager::purge): Update bounded_ranges_constraint
370 (constraint_manager::canonicalize): Update for new field.
371 (merger_fact_visitor::on_ranges): New.
372 (constraint_manager::for_each_fact): Use new field
373 m_bounded_ranges_constraints.
374 (constraint_manager::validate): Fix off-by-one error needed due
375 to bug fixed above in add_unknown_constraint. Validate the EC IDs
376 in m_bounded_ranges_constraints.
377 (constraint_manager::get_range_manager): New.
378 (selftest::assert_dump_bounded_range_eq): New.
379 (ASSERT_DUMP_BOUNDED_RANGE_EQ): New.
380 (selftest::test_bounded_range): New.
381 (selftest::assert_dump_bounded_ranges_eq): New.
382 (ASSERT_DUMP_BOUNDED_RANGES_EQ): New.
383 (selftest::test_bounded_ranges): New.
384 (selftest::run_constraint_manager_tests): Call the new selftests.
385 * constraint-manager.h (struct bounded_range): New.
386 (struct bounded_ranges): New.
387 (template <> struct default_hash_traits<bounded_ranges::key_t>): New.
388 (class bounded_ranges_manager): New.
389 (fact_visitor::on_ranges): New pure virtual function.
390 (class bounded_ranges_constraint): New.
391 (constraint_manager::add_bounded_ranges): New decl.
392 (constraint_manager::get_range_manager): New decl.
393 (constraint_manager::m_bounded_ranges_constraints): New field.
394 * diagnostic-manager.cc (epath_finder::process_worklist_item):
395 Transfer ownership of rc to add_feasibility_problem.
396 * engine.cc (feasibility_problem::dump_to_pp): Use get_model.
397 * feasible-graph.cc (infeasible_node::dump_dot): Update for
398 conversion of m_rc to a pointer.
399 (feasible_graph::add_feasibility_problem): Pass RC by pointer and
401 * feasible-graph.h (infeasible_node::infeasible_node): Pass RC by
402 pointer and take ownership.
403 (infeasible_node::~infeasible_node): New.
404 (infeasible_node::m_rc): Convert to a pointer.
405 (feasible_graph::add_feasibility_problem): Pass RC by pointer and
407 * region-model-manager.cc: Include
408 "analyzer/constraint-manager.h".
409 (region_model_manager::region_model_manager): Initializer new
411 (region_model_manager::~region_model_manager): Delete it.
412 (region_model_manager::log_stats): Call log_stats on it.
413 * region-model.cc (region_model::add_constraint): Use new subclass
414 rejected_op_constraint.
415 (region_model::apply_constraints_for_gswitch): Reimplement using
416 bounded_ranges_manager.
417 (rejected_constraint::dump_to_pp): Convert to...
418 (rejected_op_constraint::dump_to_pp): ...this.
419 (rejected_ranges_constraint::dump_to_pp): New.
420 * region-model.h (struct purge_stats): Add field
421 m_num_bounded_ranges_constraints.
422 (region_model_manager::get_range_manager): New.
423 (region_model_manager::m_range_mgr): New.
424 (region_model::get_range_manager): New.
425 (struct rejected_constraint): Split into...
426 (class rejected_constraint):...this new abstract base class,
428 (class rejected_op_constraint): ...this new concrete subclass.
429 (class rejected_ranges_constraint): New.
430 * supergraph.cc: Include "tree-cfg.h".
431 (supergraph::supergraph): Drop idx param from add_cfg_edge.
432 (supergraph::add_cfg_edge): Drop idx param.
433 (switch_cfg_superedge::switch_cfg_superedge): Move here from
434 header. Populate m_case_labels with all cases which go to DST.
435 (switch_cfg_superedge::dump_label_to_pp): Reimplement to use
437 (switch_cfg_superedge::get_case_label): Delete.
438 * supergraph.h (supergraphadd_cfg_edge): Drop "idx" param.
439 (switch_cfg_superedge::switch_cfg_superedge): Drop idx param and
440 move implementation to supergraph.cc.
441 (switch_cfg_superedge::get_case_label): Delete.
442 (switch_cfg_superedge::get_case_labels): New.
443 (switch_cfg_superedge::m_idx): Delete.
444 (switch_cfg_superedge::m_case_labels): New field.
446 2021-08-23 David Malcolm <dmalcolm@redhat.com>
449 * sm-file.cc (file_diagnostic::describe_state_change): Handle
450 change.m_expr being NULL.
452 2021-08-23 David Malcolm <dmalcolm@redhat.com>
455 * analyzer.cc (maybe_reconstruct_from_def_stmt): Bail if fn is
456 NULL, and assert that it's non-NULL before passing it to
457 build_call_array_loc.
459 2021-08-23 David Malcolm <dmalcolm@redhat.com>
462 * region-model.cc (region_model::eval_condition_without_cm):
463 Refactor comparison against zero, adding a check for
464 POINTER_PLUS_EXPR of non-NULL.
466 2021-08-23 David Malcolm <dmalcolm@redhat.com>
468 * store.cc (bit_range::intersects_p): New overload.
469 (bit_range::operator-): New.
470 (binding_cluster::maybe_get_compound_binding): Handle the partial
472 (selftest::test_bit_range_intersects_p): Add test coverage for
473 new overload of bit_range::intersects_p.
474 * store.h (bit_range::intersects_p): New overload.
475 (bit_range::operator-): New.
477 2021-08-23 Ankur Saini <arsenic@sourceware.org>
480 * diagnostic-manager.cc
481 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Fix typo.
483 2021-08-21 Ankur Saini <arsenic@sourceware.org>
486 * diagnostic-manager.cc
487 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Use
488 caller_model only when the supergraph_edge doesn't exixt.
489 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
491 * engine.cc (exploded_graph::create_dynamic_call): Rename to...
492 (exploded_graph::maybe_create_dynamic_call): ...this, return call
494 (exploded_graph::process_node): Handle calls which were not dynamically
496 * exploded-graph.h (exploded_graph::create_dynamic_call): Rename to...
497 (exploded_graph::maybe_create_dynamic_call): ...this.
498 * region-model.cc (region_model::update_for_gcall): New param, use it
499 to push call to frame.
500 (region_model::update_for_call_superedge): Pass callee function to
502 * region-model.h (region_model::update_for_gcall): New param.
504 2021-08-18 Ankur Saini <arsenic@sourceware.org>
507 * region-model.cc (region_model::get_rvalue_1): Add case for
510 2021-08-18 Ankur Saini <arsenic@sourceware.org>
513 * analysis-plan.cc (analysis_plan::use_summary_p): Don't use call
514 summaries if there is no callgraph edge
515 * checker-path.cc (call_event::call_event): Handle calls events that
516 are not represented by a supergraph call edge
517 (return_event::return_event): Likewise.
518 (call_event::get_desc): Work with new call_event structure.
519 (return_event::get_desc): Likeise.
520 * checker-path.h (call_event::m_src_snode): New field.
521 (call_event::m_dest_snode): New field.
522 (return_event::m_src_snode): New field.
523 (return_event::m_dest_snode): New field.
524 * diagnostic-manager.cc
525 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>:
526 Refactor to work with edges without callgraph edge.
527 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
529 * engine.cc (dynamic_call_info_t::update_model): New function.
530 (dynamic_call_info_t::add_events_to_path): New function.
531 (exploded_graph::create_dynamic_call): New function.
532 (exploded_graph::process_node): Work with dynamically discovered calls.
533 * exploded-graph.h (class dynamic_call_info_t): New class.
534 (exploded_graph::create_dynamic_call): New decl.
535 * program-point.cc (program_point::push_to_call_stack): New function.
536 (program_point::pop_from_call_stack): New function.
537 * program-point.h (program_point::push_to_call_stack): New decl.
538 (program_point::pop_from_call_stack): New decl.
539 * program-state.cc (program_state::push_call): New function.
540 (program_state::returning_call): New function.
541 * program-state.h (program_state::push_call): New decl.
542 (program_state::returning_call): New decl.
543 * region-model.cc (region_model::update_for_gcall) New function.
544 (region_model::update_for_return_gcall): New function.
545 (egion_model::update_for_call_superedge): Get the underlying gcall and
547 (region_model::update_for_return_superedge): Likewise.
548 * region-model.h (region_model::update_for_gcall): New decl.
549 (region_model::update_for_return_gcall): New decl.
550 * state-purge.cc (state_purge_per_ssa_name::process_point): Update to
551 work with calls without underlying cgraph edge.
552 * supergraph.cc (supergraph::supergraph) Split snodes at every callsite.
553 * supergraph.h (supernode::get_returning_call) New accessor.
555 2021-08-04 David Malcolm <dmalcolm@redhat.com>
558 * analyzer.cc (maybe_reconstruct_from_def_stmt): Add GIMPLE_ASM
560 * analyzer.h (class asm_output_svalue): New forward decl.
561 (class reachable_regions): New forward decl.
562 * complexity.cc (complexity::from_vec_svalue): New.
563 * complexity.h (complexity::from_vec_svalue): New decl.
564 * engine.cc (feasibility_state::maybe_update_for_edge): Handle
565 asm stmts by calling on_asm_stmt.
566 * region-model-asm.cc: New file.
567 * region-model-manager.cc
568 (region_model_manager::maybe_fold_asm_output_svalue): New.
569 (region_model_manager::get_or_create_asm_output_svalue): New.
570 (region_model_manager::log_stats): Log m_asm_output_values_map.
571 * region-model.cc (region_model::on_stmt_pre): Handle GIMPLE_ASM.
572 * region-model.h (visitor::visit_asm_output_svalue): New.
573 (region_model_manager::get_or_create_asm_output_svalue): New decl.
574 (region_model_manager::maybe_fold_asm_output_svalue): New decl.
575 (region_model_manager::asm_output_values_map_t): New typedef.
576 (region_model_manager::m_asm_output_values_map): New field.
577 (region_model::on_asm_stmt): New.
578 * store.cc (binding_cluster::on_asm): New.
579 * store.h (binding_cluster::on_asm): New decl.
580 * svalue.cc (svalue::cmp_ptr): Handle SK_ASM_OUTPUT.
581 (asm_output_svalue::dump_to_pp): New.
582 (asm_output_svalue::dump_input): New.
583 (asm_output_svalue::input_idx_to_asm_idx): New.
584 (asm_output_svalue::accept): New.
585 * svalue.h (enum svalue_kind): Add SK_ASM_OUTPUT.
586 (svalue::dyn_cast_asm_output_svalue): New.
587 (class asm_output_svalue): New.
588 (is_a_helper <const asm_output_svalue *>::test): New.
589 (struct default_hash_traits<asm_output_svalue::key_t>): New.
591 2021-08-03 Jakub Jelinek <jakub@redhat.com>
594 * sm-malloc.cc (known_allocator_p): Only check DECL_FUNCTION_CODE on
595 BUILT_IN_NORMAL builtins.
597 2021-07-29 Ankur Saini <arsenic@sourceware.org>
599 * call-string.cc (call_string::element_t::operator==): New operator.
600 (call_String::element_t::operator!=): New operator.
601 (call_string::element_t::get_caller_function): New function.
602 (call_string::element_t::get_callee_function): New function.
603 (call_string::call_string): Refactor to Initialise m_elements.
604 (call_string::operator=): Refactor to work with m_elements.
605 (call_string::operator==): Likewise.
606 (call_string::to_json): Likewise.
607 (call_string::hash): Refactor to hash e.m_caller.
608 (call_string::push_call): Refactor to work with m_elements.
609 (call_string::push_call): New overload to push call via supernodes.
610 (call_string::pop): Refactor to work with m_elements.
611 (call_string::calc_recursion_depth): Likewise.
612 (call_string::cmp): Likewise.
613 (call_string::validate): Likewise.
614 (call_string::operator[]): Likewise.
615 * call-string.h (class supernode): New forward decl.
616 (struct call_string::element_t): New struct.
617 (call_string::call_string): Refactor to initialise m_elements.
618 (call_string::bool empty_p): Refactor to work with m_elements.
619 (call_string::get_callee_node): New decl.
620 (call_string::get_caller_node): New decl.
621 (m_elements): Replaces m_return_edges.
622 * program-point.cc (program_point::get_function_at_depth): Refactor to
623 work with new call-string format.
624 (program_point::validate): Likewise.
625 (program_point::on_edge): Likewise.
627 2021-07-28 David Malcolm <dmalcolm@redhat.com>
629 * region-model.cc (region_model::on_call_pre): Treat
630 IFN_UBSAN_BOUNDS, BUILT_IN_STACK_SAVE, and BUILT_IN_STACK_RESTORE
631 as no-ops, rather than handling them as unknown functions.
633 2021-07-28 David Malcolm <dmalcolm@redhat.com>
635 * region-model-impl-calls.cc (region_model::impl_call_alloca):
636 Drop redundant return value.
637 (region_model::impl_call_builtin_expect): Likewise.
638 (region_model::impl_call_calloc): Likewise.
639 (region_model::impl_call_malloc): Likewise.
640 (region_model::impl_call_memset): Likewise.
641 (region_model::impl_call_operator_new): Likewise.
642 (region_model::impl_call_operator_delete): Likewise.
643 (region_model::impl_call_strlen): Likewise.
644 * region-model.cc (region_model::on_call_pre): Fix return value of
645 known functions that don't have unknown side-effects.
646 * region-model.h (region_model::impl_call_alloca): Drop redundant
648 (region_model::impl_call_builtin_expect): Likewise.
649 (region_model::impl_call_calloc): Likewise.
650 (region_model::impl_call_malloc): Likewise.
651 (region_model::impl_call_memset): Likewise.
652 (region_model::impl_call_strlen): Likewise.
653 (region_model::impl_call_operator_new): Likewise.
654 (region_model::impl_call_operator_delete): Likewise.
656 2021-07-28 Siddhesh Poyarekar <siddhesh@gotplt.org>
658 * analyzer.cc (is_named_call_p, is_std_named_call_p): Make
659 first argument a const_tree.
660 * analyzer.h (is_named_call_p, -s_std_named_call_p): Likewise.
661 * sm-malloc.cc (known_allocator_p): New function.
662 (malloc_state_machine::on_stmt): Use it.
664 2021-07-28 Siddhesh Poyarekar <siddhesh@gotplt.org>
667 (malloc_state_machine::get_or_create_deallocator): Recognize
670 2021-07-26 David Malcolm <dmalcolm@redhat.com>
672 * region-model.cc (region_model::on_call_pre): Always set conjured
673 LHS, not just for SSA names.
675 2021-07-23 David Malcolm <dmalcolm@redhat.com>
677 * diagnostic-manager.cc
678 (class auto_disable_complexity_checks): New.
679 (epath_finder::explore_feasible_paths): Use it to disable
680 complexity checks whilst processing the worklist.
681 * region-model-manager.cc
682 (region_model_manager::region_model_manager): Initialize
684 (region_model_manager::reject_if_too_complex): Bail if
685 m_check_complexity is false.
687 (region_model_manager::enable_complexity_check): New.
688 (region_model_manager::disable_complexity_check): New.
689 (region_model_manager::m_check_complexity): New.
691 2021-07-21 David Malcolm <dmalcolm@redhat.com>
694 * sm-file.cc (file_leak::emit): Handle m_arg being NULL.
695 (file_leak::describe_final_event): Handle ev.m_expr being NULL.
697 2021-07-21 David Malcolm <dmalcolm@redhat.com>
700 * store.cc (binding_cluster::purge_state_involving): Don't change
701 m_map whilst iterating through it.
703 2021-07-21 David Malcolm <dmalcolm@redhat.com>
705 * region-model.cc (region_model::handle_phi): Add "old_state"
707 (region_model::update_for_phis): Update so that all of the phi
708 stmts are effectively handled simultaneously, rather than in
710 * region-model.h (region_model::handle_phi): Add "old_state"
712 * state-purge.cc (self_referential_phi_p): Replace with...
713 (name_used_by_phis_p): ...this new function.
714 (state_purge_per_ssa_name::process_point): Update to use the
715 above, so that all phi stmts at a basic block are effectively
716 considered simultaneously, and only consider the phi arguments for
717 the pertinent in-edge.
718 * supergraph.cc (cfg_superedge::get_phi_arg_idx): New.
719 (cfg_superedge::get_phi_arg): Use the above.
720 * supergraph.h (cfg_superedge::get_phi_arg_idx): New decl.
722 2021-07-21 David Malcolm <dmalcolm@redhat.com>
724 * state-purge.cc (state_purge_annotator::add_node_annotations):
725 Rather than erroneously always using the NULL in-edge, determine
726 each relevant in-edge, and print the appropriate data for each
727 in-edge. Use print_needed to print the data as comma-separated
729 (print_vec_of_names): Add "within_table" param and use it.
730 (state_purge_annotator::add_stmt_annotations): Factor out
731 collation and printing code into...
732 (state_purge_annotator::print_needed): ...this new function.
733 * state-purge.h (state_purge_annotator::print_needed): New decl.
735 2021-07-21 David Malcolm <dmalcolm@redhat.com>
737 * program-point.cc (function_point::print): Show src BB index at
740 2021-07-21 David Malcolm <dmalcolm@redhat.com>
742 * svalue.cc (infix_p): New.
743 (binop_svalue::dump_to_pp): Use it to print MIN_EXPR and MAX_EXPR
744 in prefix form, rather than infix.
746 2021-07-19 David Malcolm <dmalcolm@redhat.com>
749 * constraint-manager.cc (constraint_manager::add_constraint): Use
750 can_have_associated_state_p rather than testing for unknown.
751 (constraint_manager::get_or_add_equiv_class): Likewise.
752 * program-state.cc (sm_state_map::set_state): Likewise.
753 (sm_state_map::impl_set_state): Add assertion.
754 * region-model-manager.cc
755 (region_model_manager::maybe_fold_unaryop): Handle poisoned
757 (region_model_manager::maybe_fold_binop): Move handling of unknown
759 (region_model_manager::get_or_create_binop): ...to here, and
760 generalize to use can_have_associated_state_p.
761 (region_model_manager::maybe_fold_sub_svalue): Use
762 can_have_associated_state_p rather than testing for unknown.
763 (region_model_manager::maybe_fold_repeated_svalue): Use unknown
764 when the size or repeated value is "unknown"/"poisoned".
765 * region-model.cc (region_model::purge_state_involving): Reject
766 attempts to purge unknown/poisoned svalues, as these svalues
767 should not have state associated with them.
768 * svalue.cc (sub_svalue::sub_svalue): Assert that we're building
769 on top of an svalue with can_have_associated_state_p.
770 (repeated_svalue::repeated_svalue): Likewise.
771 (bits_within_svalue::bits_within_svalue): Likewise.
772 * svalue.h (svalue::can_have_associated_state_p): New.
773 (unknown_svalue::can_have_associated_state_p): New.
774 (poisoned_svalue::can_have_associated_state_p): New.
775 (unaryop_svalue::unaryop_svalue): Assert that we're building on
776 top of an svalue with can_have_associated_state_p.
777 (binop_svalue::binop_svalue): Likewise.
778 (widening_svalue::widening_svalue): Likewise.
780 2021-07-16 David Malcolm <dmalcolm@redhat.com>
782 * analyzer.h (enum access_direction): New.
783 * engine.cc (exploded_node::on_longjmp): Update for new param of
785 * program-state.cc (program_state::prune_for_point): Likewise.
786 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
787 Replace call to check_for_writable_region with call to
788 check_region_for_write.
789 (region_model::impl_call_memset): Likewise.
790 (region_model::impl_call_strcpy): Likewise.
791 * region-model-reachability.cc (reachable_regions::add): Update
792 for new param of get_store_value.
793 * region-model.cc (region_model::get_rvalue_1): Likewise, also for
795 (region_model::get_store_value): Add ctxt param and use it to call
796 check_region_for_read.
797 (region_model::get_rvalue_for_bits): Add ctxt param and use it to
798 call get_store_value.
799 (region_model::check_region_access): New.
800 (region_model::check_region_for_write): New.
801 (region_model::check_region_for_read): New.
802 (region_model::set_value): Update comment. Replace call to
803 check_for_writable_region with call to check_region_for_write.
804 * region-model.h (region_model::get_rvalue_for_bits): Add ctxt
806 (region_model::get_store_value): Add ctxt param.
807 (region_model::check_region_access): New decl.
808 (region_model::check_region_for_write): New decl.
809 (region_model::check_region_for_read): New decl.
810 * region.cc (region_model::copy_region): Update call to
812 * svalue.cc (initial_svalue::implicitly_live_p): Likewise.
814 2021-07-16 David Malcolm <dmalcolm@redhat.com>
816 * engine.cc (exploded_node::on_stmt_pre): Handle
817 __analyzer_dump_state.
818 * program-state.cc (extrinsic_state::get_sm_idx_by_name): New.
819 (program_state::impl_call_analyzer_dump_state): New.
820 * program-state.h (extrinsic_state::get_sm_idx_by_name): New decl.
821 (program_state::impl_call_analyzer_dump_state): New decl.
822 * region-model-impl-calls.cc
823 (call_details::get_arg_string_literal): New.
824 * region-model.h (call_details::get_arg_string_literal): New decl.
826 2021-07-16 David Malcolm <dmalcolm@redhat.com>
828 * program-state.cc (program_state::detect_leaks): Simplify using
829 svalue::maybe_get_region.
830 * region-model-impl-calls.cc (region_model::impl_call_fgets): Likewise.
831 (region_model::impl_call_fread): Likewise.
832 (region_model::impl_call_free): Likewise.
833 (region_model::impl_call_operator_delete): Likewise.
834 * region-model.cc (selftest::test_stack_frames): Likewise.
835 (selftest::test_state_merging): Likewise.
836 * svalue.cc (svalue::maybe_get_region): New.
837 * svalue.h (svalue::maybe_get_region): New decl.
839 2021-07-15 David Malcolm <dmalcolm@redhat.com>
841 * svalue.h (is_a_helper <placeholder_svalue *>::test): Make
842 param and template param const.
843 (is_a_helper <widening_svalue *>::test): Likewise.
844 (is_a_helper <compound_svalue *>::test): Likewise.
845 (is_a_helper <conjured_svalue *>::test): Likewise.
847 2021-07-15 David Malcolm <dmalcolm@redhat.com>
852 * analyzer.cc (maybe_reconstruct_from_def_stmt): Split out
853 GIMPLE_ASSIGN case into...
854 (get_diagnostic_tree_for_gassign_1): New.
855 (get_diagnostic_tree_for_gassign): New.
856 * analyzer.h (get_diagnostic_tree_for_gassign): New decl.
857 * analyzer.opt (Wanalyzer-write-to-string-literal): New.
858 * constraint-manager.cc (class svalue_purger): New.
859 (constraint_manager::purge_state_involving): New.
860 * constraint-manager.h
861 (constraint_manager::purge_state_involving): New.
862 * diagnostic-manager.cc (saved_diagnostic::supercedes_p): New.
863 (dedupe_winners::handle_interactions): New.
864 (diagnostic_manager::emit_saved_diagnostics): Call it.
865 * diagnostic-manager.h (saved_diagnostic::supercedes_p): New decl.
866 * engine.cc (impl_region_model_context::warn): Convert return type
867 to bool. Return false if the diagnostic isn't saved.
868 (impl_region_model_context::purge_state_involving): New.
869 (impl_sm_context::get_state): Use NULL ctxt when querying old
871 (impl_sm_context::set_next_state): Use new sval when querying old
873 (class dump_path_diagnostic): Move to region-model.cc
874 (exploded_node::on_stmt): Move to on_stmt_pre and on_stmt_post.
875 Remove call to purge_state_involving.
876 (exploded_node::on_stmt_pre): New, based on the above. Move most
877 of it to region_model::on_stmt_pre.
878 (exploded_node::on_stmt_post): Likewise, moving to
879 region_model::on_stmt_post.
880 (class stale_jmp_buf): Fix parent class to use curiously recurring
882 (feasibility_state::maybe_update_for_edge): Call on_call_pre and
883 on_call_post on gcalls.
884 * exploded-graph.h (impl_region_model_context::warn): Return bool.
885 (impl_region_model_context::purge_state_involving): New decl.
886 (exploded_node::on_stmt_pre): New decl.
887 (exploded_node::on_stmt_post): New decl.
888 * pending-diagnostic.h (pending_diagnostic::use_of_uninit_p): New.
889 (pending_diagnostic::supercedes_p): New.
890 * program-state.cc (sm_state_map::get_state): Inherit state for
891 conjured_svalue as well as initial_svalue.
892 (sm_state_map::purge_state_involving): Also support SK_CONJURED.
893 * region-model-impl-calls.cc (call_details::get_uncertainty):
894 Handle m_ctxt being NULL.
895 (call_details::get_or_create_conjured_svalue): New.
896 (region_model::impl_call_fgets): New.
897 (region_model::impl_call_fread): New.
898 * region-model-manager.cc
899 (region_model_manager::get_or_create_initial_value): Return an
900 uninitialized poisoned value for regions that can't have initial
902 * region-model-reachability.cc
903 (reachable_regions::mark_escaped_clusters): Handle ctxt being
905 * region-model.cc (region_to_value_map::purge_state_involving): New.
906 (poisoned_value_diagnostic::use_of_uninit_p): New.
907 (poisoned_value_diagnostic::emit): Handle POISON_KIND_UNINIT.
908 (poisoned_value_diagnostic::describe_final_event): Likewise.
909 (region_model::check_for_poison): New.
910 (region_model::on_assignment): Call it.
911 (class dump_path_diagnostic): Move here from engine.cc.
912 (region_model::on_stmt_pre): New, based on exploded_node::on_stmt.
913 (region_model::on_call_pre): Move the setting of the LHS to a
914 conjured svalue to before the checks for specific functions.
915 Handle "fgets", "fgets_unlocked", and "fread".
916 (region_model::purge_state_involving): New.
917 (region_model::handle_unrecognized_call): Handle ctxt being NULL.
918 (region_model::get_rvalue): Call check_for_poison.
919 (selftest::test_stack_frames): Use NULL for context when getting
920 uninitialized rvalue.
921 (selftest::test_alloca): Likewise.
922 * region-model.h (region_to_value_map::purge_state_involving): New
924 (call_details::get_or_create_conjured_svalue): New decl.
925 (region_model::on_stmt_pre): New decl.
926 (region_model::purge_state_involving): New decl.
927 (region_model::impl_call_fgets): New decl.
928 (region_model::impl_call_fread): New decl.
929 (region_model::check_for_poison): New decl.
930 (region_model_context::warn): Return bool.
931 (region_model_context::purge_state_involving): New.
932 (noop_region_model_context::warn): Return bool.
933 (noop_region_model_context::purge_state_involving): New.
934 (test_region_model_context:: warn): Return bool.
935 * region.cc (region::get_memory_space): New.
936 (region::can_have_initial_svalue_p): New.
937 (region::involves_p): New.
938 * region.h (enum memory_space): New.
939 (region::get_memory_space): New decl.
940 (region::can_have_initial_svalue_p): New decl.
941 (region::involves_p): New decl.
942 * sm-malloc.cc (use_after_free::supercedes_p): New.
943 * store.cc (binding_cluster::purge_state_involving): New.
944 (store::purge_state_involving): New.
945 * store.h (class symbolic_binding): New forward decl.
946 (binding_key::dyn_cast_symbolic_binding): New.
947 (symbolic_binding::dyn_cast_symbolic_binding): New.
948 (binding_cluster::purge_state_involving): New.
949 (store::purge_state_involving): New.
950 * svalue.cc (svalue::can_merge_p): Reject attempts to merge
951 poisoned svalues with other svalues, so that we identify
952 paths in which a variable is conditionally uninitialized.
953 (involvement_visitor::visit_conjured_svalue): New.
954 (svalue::involves_p): Also handle SK_CONJURED.
955 (poison_kind_to_str): Handle POISON_KIND_UNINIT.
956 (poisoned_svalue::maybe_fold_bits_within): New.
957 * svalue.h (enum poison_kind): Add POISON_KIND_UNINIT.
958 (poisoned_svalue::maybe_fold_bits_within): New decl.
960 2021-07-15 David Malcolm <dmalcolm@redhat.com>
962 * analyzer.opt (fdump-analyzer-exploded-paths): New.
963 * diagnostic-manager.cc
964 (diagnostic_manager::emit_saved_diagnostic): Implement it.
965 * engine.cc (exploded_path::dump_to_pp): Add ext_state param and
966 use it to dump states if non-NULL.
967 (exploded_path::dump): Likewise.
968 (exploded_path::dump_to_file): New.
969 * exploded-graph.h (exploded_path::dump_to_pp): Add ext_state
971 (exploded_path::dump): Likewise.
972 (exploded_path::dump): Likewise.
973 (exploded_path::dump_to_file): New.
975 2021-07-15 David Malcolm <dmalcolm@redhat.com>
977 * analyzer.cc (fixup_tree_for_diagnostic_1): Use DECL_DEBUG_EXPR
979 * engine.cc (readability): Likewise.
981 2021-07-15 David Malcolm <dmalcolm@redhat.com>
983 * state-purge.cc (self_referential_phi_p): New.
984 (state_purge_per_ssa_name::process_point): Don't purge an SSA name
985 at its def-stmt if the def-stmt is self-referential.
987 2021-07-07 David Malcolm <dmalcolm@redhat.com>
989 * diagnostic-manager.cc (null_assignment_sm_context::get_state):
991 (null_assignment_sm_context::set_next_state): New overload.
992 (null_assignment_sm_context::get_diagnostic_tree): New.
993 * engine.cc (impl_sm_context::get_state): New overload.
994 (impl_sm_context::set_next_state): New overload.
995 (impl_sm_context::get_diagnostic_tree): New overload.
996 (impl_region_model_context::on_condition): Convert params from
997 tree to const svalue *.
998 * exploded-graph.h (impl_region_model_context::on_condition):
1000 * region-model.cc (region_model::on_call_pre): Move handling of
1001 internal calls to before checking for get_fndecl_for_call.
1002 (region_model::add_constraints_from_binop): New.
1003 (region_model::add_constraint): Split out into a new overload
1004 working on const svalue * rather than tree. Call
1005 add_constraints_from_binop. Drop call to
1006 add_any_constraints_from_ssa_def_stmt.
1007 (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
1008 (region_model::add_any_constraints_from_gassign): Delete.
1009 (region_model::add_any_constraints_from_gcall): Delete.
1011 (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
1012 (region_model::add_any_constraints_from_gassign): Delete.
1013 (region_model::add_any_constraints_from_gcall): Delete.
1014 (region_model::add_constraint): Add overload decl.
1015 (region_model::add_constraints_from_binop): New decl.
1016 (region_model_context::on_condition): Convert params from tree to
1018 (noop_region_model_context::on_condition): Likewise.
1019 * sm-file.cc (fileptr_state_machine::condition): Likewise.
1020 * sm-malloc.cc (malloc_state_machine::on_condition): Likewise.
1021 * sm-pattern-test.cc: Include tristate.h, selftest.h,
1022 analyzer/call-string.h, analyzer/program-point.h,
1023 analyzer/store.h, and analyzer/region-model.h.
1024 (pattern_test_state_machine::on_condition): Convert params from tree to
1026 * sm-sensitive.cc (sensitive_state_machine::on_condition): Delete.
1027 * sm-signal.cc (signal_state_machine::on_condition): Delete.
1028 * sm-taint.cc (taint_state_machine::on_condition): Convert params
1029 from tree to const svalue *.
1030 * sm.cc: Include tristate.h, selftest.h, analyzer/call-string.h,
1031 analyzer/program-point.h, analyzer/store.h, and
1032 analyzer/region-model.h.
1033 (any_pointer_p): Add overload taking const svalue *sval.
1034 * sm.h (any_pointer_p): Add overload taking const svalue *sval.
1035 (state_machine::on_condition): Convert params from tree to
1036 const svalue *. Provide no-op default implementation.
1037 (sm_context::get_state): Add overload taking const svalue *sval.
1038 (sm_context::set_next_state): Likewise.
1039 (sm_context::on_transition): Likewise.
1040 (sm_context::get_diagnostic_tree): Likewise.
1041 * svalue.cc (svalue::all_zeroes_p): New.
1042 (constant_svalue::all_zeroes_p): New.
1043 (repeated_svalue::all_zeroes_p): Convert to vfunc.
1044 * svalue.h (svalue::all_zeroes_p): New decl.
1045 (constant_svalue::all_zeroes_p): New decl.
1046 (repeated_svalue::all_zeroes_p): Convert decl to vfunc.
1048 2021-06-30 David Malcolm <dmalcolm@redhat.com>
1051 * analyzer.h (class repeated_svalue): New forward decl.
1052 (class bits_within_svalue): New forward decl.
1053 (class sized_region): New forward decl.
1054 (get_field_at_bit_offset): New forward decl.
1055 * engine.cc (exploded_graph::get_or_create_node): Validate the
1057 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
1058 Validate the states at each stage.
1059 * program-state.cc (program_state::validate): Validate
1061 * region-model-impl-calls.cc (region_model::impl_call_memset):
1062 Replace special-case logic for handling constant sizes with
1063 a call to fill_region of a sized_region with the given fill value.
1064 * region-model-manager.cc (maybe_undo_optimize_bit_field_compare):
1066 (region_model_manager::maybe_fold_sub_svalue): Fold element-based
1067 subregions of an initial value into initial values of an element.
1068 Fold subvalues of repeated svalues.
1069 (region_model_manager::maybe_fold_repeated_svalue): New.
1070 (region_model_manager::get_or_create_repeated_svalue): New.
1071 (get_bit_range_for_field): New.
1072 (get_byte_range_for_field): New.
1073 (get_field_at_byte_range): New.
1074 (region_model_manager::maybe_fold_bits_within_svalue): New.
1075 (region_model_manager::get_or_create_bits_within): New.
1076 (region_model_manager::get_sized_region): New.
1077 (region_model_manager::log_stats): Update for addition of
1078 m_repeated_values_map, m_bits_within_values_map, and
1080 * region-model.cc (region_model::validate): New.
1081 (region_model::on_assignment): Drop enum binding_kind.
1082 (region_model::get_initial_value_for_global): Likewise.
1083 (region_model::get_rvalue_for_bits): Replace body with call to
1084 get_or_create_bits_within.
1085 (region_model::get_capacity): Handle RK_SIZED.
