| blob | f666c7325ead329235b2c4fe8fd02aba3c27e46d |
1 2024-01-31 David Malcolm <dmalcolm@redhat.com>
3 PR analyzer/113253
4 * region-model.cc (region_model::on_stmt_pre): Add gcc_unreachable
5 for debug statements.
6 * state-purge.cc
7 (state_purge_per_ssa_name::state_purge_per_ssa_name): Skip any
8 debug stmts in the FOR_EACH_IMM_USE_FAST list.
9 * supergraph.cc (supergraph::supergraph): Don't add debug stmts
10 to the supernodes.
12 2024-01-31 David Malcolm <dmalcolm@redhat.com>
14 PR analyzer/113509
15 * checker-event.cc (state_change_event::get_desc): Don't assume
16 "var" is non-NULL.
18 2024-01-30 David Malcolm <dmalcolm@redhat.com>
20 PR analyzer/113654
21 * region-model.cc (is_round_up): New.
22 (is_multiple_p): New.
23 (is_dubious_capacity): New.
24 (region_model::check_region_size): Move usage of size_visitor into
25 is_dubious_capacity.
27 2024-01-30 David Malcolm <dmalcolm@redhat.com>
29 * region-model.cc
30 (dubious_allocation_size::dubious_allocation_size): Add
31 "capacity_sval" param. Drop unused ctor.
32 (dubious_allocation_size::maybe_add_sarif_properties): New.
33 (dubious_allocation_size::m_capacity_sval): New field.
34 (region_model::check_region_size): Pass capacity svalue to
35 dubious_allocation_size ctor.
37 2024-01-25 David Malcolm <dmalcolm@redhat.com>
39 PR analyzer/112969
40 * store.cc (binding_cluster::maybe_get_compound_binding): When
41 populating default_map, express the bit-range of the default key
42 for REG relative to REG, rather than to the base region.
44 2024-01-24 David Malcolm <dmalcolm@redhat.com>
46 PR analyzer/112977
47 * engine.cc (impl_region_model_context::on_liveness_change): Pass
48 m_ext_state to sm_state_map::on_liveness_change.
49 * program-state.cc (sm_state_map::on_svalue_leak): Guard removal
50 of map entry based on can_purge_p.
51 (sm_state_map::on_liveness_change): Add ext_state param. Add
52 workaround for bad interaction between state purging and
53 alt-inherited sm-state.
54 * program-state.h (sm_state_map::on_liveness_change): Add
55 ext_state param.
56 * sm-taint.cc
57 (taint_state_machine::has_alt_get_inherited_state_p): New.
58 (taint_state_machine::can_purge_p): Return false for "has_lb" and
59 "has_ub".
60 * sm.h (state_machine::has_alt_get_inherited_state_p): New vfunc.
62 2024-01-18 David Malcolm <dmalcolm@redhat.com>
64 PR analyzer/111361
65 * region-model.cc (svalue_byte_range_has_null_terminator_1): The
66 initial byte of an all-zeroes SVAL is a zero byte. Remove
67 gcc_unreachable from SK_CONSTANT for constants that aren't
68 STRING_CST or INTEGER_CST.
70 2024-01-18 David Malcolm <dmalcolm@redhat.com>
72 PR analyzer/112811
73 * region-model.cc (fragment::dump_to_pp): New.
74 (fragment::has_null_terminator): Convert to...
75 (svalue_byte_range_has_null_terminator_1): ...this new function,
76 updating to use a byte_range relative to the start of the svalue.
77 (svalue_byte_range_has_null_terminator): New.
78 (fragment::string_cst_has_null_terminator): Convert to...
79 (string_cst_has_null_terminator): ...this, updating to use a
80 byte_range relative to the start of the svalue.
81 (iterable_cluster::dump_to_pp): New.
82 (region_model::scan_for_null_terminator): Add logging, moving body
83 to...
84 (region_model::scan_for_null_terminator_1): ...this new function,
85 adding more logging, and updating to use
86 svalue_byte_range_has_null_terminator.
87 * region-model.h (region_model::scan_for_null_terminator_1): New
88 decl.
90 2024-01-16 David Malcolm <dmalcolm@redhat.com>
92 PR analyzer/106229
93 * analyzer.h (compare_constants): New decl.
94 * constraint-manager.cc (compare_constants): Make non-static.
95 * sm-taint.cc: Add include "fold-const.h".
96 (class concrete_range): New.
97 (get_possible_range): New.
98 (index_can_be_out_of_bounds_p): New.
99 (region_model::check_region_for_taint): Reject
100 -Wanalyzer-tainted-array-index if the type of the value makes it
101 impossible for it to be out-of-bounds of the array.
103 2024-01-16 David Malcolm <dmalcolm@redhat.com>
105 PR analyzer/113333
106 * region-model-manager.cc
107 (region_model_manager::maybe_fold_unaryop): Casting all zeroes
108 should give all zeroes.
110 2024-01-04 David Malcolm <dmalcolm@redhat.com>
112 * analyzer.opt.urls: New file, autogenerated by
113 regenerate-opt-urls.py.
115 2024-01-04 David Malcolm <dmalcolm@redhat.com>
117 * checker-event.cc: Include "diagnostic-format-sarif.h" and
118 "tree-logical-location.h".
119 (checker_event::maybe_add_sarif_properties): New.
120 (superedge_event::maybe_add_sarif_properties): New.
121 (superedge_event::superedge_event): Add comment.
122 * checker-event.h (checker_event::maybe_add_sarif_properties): New
123 decl.
124 (superedge_event::maybe_add_sarif_properties): New decl.
126 2024-01-04 David Malcolm <dmalcolm@redhat.com>
128 PR analyzer/112790
129 * checker-event.cc (class inlining_info): Move to...
130 * inlining-iterator.h (class inlining_info): ...here.
131 * sm-malloc.cc: Include "analyzer/inlining-iterator.h".
132 (maybe_complain_about_deref_before_check): Reject stmts that were
133 inlined from another function.
135 2024-01-04 David Malcolm <dmalcolm@redhat.com>
137 PR analyzer/113222
138 * access-diagram.cc (valid_region_spatial_item::add_boundaries):
139 Handle TYPE_DOMAIN being null.
140 (valid_region_spatial_item::add_array_elements_to_table):
141 Likewise.
143 2023-12-16 David Malcolm <dmalcolm@redhat.com>
145 * analyzer.cc: Include "tree-pretty-print.h" and
146 "diagnostic-event-id.h".
147 (tree_to_json): New.
148 (diagnostic_event_id_to_json): New.
149 (bit_offset_to_json): New.
150 (byte_offset_to_json): New.
151 * analyzer.h (tree_to_json): New decl.
152 (diagnostic_event_id_to_json): New decl.
153 (bit_offset_to_json): New decl.
154 (byte_offset_to_json): New decl.
155 * bounds-checking.cc: Include "diagnostic-format-sarif.h".
156 (out_of_bounds::maybe_add_sarif_properties): New.
157 (concrete_out_of_bounds::maybe_add_sarif_properties): New.
158 (concrete_past_the_end::maybe_add_sarif_properties): New.
159 (symbolic_past_the_end::maybe_add_sarif_properties): New.
160 * region-model.cc (region_to_value_map::to_json): New.
161 (region_model::to_json): New.
162 * region-model.h (region_to_value_map::to_json): New decl.
163 (region_model::to_json): New decl.
164 * store.cc (bit_range::to_json): New.
165 (byte_range::to_json): New.
166 * store.h (bit_range::to_json): New decl.
167 (byte_range::to_json): New decl.
169 2023-12-16 David Malcolm <dmalcolm@redhat.com>
171 PR analyzer/112792
172 * bounds-checking.cc
173 (out_of_bounds::oob_region_creation_event_capacity): Rename
174 "capacity" to "byte_capacity". Layout fix.
175 (out_of_bounds::::add_region_creation_events): Rename
176 "capacity" to "byte_capacity".
177 (class concrete_out_of_bounds): Rename m_out_of_bounds_range to
178 m_out_of_bounds_bits and convert from a byte_range to a bit_range.
179 (concrete_out_of_bounds::get_out_of_bounds_bytes): New.
180 (concrete_past_the_end::concrete_past_the_end): Rename param
181 "byte_bound" to "bit_bound". Initialize m_byte_bound.
182 (concrete_past_the_end::subclass_equal_p): Update for renaming
183 of m_byte_bound to m_bit_bound.
184 (concrete_past_the_end::m_bit_bound): New field.
185 (concrete_buffer_overflow::concrete_buffer_overflow): Convert
186 param "range" from byte_range to bit_range. Rename param
187 "byte_bound" to "bit_bound".
188 (concrete_buffer_overflow::emit): Update for bits vs bytes.
189 (concrete_buffer_overflow::describe_final_event): Split
190 into...
191 (concrete_buffer_overflow::describe_final_event_as_bytes): ...this
192 (concrete_buffer_overflow::describe_final_event_as_bits): ...and
193 this.
194 (concrete_buffer_over_read::concrete_buffer_over_read): Convert
195 param "range" from byte_range to bit_range. Rename param
196 "byte_bound" to "bit_bound".
197 (concrete_buffer_over_read::emit): Update for bits vs bytes.
198 (concrete_buffer_over_read::describe_final_event): Split into...
199 (concrete_buffer_over_read::describe_final_event_as_bytes):
200 ...this
201 (concrete_buffer_over_read::describe_final_event_as_bits): ...and
202 this.
203 (concrete_buffer_underwrite::concrete_buffer_underwrite): Convert
204 param "range" from byte_range to bit_range.
205 (concrete_buffer_underwrite::describe_final_event): Split into...
206 (concrete_buffer_underwrite::describe_final_event_as_bytes):
207 ...this
208 (concrete_buffer_underwrite::describe_final_event_as_bits): ...and
209 this.
210 (concrete_buffer_under_read::concrete_buffer_under_read): Convert
211 param "range" from byte_range to bit_range.
212 (concrete_buffer_under_read::describe_final_event): Split into...
213 (concrete_buffer_under_read::describe_final_event_as_bytes):
214 ...this
215 (concrete_buffer_under_read::describe_final_event_as_bits): ...and
216 this.
217 (region_model::check_region_bounds): Use bits for concrete values,
218 and rename locals to indicate whether we're dealing with bits or
219 bytes. Specifically, replace "num_bytes_sval" with
220 "num_bits_sval", and get it from reg's "get_bit_size_sval".
221 Replace "num_bytes_tree" with "num_bits_tree". Rename "capacity"
222 to "byte_capacity". Rename "cst_capacity_tree" to
223 "cst_byte_capacity_tree". Replace "offset" and
224 "num_bytes_unsigned" with "bit_offset" and "num_bits_unsigned"
225 respectively, converting from byte_offset_t to bit_offset_t.
226 Replace "out" and "read_bytes" with "bits_outside" and "read_bits"
227 respectively, converting from byte_range to bit_range. Convert
228 "buffer" from byte_range to bit_range. Replace "byte_bound" with
229 "bit_bound".
230 * region.cc (region::get_bit_size_sval): New.
231 (offset_region::get_bit_offset): New.
232 (offset_region::get_bit_size_sval): New.
233 (sized_region::get_bit_size_sval): New.
234 (bit_range_region::get_bit_size_sval): New.
235 * region.h (region::get_bit_size_sval): New vfunc.
236 (offset_region::get_bit_offset): New decl.
237 (offset_region::get_bit_size_sval): New decl.
238 (sized_region::get_bit_size_sval): New decl.
239 (bit_range_region::get_bit_size_sval): New decl.
240 * store.cc (bit_range::intersects_p): New, based on
241 byte_range::intersects_p.
242 (bit_range::exceeds_p): New, based on byte_range::exceeds_p.
243 (bit_range::falls_short_of_p): New, based on
244 byte_range::falls_short_of_p.
245 (byte_range::intersects_p): Delete.
246 (byte_range::exceeds_p): Delete.
247 (byte_range::falls_short_of_p): Delete.
248 * store.h (bit_range::intersects_p): New overload.
249 (bit_range::exceeds_p): New.
250 (bit_range::falls_short_of_p): New.
251 (byte_range::intersects_p): Delete.
252 (byte_range::exceeds_p): Delete.
253 (byte_range::falls_short_of_p): Delete.
255 2023-12-14 David Malcolm <dmalcolm@redhat.com>
257 PR analyzer/112655
258 * infinite-loop.cc (infinite_loop::infinite_loop): Pass eedges
259 via rvalue reference rather than by value.
260 (starts_infinite_loop_p): Move eedges when constructing an
261 infinite_loop instance.
262 * sm-file.cc (fileptr_state_machine::fileptr_state_machine): Use
263 initializer list for states.
264 * sm-sensitive.cc
265 (sensitive_state_machine::sensitive_state_machine): Likewise.
266 * sm-signal.cc (signal_state_machine::signal_state_machine):
267 Likewise.
268 * sm-taint.cc (taint_state_machine::taint_state_machine):
269 Likewise.
270 * varargs.cc (va_list_state_machine::va_list_state_machine): Likewise.
272 2023-12-11 David Malcolm <dmalcolm@redhat.com>
274 PR analyzer/112955
275 * engine.cc (feasibility_state::feasibility_state): Initialize
276 m_snodes_visited.
278 2023-12-11 Andrew Pinski <apinski@marvell.com>
280 * region-model-manager.cc (maybe_undo_optimize_bit_field_compare): Remove
281 the check for type being unsigned_char_type_node.
283 2023-12-08 David Malcolm <dmalcolm@redhat.com>
285 * sm-taint.cc (taint_state_machine::alt_get_inherited_state): Fix
286 handling of TRUNC_MOD_EXPR.
288 2023-12-08 David Malcolm <dmalcolm@redhat.com>
290 * region-model.cc (contains_uninit_p): Only check for
291 svalues that the infoleak warning can handle.
293 2023-12-08 David Malcolm <dmalcolm@redhat.com>
295 PR analyzer/112889
296 * store.h (concrete_binding::concrete_binding): Strengthen
297 assertion to require size to be be positive, rather than just
298 non-zero.
299 (concrete_binding::mark_deleted): Use size rather than start bit
300 offset.
301 (concrete_binding::mark_empty): Likewise.
302 (concrete_binding::is_deleted): Likewise.
303 (concrete_binding::is_empty): Likewise.
305 2023-12-07 Alexandre Oliva <oliva@adacore.com>
307 * region-model.cc (has_nondefault_case_for_value_p): Take
308 enumerate type as a parameter.
309 (region_model::apply_constraints_for_gswitch): Cope with
310 integral promotion type casts.
312 2023-12-07 David Malcolm <dmalcolm@redhat.com>
314 PR analyzer/103546
315 PR analyzer/112850
316 * analyzer.opt (-param=analyzer-max-svalue-depth=): Increase from
317 12 to 18.
318 (Wanalyzer-symbol-too-complex): New.
319 * diagnostic-manager.cc
320 (null_assignment_sm_context::clear_all_per_svalue_state): New.
321 * engine.cc (impl_sm_context::clear_all_per_svalue_state): New.
322 * program-state.cc (sm_state_map::clear_all_per_svalue_state):
323 New.
324 * program-state.h (sm_state_map::clear_all_per_svalue_state): New
325 decl.
326 * region-model-manager.cc
327 (region_model_manager::reject_if_too_complex): Add
328 -Wanalyzer-symbol-too-complex.
329 * sm-taint.cc (taint_state_machine::on_condition): Handle
330 comparisons against UNKNOWN.
331 * sm.h (sm_context::clear_all_per_svalue_state): New.
333 2023-12-06 David Malcolm <dmalcolm@redhat.com>
335 * engine.cc (dump_analyzer_json): Use
336 flag_diagnostics_json_formatting.
338 2023-12-01 David Malcolm <dmalcolm@redhat.com>
340 * analyzer.h (class saved_diagnostic): New forward decl.
341 * bounds-checking.cc: Update for changes to
342 pending_diagnostic::emit.
343 * call-details.cc: Likewise.
344 * diagnostic-manager.cc: Include "diagnostic-format-sarif.h".
345 (saved_diagnostic::maybe_add_sarif_properties): New.
346 (class pending_diagnostic_metadata): New.
347 (diagnostic_manager::emit_saved_diagnostic): Create a
348 pending_diagnostic_metadata and a diagnostic_emission_context.
349 Pass the latter to the pending_diagnostic::emit vfunc.
350 * diagnostic-manager.h
351 (saved_diagnostic::maybe_add_sarif_properties): New decl.
352 * engine.cc: Update for changes to pending_diagnostic::emit.
353 * infinite-loop.cc: Likewise.
354 * infinite-recursion.cc: Likewise.
355 * kf-analyzer.cc: Likewise.
356 * kf.cc: Likewise.
357 * pending-diagnostic.cc
358 (diagnostic_emission_context::get_pending_diagnostic): New.