1086 (region_model::set_value): Drop enum binding_kind.
1087 (region_model::fill_region): New.
1088 (region_model::get_representative_path_var_1): Handle RK_SIZED.
1089 * region-model.h (visitor::visit_repeated_svalue): New.
1090 (visitor::visit_bits_within_svalue): New.
1091 (region_model_manager::get_or_create_repeated_svalue): New decl.
1092 (region_model_manager::get_or_create_bits_within): New decl.
1093 (region_model_manager::get_sized_region): New decl.
1094 (region_model_manager::maybe_fold_repeated_svalue): New decl.
1095 (region_model_manager::maybe_fold_bits_within_svalue): New decl.
1096 (region_model_manager::repeated_values_map_t): New typedef.
1097 (region_model_manager::m_repeated_values_map): New field.
1098 (region_model_manager::bits_within_values_map_t): New typedef.
1099 (region_model_manager::m_bits_within_values_map): New field.
1100 (region_model_manager::m_sized_regions): New field.
1101 (region_model::fill_region): New decl.
1102 * region.cc (region::get_base_region): Handle RK_SIZED.
1103 (region::base_region_p): Likewise.
1104 (region::get_byte_size_sval): New.
1105 (get_field_at_bit_offset): Make non-static.
1106 (region::calc_offset): Move implementation of cases to
1107 get_relative_concrete_offset vfunc implementations. Handle
1109 (region::get_relative_concrete_offset): New.
1110 (decl_region::get_svalue_for_initializer): Drop enum binding_kind.
1111 (field_region::get_relative_concrete_offset): New, from
1112 region::calc_offset.
1113 (element_region::get_relative_concrete_offset): Likewise.
1114 (offset_region::get_relative_concrete_offset): Likewise.
1115 (sized_region::accept): New.
1116 (sized_region::dump_to_pp): New.
1117 (sized_region::get_byte_size): New.
1118 (sized_region::get_bit_size): New.
1119 * region.h (enum region_kind): Add RK_SIZED.
1120 (region::dyn_cast_sized_region): New.
1121 (region::get_byte_size): Make virtual.
1122 (region::get_bit_size): Likewise.
1123 (region::get_byte_size_sval): New decl.
1124 (region::get_relative_concrete_offset): New decl.
1125 (field_region::get_relative_concrete_offset): New decl.
1126 (element_region::get_relative_concrete_offset): Likewise.
1127 (offset_region::get_relative_concrete_offset): Likewise.
1128 (class sized_region): New.
1129 * store.cc (binding_kind_to_string): Delete.
1130 (binding_key::make): Drop enum binding_kind.
1131 (binding_key::dump_to_pp): Delete.
1132 (binding_key::cmp_ptrs): Drop enum binding_kind.
1133 (bit_range::contains_p): New.
1134 (byte_range::dump): New.
1135 (byte_range::contains_p): New.
1136 (byte_range::cmp): New.
1137 (concrete_binding::dump_to_pp): Drop enum binding_kind.
1138 (concrete_binding::cmp_ptr_ptr): Likewise.
1139 (symbolic_binding::dump_to_pp): Likewise.
1140 (symbolic_binding::cmp_ptr_ptr): Likewise.
1141 (binding_map::apply_ctor_val_to_range): Likewise.
1142 (binding_map::apply_ctor_pair_to_child_region): Likewise.
1143 (binding_map::get_overlapping_bindings): New.
1144 (binding_map::remove_overlapping_bindings): New.
1145 (binding_cluster::validate): New.
1146 (binding_cluster::bind): Drop enum binding_kind.
1147 (binding_cluster::bind_compound_sval): Likewise.
1148 (binding_cluster::purge_region): Likewise.
1149 (binding_cluster::zero_fill_region): Reimplement in terms of...
1150 (binding_cluster::fill_region): New.
1151 (binding_cluster::mark_region_as_unknown): Drop enum binding_kind.
1152 (binding_cluster::get_binding): Likewise.
1153 (binding_cluster::get_binding_recursive): Likewise.
1154 (binding_cluster::get_any_binding): Likewise.
1155 (binding_cluster::maybe_get_compound_binding): Reimplement.
1156 (binding_cluster::get_overlapping_bindings): Delete.
1157 (binding_cluster::remove_overlapping_bindings): Reimplement in
1158 terms of binding_map::remove_overlapping_bindings.
1159 (binding_cluster::can_merge_p): Update for removal of
1161 (binding_cluster::on_unknown_fncall): Drop enum binding_kind.
1162 (binding_cluster::maybe_get_simple_value): Likewise.
1163 (store_manager::get_concrete_binding): Likewise.
1164 (store_manager::get_symbolic_binding): Likewise.
1165 (store::validate): New.
1166 (store::set_value): Drop enum binding_kind.
1167 (store::zero_fill_region): Reimplement in terms of...
1168 (store::fill_region): New.
1169 (selftest::test_binding_key_overlap): Drop enum binding_kind.
1170 * store.h (enum binding_kind): Delete.
1171 (binding_kind_to_string): Delete decl.
1172 (binding_key::make): Drop enum binding_kind.
1173 (binding_key::dump_to_pp): Make pure virtual.
1174 (binding_key::get_kind): Delete.
1175 (binding_key::mark_deleted): Delete.
1176 (binding_key::mark_empty): Delete.
1177 (binding_key::is_deleted): Delete.
1178 (binding_key::is_empty): Delete.
1179 (binding_key::binding_key): Delete.
1180 (binding_key::impl_hash): Delete.
1181 (binding_key::impl_eq): Delete.
1182 (binding_key::m_kind): Delete.
1183 (bit_range::get_last_bit_offset): New.
1184 (bit_range::contains_p): New.
1185 (byte_range::contains_p): New.
1186 (byte_range::operator==): New.
1187 (byte_range::get_start_byte_offset): New.
1188 (byte_range::get_next_byte_offset): New.
1189 (byte_range::get_last_byte_offset): New.
1190 (byte_range::as_bit_range): New.
1191 (byte_range::cmp): New.
1192 (concrete_binding::concrete_binding): Drop enum binding_kind.
1193 (concrete_binding::hash): Likewise.
1194 (concrete_binding::operator==): Likewise.
1195 (concrete_binding::mark_deleted): New.
1196 (concrete_binding::mark_empty): New.
1197 (concrete_binding::is_deleted): New.
1198 (concrete_binding::is_empty): New.
1199 (default_hash_traits<ana::concrete_binding>::empty_zero_p): Make false.
1200 (symbolic_binding::symbolic_binding): Drop enum binding_kind.
1201 (symbolic_binding::hash): Likewise.
1202 (symbolic_binding::operator==): Likewise.
1203 (symbolic_binding::mark_deleted): New.
1204 (symbolic_binding::mark_empty): New.
1205 (symbolic_binding::is_deleted): New.
1206 (symbolic_binding::is_empty): New.
1207 (binding_map::remove_overlapping_bindings): New decl.
1208 (binding_map::get_overlapping_bindings): New decl.
1209 (binding_cluster::validate): New decl.
1210 (binding_cluster::bind): Drop enum binding_kind.
1211 (binding_cluster::fill_region): New decl.
1212 (binding_cluster::get_binding): Drop enum binding_kind.
1213 (binding_cluster::get_binding_recursive): Likewise.
1214 (binding_cluster::get_overlapping_bindings): Delete.
1215 (store::validate): New decl.
1216 (store::set_value): Drop enum binding_kind.
1217 (store::fill_region): New decl.
1218 (store_manager::get_concrete_binding): Drop enum binding_kind.
1219 (store_manager::get_symbolic_binding): Likewise.
1220 * svalue.cc (svalue::cmp_ptr): Handle SK_REPEATED and
1222 (svalue::extract_bit_range): New.
1223 (svalue::maybe_fold_bits_within): New.
1224 (constant_svalue::maybe_fold_bits_within): New.
1225 (unknown_svalue::maybe_fold_bits_within): New.
1226 (unaryop_svalue::maybe_fold_bits_within): New.
1227 (repeated_svalue::repeated_svalue): New.
1228 (repeated_svalue::dump_to_pp): New.
1229 (repeated_svalue::accept): New.
1230 (repeated_svalue::all_zeroes_p): New.
1231 (repeated_svalue::maybe_fold_bits_within): New.
1232 (bits_within_svalue::bits_within_svalue): New.
1233 (bits_within_svalue::dump_to_pp): New.
1234 (bits_within_svalue::maybe_fold_bits_within): New.
1235 (bits_within_svalue::accept): New.
1236 (bits_within_svalue::implicitly_live_p): New.
1237 (compound_svalue::maybe_fold_bits_within): New.
1238 * svalue.h (enum svalue_kind): Add SK_REPEATED and SK_BITS_WITHIN.
1239 (svalue::dyn_cast_repeated_svalue): New.
1240 (svalue::dyn_cast_bits_within_svalue): New.
1241 (svalue::extract_bit_range): New decl.
1242 (svalue::maybe_fold_bits_within): New vfunc decl.
1243 (region_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
1244 (region_svalue::key_t::is_empty): Likewise.
1245 (default_hash_traits<region_svalue::key_t>::empty_zero_p): Make false.
1246 (constant_svalue::maybe_fold_bits_within): New.
1247 (unknown_svalue::maybe_fold_bits_within): New.
1248 (poisoned_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
1249 (poisoned_svalue::key_t::is_empty): Likewise.
1250 (default_hash_traits<poisoned_svalue::key_t>::empty_zero_p): Make
1252 (setjmp_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
1253 (setjmp_svalue::key_t::is_empty): Likewise.
1254 (default_hash_traits<setjmp_svalue::key_t>::empty_zero_p): Make
1256 (unaryop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
1257 (unaryop_svalue::key_t::is_empty): Likewise.
1258 (unaryop_svalue::maybe_fold_bits_within): New.
1259 (default_hash_traits<unaryop_svalue::key_t>::empty_zero_p): Make
1261 (binop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
1262 (binop_svalue::key_t::is_empty): Likewise.
1263 (default_hash_traits<binop_svalue::key_t>::empty_zero_p): Make
1265 (sub_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
1266 (sub_svalue::key_t::is_empty): Likewise.
1267 (default_hash_traits<sub_svalue::key_t>::empty_zero_p): Make
1269 (class repeated_svalue): New.
1270 (is_a_helper <const repeated_svalue *>::test): New.
1271 (struct default_hash_traits<repeated_svalue::key_t>): New.
1272 (class bits_within_svalue): New.
1273 (is_a_helper <const bits_within_svalue *>::test): New.
1274 (struct default_hash_traits<bits_within_svalue::key_t>): New.
1275 (widening_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
1276 (widening_svalue::key_t::is_empty): Likewise.
1277 (default_hash_traits<widening_svalue::key_t>::empty_zero_p): Make
1279 (compound_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
1280 (compound_svalue::key_t::is_empty): Likewise.
1281 (compound_svalue::maybe_fold_bits_within): New.
1282 (default_hash_traits<compound_svalue::key_t>::empty_zero_p): Make
1285 2021-06-28 David Malcolm <dmalcolm@redhat.com>
1287 * analyzer.h (byte_offset_t): New typedef.
1288 * store.cc (bit_range::dump_to_pp): Dump as a byte range if
1290 (bit_range::as_byte_range): New.
1291 (byte_range::dump_to_pp): New.
1292 * store.h (class byte_range): New forward decl.
1293 (struct bit_range): Add comment.
1294 (bit_range::as_byte_range): New decl.
1295 (struct byte_range): New.
1297 2021-06-22 David Malcolm <dmalcolm@redhat.com>
1300 * region-model.cc (compat_types_p): New function.
1301 (region_model::create_region_for_heap_alloc): Convert assertion to
1303 (region_model::create_region_for_alloca): Likewise.
1305 2021-06-18 David Malcolm <dmalcolm@redhat.com>
1307 * store.cc (binding_cluster::get_any_binding): Make symbolic reads
1308 from a cluster with concrete bindings return unknown.
1310 2021-06-18 David Malcolm <dmalcolm@redhat.com>
1312 * region-model-manager.cc
1313 (region_model_manager::get_or_create_int_cst): New.
1314 (region_model_manager::maybe_undo_optimize_bit_field_compare): Use
1315 it to simplify away a local tree.
1316 * region-model.cc (region_model::on_setjmp): Likewise.
1317 (region_model::on_longjmp): Likewise.
1318 * region-model.h (region_model_manager::get_or_create_int_cst):
1320 * store.cc (binding_cluster::zero_fill_region): Use it to simplify
1323 2021-06-18 David Malcolm <dmalcolm@redhat.com>
1325 * checker-path.cc (class custom_event): Make abstract to allow for
1326 custom vfuncs, splitting existing implementation into...
1327 (class precanned_custom_event): New subclass.
1328 (custom_event::get_desc): Move to...
1329 (precanned_custom_event::get_desc): ...subclass.
1330 * checker-path.h (class custom_event): Make abstract to allow for
1331 custom vfuncs, splitting existing implementation into...
1332 (class precanned_custom_event): New subclass.
1333 * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
1334 Use precanned_custom_event.
1336 (stale_jmp_buf::maybe_add_custom_events_for_superedge): Likewise.
1337 * sm-signal.cc (signal_delivery_edge_info_t::add_events_to_path):
1340 2021-06-15 David Malcolm <dmalcolm@redhat.com>
1344 * engine.cc: Include "target.h".
1345 (impl_run_checkers): Log BITS_BIG_ENDIAN, BYTES_BIG_ENDIAN, and
1347 * region-model-manager.cc
1348 (region_model_manager::maybe_fold_binop): Move support for masking
1349 via ARG0 & CST into...
1350 (region_model_manager::maybe_undo_optimize_bit_field_compare):
1351 ...this new function. Flatten by converting from nested
1352 conditionals to a series of early return statements to reject
1353 failures. Reject if type is not unsigned_char_type_node.
1354 Handle BYTES_BIG_ENDIAN when determining which bits are bound
1357 (region_model_manager::maybe_undo_optimize_bit_field_compare):
1359 * store.cc (bit_range::dump): New function.
1360 * store.h (bit_range::dump): New decl.
1362 2021-06-15 David Malcolm <dmalcolm@redhat.com>
1364 * engine.cc (exploded_node::on_stmt): Handle __analyzer_dump_capacity.
1365 (exploded_node::on_stmt): Drop m_sm_changes from on_stmt_flags.
1366 (state_change_requires_new_enode_p): New function...
1367 (exploded_graph::process_node): Call it, rather than querying
1368 flags.m_sm_changes, so that dynamic-extent differences can also
1369 trigger the splitting of nodes.
1370 * exploded-graph.h (struct on_stmt_flags): Drop field m_sm_changes.
1371 * program-state.cc (program_state::detect_leaks): Purge dead
1372 heap-allocated regions from dynamic extents.
1373 (selftest::test_program_state_1): Fix type of "size_in_bytes".
1374 (selftest::test_program_state_merging): Likewise.
1375 * region-model-impl-calls.cc
1376 (region_model::impl_call_analyzer_dump_capacity): New.
1377 (region_model::impl_call_free): Remove dynamic extents from the
1379 * region-model-reachability.h
1380 (reachable_regions::begin_mutable_base_regs): New.
1381 (reachable_regions::end_mutable_base_regs): New.
1382 * region-model.cc: Include "tree-object-size.h".
1383 (region_model::region_model): Support new field m_dynamic_extents.
1384 (region_model::operator=): Likewise.
1385 (region_model::operator==): Likewise.
1386 (region_model::dump_to_pp): Dump sizes of dynamic regions.
1387 (region_model::handle_unrecognized_call): Purge dynamic extents
1388 from any regions that have escaped mutably:.
1389 (region_model::get_capacity): New function.
1390 (region_model::add_constraint): Unset dynamic extents when a
1391 heap-allocated region's address is NULL.
1392 (region_model::unbind_region_and_descendents): Purge dynamic
1393 extents of unbound regions.
1394 (region_model::can_merge_with_p): Call
1395 m_dynamic_extents.can_merge_with_p.
1396 (region_model::create_region_for_heap_alloc): Assert that
1397 size_in_bytes's type is compatible with size_type_node. Update
1398 for renaming of record_dynamic_extents to set_dynamic_extents.
1399 (region_model::create_region_for_alloca): Likewise.
1400 (region_model::record_dynamic_extents): Rename to...
1401 (region_model::set_dynamic_extents): ...this. Assert that
1402 size_in_bytes's type is compatible with size_type_node. Add it
1403 to the m_dynamic_extents map.
1404 (region_model::get_dynamic_extents): New.
1405 (region_model::unset_dynamic_extents): New.
1406 (selftest::test_state_merging): Fix type of "size".
1407 (selftest::test_malloc_constraints): Likewise.
1408 (selftest::test_malloc): Verify dynamic extents.
1409 (selftest::test_alloca): Likewise.
1410 * region-model.h (region_to_value_map::is_empty): New.
1411 (region_model::dynamic_extents_t): New typedef.
1412 (region_model::impl_call_analyzer_dump_capacity): New decl.
1413 (region_model::get_dynamic_extents): New function.
1414 (region_model::get_dynamic_extents): New decl.
1415 (region_model::set_dynamic_extents): New decl.
1416 (region_model::unset_dynamic_extents): New decl.
1417 (region_model::get_capacity): New decl.
1418 (region_model::record_dynamic_extents): Rename to set_dynamic_extents.
1419 (region_model::m_dynamic_extents): New field.
1421 2021-06-15 David Malcolm <dmalcolm@redhat.com>
1423 * region-model.cc (region_to_value_map::operator=): New.
1424 (region_to_value_map::operator==): New.
1425 (region_to_value_map::dump_to_pp): New.
1426 (region_to_value_map::dump): New.
1427 (region_to_value_map::can_merge_with_p): New.
1428 * region-model.h (class region_to_value_map): New class.
1430 2021-06-13 Trevor Saunders <tbsaunde@tbsaunde.org>
1432 * call-string.cc (call_string::call_string): Use range based for
1433 to iterate over vec<>.
1434 (call_string::to_json): Likewise.
1435 (call_string::hash): Likewise.
1436 (call_string::calc_recursion_depth): Likewise.
1437 * checker-path.cc (checker_path::fixup_locations): Likewise.
1438 * constraint-manager.cc (equiv_class::equiv_class): Likewise.
1439 (equiv_class::to_json): Likewise.
1440 (equiv_class::hash): Likewise.
1441 (constraint_manager::to_json): Likewise.
1442 * engine.cc (impl_region_model_context::on_svalue_leak):
1444 (on_liveness_change): Likewise.
1445 (impl_region_model_context::on_unknown_change): Likewise.
1446 * program-state.cc (sm_state_map::set_state): Likewise.
1447 * region-model.cc (test_canonicalization_4): Likewise.
1449 2021-06-11 David Malcolm <dmalcolm@redhat.com>
1451 * engine.cc (worklist::key_t::cmp): Move sort by call_string to
1454 2021-06-09 David Malcolm <dmalcolm@redhat.com>
1456 * region-model.cc (region_model::get_lvalue_1): Make const.
1457 (region_model::get_lvalue): Likewise.
1458 (region_model::get_rvalue_1): Likewise.
1459 (region_model::get_rvalue): Likewise.
1460 (region_model::deref_rvalue): Likewise.
1461 (region_model::get_rvalue_for_bits): Likewise.
1462 * region-model.h (region_model::get_lvalue): Likewise.
1463 (region_model::get_rvalue): Likewise.
1464 (region_model::deref_rvalue): Likewise.
1465 (region_model::get_rvalue_for_bits): Likewise.
1466 (region_model::get_lvalue_1): Likewise.
1467 (region_model::get_rvalue_1): Likewise.
1469 2021-06-08 David Malcolm <dmalcolm@redhat.com>
1472 * region-model-manager.cc
1473 (region_model_manager::maybe_fold_binop): Add support for folding
1474 BIT_AND_EXPR of compound_svalue and a mask constant.
1475 * region-model.cc (region_model::get_rvalue_1): Implement
1476 BIT_FIELD_REF in terms of...
1477 (region_model::get_rvalue_for_bits): New function.
1478 * region-model.h (region_model::get_rvalue_for_bits): New decl.
1479 * store.cc (bit_range::from_mask): New function.
1480 (selftest::test_bit_range_intersects_p): New selftest.
1481 (selftest::assert_bit_range_from_mask_eq): New.
1482 (ASSERT_BIT_RANGE_FROM_MASK_EQ): New macro.
1483 (selftest::assert_no_bit_range_from_mask_eq): New.
1484 (ASSERT_NO_BIT_RANGE_FROM_MASK): New macro.
1485 (selftest::test_bit_range_from_mask): New selftest.
1486 (selftest::analyzer_store_cc_tests): Call the new selftests.
1487 * store.h (bit_range::intersects_p): New.
1488 (bit_range::from_mask): New decl.
1489 (concrete_binding::get_bit_range): New accessor.
1490 (store_manager::get_concrete_binding): New overload taking
1493 2021-06-08 David Malcolm <dmalcolm@redhat.com>
1495 * analyzer.h (int_size_in_bits): New decl.
1496 * region.cc (int_size_in_bits): New function.
1497 (region::get_bit_size): Reimplement in terms of the above.
1499 2021-06-08 David Malcolm <dmalcolm@redhat.com>
1501 * store.cc (concrete_binding::dump_to_pp): Move bulk of
1502 implementation to...
1503 (bit_range::dump_to_pp): ...this new function.
1504 (bit_range::cmp): New.
1505 (concrete_binding::overlaps_p): Update for use of bit_range.
1506 (concrete_binding::cmp_ptr_ptr): Likewise.
1507 * store.h (struct bit_range): New.
1508 (class concrete_binding): Replace fields m_start_bit_offset and
1509 m_size_in_bits with new field m_bit_range.
1511 2021-06-08 David Malcolm <dmalcolm@redhat.com>
1513 * svalue.h (conjured_svalue::iterator_t): Delete.
1515 2021-06-03 David Malcolm <dmalcolm@redhat.com>
1517 * store.h (store::get_direct_binding): Remove unused decl.
1518 (store::get_default_binding): Likewise.
1520 2021-06-03 David Malcolm <dmalcolm@redhat.com>
1522 * svalue.cc (poisoned_svalue::dump_to_pp): Dump type.
1523 (compound_svalue::dump_to_pp): Dump any type.
1525 2021-05-18 David Malcolm <dmalcolm@redhat.com>
1528 * sm-malloc.cc: Include "analyzer/function-set.h".
1529 (malloc_state_machine::on_stmt): Call unaffected_by_call_p and
1530 bail on the functions it recognizes.
1531 (malloc_state_machine::unaffected_by_call_p): New.
1533 2021-05-10 Martin Liska <mliska@suse.cz>
1535 * sm-file.cc (is_file_using_fn_p): Use startswith
1536 function instead of strncmp.
1538 2021-05-10 Martin Liska <mliska@suse.cz>
1540 * program-state.cc (program_state::operator=): Remove
1541 __cplusplus >= 201103.
1542 (program_state::program_state): Likewise.
1543 * program-state.h: Likewise.
1544 * region-model.h (class region_model): Remove dead code.
1546 2021-04-24 David Malcolm <dmalcolm@redhat.com>
1549 * sm-malloc.cc (free_of_non_heap::describe_state_change):
1550 Bulletproof against change.m_expr being NULL.
1552 2021-04-13 David Malcolm <dmalcolm@redhat.com>
1555 * supergraph.cc (saved_uids::make_uid_unique): New.
1556 (saved_uids::restore_uids): New.
1557 (supergraph::supergraph): Replace assignments to stmt->uid with
1558 calls to m_stmt_uids.make_uid_unique.
1559 (supergraph::~supergraph): New.
1560 * supergraph.h (class saved_uids): New.
1561 (supergraph::~supergraph): New decl.
1562 (supergraph::m_stmt_uids): New field.
1564 2021-04-10 David Malcolm <dmalcolm@redhat.com>
1567 * region-model.cc (region_model::on_assignment): Avoid NULL
1568 dereference if ctxt is NULL when assigning from a STRING_CST.
1570 2021-04-08 David Malcolm <dmalcolm@redhat.com>
1575 (impl_region_model_context::impl_region_model_context): Add
1576 uncertainty param and use it to initialize m_uncertainty.
1577 (impl_region_model_context::get_uncertainty): New.
1578 (impl_sm_context::get_fndecl_for_call): Add NULL for new
1579 uncertainty param when constructing impl_region_model_context.
1580 (impl_sm_context::get_state): Likewise.
1581 (impl_sm_context::set_next_state): Likewise.
1582 (impl_sm_context::warn): Likewise.
1583 (exploded_node::on_stmt): Add uncertainty param
1584 and use it when constructing impl_region_model_context.
1585 (exploded_node::on_edge): Add uncertainty param and pass
1587 (exploded_node::detect_leaks): Create uncertainty_t and pass to
1588 impl_region_model_context.
1589 (exploded_graph::get_or_create_node): Create uncertainty_t and
1590 pass to prune_for_point.
1591 (maybe_process_run_of_before_supernode_enodes): Create
1592 uncertainty_t and pass to impl_region_model_context.
1593 (exploded_graph::process_node): Create uncertainty_t instances and
1594 pass around as needed.
1596 (impl_region_model_context::impl_region_model_context): Add
1598 (impl_region_model_context::get_uncertainty): New decl.
1599 (impl_region_model_context::m_uncertainty): New field.
1600 (exploded_node::on_stmt): Add uncertainty param.
1601 (exploded_node::on_edge): Likewise.
1602 * program-state.cc (sm_state_map::on_liveness_change): Get
1603 uncertainty from context and use it to unset sm-state from
1604 svalues as appropriate.
1605 (program_state::on_edge): Add uncertainty param and use it when
1606 constructing impl_region_model_context. Fix indentation.
1607 (program_state::prune_for_point): Add uncertainty param and use it
1608 when constructing impl_region_model_context.
1609 (program_state::detect_leaks): Get any uncertainty from ctxt and
1610 use it to get maybe-live svalues for dest_state, rather than
1611 definitely-live ones; use this when determining which svalues
1613 (selftest::test_program_state_merging): Create uncertainty_t and
1614 pass to impl_region_model_context.
1615 * program-state.h (program_state::on_edge): Add uncertainty param.
1616 (program_state::prune_for_point): Likewise.
1617 * region-model-impl-calls.cc (call_details::get_uncertainty): New.
1618 (region_model::impl_call_memcpy): Pass uncertainty to
1619 mark_region_as_unknown call.
1620 (region_model::impl_call_memset): Likewise.
1621 (region_model::impl_call_strcpy): Likewise.
1622 * region-model-reachability.cc (reachable_regions::handle_sval):
1623 Also add sval to m_mutable_svals.
1624 * region-model.cc (region_model::on_assignment): Pass any
1625 uncertainty from ctxt to the store::set_value call.
1626 (region_model::handle_unrecognized_call): Get any uncertainty from
1627 ctxt and use it to record mutable svalues at the unknown call.
1628 (region_model::get_reachable_svalues): Add uncertainty param and
1629 use it to mark any maybe-bound svalues as being reachable.
1630 (region_model::set_value): Pass any uncertainty from ctxt to the
1631 store::set_value call.
1632 (region_model::mark_region_as_unknown): Add uncertainty param and
1633 pass it on to the store::mark_region_as_unknown call.
1634 (region_model::update_for_call_summary): Add uncertainty param and
1635 pass it on to the region_model::mark_region_as_unknown call.
1636 * region-model.h (call_details::get_uncertainty): New decl.
1637 (region_model::get_reachable_svalues): Add uncertainty param.
1638 (region_model::mark_region_as_unknown): Add uncertainty param.
1639 (region_model_context::get_uncertainty): New vfunc.
1640 (noop_region_model_context::get_uncertainty): New vfunc
1642 * store.cc (dump_svalue_set): New.
1643 (uncertainty_t::dump_to_pp): New.
1644 (uncertainty_t::dump): New.
1645 (binding_cluster::clobber_region): Pass NULL for uncertainty to
1646 remove_overlapping_bindings.
1647 (binding_cluster::mark_region_as_unknown): Add uncertainty param
1648 and pass it to remove_overlapping_bindings.
1649 (binding_cluster::remove_overlapping_bindings): Add uncertainty param.
1650 Use it to record any svalues that were in clobbered bindings.
1651 (store::set_value): Add uncertainty param. Pass it to
1652 binding_cluster::mark_region_as_unknown when handling symbolic
1654 (store::mark_region_as_unknown): Add uncertainty param and pass it
1655 to binding_cluster::mark_region_as_unknown.
1656 (store::remove_overlapping_bindings): Add uncertainty param and
1657 pass it to binding_cluster::remove_overlapping_bindings.
1658 * store.h (binding_cluster::mark_region_as_unknown): Add
1660 (binding_cluster::remove_overlapping_bindings): Likewise.
1661 (store::set_value): Likewise.
1662 (store::mark_region_as_unknown): Likewise.
1664 2021-04-05 David Malcolm <dmalcolm@redhat.com>
1667 * analyzer.cc (maybe_reconstruct_from_def_stmt): Fix NULL
1668 dereference on calls with zero arguments.
1669 * sm-malloc.cc (malloc_state_machine::on_stmt): When handling
1670 __attribute__((nonnull)), only call get_diagnostic_tree if the
1671 result will be used.
1673 2021-04-05 David Malcolm <dmalcolm@redhat.com>
1676 * diagnostic-manager.cc
1677 (diagnostic_manager::prune_interproc_events): Use signed integers
1678 when subtracting one from path->num_events ().
1679 (diagnostic_manager::consolidate_conditions): Likewise. Convert
1680 next_idx to a signed int.
1682 2021-04-01 David Malcolm <dmalcolm@redhat.com>
1684 * diagnostic-manager.cc (diagnostic_manager::add_diagnostic): Make
1685 enode param non-constant, and call add_diagnostic on it. Add
1686 enode index to log message.
1687 (diagnostic_manager::add_diagnostic): Make enode param
1689 * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
1690 Likewise for both decls.
1692 (impl_region_model_context::impl_region_model_context): Likewise
1694 (impl_sm_context::impl_sm_context): Likewise.
1695 (impl_sm_context::m_enode_for_diag): Likewise.
1696 (exploded_node::dump_dot): Don't pass the diagnostic manager
1697 to dump_saved_diagnostics.
1698 (exploded_node::dump_saved_diagnostics): Drop param. Iterate
1699 directly through all saved diagnostics for the enode, rather
1700 than all saved diagnostics in the diagnostic_manager and
1702 (exploded_node::on_stmt): Make non-const.
1703 (exploded_node::on_edge): Likewise.
1704 (exploded_node::on_longjmp): Likewise.
1705 (exploded_node::detect_leaks): Likewise.
1706 (exploded_graph::get_or_create_node): Make enode_for_diag param
1708 (exploded_graph_annotator::print_enode): Iterate
1709 directly through all saved diagnostics for the enode, rather
1710 than all saved diagnostics in the diagnostic_manager and
1713 (impl_region_model_context::impl_region_model_context): Make
1714 enode_for_diag param non-constant.
1715 (impl_region_model_context::m_enode_for_diag): Likewise.
1716 (exploded_node::dump_saved_diagnostics): Drop param.
1717 (exploded_node::on_stmt): Make non-const.
1718 (exploded_node::on_edge): Likewise.
1719 (exploded_node::on_longjmp): Likewise.
1720 (exploded_node::detect_leaks): Likewise.
1721 (exploded_node::add_diagnostic): New.
1722 (exploded_node::get_num_diagnostics): New.
1723 (exploded_node::get_saved_diagnostic): New.
1724 (exploded_node::m_saved_diagnostics): New.
1725 (exploded_graph::get_or_create_node): Make enode_for_diag param
1727 * feasible-graph.cc (feasible_node::dump_dot): Drop
1728 diagnostic_manager from call to dump_saved_diagnostics.
1729 * program-state.cc (program_state::on_edge): Convert enode param
1730 to non-const pointer.
1731 (program_state::prune_for_point): Likewise for enode_for_diag
1733 * program-state.h (program_state::on_edge): Convert enode param
1734 to non-const pointer.
1735 (program_state::prune_for_point): Likewise for enode_for_diag
1738 2021-03-31 David Malcolm <dmalcolm@redhat.com>
1741 * analyzer.cc (maybe_reconstruct_from_def_stmt): New.
1742 (fixup_tree_for_diagnostic_1): New.
1743 (fixup_tree_for_diagnostic): New.
1744 * analyzer.h (fixup_tree_for_diagnostic): New decl.
1745 * checker-path.cc (call_event::get_desc): Call
1746 fixup_tree_for_diagnostic and use it for the call_with_state call.
1747 (warning_event::get_desc): Likewise for the final_event and
1748 make_label_text calls.
1749 * engine.cc (impl_region_model_context::on_state_leak): Likewise
1750 for the on_leak and add_diagnostic calls.
1751 * region-model.cc (region_model::get_representative_tree):
1752 Likewise for the result.
1754 2021-03-30 David Malcolm <dmalcolm@redhat.com>
1756 * region.h (region::dump_to_pp): Remove old decl.
1758 2021-03-30 David Malcolm <dmalcolm@redhat.com>
1760 * sm-file.cc (fileptr_state_machine::on_stmt): Only call
1761 get_diagnostic_tree if the result will be used.
1762 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
1763 (malloc_state_machine::on_deallocator_call): Likewise.
1764 (malloc_state_machine::on_realloc_call): Likewise.
1765 (malloc_state_machine::on_realloc_call): Likewise.
1767 (sensitive_state_machine::warn_for_any_exposure): Likewise.
1768 * sm-taint.cc (taint_state_machine::on_stmt): Likewise.
1770 2021-03-25 David Malcolm <dmalcolm@redhat.com>
1775 * engine.cc (exploded_node::on_stmt): Clear sm-state involving
1776 an SSA name at the def-stmt of that SSA name.
1777 * program-state.cc (sm_state_map::purge_state_involving): New.
1778 * program-state.h (sm_state_map::purge_state_involving): New decl.
1779 * region-model.cc (selftest::test_involves_p): New.
1780 (selftest::analyzer_region_model_cc_tests): Call it.
1781 * svalue.cc (class involvement_visitor): New class
1782 (svalue::involves_p): New.
1783 * svalue.h (svalue::involves_p): New decl.
1785 2021-03-19 David Malcolm <dmalcolm@redhat.com>
1788 * diagnostic-manager.cc (class epath_finder): Add
1789 DISABLE_COPY_AND_ASSIGN.
1791 2021-03-15 Martin Liska <mliska@suse.cz>
1793 * sm-file.cc (get_file_using_fns): Add missing comma in initializer.
1795 2021-03-11 David Malcolm <dmalcolm@redhat.com>
1798 * analyzer.opt (-param=analyzer-max-infeasible-edges=): New param.
1799 (fdump-analyzer-feasibility): New flag.
1800 * diagnostic-manager.cc: Include "analyzer/trimmed-graph.h" and
1801 "analyzer/feasible-graph.h".
1802 (epath_finder::epath_finder): Convert m_sep to a pointer and
1803 only create it if !flag_analyzer_feasibility.
1804 (epath_finder::~epath_finder): New.
1805 (epath_finder::m_sep): Convert to a pointer.
1806 (epath_finder::get_best_epath): Add param "diag_idx" and use it
1807 when logging. Rather than finding the shortest path and then
1808 checking feasibility, instead use explore_feasible_paths unless
1809 !flag_analyzer_feasibility, in which case simply use the shortest
1810 path, and note if it is infeasible. Update for m_sep becoming a
1812 (class feasible_worklist): New.
1813 (epath_finder::explore_feasible_paths): New.
1814 (epath_finder::process_worklist_item): New.
1815 (class dump_eg_with_shortest_path): New.
1816 (epath_finder::dump_trimmed_graph): New.
1817 (epath_finder::dump_feasible_graph): New.
1818 (saved_diagnostic::saved_diagnostic): Add "idx" param, using it
1820 (saved_diagnostic::to_json): Dump m_idx.
1821 (saved_diagnostic::calc_best_epath): Pass m_idx to get_best_epath.
1822 Remove assertion that m_problem was set when m_best_epath is NULL.
1823 (diagnostic_manager::add_diagnostic): Pass an index when created
1824 saved_diagnostic instances.
1825 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add
1827 (saved_diagnostic::get_index): New accessor.
1828 (saved_diagnostic::m_idx): New field.
1829 * engine.cc (exploded_node::dump_dot): Call args.dump_extra_info.
1831 (exploded_node::dump_processed_stmts): ...this new function and...
1832 (exploded_node::dump_saved_diagnostics): ...this new function.
1833 Add index of each diagnostic.
1834 (exploded_edge::dump_dot): Move bulk of code to...
1835 (exploded_edge::dump_dot_label): ...this new function.
1836 * exploded-graph.h (eg_traits::dump_args_t::dump_extra_info): New
1838 (exploded_node::dump_processed_stmts): New decl.
1839 (exploded_node::dump_saved_diagnostics): New decl.
1840 (exploded_edge::dump_dot_label): New decl.
1841 * feasible-graph.cc: New file.
1842 * feasible-graph.h: New file.
1843 * trimmed-graph.cc: New file.
1844 * trimmed-graph.h: New file.
1846 2021-03-11 David Malcolm <dmalcolm@redhat.com>
1848 * diagnostic-manager.cc (epath_finder::epath_finder):
1849 Update shortest_paths init for new param.
1851 2021-03-10 David Malcolm <dmalcolm@redhat.com>
1854 * engine.cc (exploded_path::feasible_p): Move "snodes_visited" and
1855 "model" locals into a new class feasibility_state. Move heart
1856 of per-edge processing into
1857 feasibility_state::maybe_update_for_edge.
1858 (feasibility_state::feasibility_state): New.
1859 (feasibility_state::maybe_update_for_edge): New, based on loop
1860 body in exploded_path::feasible_p.
1861 * exploded-graph.h (class feasibility_state): New.
1863 2021-03-10 David Malcolm <dmalcolm@redhat.com>
1866 (callgraph_superedge::dyn_cast_callgraph_superedge): New.
1867 (call_superedge::dyn_cast_callgraph_superedge): Delete.
1868 (return_superedge::dyn_cast_callgraph_superedge): Delete.
1870 2021-03-02 Martin Liska <mliska@suse.cz>
1872 * diagnostic-manager.cc (diagnostic_manager::emit_saved_diagnostics):
1875 2021-02-26 David Malcolm <dmalcolm@redhat.com>
1877 * engine.cc (exploded_path::exploded_path): New copy-ctor.
1878 * exploded-graph.h (exploded_path::operator=): Drop decl.
1880 2021-02-26 David Malcolm <dmalcolm@redhat.com>
1883 * diagnostic-manager.cc (class epath_finder): New.
1884 (epath_finder::get_best_epath): New.
1885 (saved_diagnostic::saved_diagnostic): Update for replacement of
1886 m_state and m_epath_length with m_best_epath.
1887 (saved_diagnostic::~saved_diagnostic): Delete m_best_epath.
1888 (saved_diagnostic::to_json): Update "path_length" to be optional.
1889 (saved_diagnostic::calc_best_epath): New, based on
1890 dedupe_winners::add and parts of dedupe_key::dedupe_key.
1891 (saved_diagnostic::get_epath_length): New.
1892 (saved_diagnostic::add_duplicate): New.
1893 (dedupe_key::dedupe_key): Drop epath param. Move invocation of
1894 stmt_finder to saved_diagnostic::calc_best_epath.
1895 (class dedupe_candidate): Delete.
1896 (class dedupe_hash_map_traits): Update to use saved_diagnotic *
1897 rather than dedupe_candidate * as the value_type/compare_type.
1898 (dedupe_winners::~dedupe_winners): Don't delete the values.
1899 (dedupe_winners::add): Convert param from shortest_exploded_paths to
1900 epath_finder. Drop "eg" param. Drop dedupe_candidate, moving
1901 path generation and feasiblity checking to
1902 epath_finder::get_best_epath. Update winner-selection for move
1903 of epaths from dedupe_candidate to saved_diagnostic.
1904 (dedupe_winners::emit_best): Update for removal of class
1906 (dedupe_winners::map_t): Update to use saved_diagnotic * rather
1907 than dedupe_candidate * as the value_type/compare_type.
1908 (diagnostic_manager::emit_saved_diagnostics): Move
1909 shortest_exploded_paths instance into epath_finder and pass that
1911 (diagnostic_manager::emit_saved_diagnostic): Drop epath, stmt
1912 and num_dupes params, instead getting these from the
1913 saved_diagnostic. Use correct location in inform_n call.
1914 * diagnostic-manager.h (class epath_finder): New forward decl.
1915 (saved_diagnostic::status): Drop enum.
1916 (saved_diagnostic::set_feasible): Drop.
1917 (saved_diagnostic::set_infeasible): Drop.
1918 (saved_diagnostic::get_status): Drop.
1919 (saved_diagnostic::calc_best_epath): New decl.
1920 (saved_diagnostic::get_best_epath): New decl.
1921 (saved_diagnostic::get_epath_length): New decl.
1922 (saved_diagnostic::set_epath_length): Drop.
1923 (saved_diagnostic::get_epath_length): Drop inline implementation.
1924 (saved_diagnostic::add_duplicate): New.
1925 (saved_diagnostic::get_num_dupes): New.
1926 (saved_diagnostic::m_d): Document ownership.
1927 (saved_diagnostic::m_trailing_eedge): Make const.
1928 (saved_diagnostic::m_status): Drop field.
1929 (saved_diagnostic::m_epath_length): Drop field.
1930 (saved_diagnostic::m_best_epath): New field.
1931 (saved_diagnostic::m_problem): Document ownership.
1932 (saved_diagnostic::m_duplicates): New field.
1933 (diagnostic_manager::emit_saved_diagnostic): Drop params epath,
1934 stmt, and num_dupes.
1935 * engine.cc (exploded_graph_annotator::print_saved_diagnostic):
1936 Update for changes to saved_diagnostic class.
1937 * exploded-graph.h (exploded_path::feasible_p): Drop unused
1940 2021-02-25 David Malcolm <dmalcolm@redhat.com>
1943 * region-model-impl-calls.cc (region_model::impl_call_realloc): New.
1944 * region-model.cc (region_model::on_call_pre): Call it.
1945 * region-model.h (region_model::impl_call_realloc): New decl.
1946 * sm-malloc.cc (enum wording): Add WORDING_REALLOCATED.
1947 (malloc_state_machine::m_realloc): New field.
1948 (use_after_free::describe_state_change): Add case for
1949 WORDING_REALLOCATED.
1950 (use_after_free::describe_final_event): Likewise.
1951 (malloc_state_machine::malloc_state_machine): Initialize
1953 (malloc_state_machine::on_stmt): Handle realloc by calling...
1954 (malloc_state_machine::on_realloc_call): New.
1956 2021-02-22 David Malcolm <dmalcolm@redhat.com>
1959 * engine.cc (exploded_node::on_stmt): Provide terminate_path
1960 flag as a way for on_call_pre to terminate the current analysis
1962 * region-model-impl-calls.cc (call_details::num_args): New.
1963 (region_model::impl_call_error): New.
1964 * region-model.cc (region_model::on_call_pre): Add param
1965 "out_terminate_path". Handle "error" and "error_at_line".
1966 * region-model.h (call_details::num_args): New decl.
1967 (region_model::on_call_pre): Add param "out_terminate_path".
1968 (region_model::impl_call_error): New decl.
1970 2021-02-17 David Malcolm <dmalcolm@redhat.com>
1973 * constraint-manager.cc (dead_svalue_purger::should_purge_p):
1974 Update for change to svalue::live_p.
1975 * program-state.cc (sm_state_map::on_liveness_change): Likewise.
1976 (program_state::detect_leaks): Likewise.
1977 * region-model-reachability.cc (reachable_regions::init_cluster):
1978 When dealing with a symbolic region, if the underlying pointer is
1979 implicitly live, add the region to the reachable regions.
1980 * region-model.cc (region_model::compare_initial_and_pointer):
1981 Move logic for detecting initial values of params to
1982 initial_svalue::initial_value_of_param_p.
1983 * svalue.cc (svalue::live_p): Convert "live_svalues" from a
1984 reference to a pointer; support it being NULL.
1985 (svalue::implicitly_live_p): Convert first param from a
1986 refererence to a pointer.
1987 (region_svalue::implicitly_live_p): Likewise.
1988 (constant_svalue::implicitly_live_p): Likewise.
1989 (initial_svalue::implicitly_live_p): Likewise. Treat the initial
1990 values of params for the top level frame as still live.
1991 (initial_svalue::initial_value_of_param_p): New function, taken
1992 from a test in region_model::compare_initial_and_pointer.
1993 (unaryop_svalue::implicitly_live_p): Convert first param from a
1994 refererence to a pointer.
1995 (binop_svalue::implicitly_live_p): Likewise.
1996 (sub_svalue::implicitly_live_p): Likewise.
1997 (unmergeable_svalue::implicitly_live_p): Likewise.
1998 * svalue.h (svalue::live_p): Likewise.
1999 (svalue::implicitly_live_p): Likewise.
2000 (region_svalue::implicitly_live_p): Likewise.
2001 (constant_svalue::implicitly_live_p): Likewise.
2002 (initial_svalue::implicitly_live_p): Likewise.
2003 (initial_svalue::initial_value_of_param_p): New decl.
2004 (unaryop_svalue::implicitly_live_p): Convert first param from a
2005 refererence to a pointer.
2006 (binop_svalue::implicitly_live_p): Likewise.
2007 (sub_svalue::implicitly_live_p): Likewise.
2008 (unmergeable_svalue::implicitly_live_p): Likewise.
2010 2021-02-12 David Malcolm <dmalcolm@redhat.com>
2013 * engine.cc (readability): Add names for the various arbitrary
2014 values. Handle NOP_EXPR and INTEGER_CST.
2015 (readability_comparator): Combine the readability tests for
2016 tree and stack depth, rather than performing them sequentially.
2017 (impl_region_model_context::on_state_leak): Strip off top-level
2019 * region-model.cc (region_model::get_representative_path_var): Add
2020 type-checking, moving the bulk of the implementation to...
2021 (region_model::get_representative_path_var_1): ...here. Respect
2022 types in casts by recursing and re-adding the cast, rather than
2023 merely stripping them off. Use the correct type when handling
2025 (region_model::get_representative_tree): Strip off any top-level
2027 (region_model::get_representative_path_var): Add type-checking,
2028 moving the bulk of the implementation to...
2029 (region_model::get_representative_path_var_1): ...here.
2030 * region-model.h (region_model::get_representative_path_var_1):
2032 (region_model::get_representative_path_var_1): New decl.
2033 * store.cc (append_pathvar_with_type): New.
2034 (binding_cluster::get_representative_path_vars): Cast path_vars
2035 to the correct type when adding them to *OUT_PVS.
2037 2021-02-09 David Malcolm <dmalcolm@redhat.com>
2040 * sm-file.cc (is_file_using_fn_p): Support "_IO_"-prefixed
2043 2021-02-09 David Malcolm <dmalcolm@redhat.com>
2046 * store.cc (store::set_value): Treat a pointer written to *UNKNOWN
2049 2021-02-02 David Malcolm <dmalcolm@redhat.com>
2053 * engine.cc (toplevel_function_p): Simplify so that
2054 we only reject functions with a "__analyzer_" prefix.
2055 (add_any_callbacks): Delete.
2056 (exploded_graph::build_initial_worklist): Update for
2057 dropped param of toplevel_function_p.
2058 (exploded_graph::build_initial_worklist): Don't bother
2059 looking for callbacks that are reachable from global
2062 2021-02-01 David Malcolm <dmalcolm@redhat.com>
2065 * region-model-manager.cc
2066 (region_model_manager::get_or_create_initial_value):
2067 Fold the initial value of *UNKNOWN_PTR to an UNKNOWN value.
2068 (region_model_manager::get_field_region): Fold the value
2069 of UNKNOWN_PTR->FIELD to *UNKNOWN_PTR_OF_&FIELD_TYPE.
2071 2021-01-29 David Malcolm <dmalcolm@redhat.com>
2073 * checker-path.cc (event_kind_to_string): Handle
2074 EK_START_CONSOLIDATED_CFG_EDGES and
2075 EK_END_CONSOLIDATED_CFG_EDGES.
2076 (start_consolidated_cfg_edges_event::get_desc): New.
2077 (checker_path::cfg_edge_pair_at_p): New.
2078 * checker-path.h (enum event_kind): Add
2079 EK_START_CONSOLIDATED_CFG_EDGES and
2080 EK_END_CONSOLIDATED_CFG_EDGES.
2081 (class start_consolidated_cfg_edges_event): New class.
2082 (class end_consolidated_cfg_edges_event): New class.
2083 (checker_path::delete_events): New.
2084 (checker_path::replace_event): New.
2085 (checker_path::cfg_edge_pair_at_p): New decl.
2086 * diagnostic-manager.cc (diagnostic_manager::prune_path): Call
2087 consolidate_conditions.
2088 (same_line_as_p): New.
2089 (diagnostic_manager::consolidate_conditions): New.
2090 * diagnostic-manager.h
2091 (diagnostic_manager::consolidate_conditions): New decl.
2093 2021-01-18 David Malcolm <dmalcolm@redhat.com>
2095 * analyzer.h (is_std_named_call_p): New decl.
2096 * diagnostic-manager.cc (path_builder::get_sm): New.
2097 (state_change_event_creator::state_change_event_creator): Add "pb"
2099 (state_change_event_creator::on_global_state_change): Don't consider
2100 state changes affecting other state_machines.
2101 (state_change_event_creator::on_state_change): Likewise.
2102 (state_change_event_creator::m_pb): New field.
2103 (diagnostic_manager::add_events_for_eedge): Pass pb to visitor
2105 * region-model-impl-calls.cc
2106 (region_model::impl_deallocation_call): New.
2107 * region-model.cc: Include "attribs.h".
2108 (region_model::on_call_post): Handle fndecls referenced by
2109 __attribute__((deallocated_by(FOO))).
2110 * region-model.h (region_model::impl_deallocation_call): New decl.
2111 * sm-malloc.cc: Include "stringpool.h" and "attribs.h". Add
2113 (class api): Delete.
2114 (enum resource_state): Update comment for change from api to
2115 deallocator and deallocator_set.
2116 (allocation_state::allocation_state): Drop api param. Add
2117 "deallocators" and "deallocator".
2118 (allocation_state::m_api): Drop field in favor of...
2119 (allocation_state::m_deallocators): New field.
2120 (allocation_state::m_deallocator): New field.
2121 (enum wording): Add WORDING_DEALLOCATED.
2122 (struct deallocator): New.
2123 (struct standard_deallocator): New.
2124 (struct custom_deallocator): New.
2125 (struct deallocator_set): New.
2126 (struct custom_deallocator_set): New.
2127 (struct standard_deallocator_set): New.
2128 (struct deallocator_set_map_traits): New.
2129 (malloc_state_machine::m_malloc): Drop field
2130 (malloc_state_machine::m_scalar_new): Likewise.
2131 (malloc_state_machine::m_vector_new): Likewise.
2132 (malloc_state_machine::m_free): New field
2133 (malloc_state_machine::m_scalar_delete): Likewise.
2134 (malloc_state_machine::m_vector_delete): Likewise.
2135 (malloc_state_machine::deallocator_map_t): New typedef.
2136 (malloc_state_machine::m_deallocator_map): New field.
2137 (malloc_state_machine::deallocator_set_cache_t): New typedef.
2138 (malloc_state_machine::m_custom_deallocator_set_cache): New field.
2139 (malloc_state_machine::custom_deallocator_set_map_t): New typedef.
2140 (malloc_state_machine::m_custom_deallocator_set_map): New field.
2141 (malloc_state_machine::m_dynamic_sets): New field.
2142 (malloc_state_machine::m_dynamic_deallocators): New field.
2144 (deallocator::deallocator): New ctor.
2145 (deallocator::hash): New.
2146 (deallocator::dump_to_pp): New.
2147 (deallocator::cmp): New.
2148 (deallocator::cmp_ptr_ptr): New.
2149 (standard_deallocator::standard_deallocator): New ctor.
2150 (deallocator_set::deallocator_set): New ctor.
2151 (deallocator_set::dump): New.
2152 (custom_deallocator_set::custom_deallocator_set): New ctor.
2153 (custom_deallocator_set::contains_p): New.
2154 (custom_deallocator_set::maybe_get_single): New.
2155 (custom_deallocator_set::dump_to_pp): New.
2156 (standard_deallocator_set::standard_deallocator_set): New ctor.
2157 (standard_deallocator_set::contains_p): New.
2158 (standard_deallocator_set::maybe_get_single): New.
2159 (standard_deallocator_set::dump_to_pp): New.
2161 (class mismatching_deallocation): Update for conversion from api
2162 to deallocator_set and deallocator.
2163 (double_free::emit): Use %qs.
2164 (class use_after_free): Update for conversion from api to
2165 deallocator_set and deallocator.
2166 (malloc_leak::describe_state_change): Only emit "allocated here" on
2167 a start->nonnull transition, rather than on other transitions to
2169 (allocation_state::dump_to_pp): Update for conversion from api to
2171 (allocation_state::get_nonnull): Likewise.
2172 (malloc_state_machine::malloc_state_machine): Likewise.
2173 (malloc_state_machine::~malloc_state_machine): New.
2174 (malloc_state_machine::add_state): Update for conversion from api
2176 (malloc_state_machine::get_or_create_custom_deallocator_set): New.
2177 (malloc_state_machine::maybe_create_custom_deallocator_set): New.
2178 (malloc_state_machine::get_or_create_deallocator): New.
2179 (malloc_state_machine::on_stmt): Update for conversion from api
2180 to deallocator_set. Handle "__attribute__((malloc(FOO)))", and
2181 the special attribute set on FOO.
2182 (malloc_state_machine::on_allocator_call): Update for conversion
2183 from api to deallocator_set. Add "returns_nonnull" param and use
2184 it to affect which state to transition to.
2185 (malloc_state_machine::on_deallocator_call): Update for conversion
2186 from api to deallocator_set.
2188 2021-01-14 David Malcolm <dmalcolm@redhat.com>
2190 * engine.cc (strongly_connected_components::to_json): New.
2191 (worklist::to_json): New.
2192 (exploded_graph::to_json): JSON-ify the worklist.
2193 * exploded-graph.h (strongly_connected_components::to_json): New
2195 (worklist::to_json): New decl.
2196 * store.cc (store::to_json): Fix comment.
2197 * supergraph.cc (supernode::to_json): Fix reference to
2198 "returning_call" in comment. Add optional "fun" to JSON.
2199 (edge_kind_to_string): New.
2200 (superedge::to_json): Add "kind" to JSON.
2202 2021-01-14 David Malcolm <dmalcolm@redhat.com>
2205 * analyzer.h (region_offset::operator==): Make const.
2206 * pending-diagnostic.h (pending_diagnostic::equal_p): Likewise.
2207 * store.h (binding_cluster::for_each_value): Likewise.
2208 (binding_cluster::for_each_binding): Likewise.
2210 2021-01-12 David Malcolm <dmalcolm@redhat.com>
2213 * store.cc (binding_cluster::make_unknown_relative_to): Don't mark
2214 dereferenced unknown pointers as having escaped.
2216 2021-01-07 David Malcolm <dmalcolm@redhat.com>
2219 * region.cc (decl_region::get_svalue_for_initializer): Gracefully
2220 handle when LTO writes out DECL_INITIAL as error_mark_node.
2222 2021-01-07 David Malcolm <dmalcolm@redhat.com>
2225 * store.cc (binding_cluster::can_merge_p): Add "out_store" param
2226 and pass to calls to binding_cluster::make_unknown_relative_to.
2227 (binding_cluster::make_unknown_relative_to): Add "out_store"
2228 param. Use it to mark base regions that are pointed to by
2229 pointers that become unknown as having escaped.
2230 (store::can_merge_p): Pass out_store to
2231 binding_cluster::can_merge_p.
2232 * store.h (binding_cluster::can_merge_p): Add "out_store" param.
2233 (binding_cluster::make_unknown_relative_to): Likewise.
2234 * svalue.cc (region_svalue::implicitly_live_p): New vfunc.
2235 * svalue.h (region_svalue::implicitly_live_p): New vfunc decl.
2237 2021-01-07 David Malcolm <dmalcolm@redhat.com>
2240 * engine.cc (exploded_path::feasible_p): Add missing call to
2243 2021-01-06 David Malcolm <dmalcolm@redhat.com>
2246 * region-model-reachability.cc (reachable_regions::init_cluster):
2247 Convert symbolic region handling to a switch statement. Add cases
2248 to handle SK_UNKNOWN and SK_CONJURED.
2250 2021-01-05 David Malcolm <dmalcolm@redhat.com>
2253 * store.cc (binding_map::apply_ctor_to_region): When "index" is
2254 NULL, iterate through the fields for RECORD_TYPEs, rather than
2255 creating an INTEGER_CST index.
2257 2020-11-30 David Malcolm <dmalcolm@redhat.com>
2259 * analyzer-pass.cc: Include "analyzer/analyzer.h" for the
2260 declaration of sorry_no_analyzer; include "tree.h" and
2261 "function.h" as these are needed by it.
2263 2020-11-30 David Malcolm <dmalcolm@redhat.com>
2265 * analyzer-pass.cc (pass_analyzer::execute): Move sorry call to...
2266 (sorry_no_analyzer): New.
2267 * analyzer.h (class state_machine): New forward decl.
2268 (class logger): New forward decl.
2269 (class plugin_analyzer_init_iface): New.
2270 (sorry_no_analyzer): New decl.
2271 * checker-path.cc (checker_path::fixup_locations): New.
2272 * checker-path.h (checker_event::set_location): New.
2273 (checker_path::fixup_locations): New decl.
2274 * diagnostic-manager.cc
2275 (diagnostic_manager::emit_saved_diagnostic): Call
2276 checker_path::fixup_locations, and call fixup_location
2277 on the primary location.
2278 * engine.cc: Include "plugin.h".
2279 (class plugin_analyzer_init_impl): New.
2280 (impl_run_checkers): Invoke PLUGIN_ANALYZER_INIT callbacks.
2281 * pending-diagnostic.h (pending_diagnostic::fixup_location): New
2284 2020-11-18 David Malcolm <dmalcolm@redhat.com>
2287 * sm-malloc.cc (null_deref::emit): Use CWE-476 rather than
2288 CWE-690, as this isn't due to an unchecked return value.
2289 (null_arg::emit): Likewise.
2291 2020-11-12 David Malcolm <dmalcolm@redhat.com>
2293 * checker-path.h (checker_event::get_id_ptr): New.
2294 * diagnostic-manager.cc (path_builder::path_builder): Add "sd"
2295 param and use it to initialize new field "m_sd".
2296 (path_builder::get_pending_diagnostic): New.
2297 (path_builder::m_sd): New field.
2298 (diagnostic_manager::emit_saved_diagnostic): Pass sd to
2300 (diagnostic_manager::add_events_for_superedge): Call new
2301 maybe_add_custom_events_for_superedge vfunc.
2302 * engine.cc (stale_jmp_buf::stale_jmp_buf): Add "setjmp_point"
2303 param and use it to initialize new field "m_setjmp_point".
2304 Initialize new field "m_stack_pop_event".
2305 (stale_jmp_buf::maybe_add_custom_events_for_superedge): New vfunc
2307 (stale_jmp_buf::describe_final_event): New vfunc implementation.
2308 (stale_jmp_buf::m_setjmp_point): New field.
2309 (stale_jmp_buf::m_stack_pop_event): New field.
2310 (exploded_node::on_longjmp): Pass setjmp_point to stale_jmp_buf
2312 * pending-diagnostic.h
2313 (pending_diagnostic::maybe_add_custom_events_for_superedge): New
2316 2020-11-12 David Malcolm <dmalcolm@redhat.com>
2318 PR tree-optimization/97424
2319 * analyzer.opt (Wanalyzer-shift-count-negative): New.
2320 (Wanalyzer-shift-count-overflow): New.
2321 * region-model.cc (class shift_count_negative_diagnostic): New.
2322 (class shift_count_overflow_diagnostic): New.
2323 (region_model::get_gassign_result): Complain about shift counts that
2324 are negative or are >= the operand's type's width.
2326 2020-11-10 Martin Liska <mliska@suse.cz>
2328 * constraint-manager.cc (constraint_manager::merge): Remove
2330 * constraint-manager.h: Likewise.
2331 * program-state.cc (sm_state_map::sm_state_map): Likewise.
2332 (program_state::program_state): Likewise.
2333 (test_sm_state_map): Likewise.
2334 * program-state.h: Likewise.
2335 * region-model-reachability.cc (reachable_regions::reachable_regions): Likewise.
2336 * region-model-reachability.h: Likewise.
2337 * region-model.cc (region_model::handle_unrecognized_call): Likewise.
2338 (region_model::get_reachable_svalues): Likewise.
2339 (region_model::can_merge_with_p): Likewise.
2341 2020-11-05 David Malcolm <dmalcolm@redhat.com>
2344 * svalue.cc (cmp_cst): Handle COMPLEX_CST.
2346 2020-10-29 David Malcolm <dmalcolm@redhat.com>
2348 * program-state.cc (sm_state_map::on_liveness_change): Sort the
2349 leaking svalues before calling on_state_leak.
2350 (program_state::detect_leaks): Likewise when calling
2352 * region-model-reachability.cc
2353 (reachable_regions::mark_escaped_clusters): Likewise when
2354 calling on_escaped_function.
2356 2020-10-29 David Malcolm <dmalcolm@redhat.com>
2359 * region-model-reachability.cc (reachable_regions::handle_sval):
2360 Operands of reachable reversible operations are reachable.
2362 2020-10-29 David Malcolm <dmalcolm@redhat.com>
2364 * analyzer.h (class state_machine): New forward decl.
2365 (class logger): Likewise.
2366 (class visitor): Likewise.
2367 * complexity.cc: New file, taken from svalue.cc.
2368 * complexity.h: New file, taken from region-model.h.
2369 * region-model.h: Include "analyzer/svalue.h" and
2370 "analyzer/region.h". Move struct complexity to complexity.h.
2371 Move svalue, its subclasses and supporting decls to svalue.h.
2372 Move region, its subclasses and supporting decls to region.h.
2373 * region.cc: Include "analyzer/region.h".
2374 (symbolic_region::symbolic_region): Move here from region-model.h.
2375 * region.h: New file, based on material from region-model.h.
2376 * svalue.cc: Include "analyzer/svalue.h".
2377 (complexity::complexity): Move to complexity.cc.
2378 (complexity::from_pair): Likewise.
2379 * svalue.h: New file, based on material from region-model.h.
2381 2020-10-29 David Malcolm <dmalcolm@redhat.com>
2383 * program-state.cc (sm_state_map::print): Guard the printing of
2384 the origin pointer with !flag_dump_noaddr.
2385 * region.cc (string_region::dump_to_pp): Likewise for
2388 2020-10-27 David Malcolm <dmalcolm@redhat.com>
2391 * region-model.cc (region_model::get_initial_value_for_global):
2392 Move check that !DECL_EXTERNAL from here to...
2393 * region.cc (decl_region::get_svalue_for_initializer): ...here,
2394 using it to reject zero initialization.
2396 2020-10-27 Markus Böck <markus.boeck02@gmail.com>
2399 * store.h (hash): Cast to intptr_t instead of long
2401 2020-10-27 David Malcolm <dmalcolm@redhat.com>
2403 * constraint-manager.cc (svalue_cmp_by_ptr): Delete.
2404 (equiv_class::canonicalize): Use svalue::cmp_ptr_ptr instead.
2405 (equiv_class_cmp): Eliminate pointer comparison.
2406 * diagnostic-manager.cc (dedupe_key::comparator): If they are at
2407 the same location, also compare epath ength and pending_diagnostic
2409 * engine.cc (readability_comparator): If two path_vars have the
2410 same readability, then impose an arbitrary ordering on them.
2411 (worklist::key_t::cmp): If two points have the same plan ordering,
2412 continue the comparison. Call sm_state_map::cmp rather than
2413 comparing hash values.
2414 * program-state.cc (sm_state_map::entry_t::cmp): New.
2415 (sm_state_map::cmp): New.
2416 * program-state.h (sm_state_map::entry_t::cmp): New decl.
2417 (sm_state_map::elements): New.
2418 (sm_state_map::cmp): New.
2420 2020-10-27 David Malcolm <dmalcolm@redhat.com>
2422 * engine.cc (setjmp_record::cmp): New.
2423 (supernode_cluster::dump_dot): Avoid embedding pointer in cluster
2425 (supernode_cluster::cmp_ptr_ptr): New.
2426 (function_call_string_cluster::dump_dot): Avoid embedding pointer
2427 in cluster name. Sort m_map when dumping child clusters.
2428 (function_call_string_cluster::cmp_ptr_ptr): New.
2429 (root_cluster::dump_dot): Sort m_map when dumping child clusters.
2430 * program-point.cc (function_point::cmp): New.
2431 (function_point::cmp_ptr): New.
2432 * program-point.h (function_point::cmp): New decl.
2433 (function_point::cmp_ptr): New decl.
2434 * program-state.cc (sm_state_map::print): Sort the values. Guard
2435 the printing of pointers with !flag_dump_noaddr.
2436 (program_state::prune_for_point): Sort the regions.
2437 (log_set_of_svalues): Sort the values. Guard the printing of
2438 pointers with !flag_dump_noaddr.
2439 * region-model-manager.cc (log_uniq_map): Sort the values.
2440 * region-model-reachability.cc (dump_set): New function template.
2441 (reachable_regions::dump_to_pp): Use it.
2442 * region-model.h (svalue::cmp_ptr): New decl.
2443 (svalue::cmp_ptr_ptr): New decl.
2444 (setjmp_record::cmp): New decl.
2445 (placeholder_svalue::get_name): New accessor.
2446 (widening_svalue::get_point): New accessor.
2447 (compound_svalue::get_map): New accessor.
2448 (conjured_svalue::get_stmt): New accessor.
2449 (conjured_svalue::get_id_region): New accessor.
2450 (region::cmp_ptrs): Rename to...
2451 (region::cmp_ptr_ptr): ...this.
2452 * region.cc (region::cmp_ptrs): Rename to...
2453 (region::cmp_ptr_ptr): ...this.
2455 (state_purge_per_ssa_name::state_purge_per_ssa_name): Sort
2456 m_points_needing_name when dumping.
2457 * store.cc (concrete_binding::cmp_ptr_ptr): New.
2458 (symbolic_binding::cmp_ptr_ptr): New.
2459 (binding_map::cmp): New.
2460 (get_sorted_parent_regions): Update for renaming of
2461 region::cmp_ptrs to region::cmp_ptr_ptr.
2462 (store::dump_to_pp): Likewise.
2463 (store::to_json): Likewise.
2464 (store::can_merge_p): Sort the base regions before considering
2466 * store.h (concrete_binding::cmp_ptr_ptr): New decl.
2467 (symbolic_binding::cmp_ptr_ptr): New decl.
2468 (binding_map::cmp): New decl.
2469 * supergraph.cc (supergraph::supergraph): Assign UIDs to the
2471 * svalue.cc (cmp_cst): New.
2472 (svalue::cmp_ptr): New.
2473 (svalue::cmp_ptr_ptr): New.
2475 2020-10-27 David Malcolm <dmalcolm@redhat.com>
2477 * engine.cc (exploded_graph::get_or_create_node): Fix off-by-one
2478 when imposing param_analyzer_max_enodes_per_program_point limit.
2480 2020-10-27 David Malcolm <dmalcolm@redhat.com>
2482 * region-model.cc (region_model::get_representative_path_var):
2483 Implement case RK_LABEL.
2484 * region-model.h (label_region::get_label): New accessor.
2486 2020-10-22 David Malcolm <dmalcolm@redhat.com>
2489 * engine.cc (exploded_graph::add_function_entry): Handle failure
2490 to create an enode, rather than asserting.
2492 2020-10-22 David Malcolm <dmalcolm@redhat.com>
2495 * engine.cc (exploded_graph::add_function_entry): Assert that we
2496 have a function body.
2497 (exploded_graph::on_escaped_function): Reject fndecls that don't
2498 have a function body.