359 (diagnostic_emission_context::warn): New.
360 (diagnostic_emission_context::inform): New.
361 * pending-diagnostic.h (class diagnostic_emission_context): New.
362 (pending_diagnostic::emit): Update params.
363 (pending_diagnostic::maybe_add_sarif_properties): New vfunc.
364 * region.cc: Don't include "diagnostic-metadata.h".
365 * region-model.cc: Include "diagnostic-format-sarif.h". Update
366 for changes to pending_diagnostic::emit.
367 (exposure_through_uninit_copy::maybe_add_sarif_properties): New.
368 * sm-fd.cc: Update for changes to pending_diagnostic::emit.
369 * sm-file.cc: Likewise.
370 * sm-malloc.cc: Likewise.
371 * sm-pattern-test.cc: Likewise.
372 * sm-sensitive.cc: Likewise.
373 * sm-signal.cc: Likewise.
374 * sm-taint.cc: Likewise.
375 * store.cc: Don't include "diagnostic-metadata.h".
376 * varargs.cc: Update for changes to pending_diagnostic::emit.
378 2023-11-19 David Malcolm <dmalcolm@redhat.com>
380 * analyzer.h: Include "rich-location.h".
382 2023-11-19 David Malcolm <dmalcolm@redhat.com>
384 PR analyzer/107573
385 * analyzer.h (register_known_functions): Add region_model_manager
386 param.
387 * analyzer.opt (Wanalyzer-undefined-behavior-strtok): New.
388 * call-summary.cc
389 (call_summary_replay::convert_region_from_summary_1): Handle
390 RK_PRIVATE.
391 * engine.cc (impl_run_checkers): Pass model manager to
392 register_known_functions.
393 * kf.cc (class undefined_function_behavior): New.
394 (class kf_strtok): New.
395 (register_known_functions): Add region_model_manager param.
396 Use it to register "strtok".
397 * region-model-manager.cc
398 (region_model_manager::get_or_create_conjured_svalue): Add "idx"
399 param.
400 * region-model-manager.h
401 (region_model_manager::get_or_create_conjured_svalue): Add "idx"
402 param.
403 (region_model_manager::get_root_region): New accessor.
404 * region-model.cc (region_model::scan_for_null_terminator): Handle
405 "expr" being null.
406 (region_model::get_representative_path_var_1): Handle RK_PRIVATE.
407 * region-model.h (region_model::called_from_main_p): Make public.
408 * region.cc (region::get_memory_space): Handle RK_PRIVATE.
409 (region::can_have_initial_svalue_p): Handle MEMSPACE_PRIVATE.
410 (private_region::dump_to_pp): New.
411 * region.h (MEMSPACE_PRIVATE): New.
412 (RK_PRIVATE): New.
413 (class private_region): New.
414 (is_a_helper <const private_region *>::test): New.
415 * store.cc (store::replay_call_summary_cluster): Handle
416 RK_PRIVATE.
417 * svalue.h (struct conjured_svalue::key_t): Add "idx" param to
418 ctor and "m_idx" field.
419 (class conjured_svalue::conjured_svalue): Likewise.
421 2023-11-18 David Malcolm <dmalcolm@redhat.com>
423 PR analyzer/106147
424 * analyzer.opt (Wanalyzer-infinite-loop): New option.
425 (fdump-analyzer-infinite-loop): New option.
426 * checker-event.h (start_cfg_edge_event::get_desc): Drop "final".
427 (start_cfg_edge_event::maybe_describe_condition): Convert from
428 private to protected.
429 * checker-path.h (checker_path::get_logger): New.
430 * diagnostic-manager.cc (process_worklist_item): Update for
431 new context param of maybe_update_for_edge.
432 * engine.cc
433 (impl_region_model_context::impl_region_model_context): Add
434 out_could_have_done_work param to both ctors and use it to
435 initialize mm_out_could_have_done_work.
436 (impl_region_model_context::maybe_did_work): New vfunc
437 implementation.
438 (exploded_node::on_stmt): Add out_could_have_done_work param and
439 pass to ctxt ctor.
440 (exploded_node::on_stmt_pre): Treat setjmp and longjmp as "doing
441 work".
442 (exploded_node::on_longjmp): Likewise.
443 (exploded_edge::exploded_edge): Add "could_do_work" param and use
444 it to initialize m_could_do_work_p.
445 (exploded_edge::dump_dot_label): Add result of could_do_work_p.
446 (exploded_graph::add_function_entry): Mark edge as doing no work.
447 (exploded_graph::add_edge): Add "could_do_work" param and pass to
448 exploded_edge ctor.
449 (add_tainted_args_callback): Treat as doing no work.
450 (exploded_graph::process_worklist): Likewise when merging nodes.
451 (maybe_process_run_of_before_supernode_enodes::item): Likewise.
452 (exploded_graph::maybe_create_dynamic_call): Likewise.
453 (exploded_graph::process_node): Likewise for phi nodes.
454 Pass in a "could_have_done_work" bool when handling stmts and use
455 when creating edges. Assume work is done at bifurcation.
456 (exploded_path::feasible_p): Update for new context param of
457 maybe_update_for_edge.
458 (feasibility_state::feasibility_state): New ctor.
459 (feasibility_state::operator=): New.
460 (feasibility_state::maybe_update_for_edge): Add ctxt param and use
461 it. Fix missing newline when logging state.
462 (impl_run_checkers): Call exploded_graph::detect_infinite_loops.
463 * exploded-graph.h
464 (impl_region_model_context::impl_region_model_context): Add
465 out_could_have_done_work param to both ctors.
466 (impl_region_model_context::maybe_did_work): New decl.
467 (impl_region_model_context::checking_for_infinite_loop_p): New.
468 (impl_region_model_context::on_unusable_in_infinite_loop): New.
469 (impl_region_model_context::m_out_could_have_done_work): New
470 field.
471 (exploded_node::on_stmt): Add "out_could_have_done_work" param.
472 (exploded_edge::exploded_edge): Add "could_do_work" param.
473 (exploded_edge::could_do_work_p): New accessor.
474 (exploded_edge::m_could_do_work_p): New field.
475 (exploded_graph::add_edge): Add "could_do_work" param.
476 (exploded_graph::detect_infinite_loops): New decl.
477 (feasibility_state::feasibility_state): New ctor.
478 (feasibility_state::operator=): New decl.
479 (feasibility_state::maybe_update_for_edge): Add ctxt param.
480 * infinite-loop.cc: New file.
481 * program-state.cc (program_state::on_edge): Log the rejected
482 constraint when region_model::maybe_update_for_edge fails.
483 * region-model.cc (region_model::on_assignment): Treat any writes
484 other than to the stack as "doing work".
485 (region_model::on_stmt_pre): Treat all asm stmts as "doing work".
486 (region_model::on_call_post): Likewise for all calls to functions
487 with unknown side effects.
488 (region_model::handle_phi): Add svals_changing_meaning param.
489 Mark widening svalue in phi nodes as changing meaning.
490 (unusable_in_infinite_loop_constraint_p): New.
491 (region_model::add_constraint): If we're checking for an infinite
492 loop, bail out on unusable svalues, or if we don't have a definite
493 true/false for the constraint.
494 (region_model::update_for_phis): Gather all svalues changing
495 meaning in phi nodes, and purge constraints involving them.
496 (region_model::replay_call_summary): Treat all call summaries as
497 doing work.
498 (region_model::can_merge_with_p): Purge constraints involving
499 svalues that change meaning.
500 (model_merger::on_widening_reuse): New.
501 (test_iteration_1): Likewise.
502 (selftest::test_iteration_1): Remove assertion that model6 "knows"
503 that i < 157.
504 * region-model.h (region_model::handle_phi): Add
505 svals_changing_meaning param
506 (region_model_context::maybe_did_work): New pure virtual func.
507 (region_model_context::checking_for_infinite_loop_p): Likewise.
508 (region_model_context::on_unusable_in_infinite_loop): Likewise.
509 (noop_region_model_context::maybe_did_work): Implement.
510 (noop_region_model_context::checking_for_infinite_loop_p):
511 Likewise.
512 (noop_region_model_context::on_unusable_in_infinite_loop):
513 Likewise.
514 (region_model_context_decorator::maybe_did_work): Implement.
515 (region_model_context_decorator::checking_for_infinite_loop_p):
516 Likewise.
517 (region_model_context_decorator::on_unusable_in_infinite_loop):
518 Likewise.
519 (model_merger::on_widening_reuse): New decl.
520 (model_merger::m_svals_changing_meaning): New field.
521 * sm-signal.cc (register_signal_handler::impl_transition): Assume
522 the edge "does work".
523 * supergraph.cc (supernode::get_start_location): Use CFG edge's
524 goto_locus if available.
525 (supernode::get_end_location): Likewise.
526 (cfg_superedge::dump_label_to_pp): Dump edges with a "goto_locus"
527 * supergraph.h (cfg_superedge::get_goto_locus): New.
528 * svalue.cc (svalue::can_merge_p): Call on_widening_reuse for
529 widening values.
530 (involvement_visitor::visit_widening_svalue): New.
531 (svalue::involves_p): Update assertion to allow widening svalues.
533 2023-11-14 David Malcolm <dmalcolm@redhat.com>
535 PR analyzer/103533
536 * sm-taint.cc: Remove "experimental" from comment.
537 * sm.cc (make_checkers): Always add taint state machine.
539 2023-11-04 David Malcolm <dmalcolm@redhat.com>
541 * bounds-checking.cc: Update for changes to diagnostic_context.
543 2023-11-02 David Malcolm <dmalcolm@redhat.com>
545 PR analyzer/112317
546 * access-diagram.cc (class x_aligned_x_ruler_widget): Eliminate
547 unused field "m_col_widths".
548 (access_diagram_impl::add_valid_vs_invalid_ruler): Update for
549 above change.
550 * region-model.cc
551 (check_one_function_attr_null_terminated_string_arg): Remove
552 unused variables "cd_unchecked", "strlen_sval", and
553 "limited_sval".
554 * region-model.h (region_model_context_decorator::warn): Add
555 missing "override".
557 2023-10-31 David Malcolm <dmalcolm@redhat.com>
559 * record-layout.cc: New file, based on material in region-model.cc.
560 * record-layout.h: Likewise.
561 * region-model.cc: Include "analyzer/record-layout.h".
562 (class record_layout): Move to record-layout.cc and .h
564 2023-10-26 David Malcolm <dmalcolm@redhat.com>
566 * region-model.cc
567 (region_model::check_external_function_for_access_attr): Split
568 out, replacing with...
569 (region_model::check_function_attr_access): ...this new function
570 and...
571 (region_model::check_function_attrs): ...this new function.
572 (region_model::check_one_function_attr_null_terminated_string_arg):
573 New.
574 (region_model::check_function_attr_null_terminated_string_arg):
575 New.
576 (region_model::handle_unrecognized_call): Update for renaming of
577 check_external_function_for_access_attr to check_function_attrs.
578 (region_model::check_for_null_terminated_string_arg): Add return
579 value to one overload. Make both overloads const.
580 * region-model.h: Include "stringpool.h" and "attribs.h".
581 (region_model::check_for_null_terminated_string_arg): Add return
582 value to one overload. Make both overloads const.
583 (region_model::check_external_function_for_access_attr): Delete
584 decl.
585 (region_model::check_function_attr_access): New decl.
586 (region_model::check_function_attr_null_terminated_string_arg):
587 New decl.
588 (region_model::check_one_function_attr_null_terminated_string_arg):
589 New decl.
590 (region_model::check_function_attrs): New decl.
592 2023-10-09 David Malcolm <dmalcolm@redhat.com>
594 * access-diagram.cc (boundaries::add): Explicitly state
595 "boundaries::" scope for "kind" enum.
597 2023-10-08 David Malcolm <dmalcolm@redhat.com>
599 PR analyzer/111155
600 * access-diagram.cc (boundaries::boundaries): Add logger param
601 (boundaries::add): Add logging.
602 (boundaries::get_hard_boundaries_in_range): New.
603 (boundaries::m_logger): New field.
604 (boundaries::get_table_x_for_offset): Make public.
605 (class svalue_spatial_item): New.
606 (class compound_svalue_spatial_item): New.
607 (add_ellipsis_to_gaps): New.
608 (valid_region_spatial_item::valid_region_spatial_item): Add theme
609 param. Initialize m_boundaries, m_existing_sval, and
610 m_existing_sval_spatial_item.
611 (valid_region_spatial_item::add_boundaries): Set m_boundaries.
612 Add boundaries for any m_existing_sval_spatial_item.
613 (valid_region_spatial_item::add_array_elements_to_table): Rewrite
614 creation of min/max index in terms of
615 maybe_add_array_index_to_table. Rewrite ellipsis code using
616 add_ellipsis_to_gaps. Add index values for any hard boundaries
617 within the valid region.
618 (valid_region_spatial_item::maybe_add_array_index_to_table): New,
619 based on code formerly in add_array_elements_to_table.
620 (valid_region_spatial_item::make_table): Make use of
621 m_existing_sval_spatial_item, if any.
622 (valid_region_spatial_item::m_boundaries): New field.
623 (valid_region_spatial_item::m_existing_sval): New field.
624 (valid_region_spatial_item::m_existing_sval_spatial_item): New
625 field.
626 (class svalue_spatial_item): Rename to...
627 (class written_svalue_spatial_item): ...this.
628 (class string_region_spatial_item): Rename to..
629 (class string_literal_spatial_item): ...this. Add "kind".
630 (string_literal_spatial_item::add_boundaries): Use m_kind to
631 determine kind of boundary. Update for renaming of m_actual_bits
632 to m_bits.
633 (string_literal_spatial_item::make_table): Likewise. Support not
634 displaying a row for byte indexes, and not displaying a row for
635 the type.
636 (string_literal_spatial_item::add_column_for_byte): Make byte index
637 row optional.
638 (svalue_spatial_item::make): Convert to...
639 (make_written_svalue_spatial_item): ...this.
640 (make_existing_svalue_spatial_item): New.
641 (access_diagram_impl::access_diagram_impl): Pass theme to
642 m_valid_region_spatial_item ctor. Update for renaming of
643 m_svalue_spatial_item.
644 (access_diagram_impl::find_boundaries): Pass logger to boundaries.
645 Update for renaming of...
646 (access_diagram_impl::m_svalue_spatial_item): Rename to...
647 (access_diagram_impl::m_written_svalue_spatial_item): ...this.
649 2023-10-03 David Malcolm <dmalcolm@redhat.com>
651 * analyzer-logging.cc (logger::log_va_partial): Use text_info
652 ctor.
653 * analyzer.cc (make_label_text): Likewise.
654 (make_label_text_n): Likewise.
655 * pending-diagnostic.cc (evdesc::event_desc::formatted_print):
656 Likewise.
658 2023-10-02 David Malcolm <dmalcolm@redhat.com>
660 * program-point.cc: Update for grouping of source printing fields
661 within diagnostic_context.
663 2023-09-15 David Malcolm <dmalcolm@redhat.com>
665 * analyzer.cc (get_stmt_location): Handle null stmt.
666 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic): Copy
667 m_loc from ploc.
668 (saved_diagnostic::operator==): Compare m_loc.
669 (saved_diagnostic::calc_best_epath): Only use m_stmt_finder if
670 m_loc is unknown.
671 (dedupe_key::dedupe_key): Initialize m_loc.
672 (dedupe_key::operator==): Compare m_loc.
673 (dedupe_key::get_location): Use m_loc if it's known.
674 (dedupe_key::m_loc): New field.
675 (diagnostic_manager::emit_saved_diagnostic): Only call
676 get_emission_location if m_loc is unknown, preferring to use m_loc
677 if it's available.
678 * diagnostic-manager.h (saved_diagnostic::m_loc): New field.
679 (pending_location::pending_location): Initialize m_loc. Add
680 overload taking a location_t rather than a stmt/stmt_finder.
681 (pending_location::m_loc): New field.
683 2023-09-15 David Malcolm <dmalcolm@redhat.com>
685 * analyzer.h (struct pending_location): New forward decl.
686 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
687 Replace params "enode", "snode", "stmt", and "stmt_finder" with
688 "ploc".
689 (diagnostic_manager::add_diagnostic): Likewise for both overloads.
690 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic):
691 Likewise.
692 (struct pending_location): New.
693 (diagnostic_manager::add_diagnostic): Replace params "enode",
694 "snode", "stmt", and "stmt_finder" with "ploc".
695 * engine.cc (impl_region_model_context::warn): Update call to
696 add_diagnostic for above change.
697 (impl_sm_context::warn): Likewise.
698 (impl_region_model_context::on_state_leak): Likewise.
699 * infinite-recursion.cc
700 (exploded_graph::detect_infinite_recursion): Likewise.