2500 2020-10-14 David Malcolm <dmalcolm@redhat.com>
2503 * region-model.cc (region_model::get_initial_value_for_global):
2504 Fall back to returning an initial_svalue if
2505 decl_region::get_svalue_for_initializer fails.
2506 * region.cc (decl_region::get_svalue_for_initializer): Don't
2507 attempt to create a compound_svalue if the region has an unknown
2510 2020-10-14 David Malcolm <dmalcolm@redhat.com>
2513 * store.cc (binding_map::apply_ctor_to_region): Remove redundant
2516 2020-10-12 David Malcolm <dmalcolm@redhat.com>
2519 * engine.cc (impl_region_model_context::on_escaped_function): New
2521 (exploded_graph::add_function_entry): Use m_functions_with_enodes
2522 to implement idempotency.
2523 (add_any_callbacks): New.
2524 (exploded_graph::build_initial_worklist): Use the above to find
2525 callbacks that are reachable from global initializers.
2526 (exploded_graph::on_escaped_function): New.
2528 (impl_region_model_context::on_escaped_function): New decl.
2529 (exploded_graph::on_escaped_function): New decl.
2530 (exploded_graph::m_functions_with_enodes): New field.
2531 * region-model-reachability.cc
2532 (reachable_regions::reachable_regions): Replace "store" param with
2533 "model" param; use it to initialize m_model.
2534 (reachable_regions::add): When getting the svalue for the region,
2535 call get_store_value on the model rather than using an initial
2537 (reachable_regions::mark_escaped_clusters): Add ctxt param and
2538 use it to call on_escaped_function when a function_region escapes.
2539 * region-model-reachability.h
2540 (reachable_regions::reachable_regions): Replace "store" param with
2542 (reachable_regions::mark_escaped_clusters): Add ctxt param.
2543 (reachable_regions::m_model): New field.
2544 * region-model.cc (region_model::handle_unrecognized_call): Update
2545 for change in reachable_regions ctor.
2546 (region_model::handle_unrecognized_call): Pass ctxt to
2547 mark_escaped_clusters.
2548 (region_model::get_reachable_svalues): Update for change in
2549 reachable_regions ctor.
2550 (region_model::get_initial_value_for_global): Read-only variables
2551 keep their initial values.
2552 * region-model.h (region_model_context::on_escaped_function): New
2554 (noop_region_model_context::on_escaped_function): New.
2556 2020-10-12 David Malcolm <dmalcolm@redhat.com>
2558 * analyzer.opt (Wanalyzer-write-to-const): New.
2559 (Wanalyzer-write-to-string-literal): New.
2560 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
2561 Call check_for_writable_region.
2562 (region_model::impl_call_memset): Likewise.
2563 (region_model::impl_call_strcpy): Likewise.
2564 * region-model.cc (class write_to_const_diagnostic): New.
2565 (class write_to_string_literal_diagnostic): New.
2566 (region_model::check_for_writable_region): New.
2567 (region_model::set_value): Call check_for_writable_region.
2568 * region-model.h (region_model::check_for_writable_region): New
2571 2020-10-07 David Malcolm <dmalcolm@redhat.com>
2574 * sm-malloc.cc (method_p): New.
2575 (describe_argument_index): New.
2576 (inform_nonnull_attribute): Use describe_argument_index.
2577 (possible_null_arg::describe_final_event): Likewise.
2578 (null_arg::describe_final_event): Likewise.
2580 2020-09-29 David Malcolm <dmalcolm@redhat.com>
2583 * engine.cc (stmt_requires_new_enode_p): Split enodes before
2586 2020-09-29 David Malcolm <dmalcolm@redhat.com>
2588 * constraint-manager.cc
2589 (constraint_manager::add_constraint_internal): Whitespace fixes.
2590 Silence -Wsign-compare warning.
2591 * engine.cc (maybe_process_run_of_before_supernode_enodes):
2592 Silence -Wsign-compare warning.
2594 2020-09-28 David Malcolm <dmalcolm@redhat.com>
2596 * region-model.h (binop_svalue::dyn_cast_binop_svalue): Remove
2597 redundant "virtual". Add FINAL OVERRIDE.
2598 (widening_svalue::dyn_cast_widening_svalue): Add FINAL OVERRIDE.
2599 (compound_svalue::dyn_cast_compound_svalue): Likewise.
2600 (conjured_svalue::dyn_cast_conjured_svalue): Likewise.
2602 2020-09-28 David Malcolm <dmalcolm@redhat.com>
2604 * diagnostic-manager.cc (null_assignment_sm_context::m_visitor):
2605 Remove unused field.
2607 2020-09-28 David Malcolm <dmalcolm@redhat.com>
2610 * analyzer.cc (is_longjmp_call_p): Require the initial argument
2612 * engine.cc (exploded_node::on_longjmp): Likewise.
2614 2020-09-28 David Malcolm <dmalcolm@redhat.com>
2616 * program-state.cc (sm_state_map::print): Update check
2617 for m_global_state being the start state.
2619 2020-09-26 David Malcolm <dmalcolm@redhat.com>
2623 * region-model.cc (region_model::get_representative_path_var):
2624 When handling offset_region, wrap the MEM_REF's first argument in
2625 an ADDR_EXPR of pointer type, rather than simply using the tree
2626 for the parent region. Require the MEM_REF's second argument to
2627 be an integer constant.
2629 2020-09-24 David Malcolm <dmalcolm@redhat.com>
2631 * analyzer.h (struct rejected_constraint): New decl.
2632 * analyzer.opt (fanalyzer-feasibility): New option.
2633 * diagnostic-manager.cc (path_builder::path_builder): Add
2634 "problem" param and use it to initialize new field.
2635 (path_builder::get_feasibility_problem): New accessor.
2636 (path_builder::m_feasibility_problem): New field.
2637 (dedupe_winners::add): Remove inversion of logic in "if" clause,
2638 swapping if/else suites. In the !feasible_p suite, inspect
2639 flag_analyzer_feasibility and add code to handle when this
2640 is off, accepting the infeasible path, but recording the
2641 feasibility_problem.
2642 (diagnostic_manager::emit_saved_diagnostic): Pass the
2643 feasibility_problem to the path_builder.
2644 (diagnostic_manager::add_events_for_eedge): If we have
2645 a feasibility_problem at this edge, use it to add a custom event.
2646 * engine.cc (exploded_path::feasible_p): Pass a
2647 rejected_constraint ** to model.maybe_update_for_edge and transfer
2648 ownership of any created instance to any feasibility_problem.
2649 (feasibility_problem::dump_to_pp): New.
2650 * exploded-graph.h (feasibility_problem::feasibility_problem):
2651 Drop "model" param; add rejected_constraint * param.
2652 (feasibility_problem::~feasibility_problem): New.
2653 (feasibility_problem::dump_to_pp): New decl.
2654 (feasibility_problem::m_model): Drop field.
2655 (feasibility_problem::m_rc): New field.
2656 * program-point.cc (function_point::get_location): Handle
2657 PK_BEFORE_SUPERNODE and PK_AFTER_SUPERNODE.
2658 * program-state.cc (program_state::on_edge): Pass NULL to new
2659 param of region_model::maybe_update_for_edge.
2660 * region-model.cc (region_model::add_constraint): New overload
2661 adding a rejected_constraint ** param.
2662 (region_model::maybe_update_for_edge): Add rejected_constraint **
2663 param and pass it to the various apply_constraints_for_ calls.
2664 (region_model::apply_constraints_for_gcond): Add
2665 rejected_constraint ** param and pass it to add_constraint calls.
2666 (region_model::apply_constraints_for_gswitch): Likewise.
2667 (region_model::apply_constraints_for_exception): Likewise.
2668 (rejected_constraint::dump_to_pp): New.
2669 * region-model.h (region_model::maybe_update_for_edge):
2670 Add rejected_constraint ** param.
2671 (region_model::add_constraint): New overload adding a
2672 rejected_constraint ** param.
2673 (region_model::apply_constraints_for_gcond): Add
2674 rejected_constraint ** param.
2675 (region_model::apply_constraints_for_gswitch): Likewise.
2676 (region_model::apply_constraints_for_exception): Likewise.
2677 (struct rejected_constraint): New.
2679 2020-09-23 David Malcolm <dmalcolm@redhat.com>
2682 * engine.cc (impl_run_checkers): Update for change to ext_state
2684 * program-state.cc (selftest::test_sm_state_map): Pass an engine
2685 instance to ext_state ctor.
2686 (selftest::test_program_state_1): Likewise.
2687 (selftest::test_program_state_2): Likewise.
2688 (selftest::test_program_state_merging): Likewise.
2689 (selftest::test_program_state_merging_2): Likewise.
2690 * program-state.h (extrinsic_state::extrinsic_state): Remove NULL
2691 default value for "eng" param.
2693 2020-09-23 Tobias Burnus <tobias@codesourcery.com>
2695 * analyzer-logging.cc: Guard '#pragma ... ignored "-Wformat-diag"'
2696 by '#if __GNUC__ >= 10'
2697 * analyzer.h: Likewise.
2698 * call-string.cc: Likewise.
2700 2020-09-23 David Malcolm <dmalcolm@redhat.com>
2702 * engine.cc (exploded_node::on_stmt): Replace sequence of dyn_cast
2705 2020-09-22 David Malcolm <dmalcolm@redhat.com>
2707 * analysis-plan.cc: Include "json.h".
2708 * analyzer.opt (fdump-analyzer-json): New.
2709 * call-string.cc: Include "json.h".
2710 (call_string::to_json): New.
2711 * call-string.h (call_string::to_json): New decl.
2712 * checker-path.cc: Include "json.h".
2713 * constraint-manager.cc: Include "json.h".
2714 (equiv_class::to_json): New.
2715 (constraint::to_json): New.
2716 (constraint_manager::to_json): New.
2717 * constraint-manager.h (equiv_class::to_json): New decl.
2718 (constraint::to_json): New decl.
2719 (constraint_manager::to_json): New decl.
2720 * diagnostic-manager.cc: Include "json.h".
2721 (saved_diagnostic::to_json): New.
2722 (diagnostic_manager::to_json): New.
2723 * diagnostic-manager.h (saved_diagnostic::to_json): New decl.
2724 (diagnostic_manager::to_json): New decl.
2725 * engine.cc: Include "json.h", <zlib.h>.
2726 (exploded_node::status_to_str): New.
2727 (exploded_node::to_json): New.
2728 (exploded_edge::to_json): New.
2729 (exploded_graph::to_json): New.
2730 (dump_analyzer_json): New.
2731 (impl_run_checkers): Call it.
2732 * exploded-graph.h (exploded_node::status_to_str): New decl.
2733 (exploded_node::to_json): New.
2734 (exploded_edge::to_json): New.
2735 (exploded_graph::to_json): New.
2736 * pending-diagnostic.cc: Include "json.h".
2737 * program-point.cc: Include "json.h".
2738 (program_point::to_json): New.
2739 * program-point.h (program_point::to_json): New decl.
2740 * program-state.cc: Include "json.h".
2741 (extrinsic_state::to_json): New.
2742 (sm_state_map::to_json): New.
2743 (program_state::to_json): New.
2744 * program-state.h (extrinsic_state::to_json): New decl.
2745 (sm_state_map::to_json): New decl.
2746 (program_state::to_json): New decl.
2747 * region-model-impl-calls.cc: Include "json.h".
2748 * region-model-manager.cc: Include "json.h".
2749 * region-model-reachability.cc: Include "json.h".
2750 * region-model.cc: Include "json.h".
2751 * region-model.h (svalue::to_json): New decl.
2752 (region::to_json): New decl.
2753 * region.cc: Include "json.h".
2754 (region::to_json: New.
2755 * sm-file.cc: Include "json.h".
2756 * sm-malloc.cc: Include "json.h".
2757 * sm-pattern-test.cc: Include "json.h".
2758 * sm-sensitive.cc: Include "json.h".
2759 * sm-signal.cc: Include "json.h".
2760 (signal_delivery_edge_info_t::to_json): New.
2761 * sm-taint.cc: Include "json.h".
2762 * sm.cc: Include "diagnostic.h", "tree-diagnostic.h", and
2764 (state_machine::state::to_json): New.
2765 (state_machine::to_json): New.
2766 * sm.h (state_machine::state::to_json): New.
2767 (state_machine::to_json): New.
2768 * state-purge.cc: Include "json.h".
2769 * store.cc: Include "json.h".
2770 (binding_key::get_desc): New.
2771 (binding_map::to_json): New.
2772 (binding_cluster::to_json): New.
2773 (store::to_json): New.
2774 * store.h (binding_key::get_desc): New decl.
2775 (binding_map::to_json): New decl.
2776 (binding_cluster::to_json): New decl.
2777 (store::to_json): New decl.
2778 * supergraph.cc: Include "json.h".
2779 (supergraph::to_json): New.
2780 (supernode::to_json): New.
2781 (superedge::to_json): New.
2782 * supergraph.h (supergraph::to_json): New decl.
2783 (supernode::to_json): New decl.
2784 (superedge::to_json): New decl.
2785 * svalue.cc: Include "json.h".
2786 (svalue::to_json): New.
2788 2020-09-21 David Malcolm <dmalcolm@redhat.com>
2791 * region-model-impl-calls.cc (call_details::get_arg_type): New.
2792 * region-model.cc (region_model::on_call_pre): Check that the
2793 initial arg is a pointer before calling impl_call_memset and
2795 * region-model.h (call_details::get_arg_type): New decl.
2797 2020-09-21 David Malcolm <dmalcolm@redhat.com>
2800 * sm-malloc.cc (malloc_state_machine::get_default_state): Look at
2801 the base region when considering pointers. Treat pointers to
2802 decls as being non-heap.
2804 2020-09-18 David Malcolm <dmalcolm@redhat.com>
2806 * checker-path.cc (warning_event::get_desc): Handle global state
2809 2020-09-18 David Malcolm <dmalcolm@redhat.com>
2811 * sm-malloc.cc (malloc_state_machine::on_stmt): Handle strdup and
2812 strndup as being malloc-like allocators.
2814 2020-09-16 David Malcolm <dmalcolm@redhat.com>
2816 * engine.cc (strongly_connected_components::strong_connect): Only
2817 consider intraprocedural edges when creating SCCs.
2818 (worklist::key_t::cmp): Add comment. Treat call_string
2819 differences as more important than differences of program_point
2822 2020-09-16 David Malcolm <dmalcolm@redhat.com>
2824 * engine.cc (supernode_cluster::dump_dot): Show the SCC id
2825 in the per-supernode clusters in FILENAME.eg.dot output.
2826 (exploded_graph_annotator::add_node_annotations):
2827 Show the SCC of the supernode in FILENAME.supernode.eg.dot output.
2828 * exploded-graph.h (worklist::scc_id): New.
2829 (exploded_graph::get_scc_id): New.
2831 2020-09-16 David Malcolm <dmalcolm@redhat.com>
2833 * engine.cc (exploded_node::dump_dot): Show STATUS_BULK_MERGED.
2834 (exploded_graph::process_worklist): Call
2835 maybe_process_run_of_before_supernode_enodes.
2836 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
2838 (exploded_graph_annotator::print_enode): Show STATUS_BULK_MERGED.
2839 * exploded-graph.h (enum exploded_node::status): Add
2842 2020-09-16 David Malcolm <dmalcolm@redhat.com>
2845 (exploded_graph::process_node) <case PK_BEFORE_SUPERNODE>:
2846 Simplify by using program_point::get_next.
2847 * program-point.cc (program_point::get_next): New.
2848 * program-point.h (program_point::get_next): New decl.
2850 2020-09-16 David Malcolm <dmalcolm@redhat.com>
2852 * engine.cc (exploded_graph::get_or_create_node): Show the
2853 program point when issuing -Wanalyzer-too-complex due to hitting
2854 the per-program-point limit.
2856 2020-09-16 David Malcolm <dmalcolm@redhat.com>
2858 * region-model.cc (region_model::on_call_pre): Treat getchar as
2859 having no side-effects.
2861 2020-09-15 David Malcolm <dmalcolm@redhat.com>
2864 * constraint-manager.cc (merger_fact_visitor::on_fact): Replace
2865 assertion that add_constraint succeeded with an assertion that
2866 if it fails, -fanalyzer-transitivity is off.
2868 2020-09-14 David Malcolm <dmalcolm@redhat.com>
2870 * analyzer.opt (-param=analyzer-max-constraints=): New param.
2871 * constraint-manager.cc
2872 (constraint_manager::add_constraint_internal): Silently reject
2873 attempts to add constraints when the above limit is reached.
2875 2020-09-14 David Malcolm <dmalcolm@redhat.com>
2878 * constraint-manager.cc
2879 (constraint_manager::get_or_add_equiv_class): Don't accumulate
2880 transitive closure of all constraints on constants.
2882 2020-09-14 David Malcolm <dmalcolm@redhat.com>
2885 * analyzer.cc (is_setjmp_call_p): Require the initial arg to be a
2887 * region-model.cc (region_model::deref_rvalue): Assert that the
2888 svalue is of pointer type.
2890 2020-09-11 David Malcolm <dmalcolm@redhat.com>
2893 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
2895 (region_model::impl_call_strcpy): New.
2896 * region-model.cc (region_model::on_call_pre): Flag unhandled
2897 builtins that are non-pure as having unknown side-effects.
2898 Implement BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_STRCPY,
2899 BUILT_IN_STRCPY_CHK, BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED,
2900 BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_FPUTC,
2901 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
2902 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
2903 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR,
2904 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED,
2905 BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF.
2906 * region-model.h (region_model::impl_call_memcpy): New decl.
2907 (region_model::impl_call_strcpy): New decl.
2909 2020-09-09 David Malcolm <dmalcolm@redhat.com>
2912 * analyzer.opt (Wanalyzer-mismatching-deallocation): New warning.
2913 * region-model-impl-calls.cc
2914 (region_model::impl_call_operator_new): New.
2915 (region_model::impl_call_operator_delete): New.
2916 * region-model.cc (region_model::on_call_pre): Detect operator new
2917 and operator delete.
2918 (region_model::on_call_post): Likewise.
2919 (region_model::maybe_update_for_edge): Detect EH edges and call...
2920 (region_model::apply_constraints_for_exception): New function.
2921 * region-model.h (region_model::impl_call_operator_new): New decl.
2922 (region_model::impl_call_operator_delete): New decl.
2923 (region_model::apply_constraints_for_exception): New decl.
2924 * sm-malloc.cc (enum resource_state): New.
2925 (struct allocation_state): New state subclass.
2926 (enum wording): New.
2928 (malloc_state_machine::custom_data_t): New typedef.
2929 (malloc_state_machine::add_state): New decl.
2930 (malloc_state_machine::m_unchecked)
2931 (malloc_state_machine::m_nonnull)
2932 (malloc_state_machine::m_freed): Delete these states in favor
2934 (malloc_state_machine::m_malloc)
2935 (malloc_state_machine::m_scalar_new)
2936 (malloc_state_machine::m_vector_new): ...this new api instances,
2937 which own their own versions of these states.
2938 (malloc_state_machine::on_allocator_call): New decl.
2939 (malloc_state_machine::on_deallocator_call): New decl.
2940 (api::api): New ctor.
2941 (dyn_cast_allocation_state): New.
2942 (as_a_allocation_state): New.
2947 (malloc_diagnostic::describe_state_change): Use unchecked_p and
2949 (class mismatching_deallocation): New.
2950 (double_free::double_free): Add funcname param for initializing
2952 (double_free::emit): Use m_funcname in warning message rather
2953 than hardcoding "free".
2954 (double_free::describe_state_change): Likewise. Use freed_p.
2955 (double_free::describe_call_with_state): Use freed_p.
2956 (double_free::describe_final_event): Use m_funcname in message
2957 rather than hardcoding "free".
2958 (double_free::m_funcname): New field.
2959 (possible_null::describe_state_change): Use unchecked_p.
2960 (possible_null::describe_return_of_state): Likewise.
2961 (use_after_free::use_after_free): Add param for initializing m_api.
2962 (use_after_free::emit): Use m_api->m_dealloc_funcname in message
2963 rather than hardcoding "free".
2964 (use_after_free::describe_state_change): Use freed_p. Change the
2965 wording of the message based on the API.
2966 (use_after_free::describe_final_event): Use
2967 m_api->m_dealloc_funcname in message rather than hardcoding
2968 "free". Change the wording of the message based on the API.
2969 (use_after_free::m_api): New field.
2970 (malloc_leak::describe_state_change): Use unchecked_p. Update
2971 for renaming of m_malloc_event to m_alloc_event.
2972 (malloc_leak::describe_final_event): Update for renaming of
2973 m_malloc_event to m_alloc_event.
2974 (malloc_leak::m_malloc_event): Rename...
2975 (malloc_leak::m_alloc_event): ...to this.
2976 (free_of_non_heap::free_of_non_heap): Add param for initializing
2978 (free_of_non_heap::emit): Use m_funcname in message rather than
2980 (free_of_non_heap::describe_final_event): Likewise.
2981 (free_of_non_heap::m_funcname): New field.
2982 (allocation_state::dump_to_pp): New.
2983 (allocation_state::get_nonnull): New.
2984 (malloc_state_machine::malloc_state_machine): Update for changes
2985 to state fields and new api fields.
2986 (malloc_state_machine::add_state): New.
2987 (malloc_state_machine::on_stmt): Move malloc/calloc handling to
2988 on_allocator_call and call it, passing in the API pointer.
2989 Likewise for free, moving it to on_deallocator_call. Handle calls
2990 to operator new and delete in an analogous way. Use unchecked_p
2991 when testing for possibly-null-arg and possibly-null-deref, and
2992 transition to the non-null for the correct API. Remove redundant
2993 node param from call to on_zero_assignment. Use freed_p for
2994 use-after-free check, and pass in API.
2995 (malloc_state_machine::on_allocator_call): New, based on code in
2997 (malloc_state_machine::on_deallocator_call): Likewise.
2998 (malloc_state_machine::on_phi): Mark node param with
2999 ATTRIBUTE_UNUSED; don't pass it to on_zero_assignment.
3000 (malloc_state_machine::on_condition): Mark node param with
3001 ATTRIBUTE_UNUSED. Replace on_transition calls with get_state and
3002 set_next_state pairs, transitioning to the non-null state for the
3004 (malloc_state_machine::can_purge_p): Port to new state approach.
3005 (malloc_state_machine::on_zero_assignment): Replace on_transition
3006 calls with get_state and set_next_state pairs. Drop redundant
3008 * sm.h (state_machine::add_custom_state): New.
3010 2020-09-09 David Malcolm <dmalcolm@redhat.com>
3012 * diagnostic-manager.cc
3013 (null_assignment_sm_context::warn_for_state): Replace with...
3014 (null_assignment_sm_context::warn): ...this.
3015 * engine.cc (impl_sm_context::warn_for_state): Replace with...
3016 (impl_sm_context::warn): ...this.
3017 * sm-file.cc (fileptr_state_machine::on_stmt): Replace
3018 warn_for_state and on_transition calls with a get_state
3019 test guarding warn and set_next_state calls.
3020 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
3021 * sm-pattern-test.cc (pattern_test_state_machine::on_condition):
3022 Replace warn_for_state call with warn call.
3024 (sensitive_state_machine::warn_for_any_exposure): Replace
3025 warn_for_state call with a get_state test guarding a warn call.
3026 * sm-signal.cc (signal_state_machine::on_stmt): Likewise.
3027 * sm-taint.cc (taint_state_machine::on_stmt): Replace
3028 warn_for_state and on_transition calls with a get_state
3029 test guarding warn and set_next_state calls.
3030 * sm.h (sm_context::warn_for_state): Replace with...
3031 (sm_context::warn): ...this.
3033 2020-09-09 David Malcolm <dmalcolm@redhat.com>
3035 * diagnostic-manager.cc
3036 (null_assignment_sm_context::null_assignment_sm_context): Add old_state
3037 and ext_state params, initializing m_old_state and m_ext_state.
3038 (null_assignment_sm_context::on_transition): Split into...
3039 (null_assignment_sm_context::get_state): ...this new vfunc
3040 implementation and...
3041 (null_assignment_sm_context::set_next_state): ...this new vfunc
3043 (null_assignment_sm_context::m_old_state): New field.
3044 (null_assignment_sm_context::m_ext_state): New field.
3045 (diagnostic_manager::add_events_for_eedge): Pass in old state and
3046 ext_state when creating sm_ctxt.
3047 * engine.cc (impl_sm_context::on_transition): Split into...
3048 (impl_sm_context::get_state): ...this new vfunc
3049 implementation and...
3050 (impl_sm_context::set_next_state): ...this new vfunc
3052 * sm.h (sm_context::get_state): New pure virtual function.
3053 (sm_context::set_next_state): Likewise.
3054 (sm_context::on_transition): Convert from a pure virtual function
3055 to a regular function implemented in terms of get_state and
3058 2020-09-09 David Malcolm <dmalcolm@redhat.com>
3060 * checker-path.cc (state_change_event::get_desc): Update
3061 state_machine::get_state_name calls to state::get_name.
3062 (warning_event::get_desc): Likewise.
3063 * diagnostic-manager.cc
3064 (null_assignment_sm_context::on_transition): Update comparison
3065 against 0 with comparison with m_sm.get_start_state.
3066 (diagnostic_manager::prune_for_sm_diagnostic): Update
3067 state_machine::get_state_name calls to state::get_name.
3068 * engine.cc (impl_sm_context::on_transition): Likewise.
3069 (exploded_node::get_dot_fillcolor): Use get_id when summing
3071 * program-state.cc (sm_state_map::sm_state_map): Don't hardcode
3072 0 as the start state when initializing m_global_state.
3073 (sm_state_map::print): Use dump_to_pp rather than get_state_name
3074 when dumping states.
3075 (sm_state_map::is_empty_p): Don't hardcode 0 as the start state
3076 when examining m_global_state.
3077 (sm_state_map::hash): Use get_id when hashing states.
3078 (selftest::test_sm_state_map): Use state objects rather than
3079 arbitrary hardcoded integers.
3080 (selftest::test_program_state_merging): Likewise.
3081 (selftest::test_program_state_merging_2): Likewise.
3082 * sm-file.cc (fileptr_state_machine::m_start): Move to base class.
3083 (file_diagnostic::describe_state_change): Use get_start_state.
3084 (fileptr_state_machine::fileptr_state_machine): Drop m_start
3086 * sm-malloc.cc (malloc_state_machine::m_start): Move to base
3088 (malloc_diagnostic::describe_state_change): Use get_start_state.
3089 (possible_null::describe_state_change): Likewise.
3090 (malloc_state_machine::malloc_state_machine): Drop m_start
3092 * sm-pattern-test.cc (pattern_test_state_machine::m_start): Move
3094 (pattern_test_state_machine::pattern_test_state_machine): Drop
3095 m_start initialization.
3096 * sm-sensitive.cc (sensitive_state_machine::m_start): Move to base
3098 (sensitive_state_machine::sensitive_state_machine): Drop m_start
3100 * sm-signal.cc (signal_state_machine::m_start): Move to base
3102 (signal_state_machine::signal_state_machine): Drop m_start
3104 * sm-taint.cc (taint_state_machine::m_start): Move to base class.
3105 (taint_state_machine::taint_state_machine): Drop m_start
3107 * sm.cc (state_machine::state::dump_to_pp): New.
3108 (state_machine::state_machine): Move here from sm.h. Initialize
3109 m_next_state_id and m_start.
3110 (state_machine::add_state): Reimplement in terms of state objects.
3111 (state_machine::get_state_name): Delete.
3112 (state_machine::get_state_by_name): Reimplement in terms of state
3113 objects. Make const.
3114 (state_machine::validate): Delete.
3115 (state_machine::dump_to_pp): Reimplement in terms of state
3117 * sm.h (state_machine::state): New class.
3118 (state_machine::state_t): Convert typedef from "unsigned" to
3119 "const state_machine::state *".
3120 (state_machine::state_machine): Move to sm.cc.
3121 (state_machine::get_default_state): Use m_start rather than
3123 (state_machine::get_state_name): Delete.
3124 (state_machine::get_state_by_name): Make const.
3125 (state_machine::get_start_state): New accessor.
3126 (state_machine::alloc_state_id): New.
3127 (state_machine::m_state_names): Drop in favor of...
3128 (state_machine::m_states): New field
3129 (state_machine::m_start): New field
3130 (start_start_p): Delete.
3132 2020-09-08 David Malcolm <dmalcolm@redhat.com>
3135 * store.cc (binding_map::apply_ctor_val_to_range): Add
3136 error-handling for the cases where we have symbolic offsets.
3138 2020-09-08 David Malcolm <dmalcolm@redhat.com>
3141 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
3142 where min_index == max_index.
3143 (binding_map::apply_ctor_val_to_range): Replace assertion that we
3144 don't have a CONSTRUCTOR value with error-handling.
3146 2020-09-08 David Malcolm <dmalcolm@redhat.com>
3149 * region-model.cc (region_model::on_call_pre): Fix guard on switch
3150 on built-ins to only consider BUILT_IN_NORMAL, rather than other
3153 2020-09-01 David Malcolm <dmalcolm@redhat.com>
3156 * region-model.cc (region_model::deref_rvalue): Add the constraint
3157 that PTR_SVAL is non-NULL.
3159 2020-08-31 David Malcolm <dmalcolm@redhat.com>
3162 * region-model.cc (region_model::on_call_pre): Handle
3163 BUILT_IN_MEMSET_CHK.
3165 2020-08-31 David Malcolm <dmalcolm@redhat.com>
3167 * region-model.cc (region_model::on_call_pre): Gather handling of
3168 builtins and of internal fns into switch statements. Handle
3169 "alloca" and BUILT_IN_ALLOCA_WITH_ALIGN.
3171 2020-08-31 David Malcolm <dmalcolm@redhat.com>
3174 * region.cc (decl_region::get_svalue_for_constructor): Support
3175 apply_ctor_to_region failing.
3176 * store.cc (binding_map::apply_ctor_to_region): Add failure
3178 (binding_map::apply_ctor_val_to_range): Likewise.
3179 (binding_map::apply_ctor_pair_to_child_region): Likewise. Replace
3180 assertion that child_base_offset is not symbolic with error
3182 * store.h (binding_map::apply_ctor_to_region): Convert return type
3184 (binding_map::apply_ctor_val_to_range): Likewise.
3185 (binding_map::apply_ctor_pair_to_child_region): Likewise.
3187 2020-08-31 David Malcolm <dmalcolm@redhat.com>
3190 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
3191 by calling a new binding_map::apply_ctor_val_to_range subroutine.
3192 Split out the existing non-CONSTRUCTOR-handling code to a new
3193 apply_ctor_pair_to_child_region subroutine.
3194 (binding_map::apply_ctor_val_to_range): New.
3195 (binding_map::apply_ctor_pair_to_child_region): New, split out
3196 from binding_map::apply_ctor_to_region as noted above.
3197 * store.h (binding_map::apply_ctor_val_to_range): New decl.
3198 (binding_map::apply_ctor_pair_to_child_region): New decl.
3200 2020-08-31 David Malcolm <dmalcolm@redhat.com>
3203 * region-model-manager.cc
3204 (region_model_manager::maybe_fold_unaryop): Handle VIEW_CONVERT_EXPR.
3205 (region_model_manager::get_or_create_cast): Move logic for
3206 real->integer casting to...
3207 (get_code_for_cast): ...this new function, and add logic for
3208 real->non-integer casts.
3209 (region_model_manager::maybe_fold_sub_svalue): Handle
3212 (region_model::add_any_constraints_from_gassign): Likewise.
3213 * svalue.cc (svalue::maybe_undo_cast): Likewise.
3214 (unaryop_svalue::dump_to_pp): Likewise.
3216 2020-08-26 David Malcolm <dmalcolm@redhat.com>
3219 * region-model-manager.cc
3220 (region_model_manager::get_or_create_widening_svalue): Assert that
3221 neither of the inputs are themselves widenings.
3222 * store.cc (store::eval_alias_1): The initial value of a pointer
3223 can't point to a region that was allocated on the heap after the
3224 beginning of the path. A widened pointer value can't alias anything
3225 that the initial pointer value can't alias.
3226 * svalue.cc (svalue::can_merge_p): Merge BINOP (X, OP, CST) with X
3227 to a widening svalue. Merge
3228 BINOP(WIDENING(BASE, BINOP(BASE, X)), X) and BINOP(BASE, X) to
3229 to the LHS of the first BINOP.
3231 2020-08-26 David Malcolm <dmalcolm@redhat.com>
3234 * region-model.h (class compound_svalue): Document that all keys
3236 (compound_svalue::compound_svalue): Move definition to svalue.cc.
3237 * store.cc (binding_map::apply_ctor_to_region): Handle
3238 initializers for trailing arrays with incomplete size.
3239 * svalue.cc (compound_svalue::compound_svalue): Move definition
3240 here from region-model.h. Add assertion that all keys are
3243 2020-08-22 David Malcolm <dmalcolm@redhat.com>
3246 * region-model-manager.cc
3247 (region_model_manager::maybe_fold_binop): Fold bitwise "& 0" to 0.
3249 2020-08-22 David Malcolm <dmalcolm@redhat.com>
3251 * store.cc (store::eval_alias): Make const. Split out 2nd half
3252 into store::eval_alias_1 and call it twice for symmetry, avoiding
3254 (store::eval_alias_1): New function, split out from the above.
3255 * store.h (store::eval_alias): Make const.
3256 (store::eval_alias_1): New decl.
3258 2020-08-22 David Malcolm <dmalcolm@redhat.com>
3260 * region-model.cc (region_model::push_frame): Bind the default
3261 SSA name for each parm if it exists, falling back to the parm
3262 itself otherwise, rather than doing both.
3264 2020-08-20 David Malcolm <dmalcolm@redhat.com>
3267 * region-model-manager.cc
3268 (region_model_manager::get_field_region): Assert that field is a
3270 * region.cc (region::get_subregions_for_binding): In
3271 union-handling, filter the TYPE_FIELDS traversal to just FIELD_DECLs.
3273 2020-08-20 David Malcolm <dmalcolm@redhat.com>
3276 * region-model.cc (region_model::get_gassign_result): For
3277 comparisons, only use eval_condition when the lhs has boolean
3278 type, and use get_or_create_constant_svalue on the boolean
3279 constants directly rather than via get_rvalue.
3281 2020-08-19 David Malcolm <dmalcolm@redhat.com>
3284 * region-model.cc (region_model::deref_rvalue): Rather than
3285 attempting to handle all svalue kinds in the switch, only cover
3286 the special cases, and move symbolic-region handling to after
3287 the switch, thus implicitly handling the missing case SK_COMPOUND.
3289 2020-08-19 David Malcolm <dmalcolm@redhat.com>
3292 * region-model-manager.cc
3293 (region_model_manager::maybe_fold_binop): Check that we have an
3294 integral type before calling build_int_cst.
3296 2020-08-19 David Malcolm <dmalcolm@redhat.com>
3299 * region-model-manager.cc
3300 (region_model_manager::get_or_create_cast): Use FIX_TRUNC_EXPR for
3301 casting from REAL_TYPE to INTEGER_TYPE.
3303 2020-08-19 David Malcolm <dmalcolm@redhat.com>
3306 * region-model.cc (region_model::called_from_main_p): New.
3307 (region_model::get_store_value): Move handling for globals into...
3308 (region_model::get_initial_value_for_global): ...this new
3309 function, and add logic for extracting values from decl
3311 * region-model.h (decl_region::get_svalue_for_constructor): New
3313 (decl_region::get_svalue_for_initializer): New decl.
3314 (region_model::called_from_main_p): New decl.
3315 (region_model::get_initial_value_for_global): New.
3316 * region.cc (decl_region::maybe_get_constant_value): Move logic
3317 for getting an svalue from a CONSTRUCTOR node to...
3318 (decl_region::get_svalue_for_constructor): ...this new function.
3319 (decl_region::get_svalue_for_initializer): New.
3320 * store.cc (get_svalue_for_ctor_val): Rewrite in terms of
3321 region_model::get_rvalue.
3322 * store.h (binding_cluster::get_map): New accessor.
3324 2020-08-19 David Malcolm <dmalcolm@redhat.com>
3327 * region.cc (get_field_at_bit_offset): Gracefully handle negative
3328 values for bit_offset.
3330 2020-08-18 David Malcolm <dmalcolm@redhat.com>
3332 * region-model.cc (region_model::get_rvalue_1): Fix name of local.
3334 2020-08-18 David Malcolm <dmalcolm@redhat.com>
3337 * region-model.cc (region_model::get_rvalue_1): Handle
3338 unrecognized tree codes by returning "UNKNOWN.
3340 2020-08-18 David Malcolm <dmalcolm@redhat.com>
3343 * region-model.cc (region_model::get_gassign_result): Handle various
3344 VEC_* tree codes by returning UNKNOWN.
3345 (region_model::on_assignment): Handle unrecognized tree codes by
3346 setting lhs to an unknown value, rather than issuing a "sorry" and
3349 2020-08-17 David Malcolm <dmalcolm@redhat.com>
3352 * region-model-manager.cc (get_region_for_unexpected_tree_code):
3353 Handle ctxt being NULL.
3355 2020-08-17 David Malcolm <dmalcolm@redhat.com>
3358 * region.cc (region::get_subregions_for_binding): Check for "type"
3361 2020-08-17 David Malcolm <dmalcolm@redhat.com>
3364 * store.cc (get_svalue_for_ctor_val): New.
3365 (binding_map::apply_ctor_to_region): Call it.
3367 2020-08-14 David Malcolm <dmalcolm@redhat.com>
3371 * region-model.cc (region_model::get_store_value): Call
3372 maybe_get_constant_value on decl_regions first.
3373 * region-model.h (decl_region::maybe_get_constant_value): New decl.
3374 * region.cc (decl_region::get_stack_depth): Likewise.
3375 (decl_region::maybe_get_constant_value): New.
3376 * store.cc (get_subregion_within_ctor): New.
3377 (binding_map::apply_ctor_to_region): New.
3378 * store.h (binding_map::apply_ctor_to_region): New decl.
3380 2020-08-14 David Malcolm <dmalcolm@redhat.com>
3383 * store.cc (store::mark_as_escaped): Reject attempts to
3384 get a cluster for an unknown pointer.
3386 2020-08-13 David Malcolm <dmalcolm@redhat.com>
3402 * analyzer-logging.cc: Ignore "-Wformat-diag".
3403 (logger::enter_scope): Use inc_indent in both overloads.
3404 (logger::exit_scope): Use dec_indent.
3405 * analyzer-logging.h (logger::inc_indent): New.
3406 (logger::dec_indent): New.
3407 * analyzer-selftests.cc (run_analyzer_selftests): Call
3408 analyzer_store_cc_tests.
3409 * analyzer-selftests.h (analyzer_store_cc_tests): New decl.
3410 * analyzer.cc (get_stmt_location): New function.
3411 * analyzer.h (class initial_svalue): New forward decl.
3412 (class unaryop_svalue): New forward decl.
3413 (class binop_svalue): New forward decl.
3414 (class sub_svalue): New forward decl.
3415 (class unmergeable_svalue): New forward decl.
3416 (class placeholder_svalue): New forward decl.
3417 (class widening_svalue): New forward decl.
3418 (class compound_svalue): New forward decl.
3419 (class conjured_svalue): New forward decl.
3420 (svalue_set): New typedef.
3421 (class map_region): Delete.
3422 (class array_region): Delete.
3423 (class frame_region): New forward decl.
3424 (class function_region): New forward decl.
3425 (class label_region): New forward decl.
3426 (class decl_region): New forward decl.
3427 (class element_region): New forward decl.
3428 (class offset_region): New forward decl.
3429 (class cast_region): New forward decl.
3430 (class field_region): New forward decl.
3431 (class string_region): New forward decl.
3432 (class region_model_manager): New forward decl.
3433 (class store_manager): New forward decl.
3434 (class store): New forward decl.
3435 (class call_details): New forward decl.
3436 (struct svalue_id_merger_mapping): Delete.
3437 (struct canonicalization): Delete.
3438 (class function_point): New forward decl.
3439 (class engine): New forward decl.
3440 (dump_tree): New function decl.
3441 (print_quoted_type): New function decl.
3442 (readability_comparator): New function decl.
3443 (tree_cmp): New function decl.
3444 (class path_var): Move here from region-model.h
3445 (bit_offset_t, bit_size_t, byte_size_t): New typedefs.
3446 (class region_offset): New class.
3447 (get_stmt_location): New decl.
3448 (struct member_function_hash_traits): New struct.
3449 (class consolidation_map): New class.
3450 Ignore "-Wformat-diag".
3451 * analyzer.opt (-param=analyzer-max-svalue-depth=): New param.
3452 (-param=analyzer-max-enodes-for-full-dump=): New param.
3453 * call-string.cc: Ignore -Wformat-diag.
3454 * checker-path.cc: Move includes of "analyzer/call-string.h" and
3455 "analyzer/program-point.h" to before "analyzer/region-model.h",
3456 and also include "analyzer/store.h" before it.
3457 (state_change_event::state_change_event): Replace "tree var" param
3458 with "const svalue *sval". Convert "origin" param from tree to
3460 (state_change_event::get_desc): Call get_representative_tree to
3461 convert the var and origin from const svalue * to tree. Use
3462 svalue::get_desc rather than %qE when describing state changes.
3463 (checker_path::add_final_event): Use get_stmt_location.
3464 * checker-path.h (state_change_event::state_change_event): Port
3465 from tree to const svalue *.
3466 (state_change_event::get_lvalue): Delete.
3467 (state_change_event::get_dest_function): New.
3468 (state_change_event::m_var): Replace with...
3469 (state_change_event::m_sval): ...this.
3470 (state_change_event::m_origin): Convert from tree to
3472 * constraint-manager.cc: Include "analyzer/call-string.h",
3473 "analyzer/program-point.h", and "analyzer/store.h" before
3474 "analyzer/region-model.h".
3475 (struct bound, struct range): Move to constraint-manager.h.
3476 (compare_constants): New function.
3477 (range::dump): Rename to...
3478 (range::dump_to_pp): ...this. Support NULL constants.
3479 (range::dump): Reintroduce for dumping to stderr.
3480 (range::constrained_to_single_element): Return result, rather than
3482 (range::eval_condition): New.
3483 (range::below_lower_bound): New.
3484 (range::above_upper_bound): New.
3485 (equiv_class::equiv_class): Port from svalue_id to const svalue *.
3486 (equiv_class::print): Likewise.
3487 (equiv_class::hash): Likewise.
3488 (equiv_class::operator==): Port from svalue_id to const svalue *.
3489 (equiv_class::add): Port from svalue_id to const svalue *. Drop
3491 (equiv_class::del): Port from svalue_id to const svalue *.
3492 (equiv_class::get_representative): Likewise.
3493 (equiv_class::remap_svalue_ids): Delete.
3494 (svalue_id_cmp_by_id): Rename to...
3495 (svalue_cmp_by_ptr): ...this, porting from svalue_id to
3497 (equiv_class::canonicalize): Update qsort comparator.
3498 (constraint::implied_by): New.
3499 (constraint_manager::constraint_manager): Copy m_mgr in copy ctor.
3500 (constraint_manager::dump_to_pp): Add "multiline" param
3501 (constraint_manager::dump): Pass "true" for "multiline".
3502 (constraint_manager::add_constraint): Port from svalue_id to
3503 const svalue *. Split out second part into...
3504 (constraint_manager::add_unknown_constraint): ...this new
3505 function. Remove self-constraints when merging equivalence
3507 (constraint_manager::add_constraint_internal): Remove constraints
3508 that would be implied by the new constraint. Port from svalue_id
3510 (constraint_manager::get_equiv_class_by_sid): Rename to...
3511 (constraint_manager::get_equiv_class_by_svalue): ...this, porting
3512 from svalue_id to const svalue *.
3513 (constraint_manager::get_or_add_equiv_class): Port from svalue_id
3515 (constraint_manager::eval_condition): Make const. Call
3516 compare_constants and return early if it provides a known result.
3517 (constraint_manager::get_ec_bounds): New.
3518 (constraint_manager::eval_condition): New overloads. Make
3519 existing one const, and use compare_constants.
3520 (constraint_manager::purge): Convert "p" param to a template
3521 rather that an abstract base class. Port from svalue_id to
3523 (class dead_svalue_purger): New class.
3524 (constraint_manager::remap_svalue_ids): Delete.
3525 (constraint_manager::on_liveness_change): New.
3526 (equiv_class_cmp): Port from svalue_id to const svalue *.
3527 (constraint_manager::canonicalize): Likewise. Combine with
3528 purging of redundant equivalence classes and constraints.
3529 (class cleaned_constraint_manager): Delete.
3530 (class merger_fact_visitor): Make "m_cm_b" const. Add "m_merger"
3532 (merger_fact_visitor::fact): Port from svalue_id to const svalue *.
3533 Add special case for widening.
3534 (constraint_manager::merge): Port from svalue_id to const svalue *.
3535 (constraint_manager::clean_merger_input): Delete.
3536 (constraint_manager::for_each_fact): Port from svalue_id to
3538 (constraint_manager::validate): Likewise.
3539 (selftest::test_constraint_conditions): Provide a
3540 region_model_manager when creating region_model instances.
3541 Add test for self-equality not creating equivalence classes.
3542 (selftest::test_transitivity): Provide a region_model_manager when
3543 creating region_model instances. Verify that EC-merging happens
3544 when constraints are implied.
3545 (selftest::test_constant_comparisons): Provide a
3546 region_model_manager when creating region_model instances.
3547 (selftest::test_constraint_impl): Likewise. Remove over-specified
3549 (selftest::test_equality): Provide a region_model_manager when
3550 creating region_model instances.
3551 (selftest::test_many_constants): Likewise. Provide a
3552 program_point when testing merging.
3553 (selftest::run_constraint_manager_tests): Move call to
3554 test_constant_comparisons to outside the transitivity guard.
3555 * constraint-manager.h (struct bound): Move here from
3556 constraint-manager.cc.
3557 (struct range): Likewise.
3558 (struct::eval_condition): New decl.
3559 (struct::below_lower_bound): New decl.
3560 (struct::above_upper_bound): New decl.
3561 (equiv_class::add): Port from svalue_id to const svalue *.
3562 (equiv_class::del): Likewise.
3563 (equiv_class::get_representative): Likewise.
3564 (equiv_class::remap_svalue_ids): Drop.
3565 (equiv_class::m_cst_sid): Convert to..
3566 (equiv_class::m_cst_sval): ...this.
3567 (equiv_class::m_vars): Port from svalue_id to const svalue *.
3568 (constraint::bool implied_by): New decl.
3569 (fact_visitor::on_fact): Port from svalue_id to const svalue *.
3570 (constraint_manager::constraint_manager): Add mgr param.
3571 (constraint_manager::clone): Delete.
3572 (constraint_manager::maybe_get_constant): Delete.
3573 (constraint_manager::get_sid_for_constant): Delete.
3574 (constraint_manager::get_num_svalues): Delete.
3575 (constraint_manager::dump_to_pp): Add "multiline" param.
3576 (constraint_manager::get_equiv_class): Port from svalue_id to
3578 (constraint_manager::add_constraint): Likewise.
3579 (constraint_manager::get_equiv_class_by_sid): Rename to...
3580 (constraint_manager::get_equiv_class_by_svalue): ...this, porting
3581 from svalue_id to const svalue *.
3582 (constraint_manager::add_unknown_constraint): New decl.
3583 (constraint_manager::get_or_add_equiv_class): Port from svalue_id
3585 (constraint_manager::eval_condition): Likewise. Add overloads.
3586 (constraint_manager::get_ec_bounds): New decl.
3587 (constraint_manager::purge): Convert to template.
3588 (constraint_manager::remap_svalue_ids): Delete.
3589 (constraint_manager::on_liveness_change): New decl.
3590 (constraint_manager::canonicalize): Drop param.
3591 (constraint_manager::clean_merger_input): Delete.
3592 (constraint_manager::m_mgr): New field.
3593 * diagnostic-manager.cc: Move includes of
3594 "analyzer/call-string.h" and "analyzer/program-point.h" to before
3595 "analyzer/region-model.h", and also include "analyzer/store.h"
3597 (saved_diagnostic::saved_diagnostic): Add "sval" param.
3598 (diagnostic_manager::diagnostic_manager): Add engine param.
3599 (diagnostic_manager::add_diagnostic): Add "sval" param, passing it
3600 to saved_diagnostic ctor. Update overload to pass NULL for it.
3601 (dedupe_winners::dedupe_winners): Add engine param.
3602 (dedupe_winners::add): Add "eg" param. Pass m_engine to
3604 (dedupe_winner::m_engine): New field.
3605 (diagnostic_manager::emit_saved_diagnostics): Pass engine to
3606 dedupe_winners. Pass &eg when adding candidates. Pass svalue
3607 rather than tree to prune_path. Use get_stmt_location to get
3608 primary location of diagnostic.
3609 (diagnostic_manager::emit_saved_diagnostic): Likewise.
3610 (get_any_origin): Drop.
3611 (state_change_event_creator::on_global_state_change): Pass NULL
3612 const svalue * rather than NULL_TREE trees to state_change_event
3614 (state_change_event_creator::on_state_change): Port from tree and
3615 svalue_id to const svalue *.
3616 (for_each_state_change): Port from svalue_id to const svalue *.
3617 (struct null_assignment_sm_context): New.
3618 (diagnostic_manager::add_events_for_eedge): Add state change
3619 events for assignment to NULL.
3620 (diagnostic_manager::prune_path): Update param from tree to
3622 (diagnostic_manager::prune_for_sm_diagnostic): Port from tracking
3623 by tree to by const svalue *.
3624 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add sval
3626 (saved_diagnostic::m_sval): New field.
3627 (diagnostic_manager::diagnostic_manager): Add engine param.
3628 (diagnostic_manager::get_engine): New.
3629 (diagnostic_manager::add_diagnostic): Add "sval" param.
3630 (diagnostic_manager::prune_path): Likewise.
3631 (diagnostic_manager::prune_for_sm_diagnostic): New overload.
3632 (diagnostic_manager::m_eng): New field.
3633 * engine.cc: Move includes of "analyzer/call-string.h" and
3634 "analyzer/program-point.h" to before "analyzer/region-model.h",
3635 and also include "analyzer/store.h" before it.
3636 (impl_region_model_context::impl_region_model_context): Update for
3637 removal of m_change field.
3638 (impl_region_model_context::remap_svalue_ids): Delete.
3639 (impl_region_model_context::on_svalue_leak): New.
3640 (impl_region_model_context::on_svalue_purge): Delete.
3641 (impl_region_model_context::on_liveness_change): New.
3642 (impl_region_model_context::on_unknown_change): Update param
3643 from svalue_id to const svalue *. Add is_mutable param.
3644 (setjmp_svalue::compare_fields): Delete.
3645 (setjmp_svalue::accept): New.
3646 (setjmp_svalue::add_to_hash): Delete.
3647 (setjmp_svalue::dump_to_pp): New.
3648 (setjmp_svalue::print_details): Delete.
3649 (impl_sm_context::impl_sm_context): Drop "change" param.
3650 (impl_sm_context::get_fndecl_for_call): Drop "m_change".
3651 (impl_sm_context::on_transition): Drop ATTRIBUTE_UNUSED from
3652 "stmt" param. Drop m_change. Port from svalue_id to
3654 (impl_sm_context::warn_for_state): Drop m_change. Port from
3655 svalue_id to const svalue *.
3656 (impl_sm_context::get_readable_tree): Rename to...
3657 (impl_sm_context::get_diagnostic_tree): ...this. Port from
3658 svalue_id to const svalue *.
3659 (impl_sm_context::is_zero_assignment): New.
3660 (impl_sm_context::m_change): Delete field.
3661 (leak_stmt_finder::find_stmt): Handle m_var being NULL.
3662 (readability): Increase penalty for MEM_REF. For SSA_NAMEs,
3663 slightly favor the underlying var over the SSA name. Heavily
3664 penalize temporaries. Handle RESULT_DECL.
3665 (readability_comparator): Make non-static. Consider stack depths.
3666 (impl_region_model_context::on_state_leak): Convert from svalue_id
3667 to const svalue *, updating for region_model changes. Use
3669 (impl_region_model_context::on_inherited_svalue): Delete.
3670 (impl_region_model_context::on_cast): Delete.
3671 (impl_region_model_context::on_condition): Drop m_change.
3672 (impl_region_model_context::on_phi): Likewise.
3673 (impl_region_model_context::on_unexpected_tree_code): Handle t
3675 (point_and_state::validate): Update stack checking for
3676 region_model changes.
3677 (eg_traits::dump_args_t::show_enode_details_p): New.
3678 (exploded_node::exploded_node): Initialize m_num_processed_stmts.
3679 (exploded_node::get_processed_stmt): New function.
3680 (exploded_node::get_dot_fillcolor): Add more colors.
3681 (exploded_node::dump_dot): Guard the printing of the point and
3682 state with show_enode_details_p. Print the processed stmts for
3683 this enode after the initial state.
3684 (exploded_node::dump_to_pp): Pass true for new multiline param
3685 of program_state::dump_to_pp.
3686 (exploded_node::on_stmt): Drop "change" param. Log the stmt.
3687 Set input_location. Implement __analyzer_describe. Update
3688 implementation of __analyzer_dump and __analyzer_eval.
3689 Remove purging of sm-state for unknown fncalls from here.
3690 (exploded_node::on_edge): Drop "change" param.
3691 (exploded_node::on_longjmp): Port from region_id/svalue_id to
3692 const region */const svalue *. Call program_state::detect_leaks.
3694 (exploded_node::detect_leaks): Update for changes to region_model.
3695 Call program_state::detect_leaks.
3696 (exploded_edge::exploded_edge): Drop ext_state and change params.
3697 (exploded_edge::dump_dot): "args" is no longer used. Drop dumping
3699 (exploded_graph::exploded_graph): Pass engine to
3700 m_diagnostic_manager ctor. Use program_point::origin.
3701 (exploded_graph::add_function_entry): Drop ctxt. Use
3702 program_state::push_frame. Drop state_change.
3703 (exploded_graph::get_or_create_node): Drop "change" param. Add
3704 "enode_for_diag" param. Update dumping calls for API changes.
3705 Pass point to can_merge_with_p. Show enode indices
3706 within -Wanalyzer-too-complex diagnostic for hitting the per-point
3708 (exploded_graph::add_edge): Drop "change" param. Log which nodes
3709 are being connected. Update for changes to exploded_edge ctor.
3710 (exploded_graph::get_per_program_point_data): New.
3711 (exploded_graph::process_worklist): Pass point to
3712 can_merge_with_p. Drop state_change. Update dumping call for API
3714 (exploded_graph::process_node): Drop state_change. Split the
3715 node in-place if an sm-state-change occurs. Update
3716 m_num_processed_stmts. Update dumping calls for API change.
3717 (exploded_graph::log_stats): Call engine::log_stats.
3718 (exploded_graph::dump_states_for_supernode): Update dumping
3720 (exploded_path::feasible_p): Add "eng" and "eg" params.
3721 Rename "i" to "end_idx". Pass the manager to the region_model
3722 ctor. Update for every processed stmt in the enode, not just the
3723 first. Keep track of which snodes have been visited, and call
3724 loop_replay_fixup when revisiting one.
3725 (enode_label::get_text): Update dump call for new param.
3726 (exploded_graph::dump_exploded_nodes): Likewise.
3727 (exploded_graph::get_node_by_index): New.
3728 (impl_run_checkers): Create engine instance and pass its address
3729 to extrinsic_state ctor.
3731 (impl_region_model_context::impl_region_model_context): Drop
3733 (impl_region_model_context::void remap_svalue_ids): Delete.
3734 (impl_region_model_context::on_svalue_purge): Delete.
3735 (impl_region_model_context::on_svalue_leak): New.
3736 (impl_region_model_context::on_liveness_change): New.
3737 (impl_region_model_context::on_state_leak): Update signature.
3738 (impl_region_model_context::on_inherited_svalue): Delete.
3739 (impl_region_model_context::on_cast): Delete.
3740 (impl_region_model_context::on_unknown_change): Update signature.
3741 (impl_region_model_context::m_change): Delete.
3742 (eg_traits::dump_args_t::show_enode_details_p): New.
3743 (exploded_node::on_stmt): Drop "change" param.
3744 (exploded_node::on_edge): Likewise.
3745 (exploded_node::get_processed_stmt): New decl.
3746 (exploded_node::m_num_processed_stmts): New field.
3747 (exploded_edge::exploded_edge): Drop ext_state and change params.
3748 (exploded_edge::m_change): Delete.
3749 (exploded_graph::get_engine): New accessor.
3750 (exploded_graph::get_or_create_node): Drop "change" param. Add
3751 "enode_for_diag" param.
3752 (exploded_graph::add_edge): Drop "change" param.
3753 (exploded_graph::get_per_program_point_data): New decl.
3754 (exploded_graph::get_node_by_index): New decl.
3755 (exploded_path::feasible_p): Add "eng" and "eg" params.
3756 * program-point.cc: Include "analyzer/store.h" before including
3757 "analyzer/region-model.h".
3758 (function_point::function_point): Move here from
3760 (function_point::get_function): Likewise.
3761 (function_point::from_function_entry): Likewise.
3762 (function_point::before_supernode): Likewise.
3763 (function_point::next_stmt): New function.
3764 * program-point.h (function_point::function_point): Move
3765 implementation from here to program-point.cc.
3766 (function_point::get_function): Likewise.
3767 (function_point::from_function_entry): Likewise.
3768 (function_point::before_supernode): Likewise.
3769 (function_point::next_stmt): New decl.
3770 (program_point::operator!=): New.
3771 (program_point::origin): New.
3772 (program_point::next_stmt): New.
3773 (program_point::m_function_point): Make non-const.
3774 * program-state.cc: Move includes of "analyzer/call-string.h" and
3775 "analyzer/program-point.h" to before "analyzer/region-model.h",
3776 and also include "analyzer/store.h" before it.
3777 (extrinsic_state::get_model_manager): New.
3778 (sm_state_map::sm_state_map): Pass in sm and sm_idx to ctor,
3779 rather than pass the around.
3780 (sm_state_map::clone_with_remapping): Delete.
3781 (sm_state_map::print): Remove "sm" param in favor of "m_sm". Add
3782 "simple" and "multiline" params and support multiline vs single
3784 (sm_state_map::dump): Remove "sm" param in favor of "m_sm". Add
3786 (sm_state_map::hash): Port from svalue_id to const svalue *.
3787 (sm_state_map::operator==): Likewise.
3788 (sm_state_map::get_state): Likewise. Call canonicalize_svalue on
3789 input. Handle inheritance of sm-state. Call get_default_state.
3790 (sm_state_map::get_origin): Port from svalue_id to const svalue *.
3791 (sm_state_map::set_state): Likewise. Pass in ext_state. Reject
3792 attempts to set state on UNKNOWN.
3793 (sm_state_map::impl_set_state): Port from svalue_id to
3794 const svalue *. Pass in ext_state. Call canonicalize_svalue on
3796 (sm_state_map::purge_for_unknown_fncall): Delete.
3797 (sm_state_map::on_svalue_leak): New.
3798 (sm_state_map::remap_svalue_ids): Delete.
3799 (sm_state_map::on_liveness_change): New.
3800 (sm_state_map::on_unknown_change): Reimplement.
3801 (sm_state_map::on_svalue_purge): Delete.
3802 (sm_state_map::on_inherited_svalue): Delete.
3803 (sm_state_map::on_cast): Delete.
3804 (sm_state_map::validate): Delete.
3805 (sm_state_map::canonicalize_svalue): New.
3806 (program_state::program_state): Update to pass manager to
3807 region_model's ctor. Constify num_states and pass state machine
3808 and index to sm_state_map ctor.
3809 (program_state::print): Update for changes to dump API.
3810 (program_state::dump_to_pp): Ignore the summarize param. Add
3812 (program_state::dump_to_file): Add "multiline" param.
3813 (program_state::dump): Pass "true" for new "multiline" param.
3814 (program_state::push_frame): New.
3815 (program_state::on_edge): Drop "change" param. Call
3816 program_state::detect_leaks.
3817 (program_state::prune_for_point): Add enode_for_diag param.
3818 Reimplement based on store class. Call detect_leaks
3819 (program_state::remap_svalue_ids): Delete.
3820 (program_state::get_representative_tree): Port from svalue_id to
3822 (program_state::can_merge_with_p): Add "point" param. Add early
3823 reject for sm-differences. Drop id remapping.
3824 (program_state::validate): Drop region model and sm_state_map
3826 (state_change::sm_change::dump): Delete.
3827 (state_change::sm_change::remap_svalue_ids): Delete.
3828 (state_change::sm_change::on_svalue_purge): Delete.
3829 (log_set_of_svalues): New.
3830 (state_change::sm_change::validate): Delete.
3831 (state_change::state_change): Delete.
3832 (state_change::add_sm_change): Delete.
3833 (state_change::affects_p): Delete.
3834 (state_change::dump): Delete.
3835 (state_change::remap_svalue_ids): Delete.
3836 (state_change::on_svalue_purge): Delete.
3837 (state_change::validate): Delete.
3838 (selftest::assert_dump_eq): Delete.
3839 (ASSERT_DUMP_EQ): Delete.
3840 (selftest::test_sm_state_map): Update for changes to region_model
3841 and sm_state_map, porting from svalue_id to const svalue *.
3842 (selftest::test_program_state_dumping): Likewise. Drop test of
3843 dumping, renaming to...
3844 (selftest::test_program_state_1): ...this.
3845 (selftest::test_program_state_dumping_2): Likewise, renaming to...
3846 (selftest::test_program_state_2): ...this.
3847 (selftest::test_program_state_merging): Update for changes to
3849 (selftest::test_program_state_merging_2): Likewise.
3850 (selftest::analyzer_program_state_cc_tests): Update for renamed
3852 * program-state.h (extrinsic_state::extrinsic_state): Add logger
3854 (extrinsic_state::get_logger): New accessor.
3855 (extrinsic_state::get_engine): New accessor.
3856 (extrinsic_state::get_model_manager): New accessor.
3857 (extrinsic_state::m_logger): New field.
3858 (extrinsic_state::m_engine): New field.
3859 (struct default_hash_traits<svalue_id>): Delete.
3860 (pod_hash_traits<svalue_id>::hash): Delete.
3861 (pod_hash_traits<svalue_id>::equal): Delete.
3862 (pod_hash_traits<svalue_id>::mark_deleted): Delete.
3863 (pod_hash_traits<svalue_id>::mark_empty): Delete.
3864 (pod_hash_traits<svalue_id>::is_deleted): Delete.
3865 (pod_hash_traits<svalue_id>::is_empty): Delete.
3866 (sm_state_map::entry_t::entry_t): Port from svalue_id to
3868 (sm_state_map::entry_t::m_origin): Likewise.
3869 (sm_state_map::map_t): Likewise.
3870 (sm_state_map::sm_state_map): Add state_machine and index params.
3871 (sm_state_map::clone_with_remapping): Delete.
3872 (sm_state_map::print): Drop sm param; add simple and multiline
3874 (sm_state_map::dump): Drop sm param; add simple param.
3875 (sm_state_map::get_state): Port from svalue_id to const svalue *.
3876 Add ext_state param.
3877 (sm_state_map::get_origin): Likewise.
3878 (sm_state_map::set_state): Likewise.
3879 (sm_state_map::impl_set_state): Likewise.
3880 (sm_state_map::purge_for_unknown_fncall): Delete.
3881 (sm_state_map::remap_svalue_ids): Delete.
3882 (sm_state_map::on_svalue_purge): Delete.
3883 (sm_state_map::on_svalue_leak): New.
3884 (sm_state_map::on_liveness_change): New.
3885 (sm_state_map::on_inherited_svalue): Delete.
3886 (sm_state_map::on_cast): Delete.
3887 (sm_state_map::validate): Delete.
3888 (sm_state_map::on_unknown_change): Port from svalue_id to
3889 const svalue *. Add is_mutable and ext_state params.
3890 (sm_state_map::canonicalize_svalue): New.
3891 (sm_state_map::m_sm): New field.
3892 (sm_state_map::m_sm_idx): New field.
3893 (program_state::operator=): Delete.
3894 (program_state::dump_to_pp): Drop "summarize" param, adding
3895 "simple" and "multiline".
3896 (program_state::dump_to_file): Likewise.
3897 (program_state::dump): Rename "summarize" to "simple".
3898 (program_state::push_frame): New.
3899 (program_state::get_current_function): New.
3900 (program_state::on_edge): Drop "change" param.
3901 (program_state::prune_for_point): Likewise. Add enode_for_diag
3903 (program_state::remap_svalue_ids): Delete.
3904 (program_state::get_representative_tree): Port from svalue_id to
3906 (program_state::can_purge_p): Likewise. Pass ext_state to get_state.
3907 (program_state::can_merge_with_p): Add point param.
3908 (program_state::detect_leaks): New.
3909 (state_change_visitor::on_state_change): Port from tree and
3910 svalue_id to a pair of const svalue *.
3911 (class state_change): Delete.
3912 * region.cc: New file.
3913 * region-model-impl-calls.cc: New file.
3914 * region-model-manager.cc: New file.
3915 * region-model-reachability.cc: New file.
3916 * region-model-reachability.h: New file.
3917 * region-model.cc: Include "analyzer/call-string.h",
3918 "analyzer/program-point.h", and "analyzer/store.h" before
3919 "analyzer/region-model.h". Include
3920 "analyzer/region-model-reachability.h".
3921 (dump_tree): Make non-static.
3922 (dump_quoted_tree): Make non-static.
3923 (print_quoted_type): Make non-static.
3924 (path_var::dump): Delete.
3925 (dump_separator): Delete.
3926 (class impl_constraint_manager): Delete.
3927 (svalue_id::print): Delete.
3928 (svalue_id::dump_node_name_to_pp): Delete.
3929 (svalue_id::validate): Delete.
3930 (region_id::print): Delete.
3931 (region_id::dump_node_name_to_pp): Delete.
3932 (region_id::validate): Delete.
3933 (region_id_set::region_id_set): Delete.
3934 (svalue_id_set::svalue_id_set): Delete.
3935 (svalue::operator==): Delete.
3936 (svalue::hash): Delete.
3937 (svalue::print): Delete.
3938 (svalue::dump_dot_to_pp): Delete.
3939 (svalue::remap_region_ids): Delete.
3940 (svalue::walk_for_canonicalization): Delete.
3941 (svalue::get_child_sid): Delete.
3942 (svalue::maybe_get_constant): Delete.
3943 (region_svalue::compare_fields): Delete.
3944 (region_svalue::add_to_hash): Delete.
3945 (region_svalue::print_details): Delete.
3946 (region_svalue::dump_dot_to_pp): Delete.
3947 (region_svalue::remap_region_ids): Delete.
3948 (region_svalue::merge_values): Delete.
3949 (region_svalue::walk_for_canonicalization): Delete.
3950 (region_svalue::eval_condition): Delete.
3951 (constant_svalue::compare_fields): Delete.
3952 (constant_svalue::add_to_hash): Delete.
3953 (constant_svalue::merge_values): Delete.
3954 (constant_svalue::eval_condition): Move to svalue.cc.
3955 (constant_svalue::print_details): Delete.
3956 (constant_svalue::get_child_sid): Delete.
3957 (unknown_svalue::compare_fields): Delete.
3958 (unknown_svalue::add_to_hash): Delete.
3959 (unknown_svalue::print_details): Delete.
3960 (poison_kind_to_str): Move to svalue.cc.
3961 (poisoned_svalue::compare_fields): Delete.
3962 (poisoned_svalue::add_to_hash): Delete.
3963 (poisoned_svalue::print_details): Delete.
3964 (region_kind_to_str): Move to region.cc and reimplement.
3965 (region::operator==): Delete.
3966 (region::get_parent_region): Delete.
3967 (region::set_value): Delete.
3968 (region::become_active_view): Delete.
3969 (region::deactivate_any_active_view): Delete.
3970 (region::deactivate_view): Delete.
3971 (region::get_value): Delete.
3972 (region::get_inherited_child_sid): Delete.
3973 (region_model::copy_region): Delete.
3974 (region_model::copy_struct_region): Delete.
3975 (region_model::copy_union_region): Delete.
3976 (region_model::copy_array_region): Delete.