702 2023-09-15 David Malcolm <dmalcolm@redhat.com>
704 * region-model.cc (region_model::get_gassign_result): Handle
705 volatile ops by using a conjured_svalue.
707 2023-09-14 David Malcolm <dmalcolm@redhat.com>
709 * checker-event.h (checker_event::get_thread_id): New.
710 * checker-path.h (class checker_path): Implement thread-related
711 vfuncs via a single simple_diagnostic_thread instance named
712 "main".
714 2023-09-14 David Malcolm <dmalcolm@redhat.com>
716 * diagnostic-manager.cc (compatible_epath_p): Fix missing return.
718 2023-09-14 David Malcolm <dmalcolm@redhat.com>
720 * diagnostic-manager.cc (process_worklist_item): Use
721 std::unique_ptr rather than plain rejected_constraint *.
722 * engine.cc (exploded_path::feasible_p): Likewise.
723 (feasibility_state::maybe_update_for_edge): Likewise.
724 * exploded-graph.h (feasibility_problem::feasibility_problem):
725 Likewise.
726 (feasibility_problem::~feasibility_problem): Delete.
727 (feasibility_problem::m_rc): Use std::unique_ptr.
728 (feasibility_state::maybe_update_for_edge): Likewise.
729 * feasible-graph.cc (feasible_graph::add_feasibility_problem):
730 Likewise.
731 * feasible-graph.h (class infeasible_node): Likewise.
732 (feasible_graph::add_feasibility_problem): Likewise.
733 * region-model.cc (region_model::add_constraint): Likewise.
734 (region_model::maybe_update_for_edge): Likewise.
735 (region_model::apply_constraints_for_gcond): Likewise.
736 (region_model::apply_constraints_for_gswitch): Likewise.
737 (region_model::apply_constraints_for_exception): Likewise.
738 * region-model.h (class region_model): Likewise for decls.
740 2023-09-09 benjamin priour <vultkayn@gcc.gnu.org>
742 PR analyzer/96395
743 * region-model.cc
744 (region_model::add_constraints_from_binop): binop_svalues around
745 LT_EXPR, LE_EXPR, GT_EXPR, GE_EXPR are now unwrapped.
747 2023-09-07 David Malcolm <dmalcolm@redhat.com>
749 PR analyzer/110529
750 * program-point.cc (program_point::on_edge): Don't reject
751 EDGE_ABNORMAL for computed gotos.
752 * region-model.cc (region_model::maybe_update_for_edge): Handle
753 computed goto statements.
754 (region_model::apply_constraints_for_ggoto): New.
755 * region-model.h (region_model::apply_constraints_for_ggoto): New decl.
756 * supergraph.cc (supernode::get_label): New.
757 * supergraph.h (supernode::get_label): New decl.
759 2023-09-07 benjamin priour <vultkayn@gcc.gnu.org>
760 David Malcolm <dmalcolm@redhat.com>
762 PR analyzer/110830
763 * diagnostic-manager.cc
764 (compatible_epaths_p): New function.
765 (saved_diagnostic::supercedes_p): Now calls the above
766 to determine if the diagnostics do overlap and the superseding
767 may proceed.
769 2023-09-07 David Malcolm <dmalcolm@redhat.com>
771 * region-model.h: fix -Wunused-parameter warnings
773 2023-09-06 David Malcolm <dmalcolm@redhat.com>
775 PR analyzer/105899
776 * kf.cc (class kf_strstr): New.
777 (kf_strstr::impl_call_post): New.
778 (register_known_functions): Register it.
780 2023-09-06 David Malcolm <dmalcolm@redhat.com>
782 PR analyzer/105899
783 * kf.cc (class kf_strncpy): New.
784 (kf_strncpy::impl_call_post): New.
785 (register_known_functions): Register it.
786 * region-model.cc (region_model::read_bytes): Handle unknown
787 number of bytes.
789 2023-09-06 David Malcolm <dmalcolm@redhat.com>
791 * kf.cc (kf_calloc::impl_call_pre): Pass ctxt to zero_fill_region.
792 (kf_memset::impl_call_pre): Move responsibility for calling
793 check_region_for_write to fill_region.
794 * region-model.cc (region_model::on_assignment): Pass ctxt to
795 zero_fill_region.
796 (region_model::fill_region): Add "ctxt" param, using it to call
797 check_region_for_write.
798 (region_model::zero_fill_region): Likewise.
799 * region-model.h (region_model::fill_region): Add "ctxt" param.
800 (region_model::zero_fill_region): Likewise.
802 2023-09-01 benjamin priour <priour.be@gmail.com>
804 PR analyzer/105948
805 PR analyzer/94355
806 * analyzer.h (is_placement_new_p): New declaration.
807 * call-details.cc
808 (call_details::deref_ptr_arg): New function.
809 Dereference the argument at given index if possible.
810 * call-details.h: Declaration of the above function.
811 * kf-lang-cp.cc (is_placement_new_p): Returns true if the gcall
812 is recognized as a placement new.
813 (kf_operator_delete::impl_call_post): Unbinding a region and its
814 descendents now poisons with POISON_KIND_DELETED.
815 (register_known_functions_lang_cp): Known function "operator
816 delete" is now registered only once independently of its number of
817 arguments.
818 * region-model.cc (region_model::eval_condition): Now
819 recursively calls itself if any of the operand is wrapped in a
820 cast.
821 * sm-malloc.cc (malloc_state_machine::on_stmt):
822 Add placement new recognition.
823 * svalue.cc (poison_kind_to_str): Wording for the new PK.
824 * svalue.h (enum poison_kind): Add value POISON_KIND_DELETED.
826 2023-08-31 Francois-Xavier Coudert <fxcoudert@gcc.gnu.org>
828 * kf.cc: Change spelling to macOS.
830 2023-08-30 Eric Feng <ef2648@columbia.edu>
832 PR analyzer/107646
833 * engine.cc (impl_region_model_context::warn): New optional
834 parameter.
835 * exploded-graph.h (class impl_region_model_context): Likewise.
836 * region-model.cc (region_model::pop_frame): New callback
837 feature for region_model::pop_frame.
838 * region-model.h (struct append_regions_cb_data): Likewise.
839 (class region_model): Likewise.
840 (class region_model_context): New optional parameter.
841 (class region_model_context_decorator): Likewise.
843 2023-08-30 Francois-Xavier Coudert <fxcoudert@gcc.gnu.org>
845 * region-model.cc: Define INCLUDE_ALGORITHM.
847 2023-08-29 David Malcolm <dmalcolm@redhat.com>
849 PR analyzer/99860
850 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
851 selftest::analyzer_ranges_cc_tests.
852 * analyzer-selftests.h (selftest::run_analyzer_selftests): New
853 decl.
854 * analyzer.opt (Wanalyzer-overlapping-buffers): New option.
855 * call-details.cc: Include "analyzer/ranges.h" and "make-unique.h".
856 (class overlapping_buffers): New.
857 (call_details::complain_about_overlap): New.
858 * call-details.h (call_details::complain_about_overlap): New decl.
859 * kf.cc (kf_memcpy_memmove::impl_call_pre): Call
860 cd.complain_about_overlap for memcpy and memcpy_chk.
861 (kf_strcat::impl_call_pre): Call cd.complain_about_overlap.
862 (kf_strcpy::impl_call_pre): Likewise.
863 * ranges.cc: New file.
864 * ranges.h: New file.
866 2023-08-29 David Malcolm <dmalcolm@redhat.com>
868 PR analyzer/105899
869 * kf.cc (kf_strdup::impl_call_pre): Set size of
870 dynamically-allocated buffer. Simulate copying the string from
871 the source region to the new buffer.
873 2023-08-27 benjamin priour <vultkayn@gcc.gnu.org>
875 PR analyzer/96395
876 * analyzer.h (class known_function): Add virtual casts
877 to builtin_known_function.
878 (class builtin_known_function): New subclass of known_function
879 for builtins.
880 * kf.cc (class kf_alloca): Now derived from
881 builtin_known_function.
882 (class kf_calloc): Likewise.
883 (class kf_free): Likewise.
884 (class kf_malloc): Likewise.
885 (class kf_memcpy_memmove): Likewise.
886 (class kf_memset): Likewise.
887 (class kf_realloc): Likewise.
888 (class kf_strchr): Likewise.
889 (class kf_sprintf): Likewise.
890 (class kf_strcat): Likewise.
891 (class kf_strcpy): Likewise.
892 (class kf_strdup): Likewise.
893 (class kf_strlen): Likewise.
894 (class kf_strndup): Likewise.
895 (register_known_functions): Builtins are now registered as
896 known_functions by name rather than by their BUILTIN_CODE.
897 * known-function-manager.cc (get_normal_builtin): New overload.
898 * known-function-manager.h: New overload declaration.
899 * region-model.cc (region_model::get_builtin_kf): New function.
900 * region-model.h (class region_model): Add declaration of
901 get_builtin_kf.
902 * sm-fd.cc: For called recognized as builtins, use the
903 attributes of that builtin as defined in gcc/builtins.def
904 rather than the user's.
905 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
907 2023-08-25 David Malcolm <dmalcolm@redhat.com>
909 * access-diagram.cc (class string_region_spatial_item): Remove
910 assumption that the string is written to the start of the cluster.
912 2023-08-24 David Malcolm <dmalcolm@redhat.com>
914 PR analyzer/105899
915 * call-details.cc
916 (call_details::check_for_null_terminated_string_arg): Split into
917 overloads, one taking just an arg_idx, the other a new
918 "include_terminator" param.
919 * call-details.h: Likewise.
920 * kf.cc (class kf_strcat): New.
921 (kf_strcpy::impl_call_pre): Update for change to
922 check_for_null_terminated_string_arg.
923 (register_known_functions): Register kf_strcat.
924 * region-model.cc
925 (region_model::check_for_null_terminated_string_arg): Split into
926 overloads, one taking just an arg_idx, the other a new
927 "include_terminator" param. When returning an svalue, handle
928 "include_terminator" being false by subtracting one.
929 * region-model.h
930 (region_model::check_for_null_terminated_string_arg): Split into
931 overloads, one taking just an arg_idx, the other a new
932 "include_terminator" param.
934 2023-08-24 David Malcolm <dmalcolm@redhat.com>
936 PR analyzer/105899
937 * region-model.cc (fragment::has_null_terminator): Handle
938 SK_BITS_WITHIN.
940 2023-08-24 David Malcolm <dmalcolm@redhat.com>
942 PR analyzer/105899
943 * region-model-manager.cc
944 (region_model_manager::get_or_create_initial_value): Simplify
945 INIT_VAL(ELEMENT_REG(STRING_REG), CONSTANT_SVAL) to
946 CONSTANT_SVAL(STRING[N]).
948 2023-08-24 David Malcolm <dmalcolm@redhat.com>
950 PR analyzer/105899
951 * region-model.cc (fragment::has_null_terminator): Move STRING_CST
952 handling to fragment::string_cst_has_null_terminator; also use it to
953 handle INIT_VAL(STRING_REG).
954 (fragment::string_cst_has_null_terminator): New, from above.
956 2023-08-24 David Malcolm <dmalcolm@redhat.com>
958 * kf.cc (kf_memcpy_memmove::impl_call_pre): Reimplement using
959 region_model::copy_bytes.
960 * region-model.cc (region_model::read_bytes): New.
961 (region_model::copy_bytes): New.
962 * region-model.h (region_model::read_bytes): New decl.
963 (region_model::copy_bytes): New decl.
965 2023-08-24 David Malcolm <dmalcolm@redhat.com>
967 PR analyzer/105899
968 * region-model.cc (region_model::get_string_size): Delete both.
969 * region-model.h (region_model::get_string_size): Delete both
970 decls.
972 2023-08-24 David Malcolm <dmalcolm@redhat.com>
974 PR analyzer/105899
975 * kf.cc (kf_strcpy::impl_call_pre): Reimplement using
976 check_for_null_terminated_string_arg.
977 * region-model.cc (region_model::get_store_bytes): Shortcut
978 reading all of a string_region.
979 (region_model::scan_for_null_terminator): Use get_store_value for
980 the bytes rather than "unknown" when returning an unknown length.
981 (region_model::write_bytes): New.
982 * region-model.h (region_model::write_bytes): New decl.
984 2023-08-24 David Malcolm <dmalcolm@redhat.com>
986 PR analyzer/105899
987 * region-model.cc (iterable_cluster::iterable_cluster): Add
988 symbolic binding keys to m_symbolic_bindings.
989 (iterable_cluster::has_symbolic_bindings_p): New.
990 (iterable_cluster::m_symbolic_bindings): New field.
991 (region_model::scan_for_null_terminator): Treat clusters with
992 symbolic bindings as having unknown strlen.
994 2023-08-24 David Malcolm <dmalcolm@redhat.com>
996 * engine.cc (impl_path_context::impl_path_context): Add logger
997 param.
998 (impl_path_context::bifurcate): Add log message.
999 (impl_path_context::terminate_path): Likewise.
1000 (impl_path_context::m_logger): New field.
1001 (exploded_graph::process_node): Pass logger to path_ctxt ctor.
1003 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1005 PR analyzer/105899
1006 * kf-analyzer.cc (class kf_analyzer_get_strlen): Move to kf.cc.
1007 (register_known_analyzer_functions): Use make_kf_strlen.
1008 * kf.cc (class kf_strlen::impl_call_pre): Replace with
1009 implementation of kf_analyzer_get_strlen from kf-analyzer.cc.
1010 Handle "UNKNOWN" return from check_for_null_terminated_string_arg
1011 by falling back to a conjured svalue.
1012 (make_kf_strlen): New.
1013 (register_known_functions): Use make_kf_strlen.
1014 * known-function-manager.h (make_kf_strlen): New decl.
1016 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1018 PR analyzer/105899
1019 * call-details.cc (call_details::call_details): New ctor.
1020 * call-details.h (call_details::call_details): New ctor decl.
1021 (struct call_arg_details): Move here from region-model.cc.
1022 * region-model.cc (region_model::check_call_format_attr): New.
1023 (region_model::check_call_args): Call it.
1024 (struct call_arg_details): Move it to call-details.h.
1025 * region-model.h (region_model::check_call_format_attr): New decl.
1027 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1029 * kf.cc (class kf_fopen): New.
1030 (register_known_functions): Register it.
1032 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1034 PR analyzer/105899
1035 * analyzer.opt (Wanalyzer-unterminated-string): Delete.
1036 * call-details.cc
1037 (call_details::check_for_null_terminated_string_arg): Convert
1038 return type from void to const svalue *. Add param "out_sval".
1039 * call-details.h
1040 (call_details::check_for_null_terminated_string_arg): Likewise.
1041 * kf-analyzer.cc (kf_analyzer_get_strlen::impl_call_pre): Wire up
1042 to result of check_for_null_terminated_string_arg.
1043 * region-model.cc (get_strlen): Delete.
1044 (class unterminated_string_arg): Delete.
1045 (struct fragment): New.
1046 (class iterable_cluster): New.
1047 (region_model::get_store_bytes): New.
1048 (get_tree_for_byte_offset): New.
1049 (region_model::scan_for_null_terminator): New.
1050 (region_model::check_for_null_terminated_string_arg): Convert
1051 return type from void to const svalue *. Add param "out_sval".
1052 Reimplement in terms of scan_for_null_terminator, dropping the
1053 special-case for -Wanalyzer-unterminated-string.
1054 * region-model.h (region_model::get_store_bytes): New decl.
1055 (region_model::scan_for_null_terminator): New decl.
1056 (region_model::check_for_null_terminated_string_arg): Convert
1057 return type from void to const svalue *. Add param "out_sval".
1058 * store.cc (concrete_binding::get_byte_range): New.
1059 * store.h (concrete_binding::get_byte_range): New decl.
1060 (store_manager::get_concrete_binding): New overload.
1062 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1064 * region-model.cc (region_model_context_decorator::add_event):
1065 Handle m_inner being NULL.
1066 * region-model.h (class region_model_context_decorator): Likewise.
1067 (annotating_context::warn): Likewise.
1069 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1071 * diagnostic-manager.cc (saved_diagnostic::add_event): New.
1072 (saved_diagnostic::add_any_saved_events): New.
1073 (diagnostic_manager::add_event): New.
1074 (dedupe_winners::emit_best): New.
1075 (diagnostic_manager::emit_saved_diagnostic): Make "sd" param
1076 non-const. Call saved_diagnostic::add_any_saved_events.
1077 * diagnostic-manager.h (saved_diagnostic::add_event): New decl.
1078 (saved_diagnostic::add_any_saved_events): New decl.
1079 (saved_diagnostic::m_saved_events): New field.
1080 (diagnostic_manager::add_event): New decl.
1081 (diagnostic_manager::emit_saved_diagnostic): Make "sd" param
1082 non-const.
1083 * engine.cc (impl_region_model_context::add_event): New.