3977 (region::hash): Delete.
3978 (region::print): Delete.
3979 (region::dump_dot_to_pp): Delete.
3980 (region::dump_to_pp): Delete.
3981 (region::dump_child_label): Delete.
3982 (region::validate): Delete.
3983 (region::remap_svalue_ids): Delete.
3984 (region::remap_region_ids): Delete.
3985 (region::add_view): Delete.
3986 (region::get_view): Delete.
3987 (region::region): Move to region.cc.
3988 (region::add_to_hash): Delete.
3989 (region::print_fields): Delete.
3990 (region::non_null_p): Delete.
3991 (primitive_region::clone): Delete.
3992 (primitive_region::walk_for_canonicalization): Delete.
3993 (map_region::map_region): Delete.
3994 (map_region::compare_fields): Delete.
3995 (map_region::print_fields): Delete.
3996 (map_region::validate): Delete.
3997 (map_region::dump_dot_to_pp): Delete.
3998 (map_region::dump_child_label): Delete.
3999 (map_region::get_or_create): Delete.
4000 (map_region::get): Delete.
4001 (map_region::add_to_hash): Delete.
4002 (map_region::remap_region_ids): Delete.
4003 (map_region::unbind): Delete.
4004 (map_region::get_tree_for_child_region): Delete.
4005 (map_region::get_tree_for_child_region): Delete.
4006 (tree_cmp): Move to region.cc.
4007 (map_region::can_merge_p): Delete.
4008 (map_region::walk_for_canonicalization): Delete.
4009 (map_region::get_value_by_name): Delete.
4010 (struct_or_union_region::valid_key_p): Delete.
4011 (struct_or_union_region::compare_fields): Delete.
4012 (struct_region::clone): Delete.
4013 (struct_region::compare_fields): Delete.
4014 (union_region::clone): Delete.
4015 (union_region::compare_fields): Delete.
4016 (frame_region::compare_fields): Delete.
4017 (frame_region::clone): Delete.
4018 (frame_region::valid_key_p): Delete.
4019 (frame_region::print_fields): Delete.
4020 (frame_region::add_to_hash): Delete.
4021 (globals_region::compare_fields): Delete.
4022 (globals_region::clone): Delete.
4023 (globals_region::valid_key_p): Delete.
4024 (code_region::compare_fields): Delete.
4025 (code_region::clone): Delete.
4026 (code_region::valid_key_p): Delete.
4027 (array_region::array_region): Delete.
4028 (array_region::get_element): Delete.
4029 (array_region::clone): Delete.
4030 (array_region::compare_fields): Delete.
4031 (array_region::print_fields): Delete.
4032 (array_region::validate): Delete.
4033 (array_region::dump_dot_to_pp): Delete.
4034 (array_region::dump_child_label): Delete.
4035 (array_region::get_or_create): Delete.
4036 (array_region::get): Delete.
4037 (array_region::add_to_hash): Delete.
4038 (array_region::remap_region_ids): Delete.
4039 (array_region::get_key_for_child_region): Delete.
4040 (array_region::key_cmp): Delete.
4041 (array_region::walk_for_canonicalization): Delete.
4042 (array_region::key_from_constant): Delete.
4043 (array_region::constant_from_key): Delete.
4044 (function_region::compare_fields): Delete.
4045 (function_region::clone): Delete.
4046 (function_region::valid_key_p): Delete.
4047 (stack_region::stack_region): Delete.
4048 (stack_region::compare_fields): Delete.
4049 (stack_region::clone): Delete.
4050 (stack_region::print_fields): Delete.
4051 (stack_region::dump_child_label): Delete.
4052 (stack_region::validate): Delete.
4053 (stack_region::push_frame): Delete.
4054 (stack_region::get_current_frame_id): Delete.
4055 (stack_region::pop_frame): Delete.
4056 (stack_region::add_to_hash): Delete.
4057 (stack_region::remap_region_ids): Delete.
4058 (stack_region::can_merge_p): Delete.
4059 (stack_region::walk_for_canonicalization): Delete.
4060 (stack_region::get_value_by_name): Delete.
4061 (heap_region::heap_region): Delete.
4062 (heap_region::compare_fields): Delete.
4063 (heap_region::clone): Delete.
4064 (heap_region::walk_for_canonicalization): Delete.
4065 (root_region::root_region): Delete.
4066 (root_region::compare_fields): Delete.
4067 (root_region::clone): Delete.
4068 (root_region::print_fields): Delete.
4069 (root_region::validate): Delete.
4070 (root_region::dump_child_label): Delete.
4071 (root_region::push_frame): Delete.
4072 (root_region::get_current_frame_id): Delete.
4073 (root_region::pop_frame): Delete.
4074 (root_region::ensure_stack_region): Delete.
4075 (root_region::get_stack_region): Delete.
4076 (root_region::ensure_globals_region): Delete.
4077 (root_region::get_code_region): Delete.
4078 (root_region::ensure_code_region): Delete.
4079 (root_region::get_globals_region): Delete.
4080 (root_region::ensure_heap_region): Delete.
4081 (root_region::get_heap_region): Delete.
4082 (root_region::remap_region_ids): Delete.
4083 (root_region::can_merge_p): Delete.
4084 (root_region::add_to_hash): Delete.
4085 (root_region::walk_for_canonicalization): Delete.
4086 (root_region::get_value_by_name): Delete.
4087 (symbolic_region::symbolic_region): Delete.
4088 (symbolic_region::compare_fields): Delete.
4089 (symbolic_region::clone): Delete.
4090 (symbolic_region::walk_for_canonicalization): Delete.
4091 (symbolic_region::print_fields): Delete.
4092 (region_model::region_model): Add region_model_manager * param.
4093 Reimplement in terms of store, dropping impl_constraint_manager
4095 (region_model::operator=): Reimplement in terms of store
4096 (region_model::operator==): Likewise.
4097 (region_model::hash): Likewise.
4098 (region_model::print): Delete.
4099 (region_model::print_svalue): Delete.
4100 (region_model::dump_dot_to_pp): Delete.
4101 (region_model::dump_dot_to_file): Delete.
4102 (region_model::dump_dot): Delete.
4103 (region_model::dump_to_pp): Replace "summarize" param with
4104 "simple" and "multiline". Port to store-based implementation.
4105 (region_model::dump): Replace "summarize" param with "simple" and
4107 (dump_vec_of_tree): Delete.
4108 (region_model::dump_summary_of_rep_path_vars): Delete.
4109 (region_model::validate): Delete.
4110 (svalue_id_cmp_by_constant_svalue_model): Delete.
4111 (svalue_id_cmp_by_constant_svalue): Delete.
4112 (region_model::canonicalize): Drop "ctxt" param. Reimplement in
4113 terms of store and constraints.
4114 (region_model::canonicalized_p): Remove NULL arg to canonicalize.
4115 (region_model::loop_replay_fixup): New.
4116 (poisoned_value_diagnostic::emit): Tweak wording of warnings.
4117 (region_model::check_for_poison): Delete.
4118 (region_model::get_gassign_result): New.
4119 (region_model::on_assignment): Port to store-based implementation.
4120 (region_model::on_call_pre): Delete calls to check_for_poison.
4121 Move implementations to region-model-impl-calls.c and port to
4122 store-based implementation.
4123 (region_model::on_call_post): Likewise.
4124 (class reachable_regions): Move to region-model-reachability.h/cc
4125 and port to store-based implementation.
4126 (region_model::handle_unrecognized_call): Port to store-based
4128 (region_model::get_reachable_svalues): New.
4129 (region_model::on_setjmp): Port to store-based implementation.
4130 (region_model::on_longjmp): Likewise.
4131 (region_model::handle_phi): Drop is_back_edge param and the logic
4133 (region_model::get_lvalue_1): Port from region_id to const region *.
4134 (region_model::make_region_for_unexpected_tree_code): Delete.
4135 (assert_compat_types): If the check fails, use internal_error to
4137 (region_model::get_lvalue): Port from region_id to const region *.
4138 (region_model::get_rvalue_1): Port from svalue_id to const svalue *.
4139 (region_model::get_rvalue): Likewise.
4140 (region_model::get_or_create_ptr_svalue): Delete.
4141 (region_model::get_or_create_constant_svalue): Delete.
4142 (region_model::get_svalue_for_fndecl): Delete.
4143 (region_model::get_region_for_fndecl): Delete.
4144 (region_model::get_svalue_for_label): Delete.
4145 (region_model::get_region_for_label): Delete.
4146 (build_cast): Delete.
4147 (region_model::maybe_cast_1): Delete.
4148 (region_model::maybe_cast): Delete.
4149 (region_model::get_field_region): Delete.
4150 (region_model::get_store_value): New.
4151 (region_model::region_exists_p): New.
4152 (region_model::deref_rvalue): Port from svalue_id to const svalue *.
4153 (region_model::set_value): Likewise.
4154 (region_model::clobber_region): New.
4155 (region_model::purge_region): New.
4156 (region_model::zero_fill_region): New.
4157 (region_model::mark_region_as_unknown): New.
4158 (region_model::eval_condition): Port from svalue_id to
4160 (region_model::eval_condition_without_cm): Likewise.
4161 (region_model::compare_initial_and_pointer): New.
4162 (region_model::add_constraint): Port from svalue_id to
4164 (region_model::maybe_get_constant): Delete.
4165 (region_model::get_representative_path_var): New.
4166 (region_model::add_new_malloc_region): Delete.
4167 (region_model::get_representative_tree): Port to const svalue *.
4168 (region_model::get_representative_path_var): Port to
4170 (region_model::get_path_vars_for_svalue): Delete.
4171 (region_model::set_to_new_unknown_value): Delete.
4172 (region_model::update_for_phis): Don't pass is_back_edge to handle_phi.
4173 (region_model::update_for_call_superedge): Port from svalue_id to
4175 (region_model::update_for_return_superedge): Port to store-based
4177 (region_model::update_for_call_summary): Replace
4178 set_to_new_unknown_value with mark_region_as_unknown.
4179 (region_model::get_root_region): Delete.
4180 (region_model::get_stack_region_id): Delete.
4181 (region_model::push_frame): Delete.
4182 (region_model::get_current_frame_id): Delete.
4183 (region_model::get_current_function): Delete.
4184 (region_model::pop_frame): Delete.
4185 (region_model::on_top_level_param): New.
4186 (region_model::get_stack_depth): Delete.
4187 (region_model::get_function_at_depth): Delete.
4188 (region_model::get_globals_region_id): Delete.
4189 (region_model::add_svalue): Delete.
4190 (region_model::replace_svalue): Delete.
4191 (region_model::add_region): Delete.
4192 (region_model::get_svalue): Delete.
4193 (region_model::get_region): Delete.
4194 (make_region_for_type): Delete.
4195 (region_model::add_region_for_type): Delete.
4196 (region_model::on_top_level_param): New.
4197 (class restrict_to_used_svalues): Delete.
4198 (region_model::purge_unused_svalues): Delete.
4199 (region_model::push_frame): New.
4200 (region_model::remap_svalue_ids): Delete.
4201 (region_model::remap_region_ids): Delete.
4202 (region_model::purge_regions): Delete.
4203 (region_model::get_descendents): Delete.
4204 (region_model::delete_region_and_descendents): Delete.
4205 (region_model::poison_any_pointers_to_bad_regions): Delete.
4206 (region_model::can_merge_with_p): Delete.
4207 (region_model::get_current_function): New.
4208 (region_model::get_value_by_name): Delete.
4209 (region_model::convert_byte_offset_to_array_index): Delete.
4210 (region_model::pop_frame): New.
4211 (region_model::get_or_create_mem_ref): Delete.
4212 (region_model::get_stack_depth): New.
4213 (region_model::get_frame_at_index): New.
4214 (region_model::unbind_region_and_descendents): New.
4215 (struct bad_pointer_finder): New.
4216 (region_model::get_or_create_pointer_plus_expr): Delete.
4217 (region_model::poison_any_pointers_to_descendents): New.
4218 (region_model::get_or_create_view): Delete.
4219 (region_model::can_merge_with_p): New.
4220 (region_model::get_fndecl_for_call): Port from svalue_id to
4222 (struct append_ssa_names_cb_data): New.
4223 (get_ssa_name_regions_for_current_frame): New.
4224 (region_model::append_ssa_names_cb): New.
4225 (model_merger::dump_to_pp): Add "simple" param. Drop dumping of
4227 (model_merger::dump): Add "simple" param to both overloads.
4228 (model_merger::can_merge_values_p): Delete.
4229 (model_merger::record_regions): Delete.
4230 (model_merger::record_svalues): Delete.
4231 (svalue_id_merger_mapping::svalue_id_merger_mapping): Delete.
4232 (svalue_id_merger_mapping::dump_to_pp): Delete.
4233 (svalue_id_merger_mapping::dump): Delete.
4234 (region_model::create_region_for_heap_alloc): New.
4235 (region_model::create_region_for_alloca): New.
4236 (region_model::record_dynamic_extents): New.
4237 (canonicalization::canonicalization): Delete.
4238 (canonicalization::walk_rid): Delete.
4239 (canonicalization::walk_sid): Delete.
4240 (canonicalization::dump_to_pp): Delete.
4241 (canonicalization::dump): Delete.
4242 (inchash::add): Delete overloads for svalue_id and region_id.
4243 (engine::log_stats): New.
4244 (assert_condition): Add overload comparing svalues.
4245 (assert_dump_eq): Pass "true" for multiline.
4246 (selftest::test_dump): Update for rewrite of region_model.
4247 (selftest::test_dump_2): Rename to...
4248 (selftest::test_struct): ...this. Provide a region_model_manager
4249 when creating region_model instance. Remove dump test. Add
4250 checks for get_offset.
4251 (selftest::test_dump_3): Rename to...
4252 (selftest::test_array_1): ...this. Provide a region_model_manager
4253 when creating region_model instance. Remove dump test.
4254 (selftest::test_get_representative_tree): Port from svalue_id to
4255 new API. Add test coverage for various expressions.
4256 (selftest::test_unique_constants): Provide a region_model_manager
4257 for the region_model. Add test coverage for comparing const vs
4259 (selftest::test_svalue_equality): Delete.
4260 (selftest::test_region_equality): Delete.
4261 (selftest::test_unique_unknowns): New.
4262 (class purge_all_svalue_ids): Delete.
4263 (class purge_one_svalue_id): Delete.
4264 (selftest::test_purging_by_criteria): Delete.
4265 (selftest::test_initial_svalue_folding): New.
4266 (selftest::test_unaryop_svalue_folding): New.
4267 (selftest::test_binop_svalue_folding): New.
4268 (selftest::test_sub_svalue_folding): New.
4269 (selftest::test_purge_unused_svalues): Delete.
4270 (selftest::test_descendent_of_p): New.
4271 (selftest::test_assignment): Provide a region_model_manager for
4272 the region_model. Drop the dump test.
4273 (selftest::test_compound_assignment): Likewise.
4274 (selftest::test_stack_frames): Port to new implementation.
4275 (selftest::test_get_representative_path_var): Likewise.
4276 (selftest::test_canonicalization_1): Rename to...
4277 (selftest::test_equality_1): ...this. Port to new API, and add
4278 (selftest::test_canonicalization_2): Provide a
4279 region_model_manager when creating region_model instances.
4280 Remove redundant canicalization.
4281 (selftest::test_canonicalization_3): Provide a
4282 region_model_manager when creating region_model instances.
4283 Remove param from calls to region_model::canonicalize.
4284 (selftest::test_canonicalization_4): Likewise.
4285 (selftest::assert_region_models_merge): Constify
4286 out_merged_svalue. Port to new API.
4287 (selftest::test_state_merging): Provide a
4288 region_model_manager when creating region_model instances.
4289 Provide a program_point point when merging them. Replace
4290 set_to_new_unknown_value with usage of placeholder_svalues.
4291 Drop get_value_by_name. Port from svalue_id to const svalue *.
4292 Add test of heap allocation.
4293 (selftest::test_constraint_merging): Provide a
4294 region_model_manager when creating region_model instances.
4295 Provide a program_point point when merging them. Eliminate use
4296 of set_to_new_unknown_value.
4297 (selftest::test_widening_constraints): New.
4298 (selftest::test_iteration_1): New.
4299 (selftest::test_malloc_constraints): Port to store-based
4301 (selftest::test_var): New test.
4302 (selftest::test_array_2): New test.
4303 (selftest::test_mem_ref): New test.
4304 (selftest::test_POINTER_PLUS_EXPR_then_MEM_REF): New.
4305 (selftest::test_malloc): New.
4306 (selftest::test_alloca): New.
4307 (selftest::analyzer_region_model_cc_tests): Update for renamings.
4309 * region-model.h (class path_var): Move to analyzer.h.
4310 (class svalue_id): Delete.
4311 (class region_id): Delete.
4312 (class id_map): Delete.
4313 (svalue_id_map): Delete.
4314 (region_id_map): Delete.
4315 (id_map<T>::id_map): Delete.
4316 (id_map<T>::put): Delete.
4317 (id_map<T>::get_dst_for_src): Delete.
4318 (id_map<T>::get_src_for_dst): Delete.
4319 (id_map<T>::dump_to_pp): Delete.
4320 (id_map<T>::dump): Delete.
4321 (id_map<T>::update): Delete.
4322 (one_way_svalue_id_map): Delete.
4323 (one_way_region_id_map): Delete.
4324 (class region_id_set): Delete.
4325 (class svalue_id_set): Delete.
4326 (struct complexity): New.
4327 (class visitor): New.
4328 (enum svalue_kind): Add SK_SETJMP, SK_INITIAL, SK_UNARYOP,
4329 SK_BINOP, SK_SUB,SK_UNMERGEABLE, SK_PLACEHOLDER, SK_WIDENING,
4330 SK_COMPOUND, and SK_CONJURED.
4331 (svalue::operator==): Delete.
4332 (svalue::operator!=): Delete.
4333 (svalue::clone): Delete.
4334 (svalue::hash): Delete.
4335 (svalue::dump_dot_to_pp): Delete.
4336 (svalue::dump_to_pp): New.
4337 (svalue::dump): New.
4338 (svalue::get_desc): New.
4339 (svalue::dyn_cast_initial_svalue): New.
4340 (svalue::dyn_cast_unaryop_svalue): New.
4341 (svalue::dyn_cast_binop_svalue): New.
4342 (svalue::dyn_cast_sub_svalue): New.
4343 (svalue::dyn_cast_unmergeable_svalue): New.
4344 (svalue::dyn_cast_widening_svalue): New.
4345 (svalue::dyn_cast_compound_svalue): New.
4346 (svalue::dyn_cast_conjured_svalue): New.
4347 (svalue::maybe_undo_cast): New.
4348 (svalue::unwrap_any_unmergeable): New.
4349 (svalue::remap_region_ids): Delete
4350 (svalue::can_merge_p): New.
4351 (svalue::walk_for_canonicalization): Delete
4352 (svalue::get_complexity): New.
4353 (svalue::get_child_sid): Delete
4354 (svalue::accept): New.
4355 (svalue::live_p): New.
4356 (svalue::implicitly_live_p): New.
4357 (svalue::svalue): Add complexity param.
4358 (svalue::add_to_hash): Delete
4359 (svalue::print_details): Delete
4360 (svalue::m_complexity): New field.
4361 (region_svalue::key_t): New struct.
4362 (region_svalue::region_svalue): Port from region_id to
4363 const region_id *. Add complexity.
4364 (region_svalue::compare_fields): Delete.
4365 (region_svalue::clone): Delete.
4366 (region_svalue::dump_dot_to_pp): Delete.
4367 (region_svalue::get_pointee): Port from region_id to
4369 (region_svalue::remap_region_ids): Delete.
4370 (region_svalue::merge_values): Delete.
4371 (region_svalue::dump_to_pp): New.
4372 (region_svalue::accept): New.
4373 (region_svalue::walk_for_canonicalization): Delete.
4374 (region_svalue::eval_condition): Make params const.
4375 (region_svalue::add_to_hash): Delete.
4376 (region_svalue::print_details): Delete.
4377 (region_svalue::m_rid): Replace with...
4378 (region_svalue::m_reg): ...this.
4379 (is_a_helper <region_svalue *>::test): Convert to...
4380 (is_a_helper <const region_svalue *>::test): ...this.
4381 (template <> struct default_hash_traits<region_svalue::key_t>):
4383 (constant_svalue::constant_svalue): Add complexity.
4384 (constant_svalue::compare_fields): Delete.
4385 (constant_svalue::clone): Delete.
4386 (constant_svalue::add_to_hash): Delete.
4387 (constant_svalue::dump_to_pp): New.
4388 (constant_svalue::accept): New.
4389 (constant_svalue::implicitly_live_p): New.
4390 (constant_svalue::merge_values): Delete.
4391 (constant_svalue::eval_condition): Make params const.
4392 (constant_svalue::get_child_sid): Delete.
4393 (constant_svalue::print_details): Delete.
4394 (is_a_helper <constant_svalue *>::test): Convert to...
4395 (is_a_helper <const constant_svalue *>::test): ...this.
4396 (class unknown_svalue): Update leading comment.
4397 (unknown_svalue::unknown_svalue): Add complexity.
4398 (unknown_svalue::compare_fields): Delete.
4399 (unknown_svalue::add_to_hash): Delete.
4400 (unknown_svalue::dyn_cast_unknown_svalue): Delete.
4401 (unknown_svalue::print_details): Delete.
4402 (unknown_svalue::dump_to_pp): New.
4403 (unknown_svalue::accept): New.
4404 (poisoned_svalue::key_t): New struct.
4405 (poisoned_svalue::poisoned_svalue): Add complexity.
4406 (poisoned_svalue::compare_fields): Delete.
4407 (poisoned_svalue::clone): Delete.
4408 (poisoned_svalue::add_to_hash): Delete.
4409 (poisoned_svalue::dump_to_pp): New.
4410 (poisoned_svalue::accept): New.
4411 (poisoned_svalue::print_details): Delete.
4412 (is_a_helper <poisoned_svalue *>::test): Convert to...
4413 (is_a_helper <const poisoned_svalue *>::test): ...this.
4414 (template <> struct default_hash_traits<poisoned_svalue::key_t>):
4416 (setjmp_record::add_to_hash): New.
4417 (setjmp_svalue::key_t): New struct.
4418 (setjmp_svalue::compare_fields): Delete.
4419 (setjmp_svalue::clone): Delete.
4420 (setjmp_svalue::add_to_hash): Delete.
4421 (setjmp_svalue::setjmp_svalue): Add complexity.
4422 (setjmp_svalue::dump_to_pp): New.
4423 (setjmp_svalue::accept): New.
4424 (setjmp_svalue::void print_details): Delete.
4425 (is_a_helper <const setjmp_svalue *>::test): New.
4426 (template <> struct default_hash_traits<setjmp_svalue::key_t>): New.
4427 (class initial_svalue : public svalue): New.
4428 (is_a_helper <const initial_svalue *>::test): New.
4429 (class unaryop_svalue): New.
4430 (is_a_helper <const unaryop_svalue *>::test): New.
4431 (template <> struct default_hash_traits<unaryop_svalue::key_t>): New.
4432 (class binop_svalue): New.
4433 (is_a_helper <const binop_svalue *>::test): New.
4434 (template <> struct default_hash_traits<binop_svalue::key_t>): New.
4435 (class sub_svalue): New.
4436 (is_a_helper <const sub_svalue *>::test): New.
4437 (template <> struct default_hash_traits<sub_svalue::key_t>): New.
4438 (class unmergeable_svalue): New.
4439 (is_a_helper <const unmergeable_svalue *>::test): New.
4440 (class placeholder_svalue): New.
4441 (is_a_helper <placeholder_svalue *>::test): New.
4442 (class widening_svalue): New.
4443 (is_a_helper <widening_svalue *>::test): New.
4444 (template <> struct default_hash_traits<widening_svalue::key_t>): New.
4445 (class compound_svalue): New.
4446 (is_a_helper <compound_svalue *>::test): New.
4447 (template <> struct default_hash_traits<compound_svalue::key_t>): New.
4448 (class conjured_svalue): New.
4449 (is_a_helper <conjured_svalue *>::test): New.
4450 (template <> struct default_hash_traits<conjured_svalue::key_t>): New.
4451 (enum region_kind): Delete RK_PRIMITIVE, RK_STRUCT, RK_UNION, and
4452 RK_ARRAY. Add RK_LABEL, RK_DECL, RK_FIELD, RK_ELEMENT, RK_OFFSET,
4453 RK_CAST, RK_HEAP_ALLOCATED, RK_ALLOCA, RK_STRING, and RK_UNKNOWN.
4454 (region_kind_to_str): Delete.
4455 (region::~region): Move implementation to region.cc.
4456 (region::operator==): Delete.
4457 (region::operator!=): Delete.
4458 (region::clone): Delete.
4459 (region::get_id): New.
4460 (region::cmp_ids): New.
4461 (region::dyn_cast_map_region): Delete.
4462 (region::dyn_cast_array_region): Delete.
4463 (region::region_id get_parent): Delete.
4464 (region::get_parent_region): Convert to a simple accessor.
4465 (region::void set_value): Delete.
4466 (region::svalue_id get_value): Delete.
4467 (region::svalue_id get_value_direct): Delete.
4468 (region::svalue_id get_inherited_child_sid): Delete.
4469 (region::dyn_cast_frame_region): New.
4470 (region::dyn_cast_function_region): New.
4471 (region::dyn_cast_decl_region): New.
4472 (region::dyn_cast_field_region): New.
4473 (region::dyn_cast_element_region): New.
4474 (region::dyn_cast_offset_region): New.
4475 (region::dyn_cast_cast_region): New.
4476 (region::dyn_cast_string_region): New.
4477 (region::accept): New.
4478 (region::get_base_region): New.
4479 (region::base_region_p): New.
4480 (region::descendent_of_p): New.
4481 (region::maybe_get_frame_region): New.
4482 (region::maybe_get_decl): New.
4483 (region::hash): Delete.
4484 (region::rint): Delete.
4485 (region::dump_dot_to_pp): Delete.
4486 (region::get_desc): New.
4487 (region::dump_to_pp): Convert to vfunc, changing signature.
4488 (region::dump_child_label): Delete.
4489 (region::remap_svalue_ids): Delete.
4490 (region::remap_region_ids): Delete.
4491 (region::dump): New.
4492 (region::walk_for_canonicalization): Delete.
4493 (region::non_null_p): Drop region_model param.
4494 (region::add_view): Delete.
4495 (region::get_view): Delete.
4496 (region::get_active_view): Delete.
4497 (region::is_view_p): Delete.
4498 (region::cmp_ptrs): New.
4499 (region::validate): Delete.
4500 (region::get_offset): New.
4501 (region::get_byte_size): New.
4502 (region::get_bit_size): New.
4503 (region::get_subregions_for_binding): New.
4504 (region::region): Add complexity param. Convert parent from
4505 region_id to const region *. Drop svalue_id. Drop copy ctor.
4506 (region::symbolic_for_unknown_ptr_p): New.
4507 (region::add_to_hash): Delete.
4508 (region::print_fields): Delete.
4509 (region::get_complexity): New accessor.
4510 (region::become_active_view): Delete.
4511 (region::deactivate_any_active_view): Delete.
4512 (region::deactivate_view): Delete.
4513 (region::calc_offset): New.
4514 (region::m_parent_rid): Delete.
4515 (region::m_sval_id): Delete.
4516 (region::m_complexity): New.
4517 (region::m_id): New.
4518 (region::m_parent): New.
4519 (region::m_view_rids): Delete.
4520 (region::m_is_view): Delete.
4521 (region::m_active_view_rid): Delete.
4522 (region::m_cached_offset): New.
4523 (is_a_helper <region *>::test): Convert to...
4524 (is_a_helper <const region *>::test): ... this.
4525 (class primitive_region): Delete.
4526 (class space_region): New.
4527 (class map_region): Delete.
4528 (is_a_helper <map_region *>::test): Delete.
4529 (class frame_region): Reimplement.
4530 (template <> struct default_hash_traits<frame_region::key_t>):
4532 (class globals_region): Reimplement.
4533 (is_a_helper <globals_region *>::test): Convert to...
4534 (is_a_helper <const globals_region *>::test): ...this.
4535 (class struct_or_union_region): Delete.
4536 (is_a_helper <struct_or_union_region *>::test): Delete.
4537 (class code_region): Reimplement.
4538 (is_a_helper <const code_region *>::test): New.
4539 (class struct_region): Delete.
4540 (is_a_helper <struct_region *>::test): Delete.
4541 (class function_region): Reimplement.
4542 (is_a_helper <function_region *>::test): Convert to...
4543 (is_a_helper <const function_region *>::test): ...this.
4544 (class union_region): Delete.
4545 (is_a_helper <union_region *>::test): Delete.
4546 (class label_region): New.
4547 (is_a_helper <const label_region *>::test): New.
4548 (class scope_region): Delete.
4549 (class stack_region): Reimplement.
4550 (is_a_helper <stack_region *>::test): Convert to...
4551 (is_a_helper <const stack_region *>::test): ...this.
4552 (class heap_region): Reimplement.
4553 (is_a_helper <heap_region *>::test): Convert to...
4554 (is_a_helper <const heap_region *>::test): ...this.
4555 (class root_region): Reimplement.
4556 (is_a_helper <root_region *>::test): Convert to...
4557 (is_a_helper <const root_region *>::test): ...this.
4558 (class symbolic_region): Reimplement.
4559 (is_a_helper <const symbolic_region *>::test): New.
4560 (template <> struct default_hash_traits<symbolic_region::key_t>):
4562 (class decl_region): New.
4563 (is_a_helper <const decl_region *>::test): New.
4564 (class field_region): New.
4565 (template <> struct default_hash_traits<field_region::key_t>): New.
4566 (class array_region): Delete.
4567 (class element_region): New.
4568 (is_a_helper <array_region *>::test): Delete.
4569 (is_a_helper <const element_region *>::test): New.
4570 (template <> struct default_hash_traits<element_region::key_t>):
4572 (class offset_region): New.
4573 (is_a_helper <const offset_region *>::test): New.
4574 (template <> struct default_hash_traits<offset_region::key_t>):
4576 (class cast_region): New.
4577 (is_a_helper <const cast_region *>::test): New.
4578 (template <> struct default_hash_traits<cast_region::key_t>): New.
4579 (class heap_allocated_region): New.
4580 (class alloca_region): New.
4581 (class string_region): New.
4582 (is_a_helper <const string_region *>::test): New.
4583 (class unknown_region): New.
4584 (class region_model_manager): New.
4585 (struct append_ssa_names_cb_data): New.
4586 (class call_details): New.
4587 (region_model::region_model): Add region_model_manager param.
4588 (region_model::print_svalue): Delete.
4589 (region_model::dump_dot_to_pp): Delete.
4590 (region_model::dump_dot_to_file): Delete.
4591 (region_model::dump_dot): Delete.
4592 (region_model::dump_to_pp): Drop summarize param in favor of
4593 simple and multiline.
4594 (region_model::dump): Likewise.
4595 (region_model::summarize_to_pp): Delete.
4596 (region_model::summarize): Delete.
4597 (region_model::void canonicalize): Drop ctxt param.
4598 (region_model::void check_for_poison): Delete.
4599 (region_model::get_gassign_result): New.
4600 (region_model::impl_call_alloca): New.
4601 (region_model::impl_call_analyzer_describe): New.
4602 (region_model::impl_call_analyzer_eval): New.
4603 (region_model::impl_call_builtin_expect): New.
4604 (region_model::impl_call_calloc): New.
4605 (region_model::impl_call_free): New.
4606 (region_model::impl_call_malloc): New.
4607 (region_model::impl_call_memset): New.
4608 (region_model::impl_call_strlen): New.
4609 (region_model::get_reachable_svalues): New.
4610 (region_model::handle_phi): Drop is_back_edge param.
4611 (region_model::region_id get_root_rid): Delete.
4612 (region_model::root_region *get_root_region): Delete.
4613 (region_model::region_id get_stack_region_id): Delete.
4614 (region_model::push_frame): Convert from region_id and svalue_id
4615 to const region * and const svalue *.
4616 (region_model::get_current_frame_id): Replace with...
4617 (region_model::get_current_frame): ...this.
4618 (region_model::pop_frame): Convert from region_id to
4619 const region *. Drop purge and stats param. Add out_result.
4620 (region_model::function *get_function_at_depth): Delete.
4621 (region_model::get_globals_region_id): Delete.
4622 (region_model::add_svalue): Delete.
4623 (region_model::replace_svalue): Delete.
4624 (region_model::add_region): Delete.
4625 (region_model::add_region_for_type): Delete.
4626 (region_model::get_svalue): Delete.
4627 (region_model::get_region): Delete.
4628 (region_model::get_lvalue): Convert from region_id to
4630 (region_model::get_rvalue): Convert from svalue_id to
4632 (region_model::get_or_create_ptr_svalue): Delete.
4633 (region_model::get_or_create_constant_svalue): Delete.
4634 (region_model::get_svalue_for_fndecl): Delete.
4635 (region_model::get_svalue_for_label): Delete.
4636 (region_model::get_region_for_fndecl): Delete.
4637 (region_model::get_region_for_label): Delete.
4638 (region_model::get_frame_at_index (int index) const;): New.
4639 (region_model::maybe_cast): Delete.
4640 (region_model::maybe_cast_1): Delete.
4641 (region_model::get_field_region): Delete.
4642 (region_model::id deref_rvalue): Convert from region_id and
4643 svalue_id to const region * and const svalue *. Drop overload,
4644 passing in both a tree and an svalue.
4645 (region_model::set_value): Convert from region_id and svalue_id to
4646 const region * and const svalue *.
4647 (region_model::set_to_new_unknown_value): Delete.
4648 (region_model::clobber_region (const region *reg);): New.
4649 (region_model::purge_region (const region *reg);): New.
4650 (region_model::zero_fill_region (const region *reg);): New.
4651 (region_model::mark_region_as_unknown (const region *reg);): New.
4652 (region_model::copy_region): Convert from region_id to
4654 (region_model::eval_condition): Convert from svalue_id to
4656 (region_model::eval_condition_without_cm): Likewise.
4657 (region_model::compare_initial_and_pointer): New.
4658 (region_model:maybe_get_constant): Delete.
4659 (region_model::add_new_malloc_region): Delete.
4660 (region_model::get_representative_tree): Convert from svalue_id to
4662 (region_model::get_representative_path_var): Delete decl taking a
4663 region_id in favor of two decls, for svalue vs region, with an
4664 svalue_set to ensure termination.
4665 (region_model::get_path_vars_for_svalue): Delete.
4666 (region_model::create_region_for_heap_alloc): New.
4667 (region_model::create_region_for_alloca): New.
4668 (region_model::purge_unused_svalues): Delete.
4669 (region_model::remap_svalue_ids): Delete.
4670 (region_model::remap_region_ids): Delete.
4671 (region_model::purge_regions): Delete.
4672 (region_model::get_num_svalues): Delete.
4673 (region_model::get_num_regions): Delete.
4674 (region_model::get_descendents): Delete.
4675 (region_model::get_store): New.
4676 (region_model::delete_region_and_descendents): Delete.
4677 (region_model::get_manager): New.
4678 (region_model::unbind_region_and_descendents): New.
4679 (region_model::can_merge_with_p): Add point param. Drop
4680 svalue_id_merger_mapping.
4681 (region_model::get_value_by_name): Delete.
4682 (region_model::convert_byte_offset_to_array_index): Delete.
4683 (region_model::get_or_create_mem_ref): Delete.
4684 (region_model::get_or_create_pointer_plus_expr): Delete.
4685 (region_model::get_or_create_view): Delete.
4686 (region_model::get_lvalue_1): Convert from region_id to
4688 (region_model::get_rvalue_1): Convert from svalue_id to
4690 (region_model::get_ssa_name_regions_for_current_frame): New.
4691 (region_model::append_ssa_names_cb): New.
4692 (region_model::get_store_value): New.
4693 (region_model::copy_struct_region): Delete.
4694 (region_model::copy_union_region): Delete.
4695 (region_model::copy_array_region): Delete.
4696 (region_model::region_exists_p): New.
4697 (region_model::make_region_for_unexpected_tree_code): Delete.
4698 (region_model::loop_replay_fixup): New.
4699 (region_model::poison_any_pointers_to_bad_regions): Delete.
4700 (region_model::poison_any_pointers_to_descendents): New.
4701 (region_model::dump_summary_of_rep_path_vars): Delete.
4702 (region_model::on_top_level_param): New.
4703 (region_model::record_dynamic_extents): New.
4704 (region_model::m_mgr;): New.
4705 (region_model::m_store;): New.
4706 (region_model::m_svalues;): Delete.
4707 (region_model::m_regions;): Delete.
4708 (region_model::m_root_rid;): Delete.
4709 (region_model::m_current_frame;): New.
4710 (region_model_context::remap_svalue_ids): Delete.
4711 (region_model_context::can_purge_p): Delete.
4712 (region_model_context::on_svalue_leak): New.
4713 (region_model_context::on_svalue_purge): Delete.
4714 (region_model_context::on_liveness_change): New.
4715 (region_model_context::on_inherited_svalue): Delete.
4716 (region_model_context::on_cast): Delete.
4717 (region_model_context::on_unknown_change): Convert from svalue_id to
4718 const svalue * and add is_mutable.
4719 (class noop_region_model_context): Update for region_model_context
4721 (model_merger::model_merger): Add program_point. Drop
4722 svalue_id_merger_mapping.
4723 (model_merger::dump_to_pp): Add "simple" param.
4724 (model_merger::dump): Likewise.
4725 (model_merger::get_region_a): Delete.
4726 (model_merger::get_region_b): Delete.
4727 (model_merger::can_merge_values_p): Delete.
4728 (model_merger::record_regions): Delete.
4729 (model_merger::record_svalues): Delete.
4730 (model_merger::m_point): New field.
4731 (model_merger::m_map_regions_from_a_to_m): Delete.
4732 (model_merger::m_map_regions_from_b_to_m): Delete.
4733 (model_merger::m_sid_mapping): Delete.
4734 (struct svalue_id_merger_mapping): Delete.
4735 (class engine): New.
4736 (struct canonicalization): Delete.
4737 (inchash::add): Delete decls for hashing svalue_id and region_id.
4738 (test_region_model_context::on_unexpected_tree_code): Require t to
4740 (selftest::assert_condition): Add overload comparing a pair of
4742 * sm-file.cc: Include "tristate.h", "selftest.h",
4743 "analyzer/call-string.h", "analyzer/program-point.h",
4744 "analyzer/store.h", and "analyzer/region-model.h".
4745 (fileptr_state_machine::get_default_state): New.
4746 (fileptr_state_machine::on_stmt): Remove calls to
4747 get_readable_tree in favor of get_diagnostic_tree.
4748 * sm-malloc.cc: Include "tristate.h", "selftest.h",
4749 "analyzer/call-string.h", "analyzer/program-point.h",
4750 "analyzer/store.h", and "analyzer/region-model.h".
4751 (malloc_state_machine::get_default_state): New.
4752 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New.
4753 (malloc_diagnostic::describe_state_change): Handle change.m_expr
4755 (null_arg::emit): Avoid printing "NULL '0'".
4756 (null_arg::describe_final_event): Avoid printing "(0) NULL".
4757 (malloc_leak::emit): Handle m_arg being NULL.
4758 (malloc_leak::describe_final_event): Handle ev.m_expr being NULL.
4759 (malloc_state_machine::on_stmt): Don't call get_readable_tree.
4760 Call get_diagnostic_tree when creating pending diagnostics.
4761 Update for is_zero_assignment becoming a member function of
4763 Don't transition to m_non_heap for ADDR_EXPR(MEM_REF()).
4764 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New
4765 vfunc implementation.
4766 * sm-sensitive.cc (sensitive_state_machine::warn_for_any_exposure): Call
4767 get_diagnostic_tree and pass the result to warn_for_state.
4768 * sm-signal.cc: Move includes of "analyzer/call-string.h" and
4769 "analyzer/program-point.h" to before "analyzer/region-model.h",
4770 and also include "analyzer/store.h" before it.
4771 (signal_unsafe_call::describe_state_change): Use
4772 get_dest_function to get handler.
4773 (update_model_for_signal_handler): Pass manager to region_model
4775 (register_signal_handler::impl_transition): Update for changes to
4776 get_or_create_node and add_edge.
4777 * sm-taint.cc (taint_state_machine::on_stmt): Remove calls to
4778 get_readable_tree, replacing them when calling warn_for_state with
4779 calls to get_diagnostic_tree.
4780 * sm.cc (is_zero_assignment): Delete.
4781 (any_pointer_p): Move to within namespace ana.
4782 * sm.h (is_zero_assignment): Remove decl.
4783 (any_pointer_p): Move decl to within namespace ana.
4784 (state_machine::get_default_state): New vfunc.
4785 (state_machine::reset_when_passed_to_unknown_fn_p): New vfunc.
4786 (sm_context::get_readable_tree): Rename to...
4787 (sm_context::get_diagnostic_tree): ...this.
4788 (sm_context::is_zero_assignment): New vfunc.
4789 * store.cc: New file.
4790 * store.h: New file.
4791 * svalue.cc: New file.
4793 2020-05-22 Mark Wielaard <mark@klomp.org>
4795 * sm-signal.cc(signal_unsafe_call::emit): Possibly add
4796 gcc_rich_location note for replacement.
4797 (signal_unsafe_call::get_replacement_fn): New private function.
4798 (get_async_signal_unsafe_fns): Add "exit".
4800 2020-04-28 David Malcolm <dmalcolm@redhat.com>
4803 * engine.cc (impl_region_model_context::on_unexpected_tree_code):
4805 * region-model.cc (region_model::add_region_for_type): Handle
4808 (test_region_model_context::on_unexpected_tree_code): Handle NULL
4811 2020-04-28 David Malcolm <dmalcolm@redhat.com>
4817 * analyzer.opt (Wanalyzer-use-of-uninitialized-value): Delete.
4818 * program-state.cc (selftest::test_program_state_dumping): Update
4819 expected dump result for removal of "uninit".
4820 * region-model.cc (poison_kind_to_str): Delete POISON_KIND_UNINIT
4822 (root_region::ensure_stack_region): Initialize stack with null
4823 svalue_id rather than with a typeless POISON_KIND_UNINIT value.
4824 (root_region::ensure_heap_region): Likewise for the heap.
4825 (region_model::dump_summary_of_rep_path_vars): Remove
4826 summarization of uninit values.
4827 (region_model::validate): Remove check that the stack has a
4828 POISON_KIND_UNINIT value.
4829 (poisoned_value_diagnostic::emit): Remove POISON_KIND_UNINIT
4831 (poisoned_value_diagnostic::describe_final_event): Likewise.
4832 (selftest::test_dump): Update expected dump result for removal of
4834 (selftest::test_svalue_equality): Remove "uninit" and "freed".
4835 * region-model.h (enum poison_kind): Remove POISON_KIND_UNINIT.
4837 2020-04-01 David Malcolm <dmalcolm@redhat.com>
4840 * checker-path.cc: Include "bitmap.h".
4841 * constraint-manager.cc: Likewise.
4842 * diagnostic-manager.cc: Likewise.
4843 * engine.cc: Likewise.
4844 (exploded_node::detect_leaks): Pass null region_id to pop_frame.
4845 * program-point.cc: Include "bitmap.h".
4846 * program-state.cc: Likewise.
4847 * region-model.cc (id_set<region_id>::id_set): Convert to...
4848 (region_id_set::region_id_set): ...this.
4849 (svalue_id_set::svalue_id_set): New ctor.
4850 (region_model::copy_region): New function.
4851 (region_model::copy_struct_region): New function.
4852 (region_model::copy_union_region): New function.
4853 (region_model::copy_array_region): New function.
4854 (stack_region::pop_frame): Drop return value. Add
4855 "result_dst_rid" param; if it is non-null, use copy_region to copy
4856 the result to it. Rather than capture and pass a single "known
4857 used" return value to be used by purge_unused_values, instead
4858 gather and pass a set of known used return values.
4859 (root_region::pop_frame): Drop return value. Add "result_dst_rid"
4861 (region_model::on_assignment): Use copy_region.
4862 (region_model::on_return): Likewise for the result.
4863 (region_model::on_longjmp): Pass null for pop_frame's
4865 (region_model::update_for_return_superedge): Pass the region for the
4866 return value of the call, if any, to pop_frame, rather than setting
4867 the lvalue for the lhs of the result.
4868 (region_model::pop_frame): Drop return value. Add
4869 "result_dst_rid" param.
4870 (region_model::purge_unused_svalues): Convert third param from an
4871 svalue_id * to an svalue_id_set *, updating the initial populating
4872 of the "used" bitmap accordingly. Don't remap it when done.
4873 (struct selftest::coord_test): New selftest fixture, extracted from...
4874 (selftest::test_dump_2): ...here.
4875 (selftest::test_compound_assignment): New selftest.
4876 (selftest::test_stack_frames): Pass null to new param of pop_frame.
4877 (selftest::analyzer_region_model_cc_tests): Call the new selftest.
4878 * region-model.h (class id_set): Delete template.
4879 (class region_id_set): Reimplement, using old id_set implementation.
4880 (class svalue_id_set): Likewise. Convert from auto_sbitmap to
4882 (region::get_active_view): New accessor.
4883 (stack_region::pop_frame): Drop return value. Add
4884 "result_dst_rid" param.
4885 (root_region::pop_frame): Likewise.
4886 (region_model::pop_frame): Likewise.
4887 (region_model::copy_region): New decl.
4888 (region_model::purge_unused_svalues): Convert third param from an
4889 svalue_id * to an svalue_id_set *.
4890 (region_model::copy_struct_region): New decl.
4891 (region_model::copy_union_region): New decl.
4892 (region_model::copy_array_region): New decl.
4894 2020-03-27 David Malcolm <dmalcolm@redhat.com>
4896 * program-state.cc (selftest::test_program_state_dumping): Update
4897 expected dump to include symbolic_region's possibly_null field.
4898 * region-model.cc (symbolic_region::print_fields): New vfunc
4900 (region_model::add_constraint): Clear m_possibly_null from
4901 symbolic_regions now known to be non-NULL.
4902 (selftest::test_malloc_constraints): New selftest.
4903 (selftest::analyzer_region_model_cc_tests): Call it.
4904 * region-model.h (region::dyn_cast_symbolic_region): Add non-const
4906 (symbolic_region::dyn_cast_symbolic_region): Implement it.
4907 (symbolic_region::print_fields): New vfunc override decl.
4909 2020-03-27 David Malcolm <dmalcolm@redhat.com>
4911 * analyzer.h (class feasibility_problem): New forward decl.
4912 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
4913 Initialize new fields m_status, m_epath_length, and m_problem.
4914 (saved_diagnostic::~saved_diagnostic): Delete m_problem.
4915 (dedupe_candidate::dedupe_candidate): Convert "sd" param from a
4916 const ref to a mutable ptr.
4917 (dedupe_winners::add): Convert "sd" param from a const ref to a
4918 mutable ptr. Record the length of the exploded_path. Record the
4919 feasibility/infeasibility of sd into sd, capturing a
4920 feasibility_problem when feasible_p fails, and storing it in sd.
4921 (diagnostic_manager::emit_saved_diagnostics): Update for pass by
4922 ptr rather than by const ref.
4923 * diagnostic-manager.h (class saved_diagnostic): Add new enum
4924 status. Add fields m_status, m_epath_length and m_problem.
4925 (saved_diagnostic::set_feasible): New member function.
4926 (saved_diagnostic::set_infeasible): New member function.
4927 (saved_diagnostic::get_feasibility_problem): New accessor.
4928 (saved_diagnostic::get_status): New accessor.
4929 (saved_diagnostic::set_epath_length): New member function.
4930 (saved_diagnostic::get_epath_length): New accessor.
4931 * engine.cc: Include "gimple-pretty-print.h".
4932 (exploded_path::feasible_p): Add OUT param and, if non-NULL, write
4933 a new feasibility_problem to it on failure.
4934 (viz_callgraph_node::dump_dot): Convert begin_tr calls to
4935 begin_trtd. Convert end_tr calls to end_tdtr.
4936 (class exploded_graph_annotator): New subclass of dot_annotator.
4937 (impl_run_checkers): Add a second -fdump-analyzer-supergraph dump
4938 after the analysis runs, using exploded_graph_annotator. dumping
4939 to DUMP_BASE_NAME.supergraph-eg.dot.
4940 * exploded-graph.h (exploded_node::get_dot_fillcolor): Make
4942 (exploded_path::feasible_p): Add OUT param.
4943 (class feasibility_problem): New class.
4944 * state-purge.cc (state_purge_annotator::add_node_annotations):
4945 Return a bool, add a "within_table" param.
4946 (print_vec_of_names): Convert begin_tr calls to begin_trtd.
4947 Convert end_tr calls to end_tdtr.
4948 (state_purge_annotator::add_stmt_annotations): Add "within_row"
4950 * state-purge.h ((state_purge_annotator::add_node_annotations):
4951 Return a bool, add a "within_table" param.
4952 (state_purge_annotator::add_stmt_annotations): Add "within_row"
4954 * supergraph.cc (supernode::dump_dot): Call add_node_annotations
4955 twice: as before, passing false for "within_table", then again
4956 with true when within the TABLE element. Convert some begin_tr
4957 calls to begin_trtd, and some end_tr calls to end_tdtr.
4958 Repeat each add_stmt_annotations call, distinguishing between
4959 calls that add TRs and those that add TDs to an existing TR.
4960 Add a call to add_after_node_annotations.
4961 * supergraph.h (dot_annotator::add_node_annotations): Add a
4962 "within_table" param.
4963 (dot_annotator::add_stmt_annotations): Add a "within_row" param.
4964 (dot_annotator::add_after_node_annotations): New vfunc.
4966 2020-03-27 David Malcolm <dmalcolm@redhat.com>
4968 * diagnostic-manager.cc (dedupe_winners::add): Show the
4969 exploded_node index in the log messages.
4970 (diagnostic_manager::emit_saved_diagnostics): Log a summary of
4971 m_saved_diagnostics at entry.
4973 2020-03-27 David Malcolm <dmalcolm@redhat.com>
4975 * supergraph.cc (superedge::dump): Add space before description;
4976 move newline to non-pretty_printer overload.
4978 2020-03-18 David Malcolm <dmalcolm@redhat.com>
4980 * region-model.cc: Include "stor-layout.h".
4981 (region_model::dump_to_pp): Rather than calling
4982 dump_summary_of_map on each of the current frame and the globals,
4983 instead get a vec of representative path_vars for all regions,
4984 and then dump a summary of all of them.
4985 (region_model::dump_summary_of_map): Delete, rewriting into...
4986 (region_model::dump_summary_of_rep_path_vars): ...this new
4987 function, working on a vec of path_vars.
4988 (region_model::set_value): New overload.
4989 (region_model::get_representative_path_var): Rename
4990 "parent_region" local to "parent_reg" and consolidate with other
4991 local. Guard test for grandparent being stack on parent_reg being
4992 non-NULL. Move handling for parent being an array_region to
4993 within guard for parent_reg being non-NULL.
4994 (selftest::make_test_compound_type): New function.
4995 (selftest::test_dump_2): New selftest.
4996 (selftest::test_dump_3): New selftest.
4997 (selftest::test_stack_frames): Update expected output from
4998 simplified dump to show "a" and "b" from parent frame and "y" in
5000 (selftest::analyzer_region_model_cc_tests): Call test_dump_2 and
5002 * region-model.h (region_model::set_value): New overload decl.
5003 (region_model::dump_summary_of_map): Delete.
5004 (region_model::dump_summary_of_rep_path_vars): New.
5006 2020-03-18 David Malcolm <dmalcolm@redhat.com>
5008 * region-model.h (class noop_region_model_context): New subclass
5009 of region_model_context.
5010 (class tentative_region_model_context): Inherit from
5011 noop_region_model_context rather than from region_model_context;
5012 drop redundant vfunc implementations.
5013 (class test_region_model_context): Likewise.
5015 2020-03-18 David Malcolm <dmalcolm@redhat.com>
5017 * engine.cc (exploded_node::exploded_node): Move implementation
5018 here from header; accept point_and_state by const reference rather
5020 * exploded-graph.h (exploded_node::exploded_node): Pass
5021 point_and_state by const reference rather than by value. Move
5024 2020-03-18 Jakub Jelinek <jakub@redhat.com>
5026 * sm-malloc.cc (malloc_state_machine::on_stmt): Fix up duplicated word
5028 * region-model.cc (region_model::make_region_for_unexpected_tree_code,
5029 region_model::delete_region_and_descendents): Likewise.
5030 * engine.cc (class exploded_cluster): Likewise.
5031 * diagnostic-manager.cc (class path_builder): Likewise.
5033 2020-03-13 David Malcolm <dmalcolm@redhat.com>
5037 * diagnostic-manager.cc (for_each_state_change): Bulletproof
5038 against errors in get_rvalue by passing a
5039 tentative_region_model_context and rejecting if there's an error.
5040 * region-model.cc (region_model::get_lvalue_1): When handling
5041 ARRAY_REF, handle results of error-handling. Handle NOP_EXPR.
5043 2020-03-06 David Malcolm <dmalcolm@redhat.com>
5045 * analyzer.h (class array_region): New forward decl.
5046 * program-state.cc (selftest::test_program_state_dumping_2): New.
5047 (selftest::analyzer_program_state_cc_tests): Call it.
5048 * region-model.cc (array_region::constant_from_key): New.
5049 (region_model::get_representative_tree): Handle region_svalue by
5050 generating an ADDR_EXPR.
5051 (region_model::get_representative_path_var): In view handling,
5052 remove erroneous TREE_TYPE when determining the type of the tree.
5053 Handle array regions and STRING_CST.
5054 (selftest::assert_dump_tree_eq): New.
5055 (ASSERT_DUMP_TREE_EQ): New macro.
5056 (selftest::test_get_representative_tree): New selftest.
5057 (selftest::analyzer_region_model_cc_tests): Call it.
5058 * region-model.h (region::dyn_cast_array_region): New vfunc.
5059 (array_region::dyn_cast_array_region): New vfunc implementation.
5060 (array_region::constant_from_key): New decl.
5062 2020-03-06 David Malcolm <dmalcolm@redhat.com>
5064 * analyzer.h (dump_quoted_tree): New decl.
5065 * engine.cc (exploded_node::dump_dot): Pass region model to
5066 sm_state_map::print.
5067 * program-state.cc: Include diagnostic-core.h.
5068 (sm_state_map::print): Add "model" param and use it to print
5069 representative trees. Only print origin information if non-null.
5070 (sm_state_map::dump): Pass NULL for model to print call.
5071 (program_state::print): Pass region model to sm_state_map::print.
5072 (program_state::dump_to_pp): Use spaces rather than newlines when
5073 summarizing. Pass region_model to sm_state_map::print.
5074 (ana::selftest::assert_dump_eq): New function.
5075 (ASSERT_DUMP_EQ): New macro.
5076 (ana::selftest::test_program_state_dumping): New function.
5077 (ana::selftest::analyzer_program_state_cc_tests): Call it.
5078 * program-state.h (program_state::print): Add model param.
5079 * region-model.cc (dump_quoted_tree): New function.
5080 (map_region::print_fields): Use dump_quoted_tree rather than
5081 %qE to avoid lang-dependent output.
5082 (map_region::dump_child_label): Likewise.
5083 (region_model::dump_summary_of_map): For SK_REGION, when
5084 get_representative_path_var fails, print the region id rather than
5085 erroneously printing NULL.
5086 * sm.cc (state_machine::get_state_by_name): New function.
5087 * sm.h (state_machine::get_state_by_name): New decl.
5089 2020-03-04 David Malcolm <dmalcolm@redhat.com>
5091 * region-model.cc (region::validate): Convert model param from ptr
5092 to reference. Update comment to reflect that it's now a vfunc.
5093 (map_region::validate): New vfunc implementation.
5094 (array_region::validate): New vfunc implementation.
5095 (stack_region::validate): New vfunc implementation.
5096 (root_region::validate): New vfunc implementation.
5097 (region_model::validate): Pass a reference rather than a pointer
5098 to the region::validate vfunc.
5099 * region-model.h (region::validate): Make virtual. Convert model
5100 param from ptr to reference.
5101 (map_region::validate): New vfunc decl.
5102 (array_region::validate): New vfunc decl.
5103 (stack_region::validate): New vfunc decl.
5104 (root_region::validate): New vfunc decl.
5106 2020-03-04 David Malcolm <dmalcolm@redhat.com>
5109 * region-model.cc (region_model::on_call_pre): Handle
5110 BUILT_IN_EXPECT and its variants.
5111 (region_model::add_any_constraints_from_ssa_def_stmt): Split out
5112 gassign handling into add_any_constraints_from_gassign; add gcall
5114 (region_model::add_any_constraints_from_gassign): New function,
5115 based on the above. Add handling for NOP_EXPR.
5116 (region_model::add_any_constraints_from_gcall): New function.
5117 (region_model::get_representative_path_var): Handle views.
5119 (region_model::add_any_constraints_from_ssa_def_stmt): New decl.
5120 (region_model::add_any_constraints_from_gassign): New decl.
5122 2020-03-04 David Malcolm <dmalcolm@redhat.com>
5125 * checker-path.h (state_change_event::get_lvalue): Add ctxt param
5126 and pass it to region_model::get_value call.
5127 * diagnostic-manager.cc (get_any_origin): Pass a
5128 tentative_region_model_context to the calls to get_lvalue and reject
5129 the comparison if errors occur.
5130 (can_be_expr_of_interest_p): New function.
5131 (diagnostic_manager::prune_for_sm_diagnostic): Replace checks for
5132 CONSTANT_CLASS_P with calls to update_for_unsuitable_sm_exprs.
5133 Pass a tentative_region_model_context to the calls to
5134 state_change_event::get_lvalue and reject the comparison if errors
5136 (diagnostic_manager::update_for_unsuitable_sm_exprs): New.
5137 * diagnostic-manager.h
5138 (diagnostic_manager::update_for_unsuitable_sm_exprs): New decl.
5139 * region-model.h (class tentative_region_model_context): New class.
5141 2020-03-04 David Malcolm <dmalcolm@redhat.com>
5143 * engine.cc (worklist::worklist): Remove unused field m_eg.
5144 (class viz_callgraph_edge): Remove unused field m_call_sedge.
5145 (class viz_callgraph): Remove unused field m_sg.
5146 * exploded-graph.h (worklist::::m_eg): Remove unused field.
5148 2020-03-02 David Malcolm <dmalcolm@redhat.com>
5150 * analyzer.opt (fanalyzer-show-duplicate-count): New option.
5151 * diagnostic-manager.cc
5152 (diagnostic_manager::emit_saved_diagnostic): Use the above to
5153 guard the printing of the duplicate count.
5155 2020-03-02 David Malcolm <dmalcolm@redhat.com>
5158 * analyzer.cc (is_std_function_p): New function.
5159 (is_std_named_call_p): New functions.
5160 * analyzer.h (is_std_named_call_p): New decl.
5161 * sm-malloc.cc (malloc_state_machine::on_stmt): Check for "std::"
5162 variants when checking for malloc, calloc and free.
5164 2020-02-26 David Malcolm <dmalcolm@redhat.com>
5167 * diagnostic-manager.cc
5168 (diagnostic_manager::prune_for_sm_diagnostic): Assert that var is
5169 either NULL or not a constant. When updating var, bulletproof
5170 against constant values.
5172 2020-02-26 David Malcolm <dmalcolm@redhat.com>
5175 * region-model.cc (region_model::get_fndecl_for_call): Gracefully
5176 fail for fn_decls that don't have a cgraph_node.
5178 2020-02-26 David Malcolm <dmalcolm@redhat.com>
5180 * bar-chart.cc: New file.
5181 * bar-chart.h: New file.
5182 * engine.cc: Include "analyzer/bar-chart.h".
5183 (stats::log): Only log the m_num_nodes kinds that are non-zero.
5184 (stats::dump): Likewise when dumping.
5185 (stats::get_total_enodes): New.
5186 (exploded_graph::get_or_create_node): Increment the per-point-data
5187 m_excess_enodes when hitting the per-program-point limit on
5189 (exploded_graph::print_bar_charts): New.
5190 (exploded_graph::log_stats): Log the number of unprocessed enodes
5191 in the worklist. Call print_bar_charts.
5192 (exploded_graph::dump_stats): Print the number of unprocessed
5193 enodes in the worklist.
5194 * exploded-graph.h (stats::get_total_enodes): New decl.
5195 (struct per_program_point_data): Add field m_excess_enodes.
5196 (exploded_graph::print_bar_charts): New decl.
5197 * supergraph.cc (superedge::dump): New.
5198 (superedge::dump): New.
5199 * supergraph.h (supernode::get_function): New.
5200 (superedge::dump): New decl.
5201 (superedge::dump): New decl.
5203 2020-02-24 David Malcolm <dmalcolm@redhat.com>
5205 * engine.cc (exploded_graph::get_or_create_node): Dump the
5206 program_state to the pp, rather than to stderr.
5208 2020-02-24 David Malcolm <dmalcolm@redhat.com>
5211 * sm.cc (make_checkers): Require the "taint" checker to be
5214 2020-02-24 David Malcolm <dmalcolm@redhat.com>
5218 (impl_region_model_context::impl_region_model_context): Add logger
5220 * engine.cc (exploded_graph::add_function_entry): Create an
5221 impl_region_model_context and pass it to the push_frame call.
5222 Bail if the resulting state is invalid.
5223 (exploded_graph::build_initial_worklist): Likewise.
5224 (exploded_graph::build_initial_worklist): Handle the case where
5225 add_function_entry fails.
5227 (impl_region_model_context::impl_region_model_context): Add logger
5229 * region-model.cc (map_region::get_or_create): Add ctxt param and
5230 pass it to add_region_for_type.
5231 (map_region::can_merge_p): Pass NULL as a ctxt to call to
5233 (array_region::get_element): Pass ctxt to call to get_or_create.
5234 (array_region::get_or_create): Add ctxt param and pass it to
5235 add_region_for_type.
5236 (root_region::push_frame): Pass ctxt to get_or_create calls.
5237 (region_model::get_lvalue_1): Likewise.
5238 (region_model::make_region_for_unexpected_tree_code): Assert that
5240 (region_model::get_rvalue_1): Pass ctxt to get_svalue_for_fndecl
5241 and get_svalue_for_label calls.
5242 (region_model::get_svalue_for_fndecl): Add ctxt param and pass it
5243 to get_region_for_fndecl.
5244 (region_model::get_region_for_fndecl): Add ctxt param and pass it
5246 (region_model::get_svalue_for_label): Add ctxt param and pass it
5247 to get_region_for_label.
5248 (region_model::get_region_for_label): Add ctxt param and pass it
5249 to get_region_for_fndecl and get_or_create.
5250 (region_model::get_field_region): Add ctxt param and pass it to
5251 get_or_create_view and get_or_create.
5252 (make_region_for_type): Replace gcc_unreachable with return NULL.
5253 (region_model::add_region_for_type): Add ctxt param. Handle a
5254 return of NULL from make_region_for_type by calling
5255 make_region_for_unexpected_tree_code.
5256 (region_model::get_or_create_mem_ref): Pass ctxt to calls to
5258 (region_model::get_or_create_view): Add ctxt param and pass it to
5259 add_region_for_type.
5260 (selftest::test_state_merging): Pass ctxt to get_or_create_view.
5261 * region-model.h (region_model::get_or_create): Add ctxt param.
5262 (region_model::add_region_for_type): Likewise.
5263 (region_model::get_svalue_for_fndecl): Likewise.
5264 (region_model::get_svalue_for_label): Likewise.
5265 (region_model::get_region_for_fndecl): Likewise.
5266 (region_model::get_region_for_label): Likewise.
5267 (region_model::get_field_region): Likewise.
5268 (region_model::get_or_create_view): Likewise.
5270 2020-02-24 David Malcolm <dmalcolm@redhat.com>
5272 * checker-path.cc (superedge_event::should_filter_p): Update
5273 filter for empty descriptions to cover verbosity level 3 as well
5275 * diagnostic-manager.cc: Include "analyzer/reachability.h".
5276 (class path_builder): New class.
5277 (diagnostic_manager::emit_saved_diagnostic): Create a path_builder
5278 and pass it to build_emission_path, rather passing eg; similarly
5279 for add_events_for_eedge and ext_state.
5280 (diagnostic_manager::build_emission_path): Replace "eg" param
5281 with a path_builder, pass it to add_events_for_eedge.
5282 (diagnostic_manager::add_events_for_eedge): Replace ext_state
5283 param with path_builder; pass it to add_events_for_superedge.
5284 (diagnostic_manager::significant_edge_p): New.
5285 (diagnostic_manager::add_events_for_superedge): Add path_builder
5286 param. Reject insignificant edges at verbosity levels below 3.
5287 (diagnostic_manager::prune_for_sm_diagnostic): Update highest
5288 verbosity level to 4.
5289 * diagnostic-manager.h (class path_builder): New forward decl.
5290 (diagnostic_manager::build_emission_path): Replace "eg" param
5291 with a path_builder.
5292 (diagnostic_manager::add_events_for_eedge): Replace ext_state
5293 param with path_builder.
5294 (diagnostic_manager::significant_edge_p): New.
5295 (diagnostic_manager::add_events_for_superedge): Add path_builder
5297 * reachability.h: New file.
5299 2020-02-18 David Malcolm <dmalcolm@redhat.com>
5302 * analyzer.opt (fdump-analyzer-callgraph): Rewrite description.
5304 2020-02-18 David Malcolm <dmalcolm@redhat.com>
5307 * region-model.cc (region_model::maybe_cast_1): Replace assertion
5308 that build_cast returns non-NULL with a conditional, falling
5309 through to the logic which returns a new unknown value of the
5310 desired type if it fails.
5312 2020-02-18 David Malcolm <dmalcolm@redhat.com>
5315 * engine.cc (impl_region_model_context::on_unknown_tree_code):
5317 (impl_region_model_context::on_unexpected_tree_code): ...this and
5318 convert first argument from path_var to tree.
5319 (exploded_node::on_stmt): Pass ctxt to purge_for_unknown_fncall.
5320 * exploded-graph.h (region_model_context::on_unknown_tree_code):
5322 (region_model_context::on_unexpected_tree_code): ...this and
5323 convert first argument from path_var to tree.
5324 * program-state.cc (sm_state_map::purge_for_unknown_fncall): Add
5325 ctxt param and pass on to calls to get_rvalue.
5326 * program-state.h (sm_state_map::purge_for_unknown_fncall): Add
5328 * region-model.cc (region_model::handle_unrecognized_call): Pass
5329 ctxt on to call to get_rvalue.
5330 (region_model::get_lvalue_1): Move body of default case to
5331 region_model::make_region_for_unexpected_tree_code and call it.
5332 Within COMPONENT_REF case, reject attempts to handle types other
5333 than RECORD_TYPE and UNION_TYPE.
5334 (region_model::make_region_for_unexpected_tree_code): New
5335 function, based on default case of region_model::get_lvalue_1.
5337 (region_model::make_region_for_unexpected_tree_code): New decl.
5338 (region_model::on_unknown_tree_code): Rename to...
5339 (region_model::on_unexpected_tree_code): ...this and convert first
5340 argument from path_var to tree.
5341 (class test_region_model_context): Update vfunc implementation for
5344 2020-02-18 David Malcolm <dmalcolm@redhat.com>
5348 (region_model::convert_byte_offset_to_array_index): Use
5349 int_size_in_bytes before calling size_in_bytes, to gracefully fail
5350 on incomplete types.
5352 2020-02-17 David Malcolm <dmalcolm@redhat.com>
5355 * region-model.cc (region_model::get_fndecl_for_call): Handle the
5356 case where the code_region's get_tree_for_child_region returns
5359 2020-02-17 David Malcolm <dmalcolm@redhat.com>
5362 * engine.cc (impl_region_model_context::on_unknown_tree_code):
5364 (exploded_graph::get_or_create_node): Reject invalid states.
5366 (impl_region_model_context::on_unknown_tree_code): New decl.
5367 (point_and_state::point_and_state): Assert that the state is
5369 * program-state.cc (program_state::program_state): Initialize
5371 (program_state::operator=): Copy m_valid.