1084 * exploded-graph.h (impl_region_model_context::add_event): New decl.
1085 * region-model.cc
1086 (noop_region_model_context::add_event): New.
1087 (region_model_context_decorator::add_event): New.
1088 * region-model.h (region_model_context::add_event): New vfunc.
1089 (noop_region_model_context::add_event): New decl.
1090 (region_model_context_decorator::add_event): New decl.
1092 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1094 * region-model.cc
1095 (class check_external_function_for_access_attr::annotating_ctxt):
1096 Convert to an annotating_context.
1097 * region-model.h (class note_adding_context): Rename to...
1098 (class annotating_context): ...this, updating the "warn" method.
1099 (note_adding_context::make_note): Replace with...
1100 (annotating_context::add_annotations): ...this.
1102 2023-08-14 benjamin priour <vultkayn@gcc.gnu.org>
1104 PR analyzer/110543
1105 * analyzer.opt: Add new option.
1106 * diagnostic-manager.cc
1107 (diagnostic_manager::prune_path): Call prune_system_headers.
1108 (prune_frame): New function that deletes all events in a frame.
1109 (diagnostic_manager::prune_system_headers): New function.
1110 * diagnostic-manager.h: Add prune_system_headers declaration.
1112 2023-08-11 David Malcolm <dmalcolm@redhat.com>
1114 PR analyzer/105899
1115 * analyzer.opt (Wanalyzer-unterminated-string): New.
1116 * call-details.cc
1117 (call_details::check_for_null_terminated_string_arg): New.
1118 * call-details.h
1119 (call_details::check_for_null_terminated_string_arg): New decl.
1120 * kf-analyzer.cc (class kf_analyzer_get_strlen): New.
1121 (register_known_analyzer_functions): Register it.
1122 * kf.cc (kf_error::impl_call_pre): Check that format arg is a
1123 valid null-terminated string.
1124 (kf_putenv::impl_call_pre): Likewise for the sole param.
1125 (kf_strchr::impl_call_pre): Likewise for the first param.
1126 (kf_strcpy::impl_call_pre): Likewise for the second param.
1127 (kf_strdup::impl_call_pre): Likewise for the sole param.
1128 * region-model.cc (get_strlen): New.
1129 (struct call_arg_details): New.
1130 (inform_about_expected_null_terminated_string_arg): New.
1131 (class unterminated_string_arg): New.
1132 (region_model::check_for_null_terminated_string_arg): New.
1133 * region-model.h
1134 (region_model::check_for_null_terminated_string_arg): New decl.
1136 2023-08-11 Eric Feng <ef2648@columbia.edu>
1138 PR analyzer/107646
1139 * call-details.h: New function.
1140 * region-model.cc (region_model::get_or_create_region_for_heap_alloc):
1141 New optional parameters.
1142 * region-model.h (class region_model): New optional parameters.
1143 * sm-malloc.cc (on_realloc_with_move): New function.
1144 (region_model::transition_ptr_sval_non_null): New function.
1146 2023-08-09 David Malcolm <dmalcolm@redhat.com>
1148 * analyzer.h (class pure_known_function_with_default_return): New
1149 subclass.
1150 * call-details.cc (const_fn_p): Move here from region-model.cc.
1151 (maybe_get_const_fn_result): Likewise.
1152 (get_result_size_in_bytes): Likewise.
1153 (call_details::set_any_lhs_with_defaults): New function, based on
1154 code in region_model::on_call_pre.
1155 * call-details.h (call_details::set_any_lhs_with_defaults): New
1156 decl.
1157 * diagnostic-manager.cc
1158 (diagnostic_manager::emit_saved_diagnostic): Log the index of the
1159 saved_diagnostic.
1160 * kf.cc (pure_known_function_with_default_return::impl_call_pre):
1161 New.
1162 (kf_memset::impl_call_pre): Set the LHS to the first param.
1163 (kf_putenv::impl_call_pre): Call cd.set_any_lhs_with_defaults.
1164 (kf_sprintf::impl_call_pre): Call cd.set_any_lhs_with_defaults.
1165 (class kf_stack_restore): Derive from
1166 pure_known_function_with_default_return.
1167 (class kf_stack_save): Likewise.
1168 (kf_strlen::impl_call_pre): Call cd.set_any_lhs_with_defaults.
1169 * region-model-reachability.cc (reachable_regions::handle_sval):
1170 Remove logic for symbolic regions for pointers.
1171 * region-model.cc (region_model::canonicalize): Remove purging of
1172 dynamic extents workaround for surplus values from
1173 region_model::on_call_pre's default LHS code.
1174 (const_fn_p): Move to call-details.cc.
1175 (maybe_get_const_fn_result): Likewise.
1176 (get_result_size_in_bytes): Likewise.
1177 (region_model::update_for_nonzero_return): Call
1178 cd.set_any_lhs_with_defaults.
1179 (region_model::on_call_pre): Remove the assignment to the LHS of a
1180 default return value, instead requiring all known_function
1181 implementations to write to any LHS of the call. Use
1182 cd.set_any_lhs_with_defaults on the non-kf paths.
1183 * sm-fd.cc (kf_socket::outcome_of_socket::update_model): Use
1184 cd.set_any_lhs_with_defaults when failing to get at fd state.
1185 (kf_bind::outcome_of_bind::update_model): Likewise.
1186 (kf_listen::outcome_of_listen::update_model): Likewise.
1187 (kf_accept::outcome_of_accept::update_model): Likewise.
1188 (kf_connect::outcome_of_connect::update_model): Likewise.
1189 (kf_read::impl_call_pre): Use cd.set_any_lhs_with_defaults.
1190 * sm-file.cc (class kf_stdio_output_fn): Derive from
1191 pure_known_function_with_default_return.
1192 (class kf_ferror): Likewise.
1193 (class kf_fileno): Likewise.
1194 (kf_fgets::impl_call_pre): Use cd.set_any_lhs_with_defaults.
1195 (kf_read::impl_call_pre): Likewise.
1196 (class kf_getc): Derive from
1197 pure_known_function_with_default_return.
1198 (class kf_getchar): Likewise.
1199 * varargs.cc (kf_va_arg::impl_call_pre): Use
1200 cd.set_any_lhs_with_defaults.
1202 2023-08-04 David Malcolm <dmalcolm@redhat.com>
1204 PR analyzer/110426
1205 * bounds-checking.cc (region_model::check_region_bounds): Handle
1206 symbolic base regions.
1207 * call-details.cc: Include "stringpool.h" and "attribs.h".
1208 (call_details::lookup_function_attribute): New function.
1209 * call-details.h (call_details::lookup_function_attribute): New
1210 function decl.
1211 * region-model-manager.cc
1212 (region_model_manager::maybe_fold_binop): Add reference to
1213 PR analyzer/110902.
1214 * region-model-reachability.cc (reachable_regions::handle_sval):
1215 Add symbolic regions for pointers that are conjured svalues for
1216 the LHS of a stmt.
1217 * region-model.cc (region_model::canonicalize): Purge dynamic
1218 extents for regions that aren't referenced.
1219 (get_result_size_in_bytes): New function.
1220 (region_model::on_call_pre): Use get_result_size_in_bytes and
1221 potentially set the dynamic extents of the region pointed to by
1222 the return value.
1223 (region_model::deref_rvalue): Add param "add_nonnull_constraint"
1224 and use it to conditionalize adding the constraint.
1225 (pending_diagnostic_subclass::dubious_allocation_size): Add "stmt"
1226 param to both ctors and use it to initialize new "m_stmt" field.
1227 (pending_diagnostic_subclass::operator==): Use m_stmt; don't use
1228 m_lhs or m_rhs.
1229 (pending_diagnostic_subclass::m_stmt): New field.
1230 (region_model::check_region_size): Generalize to any kind of
1231 pointer svalue by using deref_rvalue rather than checking for
1232 region_svalue. Pass stmt to dubious_allocation_size ctor.
1233 * region-model.h (region_model::deref_rvalue): Add param
1234 "add_nonnull_constraint".
1235 * svalue.cc (conjured_svalue::lhs_value_p): New function.
1236 * svalue.h (conjured_svalue::lhs_value_p): New decl.
1238 2023-08-04 David Malcolm <dmalcolm@redhat.com>
1240 * svalue.cc (region_svalue::dump_to_pp): Support NULL type.
1241 (constant_svalue::dump_to_pp): Likewise.
1242 (initial_svalue::dump_to_pp): Likewise.
1243 (conjured_svalue::dump_to_pp): Likewise. Fix missing print of the
1244 type.
1246 2023-08-03 David Malcolm <dmalcolm@redhat.com>
1248 PR analyzer/110882
1249 * region.cc (int_size_in_bits): Fail on zero-sized types.
1251 2023-08-02 Eric Feng <ef2648@columbia.edu>
1253 PR analyzer/107646
1254 * analyzer-language.cc (run_callbacks): New function.
1255 (on_finish_translation_unit): New function.
1256 * analyzer-language.h (GCC_ANALYZER_LANGUAGE_H): New include.
1257 (class translation_unit): New vfuncs.
1259 2023-07-26 David Malcolm <dmalcolm@redhat.com>
1261 PR analyzer/104940
1262 * region-model-manager.cc
1263 (region_model_manager::region_model_manager): Update for
1264 generalizing region ids to also cover svalues.
1265 (region_model_manager::get_or_create_constant_svalue): Likewise.
1266 (region_model_manager::get_or_create_unknown_svalue): Likewise.
1267 (region_model_manager::create_unique_svalue): Likewise.
1268 (region_model_manager::get_or_create_initial_value): Likewise.
1269 (region_model_manager::get_or_create_setjmp_svalue): Likewise.
1270 (region_model_manager::get_or_create_poisoned_svalue): Likewise.
1271 (region_model_manager::get_ptr_svalue): Likewise.
1272 (region_model_manager::get_or_create_unaryop): Likewise.
1273 (region_model_manager::get_or_create_binop): Likewise.
1274 (region_model_manager::get_or_create_sub_svalue): Likewise.
1275 (region_model_manager::get_or_create_repeated_svalue): Likewise.
1276 (region_model_manager::get_or_create_bits_within): Likewise.
1277 (region_model_manager::get_or_create_unmergeable): Likewise.
1278 (region_model_manager::get_or_create_widening_svalue): Likewise.
1279 (region_model_manager::get_or_create_compound_svalue): Likewise.
1280 (region_model_manager::get_or_create_conjured_svalue): Likewise.
1281 (region_model_manager::get_or_create_asm_output_svalue): Likewise.
1282 (region_model_manager::get_or_create_const_fn_result_svalue):
1283 Likewise.
1284 (region_model_manager::get_region_for_fndecl): Likewise.
1285 (region_model_manager::get_region_for_label): Likewise.
1286 (region_model_manager::get_region_for_global): Likewise.
1287 (region_model_manager::get_field_region): Likewise.
1288 (region_model_manager::get_element_region): Likewise.
1289 (region_model_manager::get_offset_region): Likewise.
1290 (region_model_manager::get_sized_region): Likewise.
1291 (region_model_manager::get_cast_region): Likewise.
1292 (region_model_manager::get_frame_region): Likewise.
1293 (region_model_manager::get_symbolic_region): Likewise.
1294 (region_model_manager::get_region_for_string): Likewise.
1295 (region_model_manager::get_bit_range): Likewise.
1296 (region_model_manager::get_var_arg_region): Likewise.
1297 (region_model_manager::get_region_for_unexpected_tree_code):
1298 Likewise.
1299 (region_model_manager::get_or_create_region_for_heap_alloc):
1300 Likewise.
1301 (region_model_manager::create_region_for_alloca): Likewise.
1302 (region_model_manager::log_stats): Likewise.
1303 * region-model-manager.h (region_model_manager::get_num_regions):
1304 Replace with...
1305 (region_model_manager::get_num_symbols): ...this.
1306 (region_model_manager::alloc_region_id): Replace with...
1307 (region_model_manager::alloc_symbol_id): ...this.
1308 (region_model_manager::m_next_region_id): Replace with...
1309 (region_model_manager::m_next_symbol_id): ...this.
1310 * region-model.cc (selftest::test_get_representative_tree): Update
1311 for generalizing region ids to also cover svalues.
1312 (selftest::test_binop_svalue_folding): Likewise.
1313 (selftest::test_state_merging): Likewise.
1314 * region.cc (region::cmp_ids): Delete, in favor of
1315 symbol::cmp_ids.
1316 (region::region): Update for introduction of symbol base class.
1317 (frame_region::get_region_for_local): Likewise.
1318 (root_region::root_region): Likewise.
1319 (symbolic_region::symbolic_region): Likewise.
1320 * region.h: Replace include of "analyzer/complexity.h" with
1321 "analyzer/symbol.h".
1322 (class region): Make a subclass of symbol.
1323 (region::get_id): Delete in favor of symbol::get_id.
1324 (region::cmp_ids): Delete in favor of symbol::cmp_ids.
1325 (region::get_complexity): Delete in favor of
1326 symbol::get_complexity.
1327 (region::region): Use symbol::id_t for "id" param.
1328 (region::m_complexity): Move field to symbol base class.
1329 (region::m_id): Likewise.
1330 (space_region::space_region): Use symbol::id_t for "id" param.
1331 (frame_region::frame_region): Likewise.
1332 (globals_region::globals_region): Likewise.
1333 (code_region::code_region): Likewise.
1334 (function_region::function_region): Likewise.
1335 (label_region::label_region): Likewise.
1336 (stack_region::stack_region): Likewise.
1337 (heap_region::heap_region): Likewise.
1338 (thread_local_region::thread_local_region): Likewise.
1339 (root_region::root_region): Likewise.
1340 (symbolic_region::symbolic_region): Likewise.
1341 (decl_region::decl_region): Likewise.
1342 (field_region::field_region): Likewise.
1343 (element_region::element_region): Likewise.
1344 (offset_region::offset_region): Likewise.
1345 (sized_region::sized_region): Likewise.
1346 (cast_region::cast_region): Likewise.
1347 (heap_allocated_region::heap_allocated_region): Likewise.
1348 (alloca_region::alloca_region): Likewise.
1349 (string_region::string_region): Likewise.
1350 (bit_range_region::bit_range_region): Likewise.
1351 (var_arg_region::var_arg_region): Likewise.
1352 (errno_region::errno_region): Likewise.
1353 (unknown_region::unknown_region): Likewise.
1354 * svalue.cc (sub_svalue::sub_svalue): Add symbol::id_t param.
1355 (repeated_svalue::repeated_svalue): Likewise.
1356 (bits_within_svalue::bits_within_svalue): Likewise.
1357 (compound_svalue::compound_svalue): Likewise.
1358 * svalue.h: Replace include of "analyzer/complexity.h" with
1359 "analyzer/symbol.h".
1360 (class svalue): Make a subclass of symbol.
1361 (svalue::get_complexity): Delete in favor of
1362 symbol::get_complexity.
1363 (svalue::svalue): Add symbol::id_t param. Update for new base
1364 class.
1365 (svalue::m_complexity): Delete in favor of
1366 symbol::m_complexity.
1367 (region_svalue::region_svalue): Add symbol::id_t param
1368 (constant_svalue::constant_svalue): Likewise.
1369 (unknown_svalue::unknown_svalue): Likewise.
1370 (poisoned_svalue::poisoned_svalue): Likewise.
1371 (setjmp_svalue::setjmp_svalue): Likewise.
1372 (initial_svalue::initial_svalue): Likewise.
1373 (unaryop_svalue::unaryop_svalue): Likewise.
1374 (binop_svalue::binop_svalue): Likewise.
1375 (sub_svalue::sub_svalue): Likewise.
1376 (repeated_svalue::repeated_svalue): Likewise.
1377 (bits_within_svalue::bits_within_svalue): Likewise.
1378 (unmergeable_svalue::unmergeable_svalue): Likewise.
1379 (placeholder_svalue::placeholder_svalue): Likewise.
1380 (widening_svalue::widening_svalue): Likewise.
1381 (compound_svalue::compound_svalue): Likewise.
1382 (conjured_svalue::conjured_svalue): Likewise.
1383 (asm_output_svalue::asm_output_svalue): Likewise.
1384 (const_fn_result_svalue::const_fn_result_svalue): Likewise.
1385 * symbol.cc: New file.
1386 * symbol.h: New file.
1388 2023-07-21 David Malcolm <dmalcolm@redhat.com>
1390 PR analyzer/110455
1391 * region-model.cc (region_model::get_gassign_result): Only check
1392 for bad shift counts when dealing with an integral type.
1394 2023-07-21 David Malcolm <dmalcolm@redhat.com>
1396 PR analyzer/110433
1397 PR middle-end/110612
1398 * access-diagram.cc (class spatial_item): Add virtual dtor.
1400 2023-07-21 David Malcolm <dmalcolm@redhat.com>
1402 PR analyzer/110387
1403 * region.h (struct cast_region::key_t): Support "m_type" being
1404 null by using "m_original_region" for empty/deleted slots.
1406 2023-07-19 David Malcolm <dmalcolm@redhat.com>
1408 PR analyzer/110700
1409 * region-model-manager.cc
1410 (region_model_manager::get_or_create_int_cst): Assert that we have
1411 an integral or pointer type.
1412 * sm-taint.cc (taint_state_machine::check_for_tainted_divisor):
1413 Don't check non-integral types.
1415 2023-06-29 benjamin priour <priour.be@gmail.com>
1417 PR analyzer/110198
1418 * region-model-manager.cc
1419 (region_model_manager::get_or_create_initial_value): Take an
1420 optional boolean value to bypass poisoning checks
1421 * region-model-manager.h: Update declaration of the above function.
1422 * region-model.cc (region_model::get_store_value): No longer returns
1423 on OOB, but rather gives a boolean to get_or_create_initial_value.
1424 (region_model::check_region_access): Update docstring.
1425 (region_model::check_region_for_write): Update docstring.
1427 2023-06-24 David Malcolm <dmalcolm@redhat.com>
1429 * access-diagram.cc: Add #define INCLUDE_VECTOR.
1430 * bounds-checking.cc: Likewise.
1432 2023-06-22 David Malcolm <dmalcolm@redhat.com>
1434 PR analyzer/106626
1435 * access-diagram.cc: New file.
1436 * access-diagram.h: New file.
1437 * analyzer.h (class region_offset): Add default ctor.
1438 (region_offset::make_byte_offset): New decl.
1439 (region_offset::concrete_p): New.
1440 (region_offset::get_concrete_byte_offset): New.
1441 (region_offset::calc_symbolic_bit_offset): New decl.
1442 (region_offset::calc_symbolic_byte_offset): New decl.
1443 (region_offset::dump_to_pp): New decl.
1444 (region_offset::dump): New decl.
1445 (operator<, operator<=, operator>, operator>=): New decls for
1446 region_offset.
1447 * analyzer.opt
1448 (-param=analyzer-text-art-string-ellipsis-threshold=): New.
1449 (-param=analyzer-text-art-string-ellipsis-head-len=): New.
1450 (-param=analyzer-text-art-string-ellipsis-tail-len=): New.
1451 (-param=analyzer-text-art-ideal-canvas-width=): New.
1452 (fanalyzer-debug-text-art): New.
1453 * bounds-checking.cc: Include "intl.h", "diagnostic-diagram.h",
1454 and "analyzer/access-diagram.h".
1455 (class out_of_bounds::oob_region_creation_event_capacity): New.
1456 (out_of_bounds::out_of_bounds): Add "model" and "sval_hint"
1457 params.
1458 (out_of_bounds::mark_interesting_stuff): Use the base region.
1459 (out_of_bounds::add_region_creation_events): Use
1460 oob_region_creation_event_capacity.
1461 (out_of_bounds::get_dir): New pure vfunc.
1462 (out_of_bounds::maybe_show_notes): New.
1463 (out_of_bounds::maybe_show_diagram): New.
1464 (out_of_bounds::make_access_diagram): New.
1465 (out_of_bounds::m_model): New field.
1466 (out_of_bounds::m_sval_hint): New field.
1467 (out_of_bounds::m_region_creation_event_id): New field.
1468 (concrete_out_of_bounds::concrete_out_of_bounds): Update for new
1469 fields.
1470 (concrete_past_the_end::concrete_past_the_end): Likewise.
1471 (concrete_past_the_end::add_region_creation_events): Use
1472 oob_region_creation_event_capacity.
1473 (concrete_buffer_overflow::concrete_buffer_overflow): Update for
1474 new fields.
1475 (concrete_buffer_overflow::emit): Replace call to
1476 maybe_describe_array_bounds with maybe_show_notes.
1477 (concrete_buffer_overflow::get_dir): New.
1478 (concrete_buffer_over_read::concrete_buffer_over_read): Update for
1479 new fields.
1480 (concrete_buffer_over_read::emit): Replace call to
1481 maybe_describe_array_bounds with maybe_show_notes.
1482 (concrete_buffer_overflow::get_dir): New.
1483 (concrete_buffer_underwrite::concrete_buffer_underwrite): Update
1484 for new fields.
1485 (concrete_buffer_underwrite::emit): Replace call to
1486 maybe_describe_array_bounds with maybe_show_notes.
1487 (concrete_buffer_underwrite::get_dir): New.
1488 (concrete_buffer_under_read::concrete_buffer_under_read): Update
1489 for new fields.
1490 (concrete_buffer_under_read::emit): Replace call to
1491 maybe_describe_array_bounds with maybe_show_notes.
1492 (concrete_buffer_under_read::get_dir): New.
1493 (symbolic_past_the_end::symbolic_past_the_end): Update for new
1494 fields.
1495 (symbolic_buffer_overflow::symbolic_buffer_overflow): Likewise.
1496 (symbolic_buffer_overflow::emit): Call maybe_show_notes.
1497 (symbolic_buffer_overflow::get_dir): New.
1498 (symbolic_buffer_over_read::symbolic_buffer_over_read): Update for
1499 new fields.
1500 (symbolic_buffer_over_read::emit): Call maybe_show_notes.
1501 (symbolic_buffer_over_read::get_dir): New.
1502 (region_model::check_symbolic_bounds): Add "sval_hint" param. Pass
1503 it and sized_offset_reg to diagnostics.
1504 (region_model::check_region_bounds): Add "sval_hint" param, passing
1505 it to diagnostics.
1506 * diagnostic-manager.cc
1507 (diagnostic_manager::emit_saved_diagnostic): Pass logger to
1508 pending_diagnostic::emit.
1509 * engine.cc: Add logger param to pending_diagnostic::emit
1510 implementations.
1511 * infinite-recursion.cc: Likewise.
1512 * kf-analyzer.cc: Likewise.
1513 * kf.cc: Likewise. Add nullptr for new param of
1514 check_region_for_write.
1515 * pending-diagnostic.h: Likewise in decl.
1516 * region-model-manager.cc
1517 (region_model_manager::get_or_create_int_cst): Convert param from
1518 poly_int64 to const poly_wide_int_ref &.
1519 (region_model_manager::maybe_fold_binop): Support type being NULL
1520 when checking for floating-point types.
1521 Check for (X + Y) - X => Y. Be less strict about types when folding
1522 associative ops. Check for (X + Y) * CST => (X * CST) + (Y * CST).
1523 * region-model-manager.h
1524 (region_model_manager::get_or_create_int_cst): Convert param from
1525 poly_int64 to const poly_wide_int_ref &.
1526 * region-model.cc: Add logger param to pending_diagnostic::emit
1527 implementations.
1528 (region_model::check_external_function_for_access_attr): Update
1529 for new param of check_region_for_write.
1530 (region_model::deref_rvalue): Use nullptr rather than NULL.
1531 (region_model::get_capacity): Handle RK_STRING.
1532 (region_model::check_region_access): Add "sval_hint" param; pass it to
1533 check_region_bounds.
1534 (region_model::check_region_for_write): Add "sval_hint" param;
1535 pass it to check_region_access.
1536 (region_model::check_region_for_read): Add NULL for new param to
1537 check_region_access.
1538 (region_model::set_value): Pass rhs_sval to
1539 check_region_for_write.
1540 (region_model::get_representative_path_var_1): Handle SK_CONSTANT
1541 in the check for infinite recursion.
1542 * region-model.h (region_model::check_region_for_write): Add
1543 "sval_hint" param.
1544 (region_model::check_region_access): Likewise.
1545 (region_model::check_symbolic_bounds): Likewise.
1546 (region_model::check_region_bounds): Likewise.
1547 * region.cc (region_offset::make_byte_offset): New.
1548 (region_offset::calc_symbolic_bit_offset): New.
1549 (region_offset::calc_symbolic_byte_offset): New.
1550 (region_offset::dump_to_pp): New.
1551 (region_offset::dump): New.
1552 (struct linear_op): New.
1553 (operator<, operator<=, operator>, operator>=): New, for
1554 region_offset.
1555 (region::get_next_offset): New.
1556 (region::get_relative_symbolic_offset): Use ptrdiff_type_node.
1557 (field_region::get_relative_symbolic_offset): Likewise.
1558 (element_region::get_relative_symbolic_offset): Likewise.
1559 (bit_range_region::get_relative_symbolic_offset): Likewise.
1560 * region.h (region::get_next_offset): New decl.
1561 * sm-fd.cc: Add logger param to pending_diagnostic::emit
1562 implementations.
1563 * sm-file.cc: Likewise.
1564 * sm-malloc.cc: Likewise.
1565 * sm-pattern-test.cc: Likewise.
1566 * sm-sensitive.cc: Likewise.
1567 * sm-signal.cc: Likewise.
1568 * sm-taint.cc: Likewise.
1569 * store.cc (bit_range::contains_p): Allow "out" to be null.
1570 * store.h (byte_range::get_start_bit_offset): New.
1571 (byte_range::get_next_bit_offset): New.
1572 * varargs.cc: Add logger param to pending_diagnostic::emit
1573 implementations.
1575 2023-06-10 Tim Lange <mail@tim-lange.me>
1577 PR analyzer/109577
1578 * constraint-manager.cc (class sval_finder): Visitor to find
1579 childs in svalue trees.
1580 (constraint_manager::sval_constrained_p): Add new function to
1581 check whether a sval might be part of an constraint.
1582 * constraint-manager.h: Add sval_constrained_p function.
1583 * region-model.cc (class size_visitor): Reverse behavior to not
1584 emit a warning on not explicitly considered cases.
1585 (region_model::check_region_size):
1586 Adapt to size_visitor changes.
1588 2023-06-09 David Malcolm <dmalcolm@redhat.com>
1590 PR analyzer/110112
1591 * region-model.cc (region_model::get_initial_value_for_global):
1592 Move code to region::calc_initial_value_at_main.
1593 * region.cc (region::get_initial_value_at_main): New function.
1594 (region::calc_initial_value_at_main): New function, based on code
1595 in region_model::get_initial_value_for_global.
1596 (region::region): Initialize m_cached_init_sval_at_main.
1597 (decl_region::get_svalue_for_constructor): Add a cache, splitting
1598 out body to...
1599 (decl_region::calc_svalue_for_constructor): ...this new function.
1600 * region.h (region::get_initial_value_at_main): New decl.
1601 (region::calc_initial_value_at_main): New decl.
1602 (region::m_cached_init_sval_at_main): New field.
1603 (decl_region::decl_region): Initialize m_ctor_svalue.
1604 (decl_region::calc_svalue_for_constructor): New decl.
1605 (decl_region::m_ctor_svalue): New field.
1607 2023-06-08 Benjamin Priour <vultkayn@gcc.gnu.org>
1609 * bounds-checking.cc (region_model::check_symbolic_bounds): Returns whether the BASE_REG
1610 region access was OOB.
1611 (region_model::check_region_bounds): Likewise.
1612 * region-model.cc (region_model::get_store_value): Creates an
1613 unknown svalue on OOB-read access to REG.
1614 (region_model::check_region_access): Returns whether an unknown svalue needs be created.
1615 (region_model::check_region_for_read): Passes check_region_access return value.
1616 * region-model.h: Update prior function definitions.
1618 2023-06-02 David Malcolm <dmalcolm@redhat.com>
1620 PR analyzer/109015
1621 * kf.cc (class kf_atomic_exchange): New.
1622 (class kf_atomic_exchange_n): New.
1623 (class kf_atomic_fetch_op): New.
1624 (class kf_atomic_op_fetch): New.
1625 (class kf_atomic_load): New.
1626 (class kf_atomic_load_n): New.
1627 (class kf_atomic_store_n): New.
1628 (register_atomic_builtins): New function.
1629 (register_known_functions): Call register_atomic_builtins.
1631 2023-06-02 David Malcolm <dmalcolm@redhat.com>
1633 * store.cc (store::eval_alias_1): Regions in different memory
1634 spaces can't alias.
1636 2023-05-18 Bernhard Reutner-Fischer <aldot@gcc.gnu.org>
1638 * region-model-manager.cc (get_code_for_cast): Use _P defines from
1639 tree.h.
1640 (region_model_manager::get_or_create_cast): Ditto.
1641 (region_model_manager::get_region_for_global): Ditto.
1642 * region-model.cc (region_model::get_lvalue_1): Ditto.
1643 * region.cc (decl_region::maybe_get_constant_value): Ditto.
1645 2023-03-22 David Malcolm <dmalcolm@redhat.com>
1647 PR analyzer/109239
1648 * program-point.cc: Include "analyzer/inlining-iterator.h".
1649 (program_point::effectively_intraprocedural_p): New function.
1650 * program-point.h (program_point::effectively_intraprocedural_p):
1651 New decl.
1652 * sm-malloc.cc (deref_before_check::emit): Use it when rejecting
1653 interprocedural cases, so that we reject interprocedural cases
1654 that have become intraprocedural due to inlining.
1656 2023-03-18 David Malcolm <dmalcolm@redhat.com>
1658 PR analyzer/109094
1659 * region-model.cc (region_model::on_longjmp): Pass false for
1660 new "eval_return_svalue" param of pop_frame.
1661 (region_model::pop_frame): Add new "eval_return_svalue" param and
1662 use it to suppress the call to get_rvalue on the result when
1663 needed by on_longjmp.
1664 * region-model.h (region_model::pop_frame): Add new
1665 "eval_return_svalue" param.
1667 2023-03-10 David Malcolm <dmalcolm@redhat.com>
1669 PR analyzer/109059
1670 * region-model.cc (region_model::mark_region_as_unknown): Gather a
1671 set of maybe-live svalues and call on_maybe_live_values with it.
1672 * store.cc (binding_map::remove_overlapping_bindings): Add new
1673 "maybe_live_values" param; add any removed svalues to it.
1674 (binding_cluster::clobber_region): Add NULL as new param of
1675 remove_overlapping_bindings.
1676 (binding_cluster::mark_region_as_unknown): Add "maybe_live_values"
1677 param and pass it to remove_overlapping_bindings.
1678 (binding_cluster::maybe_get_compound_binding): Add NULL for new
1679 param of binding_map::remove_overlapping_bindings.
1680 (binding_cluster::remove_overlapping_bindings): Add
1681 "maybe_live_values" param and pass to
1682 binding_map::remove_overlapping_bindings.
1683 (store::set_value): Capture a set of maybe-live svalues, and call
1684 on_maybe_live_values with it.
1685 (store::on_maybe_live_values): New.
1686 (store::mark_region_as_unknown): Add "maybe_live_values" param
1687 and pass it to binding_cluster::mark_region_as_unknown.
1688 (store::remove_overlapping_bindings): Pass NULL for new param of
1689 binding_cluster::remove_overlapping_bindings.
1690 * store.h (binding_map::remove_overlapping_bindings): Add
1691 "maybe_live_values" param.
1692 (binding_cluster::mark_region_as_unknown): Likewise.
1693 (binding_cluster::remove_overlapping_bindings): Likewise.
1694 (store::mark_region_as_unknown): Likewise.
1695 (store::on_maybe_live_values): New decl.
1697 2023-03-10 David Malcolm <dmalcolm@redhat.com>
1699 PR analyzer/108475
1700 PR analyzer/109060
1701 * sm-malloc.cc (deref_before_check::deref_before_check):
1702 Initialize new field m_deref_expr. Assert that arg is non-NULL.
1703 (deref_before_check::emit): Reject cases where the spelling of the
1704 thing that was dereferenced differs from that of what is checked,
1705 or if the dereference expression was not found. Remove code to
1706 handle NULL m_arg.
1707 (deref_before_check::describe_state_change): Remove code to handle
1708 NULL m_arg.
1709 (deref_before_check::describe_final_event): Likewise.
1710 (deref_before_check::sufficiently_similar_p): New.
1711 (deref_before_check::m_deref_expr): New field.
1712 (malloc_state_machine::maybe_complain_about_deref_before_check):
1713 Don't warn if the diag_ptr is NULL.
1715 2023-03-03 David Malcolm <dmalcolm@redhat.com>
1717 * kf.cc (class kf_sprintf): New.
1718 (register_known_functions): Register it.
1720 2023-03-02 David Malcolm <dmalcolm@redhat.com>
1722 PR analyzer/108968
1723 * region-model.cc (region_model::get_rvalue_1): Handle VAR_DECLs
1724 with a DECL_HARD_REGISTER by returning UNKNOWN.
1726 2023-03-02 Hans-Peter Nilsson <hp@axis.com>
1728 * kf.cc (register_known_functions): Add __errno function for newlib.