5372 (program_state::program_state): Likewise for move constructor.
5373 (program_state::print): Print m_valid.
5374 (program_state::dump_to_pp): Likewise.
5375 * program-state.h (program_state::m_valid): New field.
5376 * region-model.cc (region_model::get_lvalue_1): Implement the
5377 default case by returning a new symbolic region and calling
5378 the context's on_unknown_tree_code, rather than issuing an
5379 internal_error. Implement VIEW_CONVERT_EXPR.
5380 * region-model.h (region_model_context::on_unknown_tree_code): New
5382 (test_region_model_context::on_unknown_tree_code): New.
5384 2020-02-17 David Malcolm <dmalcolm@redhat.com>
5386 * sm-malloc.cc (malloc_diagnostic::describe_state_change): For
5387 transition to the "null" state, only say "assuming" when
5388 transitioning from the "unchecked" state.
5390 2020-02-17 David Malcolm <dmalcolm@redhat.com>
5392 * diagnostic-manager.h (diagnostic_manager::get_saved_diagnostic):
5394 * engine.cc (exploded_node::dump_dot): Dump saved_diagnostics.
5395 * exploded-graph.h (exploded_graph::get_diagnostic_manager): Add
5398 2020-02-11 David Malcolm <dmalcolm@redhat.com>
5401 * analysis-plan.cc (analysis_plan::use_summary_p): Look through
5402 the ultimate_alias_target when getting the called function.
5403 * engine.cc (exploded_node::on_stmt): Rename second "ctxt" to
5404 "sm_ctxt". Use the region_model's get_fndecl_for_call rather than
5406 * region-model.cc (region_model::get_fndecl_for_call): Use
5407 ultimate_alias_target on fndecl.
5408 * supergraph.cc (get_ultimate_function_for_cgraph_edge): New
5410 (supergraph_call_edge): Use it when rejecting edges without
5412 (supergraph::supergraph): Use it to get the function for the
5413 cgraph_edge when building interprocedural superedges.
5414 (callgraph_superedge::get_callee_function): Use it.
5415 * supergraph.h (supergraph::get_num_snodes): Make param const.
5416 (supergraph::function_to_num_snodes_t): Make first type param
5419 2020-02-11 David Malcolm <dmalcolm@redhat.com>
5422 * engine.cc (exploded_edge::exploded_edge): Add ext_state param
5423 and pass it to change.validate.
5424 (exploded_graph::get_or_create_node): Move purging of change
5425 svalues to also cover the case of reusing an existing enode.
5426 (exploded_graph::add_edge): Pass m_ext_state to exploded_edge's
5428 * exploded-graph.h (exploded_edge::exploded_edge): Add ext_state
5430 * program-state.cc (state_change::sm_change::validate): Likewise.
5431 Assert that m_sm_idx is sane. Use ext_state to validate
5432 m_old_state and m_new_state.
5433 (state_change::validate): Add ext_state param and pass it to
5434 the sm_change validate calls.
5435 * program-state.h (state_change::sm_change::validate): Add
5437 (state_change::validate): Likewise.
5439 2020-02-11 David Malcolm <dmalcolm@redhat.com>
5442 * engine.cc (exploded_graph::dump_exploded_nodes): Handle missing
5443 case of STATUS_WORKLIST in implementation of
5444 "__analyzer_dump_exploded_nodes".
5446 2020-02-11 David Malcolm <dmalcolm@redhat.com>
5449 * constraint-manager.cc (constraint_manager::add_constraint): When
5450 merging equivalence classes and updating m_constant, also update
5452 (constraint_manager::validate): If m_constant is non-NULL assert
5453 that m_cst_sid is non-null and is valid.
5455 2020-02-11 David Malcolm <dmalcolm@redhat.com>
5458 * analyzer.opt (fdump-analyzer): Reword description.
5459 (fdump-analyzer-stderr): Likewise.
5461 2020-02-11 David Malcolm <dmalcolm@redhat.com>
5463 * region-model.cc (print_quoted_type): New function.
5464 (svalue::print): Use it to replace %qT.
5465 (region::dump_to_pp): Likewise.
5466 (region::dump_child_label): Likewise.
5467 (region::print_fields): Likewise.
5469 2020-02-10 David Malcolm <dmalcolm@redhat.com>
5472 * analyzer.opt (-param=analyzer-max-recursion-depth=): Fix "tha"
5474 (Wanalyzer-use-of-uninitialized-value): Fix "initialized" ->
5475 "uninitialized" typo.
5477 2020-02-10 David Malcolm <dmalcolm@redhat.com>
5480 * region-model.cc (region_model::get_lvalue_1):
5481 Handle BIT_FIELD_REF.
5482 (make_region_for_type): Handle VECTOR_TYPE.
5484 2020-02-10 David Malcolm <dmalcolm@redhat.com>
5487 * diagnostic-manager.cc
5488 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof against
5490 * region-model.cc (region_model::get_lvalue_1): Provide a better
5491 error message when encountering an unhandled tree code.
5493 2020-02-10 David Malcolm <dmalcolm@redhat.com>
5496 * region-model.cc (region_model::get_lvalue_1): Implement
5499 2020-02-06 David Malcolm <dmalcolm@redhat.com>
5501 * region-model.cc (region_model::maybe_cast_1): Attempt to provide
5502 a region_svalue if either type is a pointer, rather than if both
5505 2020-02-05 David Malcolm <dmalcolm@redhat.com>
5507 * engine.cc (exploded_node::dump_dot): Show merger enodes.
5508 (worklist::add_node): Assert that the node's m_status is
5510 (exploded_graph::process_worklist): Likewise for nodes from the
5511 worklist. Set status of merged nodes to STATUS_MERGER.
5512 (exploded_graph::process_node): Set status of node to
5514 (exploded_graph::dump_exploded_nodes): Rework handling of
5515 "__analyzer_dump_exploded_nodes", splitting enodes by status into
5516 "processed" and "merger", showing the count of just the processed
5517 enodes at the call, rather than the count of all enodes.
5518 * exploded-graph.h (exploded_node::status): New enum.
5519 (exploded_node::exploded_node): Initialize m_status to
5521 (exploded_node::get_status): New getter.
5522 (exploded_node::set_status): New setter.
5524 2020-02-04 David Malcolm <dmalcolm@redhat.com>
5527 * engine.cc (pod_hash_traits<function_call_string>::mark_empty):
5528 Eliminate reinterpret_cast.
5529 (pod_hash_traits<function_call_string>::is_empty): Likewise.
5531 2020-02-03 David Malcolm <dmalcolm@redhat.com>
5533 * constraint-manager.cc (range::constrained_to_single_element):
5534 Replace fold_build2 with fold_binary. Remove unnecessary newline.
5535 (constraint_manager::get_or_add_equiv_class): Replace fold_build2
5536 with fold_binary in two places, and remove out-of-date comment.
5537 (constraint_manager::eval_condition): Replace fold_build2 with
5539 * region-model.cc (constant_svalue::eval_condition): Likewise.
5540 (region_model::on_assignment): Likewise.
5542 2020-02-03 David Malcolm <dmalcolm@redhat.com>
5545 * diagnostic-manager.cc
5546 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof
5547 against bad choices due to bad paths.
5548 * engine.cc (impl_region_model_context::on_phi): New.
5549 * exploded-graph.h (impl_region_model_context::on_phi): New decl.
5550 * region-model.cc (region_model::on_longjmp): Likewise.
5551 (region_model::handle_phi): Add phi param. Call the ctxt's on_phi
5553 (region_model::update_for_phis): Pass phi to handle_phi.
5554 * region-model.h (region_model::handle_phi): Add phi param.
5555 (region_model_context::on_phi): New vfunc.
5556 (test_region_model_context::on_phi): New.
5557 * sm-malloc.cc (malloc_state_machine::on_phi): New.
5558 (malloc_state_machine::on_zero_assignment): New.
5559 * sm.h (state_machine::on_phi): New vfunc.
5561 2020-02-03 David Malcolm <dmalcolm@redhat.com>
5563 * engine.cc (supernode_cluster::dump_dot): Show BB index as
5565 * supergraph.cc (supernode::dump_dot): Likewise.
5567 2020-02-03 David Malcolm <dmalcolm@redhat.com>
5570 * region-model.cc (region_model::on_call_pre): Update for new
5571 param of symbolic_region ctor.
5572 (region_model::deref_rvalue): Likewise.
5573 (region_model::add_new_malloc_region): Likewise.
5574 (make_region_for_type): Likewise, preserving type.
5575 * region-model.h (symbolic_region::symbolic_region): Add "type"
5576 param and pass it to base class ctor.
5578 2020-02-03 David Malcolm <dmalcolm@redhat.com>
5581 * constraint-manager.cc
5582 (constraint_manager::get_or_add_equiv_class): Ensure types are
5583 compatible before comparing constants.
5585 2020-01-31 David Malcolm <dmalcolm@redhat.com>
5588 * region-model.cc (make_region_for_type): Use VOID_TYPE_P rather
5589 than checking against void_type_node.
5591 2020-01-31 David Malcolm <dmalcolm@redhat.com>
5594 * region-model.cc (ASSERT_COMPAT_TYPES): Convert to...
5595 (assert_compat_types): ...this, and bail when either type is NULL,
5596 or when VOID_TYPE_P (dst_type).
5597 (region_model::get_lvalue): Update for above conversion.
5598 (region_model::get_rvalue): Likewise.
5600 2020-01-31 David Malcolm <dmalcolm@redhat.com>
5603 * region-model.cc (region_model::update_for_return_superedge):
5604 Move check for null result so that it also guards setting the
5607 2020-01-31 David Malcolm <dmalcolm@redhat.com>
5610 * region-model.cc (stack_region::can_merge_p): Split into a two
5611 pass approach, creating all stack regions first, then populating
5613 (selftest::test_state_merging): Add test coverage for (a) the case
5614 of self-merging a model in which a local in an older stack frame
5615 points to a local in a more recent stack frame (which previously
5616 would ICE), and (b) the case of self-merging a model in which a
5617 local points to a global (which previously worked OK).
5619 2020-01-31 David Malcolm <dmalcolm@redhat.com>
5621 * analyzer.cc (is_named_call_p): Replace tests for fndecl being
5622 extern at file scope and having a non-NULL DECL_NAME with a call
5623 to maybe_special_function_p.
5624 * function-set.cc (function_set::contains_decl_p): Add call to
5625 maybe_special_function_p.
5627 2020-01-31 David Malcolm <dmalcolm@redhat.com>
5630 * constraint-manager.cc
5631 (constraint_manager::get_or_add_equiv_class): Only compare constants
5632 if their types are compatible.
5633 * region-model.cc (constant_svalue::eval_condition): Replace check
5634 for identical types with call to types_compatible_p.
5636 2020-01-30 David Malcolm <dmalcolm@redhat.com>
5638 * program-state.cc (extrinsic_state::dump_to_pp): New.
5639 (extrinsic_state::dump_to_file): New.
5640 (extrinsic_state::dump): New.
5641 * program-state.h (extrinsic_state::dump_to_pp): New decl.
5642 (extrinsic_state::dump_to_file): New decl.
5643 (extrinsic_state::dump): New decl.
5644 * sm.cc: Include "pretty-print.h".
5645 (state_machine::dump_to_pp): New.
5646 * sm.h (state_machine::dump_to_pp): New decl.
5648 2020-01-30 David Malcolm <dmalcolm@redhat.com>
5650 * diagnostic-manager.cc (for_each_state_change): Use
5651 extrinsic_state::get_num_checkers rather than accessing m_checkers
5653 * program-state.cc (program_state::program_state): Likewise.
5654 * program-state.h (extrinsic_state::m_checkers): Make private.
5656 2020-01-30 David Malcolm <dmalcolm@redhat.com>
5659 * region-model.cc (region_model::eval_condition): In both
5660 overloads, bail out immediately on floating-point types.
5661 (region_model::eval_condition_without_cm): Likewise.
5662 (region_model::add_constraint): Likewise.
5664 2020-01-30 David Malcolm <dmalcolm@redhat.com>
5667 * program-state.cc (sm_state_map::set_state): For the overload
5668 taking an svalue_id, bail out if the set_state on the ec does
5669 nothing. Convert the latter's return type from void to bool,
5670 returning true if anything changed.
5671 (sm_state_map::impl_set_state): Convert the return type from void
5672 to bool, returning true if the state changed.
5673 * program-state.h (sm_state_map::set_state): Convert return type
5675 (sm_state_map::impl_set_state): Likewise.
5676 * region-model.cc (constant_svalue::eval_condition): Only call
5677 fold_build2 if the types are the same.
5679 2020-01-29 Jakub Jelinek <jakub@redhat.com>
5681 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Remove.
5682 * constraint-manager.cc: Include diagnostic-core.h before graphviz.h.
5683 (range::dump, equiv_class::print): Don't use PUSH_IGNORE_WFORMAT or
5685 * state-purge.cc: Include diagnostic-core.h before
5686 gimple-pretty-print.h.
5687 (state_purge_annotator::add_node_annotations, print_vec_of_names):
5688 Don't use PUSH_IGNORE_WFORMAT or POP_IGNORE_WFORMAT.
5689 * region-model.cc: Move diagnostic-core.h include before graphviz.h.
5690 (path_var::dump, svalue::print, constant_svalue::print_details,
5691 region::dump_to_pp, region::dump_child_label, region::print_fields,
5692 map_region::print_fields, map_region::dump_dot_to_pp,
5693 map_region::dump_child_label, array_region::print_fields,
5694 array_region::dump_dot_to_pp): Don't use PUSH_IGNORE_WFORMAT or
5697 2020-01-28 David Malcolm <dmalcolm@redhat.com>
5700 * engine.cc (rewind_info_t::update_model): Get the longjmp call
5701 stmt via get_longjmp_call () rather than assuming it is the last
5702 stmt in the longjmp's supernode.
5703 (rewind_info_t::add_events_to_path): Get the location_t for the
5704 rewind_from_longjmp_event via get_longjmp_call () rather than from
5705 the supernode's get_end_location ().
5707 2020-01-28 David Malcolm <dmalcolm@redhat.com>
5709 * region-model.cc (poisoned_value_diagnostic::emit): Update for
5710 renaming of warning_at overload to warning_meta.
5711 * sm-file.cc (file_leak::emit): Likewise.
5712 * sm-malloc.cc (double_free::emit): Likewise.
5713 (possible_null_deref::emit): Likewise.
5714 (possible_null_arg::emit): Likewise.
5715 (null_deref::emit): Likewise.
5716 (null_arg::emit): Likewise.
5717 (use_after_free::emit): Likewise.
5718 (malloc_leak::emit): Likewise.
5719 (free_of_non_heap::emit): Likewise.
5720 * sm-sensitive.cc (exposure_through_output_file::emit): Likewise.
5721 * sm-signal.cc (signal_unsafe_call::emit): Likewise.
5722 * sm-taint.cc (tainted_array_index::emit): Likewise.
5724 2020-01-27 David Malcolm <dmalcolm@redhat.com>
5727 * region-model.cc (tree_cmp): For the REAL_CST case, impose an
5728 arbitrary order on NaNs relative to other NaNs and to non-NaNs;
5729 const-correctness tweak.
5730 (ana::selftests::build_real_cst_from_string): New function.
5731 (ana::selftests::append_interesting_constants): New function.
5732 (ana::selftests::test_tree_cmp_on_constants): New test.
5733 (ana::selftests::test_canonicalization_4): New test.
5734 (ana::selftests::analyzer_region_model_cc_tests): Call the new
5737 2020-01-27 David Malcolm <dmalcolm@redhat.com>
5740 * engine.cc (run_checkers): Save and restore input_location.
5742 2020-01-27 David Malcolm <dmalcolm@redhat.com>
5744 * call-string.cc (call_string::cmp_1): Delete, moving body to...
5745 (call_string::cmp): ...here.
5746 * call-string.h (call_string::cmp_1): Delete decl.
5747 * engine.cc (worklist::key_t::cmp_1): Delete, moving body to...
5748 (worklist::key_t::cmp): ...here. Implement hash comparisons
5749 via comparison rather than subtraction to avoid overflow issues.
5750 * exploded-graph.h (worklist::key_t::cmp_1): Delete decl.
5751 * region-model.cc (tree_cmp): Eliminate buggy checking for
5754 2020-01-27 David Malcolm <dmalcolm@redhat.com>
5756 * analyzer.cc (is_named_call_p): Check that fndecl is "extern"
5757 and at file scope. Potentially disregard prefix _ or __ in
5758 fndecl's name. Bail if the identifier is NULL.
5759 (is_setjmp_call_p): Expect a gcall rather than plain gimple.
5760 Remove special-case check for leading prefix, and also check for
5762 (is_longjmp_call_p): Also check for siglongjmp.
5763 (get_user_facing_name): New function.
5764 * analyzer.h (is_setjmp_call_p): Expect a gcall rather than plain
5766 (get_user_facing_name): New decl.
5767 * checker-path.cc (setjmp_event::get_desc): Use
5768 get_user_facing_name to avoid hardcoding the function name.
5769 (rewind_event::rewind_event): Add rewind_info param, using it to
5770 initialize new m_rewind_info field, and strengthen the assertion.
5771 (rewind_from_longjmp_event::get_desc): Use get_user_facing_name to
5772 avoid hardcoding the function name.
5773 (rewind_to_setjmp_event::get_desc): Likewise.
5774 * checker-path.h (setjmp_event::setjmp_event): Add setjmp_call
5775 param and use it to initialize...
5776 (setjmp_event::m_setjmp_call): New field.
5777 (rewind_event::rewind_event): Add rewind_info param.
5778 (rewind_event::m_rewind_info): New protected field.
5779 (rewind_from_longjmp_event::rewind_from_longjmp_event): Add
5781 (class rewind_to_setjmp_event): Move rewind_info field to parent
5783 * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
5784 Update setjmp-handling for is_setjmp_call_p requiring a gcall;
5785 pass the call to the new setjmp_event.
5786 * engine.cc (exploded_node::on_stmt): Update for is_setjmp_call_p
5788 (stale_jmp_buf::emit): Use get_user_facing_name to avoid
5789 hardcoding the function names.
5790 (exploded_node::on_longjmp): Pass the longjmp_call when
5791 constructing rewind_info.
5792 (rewind_info_t::add_events_to_path): Pass the rewind_info_t to the
5793 rewind_from_longjmp_event's ctor.
5794 * exploded-graph.h (rewind_info_t::rewind_info_t): Add
5796 (rewind_info_t::get_longjmp_call): New.
5797 (rewind_info_t::m_longjmp_call): New.
5798 * region-model.cc (region_model::on_setjmp): Update comment to
5799 indicate this is also for sigsetjmp.
5800 * region-model.h (struct setjmp_record): Likewise.
5801 (class setjmp_svalue): Likewise.
5803 2020-01-27 David Malcolm <dmalcolm@redhat.com>
5806 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Guard these
5807 macros with GCC_VERSION >= 4006, making them no-op otherwise.
5808 * engine.cc (exploded_edge::exploded_edge): Specify template for
5809 base class initializer.
5810 (exploded_graph::add_edge): Specify template when chaining up to
5811 base class add_edge implementation.
5812 (viz_callgraph_node::dump_dot): Drop redundant "typename".
5813 (viz_callgraph_edge::viz_callgraph_edge): Specify template for
5814 base class initializer.
5815 * program-state.cc (sm_state_map::clone_with_remapping): Drop
5816 redundant "typename".
5817 (sm_state_map::print): Likewise.
5818 (sm_state_map::hash): Likewise.
5819 (sm_state_map::operator==): Likewise.
5820 (sm_state_map::remap_svalue_ids): Likewise.
5821 (sm_state_map::on_svalue_purge): Likewise.
5822 (sm_state_map::validate): Likewise.
5823 * program-state.h (sm_state_map::iterator_t): Likewise.
5824 * supergraph.h (superedge::superedge): Specify template for base
5827 2020-01-23 David Malcolm <dmalcolm@redhat.com>
5830 * supergraph.cc (callgraph_superedge::get_arg_for_parm): Fail
5831 gracefully is the number of parameters at the callee exceeds the
5832 number of arguments at the call stmt.
5833 (callgraph_superedge::get_parm_for_arg): Likewise.
5835 2020-01-22 David Malcolm <dmalcolm@redhat.com>
5838 * program-state.cc (sm_state_map::on_svalue_purge): If the
5839 entry survives, but the origin is being purged, then reset the
5842 2020-01-22 David Malcolm <dmalcolm@redhat.com>
5844 * sm-signal.cc: Fix nesting of CHECKING_P and namespace ana.
5846 2020-01-22 David Malcolm <dmalcolm@redhat.com>
5849 * engine.cc (setjmp_svalue::compare_fields): Update for
5850 replacement of m_enode with m_setjmp_record.
5851 (setjmp_svalue::add_to_hash): Likewise.
5852 (setjmp_svalue::get_index): Rename...
5853 (setjmp_svalue::get_enode_index): ...to this.
5854 (setjmp_svalue::print_details): Update for replacement of m_enode
5855 with m_setjmp_record.
5856 (exploded_node::on_longjmp): Likewise.
5857 * exploded-graph.h (rewind_info_t::m_enode_origin): Replace...
5858 (rewind_info_t::m_setjmp_record): ...with this.
5859 (rewind_info_t::rewind_info_t): Update for replacement of m_enode
5860 with m_setjmp_record.
5861 (rewind_info_t::get_setjmp_point): Likewise.
5862 (rewind_info_t::get_setjmp_call): Likewise.
5863 * region-model.cc (region_model::dump_summary_of_map): Likewise.
5864 (region_model::on_setjmp): Likewise.
5865 * region-model.h (struct setjmp_record): New struct.
5866 (setjmp_svalue::m_enode): Replace...
5867 (setjmp_svalue::m_setjmp_record): ...with this.
5868 (setjmp_svalue::setjmp_svalue): Update for replacement of m_enode
5869 with m_setjmp_record.
5870 (setjmp_svalue::clone): Likewise.
5871 (setjmp_svalue::get_index): Rename...
5872 (setjmp_svalue::get_enode_index): ...to this.
5873 (setjmp_svalue::get_exploded_node): Replace...
5874 (setjmp_svalue::get_setjmp_record): ...with this.
5876 2020-01-22 David Malcolm <dmalcolm@redhat.com>
5879 * analyzer.cc (is_setjmp_call_p): Check for "setjmp" as well as
5882 2020-01-22 David Malcolm <dmalcolm@redhat.com>
5885 * analysis-plan.h: Wrap everything namespace "ana".
5886 * analyzer-logging.cc: Likewise.
5887 * analyzer-logging.h: Likewise.
5888 * analyzer-pass.cc (pass_analyzer::execute): Update for "ana"
5890 * analyzer-selftests.cc: Wrap everything namespace "ana".
5891 * analyzer-selftests.h: Likewise.
5892 * analyzer.h: Likewise for forward decls of types.
5893 * call-string.h: Likewise.
5894 * checker-path.cc: Likewise.
5895 * checker-path.h: Likewise.
5896 * constraint-manager.cc: Likewise.
5897 * constraint-manager.h: Likewise.
5898 * diagnostic-manager.cc: Likewise.
5899 * diagnostic-manager.h: Likewise.
5900 * engine.cc: Likewise.
5901 * engine.h: Likewise.
5902 * exploded-graph.h: Likewise.
5903 * function-set.cc: Likewise.
5904 * function-set.h: Likewise.
5905 * pending-diagnostic.cc: Likewise.
5906 * pending-diagnostic.h: Likewise.
5907 * program-point.cc: Likewise.
5908 * program-point.h: Likewise.
5909 * program-state.cc: Likewise.
5910 * program-state.h: Likewise.
5911 * region-model.cc: Likewise.
5912 * region-model.h: Likewise.
5913 * sm-file.cc: Likewise.
5914 * sm-malloc.cc: Likewise.
5915 * sm-pattern-test.cc: Likewise.
5916 * sm-sensitive.cc: Likewise.
5917 * sm-signal.cc: Likewise.
5918 * sm-taint.cc: Likewise.
5921 * state-purge.h: Likewise.
5922 * supergraph.cc: Likewise.
5923 * supergraph.h: Likewise.
5925 2020-01-21 David Malcolm <dmalcolm@redhat.com>
5928 * region-model.cc (int_cmp): Rename to...
5929 (array_region::key_cmp): ...this, using key_t rather than int.
5930 Rewrite in terms of comparisons rather than subtraction to
5931 ensure qsort is anti-symmetric when handling extreme values.
5932 (array_region::walk_for_canonicalization): Update for above
5934 * region-model.h (array_region::key_cmp): New decl.
5936 2020-01-17 David Malcolm <dmalcolm@redhat.com>
5939 * region-model.cc (region_model::eval_condition_without_cm): Avoid
5940 gcc_unreachable for unexpected operations for the case where
5941 we're comparing an svalue against itself.
5943 2020-01-17 David Malcolm <dmalcolm@redhat.com>
5947 (region_model::convert_byte_offset_to_array_index): Convert to
5948 ssizetype before dividing by byte_size. Use fold_binary rather
5949 than fold_build2 to avoid needlessly constructing a tree for the
5952 2020-01-15 David Malcolm <dmalcolm@redhat.com>
5954 * engine.cc (class impl_region_model_context): Fix comment.
5956 2020-01-14 David Malcolm <dmalcolm@redhat.com>
5959 * region-model.cc (make_region_for_type): Use
5960 FUNC_OR_METHOD_TYPE_P rather than comparing against FUNCTION_TYPE.
5961 * region-model.h (function_region::function_region): Likewise.
5963 2020-01-14 David Malcolm <dmalcolm@redhat.com>
5965 * program-state.cc (sm_state_map::clone_with_remapping): Copy
5967 (selftest::test_program_state_merging_2): New selftest.
5968 (selftest::analyzer_program_state_cc_tests): Call it.
5970 2020-01-14 David Malcolm <dmalcolm@redhat.com>
5972 * checker-path.h (checker_path::get_checker_event): New function.
5973 (checker_path): Add DISABLE_COPY_AND_ASSIGN; make fields private.
5974 * diagnostic-manager.cc
5975 (diagnostic_manager::prune_for_sm_diagnostic): Replace direct
5976 access to checker_path::m_events with accessor functions. Fix
5978 (diagnostic_manager::prune_interproc_events): Replace direct
5979 access to checker_path::m_events with accessor functions.
5980 (diagnostic_manager::finish_pruning): Likewise.
5982 2020-01-14 David Malcolm <dmalcolm@redhat.com>
5984 * checker-path.h (checker_event::clone): Delete vfunc decl.
5985 (debug_event::clone): Delete vfunc impl.
5986 (custom_event::clone): Delete vfunc impl.
5987 (statement_event::clone): Delete vfunc impl.
5988 (function_entry_event::clone): Delete vfunc impl.
5989 (state_change_event::clone): Delete vfunc impl.
5990 (start_cfg_edge_event::clone): Delete vfunc impl.
5991 (end_cfg_edge_event::clone): Delete vfunc impl.
5992 (call_event::clone): Delete vfunc impl.
5993 (return_event::clone): Delete vfunc impl.
5994 (setjmp_event::clone): Delete vfunc impl.
5995 (rewind_from_longjmp_event::clone): Delete vfunc impl.
5996 (rewind_to_setjmp_event::clone): Delete vfunc impl.
5997 (warning_event::clone): Delete vfunc impl.
5999 2020-01-14 David Malcolm <dmalcolm@redhat.com>
6001 * supergraph.cc (supernode::dump_dot): Ensure that the TABLE
6002 element has at least one TR.
6004 2020-01-14 David Malcolm <dmalcolm@redhat.com>
6007 * engine.cc (leak_stmt_finder::find_stmt): Use get_pure_location
6008 when comparing against UNKNOWN_LOCATION.
6009 (stmt_requires_new_enode_p): Likewise.
6010 (exploded_graph::dump_exploded_nodes): Likewise.
6011 * supergraph.cc (supernode::get_start_location): Likewise.
6012 (supernode::get_end_location): Likewise.
6014 2020-01-14 David Malcolm <dmalcolm@redhat.com>
6017 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
6018 selftest::analyzer_sm_file_cc_tests.
6019 * analyzer-selftests.h (selftest::analyzer_sm_file_cc_tests): New
6021 * sm-file.cc: Include "analyzer/function-set.h" and
6022 "analyzer/analyzer-selftests.h".
6023 (get_file_using_fns): New function.
6024 (is_file_using_fn_p): New function.
6025 (fileptr_state_machine::on_stmt): Return true for known functions.
6026 (selftest::analyzer_sm_file_cc_tests): New function.
6028 2020-01-14 David Malcolm <dmalcolm@redhat.com>
6030 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
6031 selftest::analyzer_sm_signal_cc_tests.
6032 * analyzer-selftests.h (selftest::analyzer_sm_signal_cc_tests):
6034 * sm-signal.cc: Include "analyzer/function-set.h" and
6035 "analyzer/analyzer-selftests.h".
6036 (get_async_signal_unsafe_fns): New function.
6037 (signal_unsafe_p): Reimplement in terms of the above.
6038 (selftest::analyzer_sm_signal_cc_tests): New function.
6040 2020-01-14 David Malcolm <dmalcolm@redhat.com>
6042 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
6043 selftest::analyzer_function_set_cc_tests.
6044 * analyzer-selftests.h (selftest::analyzer_function_set_cc_tests):
6046 * function-set.cc: New file.
6047 * function-set.h: New file.
6049 2020-01-14 David Malcolm <dmalcolm@redhat.com>
6051 * analyzer.h (fndecl_has_gimple_body_p): New decl.
6052 * engine.cc (impl_region_model_context::on_unknown_change): New
6054 (fndecl_has_gimple_body_p): Make non-static.
6055 (exploded_node::on_stmt): Treat __analyzer_dump_exploded_nodes as
6056 known. Track whether we have a call with unknown side-effects and
6057 pass it to on_call_post.
6058 * exploded-graph.h (impl_region_model_context::on_unknown_change):
6060 * program-state.cc (sm_state_map::on_unknown_change): New function.
6061 * program-state.h (sm_state_map::on_unknown_change): New decl.
6062 * region-model.cc: Include "bitmap.h".
6063 (region_model::on_call_pre): Return a bool, capturing whether the
6064 call has unknown side effects.
6065 (region_model::on_call_post): Add arg "bool unknown_side_effects"
6066 and if true, call handle_unrecognized_call.
6067 (class reachable_regions): New class.
6068 (region_model::handle_unrecognized_call): New function.
6069 * region-model.h (region_model::on_call_pre): Return a bool.
6070 (region_model::on_call_post): Add arg "bool unknown_side_effects".
6071 (region_model::handle_unrecognized_call): New decl.
6072 (region_model_context::on_unknown_change): New vfunc.
6073 (test_region_model_context::on_unknown_change): New function.
6075 2020-01-14 David Malcolm <dmalcolm@redhat.com>
6077 * diagnostic-manager.cc (saved_diagnostic::operator==): Move here
6078 from header. Replace pointer equality test on m_var with call to
6079 pending_diagnostic::same_tree_p.
6080 * diagnostic-manager.h (saved_diagnostic::operator==): Move to
6081 diagnostic-manager.cc.
6082 * pending-diagnostic.cc (pending_diagnostic::same_tree_p): New.
6083 * pending-diagnostic.h (pending_diagnostic::same_tree_p): New.
6084 * sm-file.cc (file_diagnostic::subclass_equal_p): Replace pointer
6085 equality on m_arg with call to pending_diagnostic::same_tree_p.
6086 * sm-malloc.cc (malloc_diagnostic::subclass_equal_p): Likewise.
6087 (possible_null_arg::subclass_equal_p): Likewise.
6088 (null_arg::subclass_equal_p): Likewise.
6089 (free_of_non_heap::subclass_equal_p): Likewise.
6090 * sm-pattern-test.cc (pattern_match::operator==): Likewise.
6091 * sm-sensitive.cc (exposure_through_output_file::operator==):
6093 * sm-taint.cc (tainted_array_index::operator==): Likewise.
6095 2020-01-14 David Malcolm <dmalcolm@redhat.com>
6097 * diagnostic-manager.cc (dedupe_winners::add): Add logging
6098 of deduplication decisions made.
6100 2020-01-14 David Malcolm <dmalcolm@redhat.com>
6102 * ChangeLog: New file.
6103 * analyzer-selftests.cc: New file.
6104 * analyzer-selftests.h: New file.
6105 * analyzer.opt: New file.
6106 * analysis-plan.cc: New file.
6107 * analysis-plan.h: New file.
6108 * analyzer-logging.cc: New file.
6109 * analyzer-logging.h: New file.
6110 * analyzer-pass.cc: New file.
6111 * analyzer.cc: New file.
6112 * analyzer.h: New file.
6113 * call-string.cc: New file.
6114 * call-string.h: New file.
6115 * checker-path.cc: New file.
6116 * checker-path.h: New file.
6117 * constraint-manager.cc: New file.
6118 * constraint-manager.h: New file.
6119 * diagnostic-manager.cc: New file.
6120 * diagnostic-manager.h: New file.
6121 * engine.cc: New file.
6122 * engine.h: New file.
6123 * exploded-graph.h: New file.
6124 * pending-diagnostic.cc: New file.
6125 * pending-diagnostic.h: New file.
6126 * program-point.cc: New file.
6127 * program-point.h: New file.
6128 * program-state.cc: New file.
6129 * program-state.h: New file.
6130 * region-model.cc: New file.
6131 * region-model.h: New file.
6132 * sm-file.cc: New file.
6133 * sm-malloc.cc: New file.
6134 * sm-malloc.dot: New file.
6135 * sm-pattern-test.cc: New file.
6136 * sm-sensitive.cc: New file.
6137 * sm-signal.cc: New file.
6138 * sm-taint.cc: New file.
6141 * state-purge.cc: New file.
6142 * state-purge.h: New file.
6143 * supergraph.cc: New file.
6144 * supergraph.h: New file.
6146 2019-12-13 David Malcolm <dmalcolm@redhat.com>
6151 Copyright (C) 2019-2021 Free Software Foundation, Inc.
6153 Copying and distribution of this file, with or without modification,
6154 are permitted in any medium without royalty provided the copyright
6155 notice and this notice are preserved.