1730 2023-03-01 David Malcolm <dmalcolm@redhat.com>
1732 PR analyzer/107565
1733 * region-model.cc (region_model::on_call_pre): Flatten logic by
1734 returning early. Consolidate logic for detecting const and pure
1735 functions. When considering whether an unhandled built-in
1736 function has side-effects, consider all kinds of builtin, rather
1737 than just BUILT_IN_NORMAL, and don't require
1738 gimple_builtin_call_types_compatible_p.
1740 2023-03-01 David Malcolm <dmalcolm@redhat.com>
1742 PR analyzer/108935
1743 * infinite-recursion.cc (contains_unknown_p): New.
1744 (sufficiently_different_region_binding_p): New function, splitting
1745 out inner loop from...
1746 (sufficiently_different_p): ...here. Extend detection of unknown
1747 svalues to also include svalues that contain unknown. Treat
1748 changes in frames below the entry to the recursion as being
1749 sufficiently different to reject being an infinite recursion.
1751 2023-02-21 David Malcolm <dmalcolm@redhat.com>
1753 PR analyzer/108830
1754 * analyzer.opt (fanalyzer-suppress-followups): New option.
1755 * engine.cc (impl_region_model_context::warn): Terminate the path
1756 if the diagnostic's terminate_path_p vfunc returns true and
1757 -fanalyzer-suppress-followups is true (the default).
1758 (impl_sm_context::warn): Likewise, for both overloads.
1759 * pending-diagnostic.h (pending_diagnostic::terminate_path_p): New
1760 vfunc.
1761 * program-state.cc (program_state::on_edge): Terminate the path if
1762 the ctxt requests it during updating the edge.
1763 * region-model.cc (poisoned_value_diagnostic::terminate_path_p):
1764 New vfunc.
1765 * sm-malloc.cc (null_deref::terminate_path_p): New vfunc.
1766 (null_arg::terminate_path_p): New vfunc.
1768 2023-02-16 David Malcolm <dmalcolm@redhat.com>
1770 PR analyzer/108806
1771 * constraint-manager.cc (bounded_range::dump_to_pp): Use
1772 bounded_range::singleton_p.
1773 (constraint_manager::add_bounded_ranges): Handle singleton ranges
1774 by adding an EQ_EXPR constraint.
1775 (constraint_manager::impossible_derived_conditions_p): New.
1776 (constraint_manager::eval_condition): Reject EQ_EXPR when it would
1777 imply impossible derived conditions.
1778 (selftest::test_bits): New.
1779 (selftest::run_constraint_manager_tests): Run it.
1780 * constraint-manager.h (bounded_range::singleton_p): New.
1781 (constraint_manager::impossible_derived_conditions_p): New decl.
1782 * region-model.cc (region_model::get_rvalue_1): Handle
1783 BIT_AND_EXPR, BIT_IOR_EXPR, and BIT_XOR_EXPR.
1785 2023-02-15 David Malcolm <dmalcolm@redhat.com>
1787 PR analyzer/108664
1788 PR analyzer/108666
1789 PR analyzer/108725
1790 * diagnostic-manager.cc (epath_finder::get_best_epath): Add
1791 "target_stmt" param.
1792 (epath_finder::explore_feasible_paths): Likewise.
1793 (epath_finder::process_worklist_item): Likewise.
1794 (saved_diagnostic::calc_best_epath): Pass m_stmt to
1795 epath_finder::get_best_epath.
1796 * engine.cc (feasibility_state::maybe_update_for_edge): Move
1797 per-stmt logic to...
1798 (feasibility_state::update_for_stmt): ...this new function.
1799 * exploded-graph.h (feasibility_state::update_for_stmt): New decl.
1800 * feasible-graph.cc (feasible_node::get_state_at_stmt): New.
1801 * feasible-graph.h: Include "analyzer/exploded-graph.h".
1802 (feasible_node::get_state_at_stmt): New decl.
1803 * infinite-recursion.cc
1804 (infinite_recursion_diagnostic::check_valid_fpath_p): Update for
1805 vfunc signature change.
1806 * pending-diagnostic.h (pending_diagnostic::check_valid_fpath_p):
1807 Convert first param to a reference. Add stmt param.
1808 * region-model.cc: Include "analyzer/feasible-graph.h".
1809 (poisoned_value_diagnostic::poisoned_value_diagnostic): Add
1810 "check_expr" param.
1811 (poisoned_value_diagnostic::check_valid_fpath_p): New.
1812 (poisoned_value_diagnostic::m_check_expr): New field.
1813 (region_model::check_for_poison): Attempt to supply a check_expr
1814 to the diagnostic
1815 (region_model::deref_rvalue): Add NULL for new check_expr param
1816 of poisoned_value_diagnostic.
1817 (region_model::get_or_create_region_for_heap_alloc): Don't reuse
1818 regions that are marked as TOUCHED.
1820 2023-02-10 David Malcolm <dmalcolm@redhat.com>
1822 PR analyzer/108745
1823 * sm-malloc.cc (deref_before_check::emit): Reject the warning if
1824 the check occurs within a macro defintion.
1826 2023-02-09 David Malcolm <dmalcolm@redhat.com>
1828 PR analyzer/108733
1829 * state-purge.cc (get_candidate_for_purging): Add ADDR_EXPR
1830 and MEM_REF.
1832 2023-02-08 David Malcolm <dmalcolm@redhat.com>
1834 PR analyzer/108704
1835 * state-purge.cc (state_purge_per_decl::process_point_backwards):
1836 Don't stop processing the decl if it's fully overwritten by
1837 this stmt if it's also used by this stmt.
1839 2023-02-07 David Malcolm <dmalcolm@redhat.com>
1841 PR analyzer/108661
1842 * sm-fd.cc (class kf_read): New.
1843 (register_known_fd_functions): Register "read".
1844 * sm-file.cc (class kf_fread): Update comment.
1846 2023-02-02 David Malcolm <dmalcolm@redhat.com>
1848 PR analyzer/108633
1849 * sm-fd.cc (fd_state_machine::check_for_fd_attrs): Add missing
1850 "continue".
1851 (fd_state_machine::on_listen): Don't issue phase-mismatch or
1852 type-mismatch warnings for the "invalid" state.
1854 2023-02-01 David Malcolm <dmalcolm@redhat.com>
1856 PR analyzer/108616
1857 * pending-diagnostic.cc (fixup_location_in_macro_p): Add "alloca"
1858 to macros that we shouldn't unwind inside.
1860 2023-01-26 David Malcolm <dmalcolm@redhat.com>
1862 PR analyzer/108524
1863 * analyzer.h (class feasible_node): New forward decl.
1864 * diagnostic-manager.cc (epath_finder::get_best_epath): Add "pd"
1865 param.
1866 (epath_finder::explore_feasible_paths): Likewise.
1867 (epath_finder::process_worklist_item): Likewise. Use it to call
1868 pending_diagnostic::check_valid_fpath_p on the final fpath to
1869 give pending_diagnostic a way to add additional restrictions on
1870 feasibility.
1871 (saved_diagnostic::calc_best_epath): Pass pending_diagnostic to
1872 epath_finder::get_best_epath.
1873 * infinite-recursion.cc: Include "analyzer/feasible-graph.h".
1874 (infinite_recursion_diagnostic::check_valid_fpath_p): New.
1875 (infinite_recursion_diagnostic::fedge_uses_conjured_svalue_p): New.
1876 (infinite_recursion_diagnostic::expr_uses_conjured_svalue_p): New.
1877 * pending-diagnostic.h (pending_diagnostic::check_valid_fpath_p):
1878 New vfunc.
1880 2023-01-19 David Malcolm <dmalcolm@redhat.com>
1882 PR analyzer/108455
1883 * analyzer.h (class checker_event): New forward decl.
1884 (class state_change_event): Indent.
1885 (class warning_event): New forward decl.
1886 * checker-event.cc (state_change_event::state_change_event): Add
1887 "enode" param.
1888 (warning_event::get_desc): Update for new param of
1889 evdesc::final_event ctor.
1890 * checker-event.h (state_change_event::state_change_event): Add
1891 "enode" param.
1892 (state_change_event::get_exploded_node): New accessor.
1893 (state_change_event::m_enode): New field.
1894 (warning_event::warning_event): New "enode" param.
1895 (warning_event::get_exploded_node): New accessor.
1896 (warning_event::m_enode): New field.
1897 * diagnostic-manager.cc
1898 (state_change_event_creator::on_global_state_change): Pass
1899 src_node to state_change_event ctor.
1900 (state_change_event_creator::on_state_change): Likewise.
1901 (null_assignment_sm_context::set_next_state): Pass NULL for
1902 new param of state_change_event ctor.
1903 * infinite-recursion.cc
1904 (infinite_recursion_diagnostic::add_final_event): Update for new
1905 param of warning_event ctor.
1906 * pending-diagnostic.cc (pending_diagnostic::add_final_event):
1907 Pass enode to warning_event ctor.
1908 * pending-diagnostic.h (evdesc::final_event): Add reference to
1909 warning_event.
1910 * sm-malloc.cc: Include "analyzer/checker-event.h" and
1911 "analyzer/exploded-graph.h".
1912 (deref_before_check::deref_before_check): Initialize new fields.
1913 (deref_before_check::emit): Reject warnings in which we were
1914 unable to determine the enodes of the dereference and the check.
1915 Reject warnings interprocedural warnings. Reject warnings in which
1916 the dereference doesn't dominate the check.
1917 (deref_before_check::describe_state_change): Set m_deref_enode.
1918 (deref_before_check::describe_final_event): Set m_check_enode.
1919 (deref_before_check::m_deref_enode): New field.
1920 (deref_before_check::m_check_enode): New field.
1922 2023-01-13 David Malcolm <dmalcolm@redhat.com>
1924 PR analyzer/105273
1925 * region-model.cc (has_nondefault_case_for_value_p): New.
1926 (has_nondefault_cases_for_all_enum_values_p): New.
1927 (region_model::apply_constraints_for_gswitch): Skip
1928 implicitly-created "default" when switching on an enum
1929 and all enum values have non-default cases.
1930 (rejected_default_case::dump_to_pp): New.
1931 * region-model.h (region_model_context::possibly_tainted_p): New
1932 decl.
1933 (class rejected_default_case): New.
1934 * sm-taint.cc (region_model_context::possibly_tainted_p): New.
1935 * supergraph.cc (switch_cfg_superedge::dump_label_to_pp): Dump
1936 when implicitly_created_default_p.
1937 (switch_cfg_superedge::implicitly_created_default_p): New.
1938 * supergraph.h
1939 (switch_cfg_superedge::implicitly_created_default_p): New decl.
1941 2023-01-11 David Malcolm <dmalcolm@redhat.com>
1943 PR analyzer/108252
1944 * kf.cc (class kf_strdup): New.
1945 (class kf_strndup): New.
1946 (register_known_functions): Register them.
1947 * region-model.cc (region_model::on_call_pre): Use
1948 &HEAP_ALLOCATED_REGION for the default result of an external
1949 function with the "malloc" attribute, rather than CONJURED_SVALUE.
1950 (region_model::get_or_create_region_for_heap_alloc): Allow
1951 "size_in_bytes" to be NULL.
1952 * store.cc (store::set_value): When handling *UNKNOWN = VAL,
1953 mark VAL as "maybe bound".
1955 2022-12-16 David Malcolm <dmalcolm@redhat.com>
1957 PR analyzer/106479
1958 * kf.cc (kf_memcpy_memmove::impl_call_pre): Pass in source region
1959 to region_model::check_for_poison.
1960 * region-model-asm.cc (region_model::on_asm_stmt): Pass NULL
1961 region to region_model::check_for_poison.
1962 * region-model.cc (region_model::check_for_poison): Add
1963 "src_region" param, and pass it to poisoned_value_diagnostic.
1964 (region_model::on_assignment): Pass NULL region to
1965 region_model::check_for_poison.
1966 (region_model::get_rvalue): Likewise.
1967 * region-model.h (region_model::check_for_poison): Add
1968 "src_region" param.
1969 * sm-fd.cc (fd_state_machine::on_accept): Pass in source region
1970 to region_model::check_for_poison.
1971 * varargs.cc (kf_va_copy::impl_call_pre): Pass NULL region to
1972 region_model::check_for_poison.
1973 (kf_va_arg::impl_call_pre): Pass in source region to
1974 region_model::check_for_poison.
1976 2022-12-14 David Malcolm <dmalcolm@redhat.com>
1978 PR analyzer/108065
1979 * region.cc (decl_region::get_svalue_for_initializer): Bail out to
1980 avoid calling binding_key::make with an empty region.
1981 * store.cc (binding_map::apply_ctor_val_to_range): Likewise.
1982 (binding_map::apply_ctor_pair_to_child_region): Likewise.
1983 (binding_cluster::bind): Likewise.
1984 (binding_cluster::purge_region): Likewise.
1985 (binding_cluster::maybe_get_compound_binding): Likewise.
1986 (binding_cluster::maybe_get_simple_value): Likewise.
1988 2022-12-09 David Malcolm <dmalcolm@redhat.com>
1990 * analyzer.h (class known_function): Expand comment.
1991 * region-model-impl-calls.cc: Rename to...
1992 * kf.cc: ...this.
1993 * known-function-manager.h (class known_function_manager): Add
1994 leading comment.
1996 2022-12-09 David Malcolm <dmalcolm@redhat.com>
1998 PR analyzer/108003
1999 * call-summary.cc
2000 (call_summary_replay::convert_region_from_summary_1): Convert
2001 heap_regs_in_use from auto_sbitmap to auto_bitmap.
2002 * region-model-manager.cc
2003 (region_model_manager::get_or_create_region_for_heap_alloc):
2004 Convert from sbitmap to bitmap.
2005 * region-model-manager.h: Likewise.
2006 * region-model.cc
2007 (region_model::get_or_create_region_for_heap_alloc): Convert from
2008 auto_sbitmap to auto_bitmap.
2009 (region_model::get_referenced_base_regions): Likewise.
2010 * region-model.h: Include "bitmap.h" rather than "sbitmap.h".
2011 (region_model::get_referenced_base_regions): Convert from
2012 auto_sbitmap to auto_bitmap.
2014 2022-12-09 David Malcolm <dmalcolm@redhat.com>
2016 * region-model-impl-calls.cc (class kf_memcpy): Rename to...
2017 (class kf_memcpy_memmove): ...this.
2018 (kf_memcpy::impl_call_pre): Rename to...
2019 (kf_memcpy_memmove::impl_call_pre): ...this, and check the src for
2020 poison.
2021 (register_known_functions): Update for above renaming, and
2022 register BUILT_IN_MEMMOVE and BUILT_IN_MEMMOVE_CHK.
2024 2022-12-06 David Malcolm <dmalcolm@redhat.com>
2026 PR analyzer/107882
2027 * region-model.cc (region_model::get_store_value): Return an
2028 unknown value for empty regions.
2029 (region_model::set_value): Bail on empty regions.
2030 * region.cc (region::empty_p): New.
2031 * region.h (region::empty_p): New decl.
2032 * state-purge.cc (same_binding_p): Bail if either region is empty.
2033 * store.cc (binding_key::make): Assert that a concrete binding's
2034 bit_size must be > 0.
2035 (binding_cluster::mark_region_as_unknown): Bail on empty regions.
2036 (binding_cluster::get_binding): Likewise.
2037 (binding_cluster::remove_overlapping_bindings): Likewise.
2038 (binding_cluster::on_unknown_fncall): Don't conjure values for
2039 empty regions.
2040 (store::fill_region): Bail on empty regions.
2041 * store.h (class concrete_binding): Update comment to reflect that
2042 the range of bits must be non-empty.
2043 (concrete_binding::concrete_binding): Assert that bit range is
2044 non-empty.
2046 2022-12-06 David Malcolm <dmalcolm@redhat.com>
2048 PR analyzer/106325
2049 * region-model-manager.cc
2050 (region_model_manager::get_or_create_null_ptr): New.
2051 * region-model-manager.h
2052 (region_model_manager::get_or_create_null_ptr): New decl.
2053 * region-model.cc (region_model::on_top_level_param): Add
2054 "nonnull" param and make use of it.
2055 (region_model::push_frame): When handling a top-level entrypoint
2056 to the analysis, determine which params __attribute__((nonnull))
2057 applies to, and pass to on_top_level_param.
2058 * region-model.h (region_model::on_top_level_param): Add "nonnull"
2059 param.
2061 2022-12-06 David Malcolm <dmalcolm@redhat.com>
2063 * analyzer.h (register_known_analyzer_functions): New decl.
2064 (register_known_functions_lang_cp): New decl.
2065 * call-details.cc: New file, split out from
2066 region-model-impl-calls.cc.
2067 * call-details.h: New file, split out from region-model.h.
2068 * call-info.cc: Include "analyzer/call-details.h".
2069 * call-summary.h: Likewise.
2070 * kf-analyzer.cc: New file, split out from
2071 region-model-impl-calls.cc.
2072 * kf-lang-cp.cc: Likewise.
2073 * known-function-manager.cc: Include "analyzer/call-details.h".
2074 * region-model-impl-calls.cc: Move definitions of call_details's
2075 member functions to call-details.cc. Move class kf_analyzer_* to
2076 kf-analyzer.cc. Move kf_operator_new and kf_operator_delete to
2077 kf-lang-cp.cc. Refresh #includes accordingly.
2078 (register_known_functions): Replace registration of __analyzer_*
2079 functions with a call to register_known_analyzer_functions.
2080 Replace registration of C++ support functions with a call to
2081 register_known_functions_lang_cp.
2082 * region-model.h (class call_details): Move to new call-details.h.
2083 * sm-fd.cc: Include "analyzer/call-details.h".
2084 * sm-file.cc: Likewise.
2085 * sm-malloc.cc: Likewise.
2086 * varargs.cc: Likewise.
2088 2022-12-02 David Malcolm <dmalcolm@redhat.com>
2090 * analyzer.h (struct event_loc_info): New forward decl.
2091 * bounds-checking.cc: Use event_loc_info throughout to bundle the
2092 loc, fndecl, depth triples.
2093 * call-info.cc: Likewise.
2094 * checker-event.cc: Likewise.
2095 * checker-event.h (struct event_loc_info): New decl. Use it
2096 throughout to bundle the loc, fndecl, depth triples.
2097 * checker-path.cc: Likewise.
2098 * checker-path.h: Likewise.
2099 * diagnostic-manager.cc: Likewise.
2100 * engine.cc: Likewise.
2101 * infinite-recursion.cc: Likewise.
2102 * pending-diagnostic.cc: Likewise.
2103 * pending-diagnostic.h: Likewise.
2104 * region-model.cc: Likewise.
2105 * sm-signal.cc: Likewise.
2106 * varargs.cc: Likewise.
2108 2022-12-02 David Malcolm <dmalcolm@redhat.com>
2110 PR analyzer/107851
2111 * analyzer.cc (make_label_text_n): Convert param "n" from int to
2112 unsigned HOST_WIDE_INT.
2113 * analyzer.h (make_label_text_n): Likewise for decl.
2114 * bounds-checking.cc: Include "analyzer/checker-event.h" and
2115 "analyzer/checker-path.h".
2116 (out_of_bounds::add_region_creation_events): New.
2117 (concrete_past_the_end::describe_region_creation_event): Replace
2118 with...
2119 (concrete_past_the_end::add_region_creation_events): ...this.
2120 (symbolic_past_the_end::describe_region_creation_event): Delete.
2121 * checker-event.cc (region_creation_event::region_creation_event):
2122 Update for dropping all member data.
2123 (region_creation_event::get_desc): Delete, splitting out into
2124 region_creation_event_memory_space::get_desc,
2125 region_creation_event_capacity::get_desc, and
2126 region_creation_event_debug::get_desc.
2127 (region_creation_event_memory_space::get_desc): New.
2128 (region_creation_event_capacity::get_desc): New.
2129 (region_creation_event_allocation_size::get_desc): New.
2130 (region_creation_event_debug::get_desc): New.
2131 * checker-event.h: Include "analyzer/program-state.h".
2132 (enum rce_kind): Delete.
2133 (class region_creation_event): Drop all member data.
2134 (region_creation_event::region_creation_event): Make protected.
2135 (region_creation_event::get_desc): Delete.
2136 (class region_creation_event_memory_space): New.
2137 (class region_creation_event_capacity): New.
2138 (class region_creation_event_allocation_size): New.
2139 (class region_creation_event_debug): New.
2140 * checker-path.cc (checker_path::add_region_creation_events): Add
2141 "pd" param. Call pending_diangnostic::add_region_creation_events.
2142 Update for conversion of RCE_DEBUG to region_creation_event_debug.
2143 * checker-path.h (checker_path::add_region_creation_events): Add
2144 "pd" param.
2145 * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
2146 Pass pending_diagnostic to
2147 emission_path::add_region_creation_events.
2148 (diagnostic_manager::build_emission_path): Pass path_builder to
2149 add_event_on_final_node.
2150 (diagnostic_manager::add_event_on_final_node): Add "pb" param.
2151 Pass pending_diagnostic to
2152 emission_path::add_region_creation_events.
2153 (diagnostic_manager::add_events_for_eedge): Pass
2154 pending_diagnostic to emission_path::add_region_creation_events.
2155 * diagnostic-manager.h
2156 (diagnostic_manager::add_event_on_final_node): Add "pb" param.
2157 * pending-diagnostic.cc
2158 (pending_diagnostic::add_region_creation_events): New.
2159 * pending-diagnostic.h (struct region_creation): Delete.
2160 (pending_diagnostic::describe_region_creation_event): Delete.
2161 (pending_diagnostic::add_region_creation_events): New vfunc.
2162 * region-model.cc: Include "analyzer/checker-event.h" and
2163 "analyzer/checker-path.h".
2164 (dubious_allocation_size::dubious_allocation_size): Initialize
2165 m_has_allocation_event.
2166 (dubious_allocation_size::describe_region_creation_event): Delete.
2167 (dubious_allocation_size::describe_final_event): Update for
2168 replacement of m_allocation_event with m_has_allocation_event.
2169 (dubious_allocation_size::add_region_creation_events): New.
2170 (dubious_allocation_size::m_allocation_event): Replace with...
2171 (dubious_allocation_size::m_has_allocation_event): ...this.
2173 2022-12-02 David Malcolm <dmalcolm@redhat.com>
2175 PR analyzer/107948
2176 * region-model-manager.cc
2177 (region_model_manager::maybe_fold_binop): Fold (0 - VAL) to -VAL.
2178 * region-model.cc (region_model::eval_condition): Handle e.g.
2179 "-X <= 0" as equivalent to X >= 0".
2181 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2183 PR analyzer/106626
2184 * bounds-checking.cc
2185 (symbolic_past_the_end::describe_final_event): Delete, moving to
2186 symbolic_buffer_overflow::describe_final_event and
2187 symbolic_buffer_over_read::describe_final_event, eliminating
2188 composition of text strings via "byte_str" and "m_dir_str".
2189 (symbolic_past_the_end::m_dir_str): Delete field.
2190 (symbolic_buffer_overflow::symbolic_buffer_overflow): Drop
2191 m_dir_str.
2192 (symbolic_buffer_overflow::describe_final_event): New, as noted
2193 above.
2194 (symbolic_buffer_over_read::symbolic_buffer_overflow): Drop
2195 m_dir_str.
2196 (symbolic_buffer_over_read::describe_final_event): New, as noted
2197 above.
2199 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2201 * bounds-checking.cc (class out_of_bounds): Split out from...
2202 (class concrete_out_of_bounds): New abstract subclass.
2203 (class past_the_end): Rename to...
2204 (class concrete_past_the_end): ...this, and make a subclass of
2205 concrete_out_of_bounds.
2206 (class buffer_overflow): Rename to...
2207 (class concrete_buffer_overflow): ...this, and make a subclass of
2208 concrete_past_the_end.
2209 (class buffer_over_read): Rename to...
2210 (class concrete_buffer_over_read): ...this, and make a subclass of
2211 concrete_past_the_end.
2212 (class buffer_underwrite): Rename to...
2213 (class concrete_buffer_underwrite): ...this, and make a subclass
2214 of concrete_out_of_bounds.
2215 (class buffer_under_read): Rename to...
2216 (class concrete_buffer_under_read): ...this, and make a subclass
2217 of concrete_out_of_bounds.
2218 (class symbolic_past_the_end): Convert to a subclass of
2219 out_of_bounds.
2220 (symbolic_buffer_overflow::get_kind): New.
2221 (symbolic_buffer_over_read::get_kind): New.
2222 (region_model::check_region_bounds): Update for renamings.
2223 * engine.cc (impl_sm_context::set_next_state): Eliminate
2224 "new_ctxt", passing NULL to get_rvalue instead.
2225 (impl_sm_context::warn): Likewise.
2227 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2229 PR analyzer/106626
2230 * bounds-checking.cc (out_of_bounds::get_memory_space): New.
2231 (buffer_overflow::emit): Use it.
2232 (class buffer_overread): Rename to...
2233 (class buffer_over_read): ...this.
2234 (buffer_over_read::emit): Specify which memory space the read is
2235 from, where known. Change "overread" to "over-read".
2236 (class buffer_underflow): Rename to...
2237 (class buffer_underwrite): ...this.
2238 (buffer_underwrite::emit): Specify which memory space the write is
2239 to, where known. Change "underflow" to "underwrite".
2240 (class buffer_underread): Rename to...
2241 (class buffer_under_read): Rename to...
2242 (buffer_under_read::emit): Specify which memory space the read is
2243 from, where known. Change "underread" to "under-read".
2244 (symbolic_past_the_end::get_memory_space): New.
2245 (symbolic_buffer_overflow::emit): Use it.
2246 (class symbolic_buffer_overread): Rename to...
2247 (class symbolic_buffer_over_read): ...this.
2248 (symbolic_buffer_over_read::emit): Specify which memory space the
2249 read is from, where known. Change "overread" to "over-read".
2250 (region_model::check_symbolic_bounds): Update for class renaming.
2251 (region_model::check_region_bounds): Likewise.
2253 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2255 PR analyzer/106626
2256 * bounds-checking.cc (out_of_bounds::maybe_describe_array_bounds):
2257 New.
2258 (buffer_overflow::emit): Call maybe_describe_array_bounds.
2259 (buffer_overread::emit): Likewise.
2260 (buffer_underflow::emit): Likewise.
2261 (buffer_underread::emit): Likewise.
2263 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2265 PR analyzer/106626
2266 * bounds-checking.cc (buffer_overflow::emit): Use inform_n.
2267 Update wording to clarify that we're talking about the size of
2268 the bad access, rather than its position.
2269 (buffer_overread::emit): Likewise.
2271 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2273 * bounds-checking.cc: New file, taken from region-model.cc.
2274 * region-model.cc (class out_of_bounds): Move to
2275 bounds-checking.cc.
2276 (class past_the_end): Likewise.
2277 (class buffer_overflow): Likewise.
2278 (class buffer_overread): Likewise.
2279 (class buffer_underflow): Likewise.
2280 (class buffer_underread): Likewise.
2281 (class symbolic_past_the_end): Likewise.
2282 (class symbolic_buffer_overflow): Likewise.
2283 (class symbolic_buffer_overread): Likewise.
2284 (region_model::check_symbolic_bounds): Likewise.
2285 (maybe_get_integer_cst_tree): Likewise.
2286 (region_model::check_region_bounds): Likewise.
2287 * region-model.h: Add comment.
2289 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2291 PR analyzer/107928
2292 * sm-fd.cc (fd_state_machine::on_bind): Handle m_constant_fd in
2293 the "success" outcome.
2294 (fd_state_machine::on_connect): Likewise.
2295 * sm-fd.dot: Add "constant_fd" state and its transitions.
2297 2022-11-30 David Malcolm <dmalcolm@redhat.com>
2299 * region-model-impl-calls.cc (class kf_fgets): Move to sm-file.cc.
2300 (kf_fgets::impl_call_pre): Likewise.
2301 (class kf_fread): Likewise.
2302 (kf_fread::impl_call_pre): Likewise.
2303 (class kf_getchar): Likewise.
2304 (class kf_stdio_output_fn): Likewise.
2305 (register_known_functions): Move registration of
2306 BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
2307 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
2308 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
2309 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
2310 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
2311 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF,
2312 "getchar", "fgets", "fgets_unlocked", and "fread" to
2313 register_known_file_functions.
2314 * sm-file.cc (class kf_stdio_output_fn): Move here from
2315 region-model-impl-calls.cc.
2316 (class kf_fgets): Likewise.
2317 (class kf_fread): Likewise.
2318 (class kf_getchar): Likewise.
2319 (register_known_file_functions): Move registration of
2320 BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
2321 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
2322 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
2323 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
2324 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
2325 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF,
2326 "fgets", "fgets_unlocked", "fread", and "getchar" to here from
2327 register_known_functions.
2329 2022-11-30 David Malcolm <dmalcolm@redhat.com>
2331 PR analyzer/103546
2332 * analyzer.h (register_known_file_functions): New decl.
2333 * program-state.cc (sm_state_map::replay_call_summary): Rejct
2334 attempts to store sm-state for caller_sval that can't have
2335 associated state.
2336 * region-model-impl-calls.cc (register_known_functions): Call
2337 register_known_file_functions.
2338 * sm-fd.cc (class kf_isatty): New.
2339 (register_known_fd_functions): Register it.
2340 * sm-file.cc (class kf_ferror): New.
2341 (class kf_fileno): New.
2342 (class kf_getc): New.
2343 (register_known_file_functions): New.
2345 2022-11-30 David Malcolm <dmalcolm@redhat.com>
2347 PR analyzer/105784
2348 * region-model-manager.cc
2349 (region_model_manager::maybe_fold_binop): For POINTER_PLUS_EXPR,
2350 PLUS_EXPR and MINUS_EXPR, eliminate requirement that the final
2351 type matches that of arg0 in favor of a cast.
2353 2022-11-24 Martin Liska <mliska@suse.cz>
2355 * varargs.cc: Fix Clang warnings.
2357 2022-11-24 David Malcolm <dmalcolm@redhat.com>
2359 PR analyzer/106473
2360 * call-summary.cc
2361 (call_summary_replay::convert_region_from_summary_1): Update for
2362 change to creation of heap-allocated regions.
2363 * program-state.cc (test_program_state_1): Likewise.
2364 (test_program_state_merging): Likewise.
2365 * region-model-impl-calls.cc (kf_calloc::impl_call_pre): Likewise.
2366 (kf_malloc::impl_call_pre): Likewise.
2367 (kf_operator_new::impl_call_pre): Likewise.
2368 (kf_realloc::impl_call_postsuccess_with_move::update_model): Likewise.
2369 * region-model-manager.cc
2370 (region_model_manager::create_region_for_heap_alloc): Convert
2371 to...
2372 (region_model_manager::get_or_create_region_for_heap_alloc):
2373 ...this, reusing an existing region if it's unreferenced in the
2374 client state.
2375 * region-model-manager.h (region_model_manager::get_num_regions): New.
2376 (region_model_manager::create_region_for_heap_alloc): Convert to...
2377 (region_model_manager::get_or_create_region_for_heap_alloc): ...this.
2378 * region-model.cc (region_to_value_map::can_merge_with_p): Reject
2379 merger when the values are different.
2380 (region_model::create_region_for_heap_alloc): Convert to...
2381 (region_model::get_or_create_region_for_heap_alloc): ...this.
2382 (region_model::get_referenced_base_regions): New.
2383 (selftest::test_state_merging): Update for change to creation of
2384 heap-allocated regions.
2385 (selftest::test_malloc_constraints): Likewise.
2386 (selftest::test_malloc): Likewise.
2387 * region-model.h: Include "sbitmap.h".
2388 (region_model::create_region_for_heap_alloc): Convert to...
2389 (region_model::get_or_create_region_for_heap_alloc): ...this.
2390 (region_model::get_referenced_base_regions): New decl.
2391 * store.cc (store::canonicalize): Don't purge a heap-allocated region
2392 that's been marked as escaping.
2394 2022-11-24 David Malcolm <dmalcolm@redhat.com>
2396 * checker-path.cc (checker_path::inject_any_inlined_call_events):
2397 Don't dump the address of the block when -fdump-noaddr.
2399 2022-11-24 David Malcolm <dmalcolm@redhat.com>
2401 * region-model.h (region_model::on_socket): Delete decl.
2402 (region_model::on_bind): Likewise.
2403 (region_model::on_listen): Likewise.
2404 (region_model::on_accept): Likewise.
2405 (region_model::on_connect): Likewise.
2406 * sm-fd.cc (kf_socket::outcome_of_socket::update_model): Move body
2407 of region_model::on_socket into here, ...
2408 (region_model::on_socket): ...eliminating this function.
2409 (kf_bind::outcome_of_bind::update_model): Likewise for on_bind...
2410 (region_model::on_bind): ...eliminating this function.
2411 (kf_listen::outcome_of_listen::update_model): Likewise fo
2412 on_listen...
2413 (region_model::on_listen): ...eliminating this function.
2414 (kf_accept::outcome_of_accept::update_model): Likewise fo
2415 on_accept...
2416 (region_model::on_accept): ...eliminating this function.
2417 (kf_connect::outcome_of_connect::update_model): Likewise fo
2418 on_connect...
2419 (region_model::on_connect): ...eliminating this function.
2421 2022-11-24 David Malcolm <dmalcolm@redhat.com>
2423 * analyzer.h (register_known_fd_functions): New decl.
2424 * region-model-impl-calls.cc (class kf_accept): Move to sm-fd.cc.
2425 (class kf_bind): Likewise.
2426 (class kf_connect): Likewise.
2427 (class kf_listen): Likewise.
2428 (class kf_pipe): Likewise.
2429 (class kf_socket): Likewise.
2430 (register_known_functions): Remove registration of the above
2431 functions, instead calling register_known_fd_functions.
2432 * sm-fd.cc: Include "analyzer/call-info.h".
2433 (class kf_socket): Move here from region-model-impl-calls.cc.
2434 (class kf_bind): Likewise.
2435 (class kf_listen): Likewise.
2436 (class kf_accept): Likewise.
2437 (class kf_connect): Likewise.
2438 (class kf_pipe): Likewise.
2439 (register_known_fd_functions): New.
2441 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2443 PR analyzer/107788
2444 * known-function-manager.cc (known_function_manager::get_match):
2445 Don't look up fndecls by name when they're not in the root
2446 namespace.
2448 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2450 PR analyzer/107783
2451 * sm-fd.cc (fd_state_machine::check_for_new_socket_fd): Don't
2452 complain when old state is "fd-constant".
2453 (fd_state_machine::on_listen): Likewise.
2454 (fd_state_machine::on_accept): Likewise.
2456 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2458 PR analyzer/107807
2459 * region-model-impl-calls.cc (register_known_functions): Register
2460 "___errno" and "__error" as synonyms for "__errno_location".
2462 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2464 * analyzer.h (class internal_known_function): New.
2465 (register_varargs_builtins): New decl.
2466 * engine.cc (exploded_node::on_stmt_pre): Remove
2467 "out_terminate_path" param from call to region_model::on_stmt_pre.
2468 (feasibility_state::maybe_update_for_edge): Likewise.
2469 * known-function-manager.cc: Include "basic-block.h", "gimple.h",
2470 and "analyzer/region-model.h".
2471 (known_function_manager::known_function_manager): Initialize
2472 m_combined_fns_arr.
2473 (known_function_manager::~known_function_manager): Clean up
2474 m_combined_fns_arr.
2475 (known_function_manager::get_by_identifier): Make const.
2476 (known_function_manager::add): New overloaded definitions for
2477 enum built_in_function and enum internal_fn.
2478 (known_function_manager::get_by_fndecl): Delete.
2479 (known_function_manager::get_match): New.
2480 (known_function_manager::get_internal_fn): New.
2481 (known_function_manager::get_normal_builtin): New.
2482 * known-function-manager.h
2483 (known_function_manager::get_by_identifier): Make private and
2484 add const qualifier.
2485 (known_function_manager::get_by_fndecl): Delete.
2486 (known_function_manager::add): Add overloaded decls for
2487 enum built_in_function name and enum internal_fn.
2488 (known_function_manager::get_match): New decl.
2489 (known_function_manager::get_internal_fn): New decl.
2490 (known_function_manager::get_normal_builtin): New decl.
2491 (known_function_manager::m_combined_fns_arr): New field.
2492 * region-model-impl-calls.cc (call_details::arg_is_size_p): New.
2493 (class kf_alloca): New.
2494 (region_model::impl_call_alloca): Convert to...
2495 (kf_alloca::impl_call_pre): ...this.
2496 (kf_analyzer_dump_capacity::matches_call_types_p): Rewrite check
2497 to use call_details::arg_is_pointer_p.
2498 (region_model::impl_call_builtin_expect): Convert to...
2499 (class kf_expect): ...this.
2500 (class kf_calloc): New, adding check that both arguments are
2501 size_t.
2502 (region_model::impl_call_calloc): Convert to...
2503 (kf_calloc::impl_call_pre): ...this.
2504 (kf_connect::matches_call_types_p): Rewrite check to use
2505 call_details::arg_is_pointer_p.
2506 (region_model::impl_call_error): Convert to...
2507 (class kf_error): ...this, and...
2508 (kf_error::impl_call_pre): ...this.
2509 (class kf_fgets): New, adding checks that args 0 and 2 are
2510 pointers.
2511 (region_model::impl_call_fgets): Convert to...
2512 (kf_fgets::impl_call_pre): ...this.
2513 (class kf_fread): New, adding checks on the argument types.
2514 (region_model::impl_call_fread): Convert to...
2515 (kf_fread::impl_call_pre): ...this.
2516 (class kf_free): New, adding check that the argument is a pointer.
2517 (region_model::impl_call_free): Convert to...
2518 (kf_free::impl_call_post): ...this.
2519 (class kf_getchar): New.
2520 (class kf_malloc): New, adding check that the argument is a
2521 size_t.
2522 (region_model::impl_call_malloc): Convert to...
2523 (kf_malloc::impl_call_pre): ...this.
2524 (class kf_memcpy): New, adding checks on arguments.
2525 (region_model::impl_call_memcpy): Convert to...
2526 (kf_memcpy::impl_call_pre): ...this.
2527 (class kf_memset): New.
2528 (region_model::impl_call_memset): Convert to...
2529 (kf_memset::impl_call_pre): ...this.
2530 (kf_pipe::matches_call_types_p): Rewrite check to use
2531 call_details::arg_is_pointer_p.
2532 (kf_putenv::matches_call_types_p): Likewise.
2533 (class kf_realloc): New, adding checks on the argument types.
2534 (region_model::impl_call_realloc): Convert to...
2535 (kf_realloc::impl_call_post): ...this.
2536 (class kf_strchr): New.
2537 (region_model::impl_call_strchr): Convert to...
2538 (kf_strchr::impl_call_post): ...this.
2539 (class kf_stack_restore): New.
2540 (class kf_stack_save): New.
2541 (class kf_stdio_output_fn): New.
2542 (class kf_strcpy): New,
2543 (region_model::impl_call_strcpy): Convert to...
2544 (kf_strcpy::impl_call_pre): ...this.
2545 (class kf_strlen): New.
2546 (region_model::impl_call_strlen): Convert to...
2547 (kf_strlen::impl_call_pre): ...this.
2548 (class kf_ubsan_bounds): New.
2549 (region_model::impl_deallocation_call): Reimplement to avoid call
2550 to impl_call_free.
2551 (register_known_functions): Add handlers for IFN_BUILTIN_EXPECT
2552 and IFN_UBSAN_BOUNDS. Add handlers for BUILT_IN_ALLOCA,
2553 BUILT_IN_ALLOCA_WITH_ALIGN, BUILT_IN_CALLOC, BUILT_IN_EXPECT,
2554 BUILT_IN_EXPECT_WITH_PROBABILITY, BUILT_IN_FPRINTF,
2555 BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
2556 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
2557 BUILT_IN_FREE, BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED,
2558 BUILT_IN_MALLOC, BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK,
2559 BUILT_IN_MEMSET, BUILT_IN_MEMSET_CHK, BUILT_IN_PRINTF,
2560 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
2561 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
2562 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_REALLOC, BUILT_IN_STACK_RESTORE,
2563 BUILT_IN_STACK_SAVE, BUILT_IN_STRCHR, BUILT_IN_STRCPY,
2564 BUILT_IN_STRCPY_CHK, BUILT_IN_STRLEN, BUILT_IN_VFPRINTF, and
2565 BUILT_IN_VPRINTF. Call register_varargs_builtins. Add handlers
2566 for "getchar", "memset", "fgets", "fgets_unlocked", "fread",
2567 "error", and "error_at_line".
2568 * region-model.cc (region_model::on_stmt_pre): Drop
2569 "out_terminate_path" param.
2570 (region_model::get_known_function): Reimplement by calling
2571 known_function_manager::get_match, passing new "cd" param.
2572 Add overload taking enum internal_fn.
2573 (region_model::on_call_pre): Drop "out_terminate_path" param.
2574 Remove special-case handling of internal fns IFN_BUILTIN_EXPECT,
2575 IFN_UBSAN_BOUNDS, and IFN_VA_ARG, of built-in fns BUILT_IN_ALLOCA,
2576 BUILT_IN_ALLOCA_WITH_ALIGN, BUILT_IN_CALLOC, BUILT_IN_EXPECT,
2577 BUILT_IN_EXPECT_WITH_PROBABILITY, BUILT_IN_FREE, BUILT_IN_MALLOC,
2578 BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_MEMSET,
2579 BUILT_IN_MEMSET_CHK, BUILT_IN_REALLOC, BUILT_IN_STRCHR,
2580 BUILT_IN_STRCPY, BUILT_IN_STRCPY_CHK, BUILT_IN_STRLEN,
2581 BUILT_IN_STACK_SAVE, BUILT_IN_STACK_RESTORE, BUILT_IN_FPRINTF,
2582 BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED,
2583 BUILT_IN_FPUTC, BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS,
2584 BUILT_IN_FPUTS_UNLOCKED, BUILT_IN_FWRITE,
2585 BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
2586 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR,
2587 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED,
2588 BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF, BUILT_IN_VA_START, and
2589 BUILT_IN_VA_COPY, and of named functions "malloc", "calloc",
2590 "alloca", "realloc", "error", "error_at_line", "fgets",
2591 "fgets_unlocked", "fread", "getchar", "memset", "strchr", and
2592 "strlen". Replace all this special-casing with calls to
2593 get_known_function for internal fns and for fn decls.
2594 (region_model::on_call_post): Remove special-casing handling for
2595 "free" and "strchr", and for BUILT_IN_REALLOC, BUILT_IN_STRCHR,
2596 and BUILT_IN_VA_END. Replace by consolidating on usage of
2597 get_known_function.
2598 * region-model.h (call_details::arg_is_size_p): New.
2599 (region_model::on_stmt_pre): Drop "out_terminate_path" param.
2600 (region_model::on_call_pre): Likewise.
2601 (region_model::impl_call_alloca): Delete.
2602 (region_model::impl_call_builtin_expect): Delete.
2603 (region_model::impl_call_calloc): Delete.
2604 (region_model::impl_call_error): Delete.
2605 (region_model::impl_call_fgets): Delete.
2606 (region_model::impl_call_fread): Delete.
2607 (region_model::impl_call_free): Delete.
2608 (region_model::impl_call_malloc): Delete.
2609 (region_model::impl_call_memcpy): Delete.
2610 (region_model::impl_call_memset): Delete.
2611 (region_model::impl_call_realloc): Delete.
2612 (region_model::impl_call_strchr): Delete.
2613 (region_model::impl_call_strcpy): Delete.
2614 (region_model::impl_call_strlen): Delete.
2615 (region_model::impl_call_va_start): Delete.
2616 (region_model::impl_call_va_copy): Delete.
2617 (region_model::impl_call_va_arg): Delete.
2618 (region_model::impl_call_va_end): Delete.
2619 (region_model::check_region_for_write): Public.
2620 (region_model::get_known_function): Add "cd" param. Add
2621 overloaded decl taking enum internal_fn.
2622 * sm-malloc.cc: Update comments.
2623 * varargs.cc (class kf_va_start): New.
2624 (region_model::impl_call_va_start): Convert to...
2625 (kf_va_start::impl_call_pre): ...this.
2626 (class kf_va_copy): New.
2627 (region_model::impl_call_va_copy): Convert to...
2628 (kf_va_copy::impl_call_pre): ...this.
2629 (class kf_va_arg): New.
2630 (region_model::impl_call_va_arg): Convert to...
2631 (kf_va_arg::impl_call_pre): ...this.
2632 (class kf_va_end): New.
2633 (region_model::impl_call_va_end): Delete.
2634 (register_varargs_builtins): New.
2636 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2638 PR analyzer/107788
2639 * region-model.cc (region_model::update_for_int_cst_return):
2640 Require that the return type be an integer type.
2641 (region_model::update_for_nonzero_return): Likewise.
2643 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2645 PR analyzer/107783
2646 * region-model-impl-calls.cc (kf_accept::matches_call_types_p):
2647 Require that args 1 and 2 be pointers.
2648 (kf_bind::matches_call_types_p): Require that arg 1 be a pointer.
2649 * region-model.h (call_details::arg_is_pointer_p): New
2651 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2653 PR analyzer/107777
2654 * call-summary.cc
2655 (call_summary_replay::convert_region_from_summary_1): Handle
2656 RK_THREAD_LOCAL and RK_ERRNO in switch.
2657 * region-model.cc (region_model::get_representative_path_var_1):
2658 Likewise.
2660 2022-11-19 David Malcolm <dmalcolm@redhat.com>
2662 PR analyzer/107582
2663 * engine.cc (dynamic_call_info_t::update_model): Update the model
2664 by pushing or pop a frame, rather than by clobbering it with the
2665 model from the exploded_node's state.
2667 2022-11-18 David Malcolm <dmalcolm@redhat.com>
2669 * analyzer.cc (is_pipe_call_p): Delete.
2670 * analyzer.h (is_pipe_call_p): Delete.
2671 * region-model-impl-calls.cc (call_details::get_location): New.
2672 (class kf_analyzer_break): New, adapted from
2673 region_model::on_stmt_pre.
2674 (region_model::impl_call_analyzer_describe): Convert to...
2675 (class kf_analyzer_describe): ...this.
2676 (region_model::impl_call_analyzer_dump_capacity): Convert to...
2677 (class kf_analyzer_dump_capacity): ...this.
2678 (region_model::impl_call_analyzer_dump_escaped): Convert to...
2679 (class kf_analyzer_dump_escaped): ...this.
2680 (class kf_analyzer_dump_exploded_nodes): New.
2681 (region_model::impl_call_analyzer_dump_named_constant): Convert
2682 to...
2683 (class kf_analyzer_dump_named_constant): ...this.
2684 (class dump_path_diagnostic): Move here from region-model.cc.
2685 (class kf_analyzer_dump_path) New, adapted from
2686 region_model::on_stmt_pre.
2687 (class kf_analyzer_dump_region_model): Likewise.
2688 (region_model::impl_call_analyzer_eval): Convert to...
2689 (class kf_analyzer_eval): ...this.
2690 (region_model::impl_call_analyzer_get_unknown_ptr): Convert to...
2691 (class kf_analyzer_get_unknown_ptr): ...this.
2692 (class known_function_accept): Rename to...
2693 (class kf_accept): ...this.
2694 (class known_function_bind): Rename to...
2695 (class kf_bind): ...this.
2696 (class known_function_connect): Rename to...
2697 (class kf_connect): ...this.
2698 (region_model::impl_call_errno_location): Convert to...
2699 (class kf_errno_location): ...this.
2700 (class known_function_listen): Rename to...
2701 (class kf_listen): ...this.
2702 (region_model::impl_call_pipe): Convert to...
2703 (class kf_pipe): ...this.
2704 (region_model::impl_call_putenv): Convert to...
2705 (class kf_putenv): ...this.
2706 (region_model::impl_call_operator_new): Convert to...
2707 (class kf_operator_new): ...this.
2708 (region_model::impl_call_operator_delete): Convert to...
2709 (class kf_operator_delete): ...this.
2710 (class known_function_socket): Rename to...
2711 (class kf_socket): ...this.
2712 (register_known_functions): Rename param to KFM. Break out
2713 existing known functions into a "POSIX" section, and add "pipe",
2714 "pipe2", and "putenv". Add debugging functions
2715 "__analyzer_break", "__analyzer_describe",
2716 "__analyzer_dump_capacity", "__analyzer_dump_escaped",
2717 "__analyzer_dump_exploded_nodes",
2718 "__analyzer_dump_named_constant", "__analyzer_dump_path",
2719 "__analyzer_dump_region_model", "__analyzer_eval",
2720 "__analyzer_get_unknown_ptr". Add C++ support functions
2721 "operator new", "operator new []", "operator delete", and
2722 "operator delete []".
2723 * region-model.cc (class dump_path_diagnostic): Move to
2724 region-model-impl-calls.cc.
2725 (region_model::on_stmt_pre): Eliminate special-casing of
2726 "__analyzer_describe", "__analyzer_dump_capacity",
2727 "__analyzer_dump_escaped", "__analyzer_dump_named_constant",
2728 "__analyzer_dump_path", "__analyzer_dump_region_model",
2729 "__analyzer_eval", "__analyzer_break",
2730 "__analyzer_dump_exploded_nodes", "__analyzer_get_unknown_ptr",
2731 "__errno_location", "pipe", "pipe2", "putenv", "operator new",
2732 "operator new []", "operator delete", "operator delete []"
2733 "pipe" and "pipe2", handling them instead via the known_functions
2734 mechanism.
2735 * region-model.h (call_details::get_location): New decl.
2736 (region_model::impl_call_analyzer_describe): Delete decl.
2737 (region_model::impl_call_analyzer_dump_capacity): Delete decl.
2738 (region_model::impl_call_analyzer_dump_escaped): Delete decl.
2739 (region_model::impl_call_analyzer_dump_named_constant): Delete decl.
2740 (region_model::impl_call_analyzer_eval): Delete decl.
2741 (region_model::impl_call_analyzer_get_unknown_ptr): Delete decl.
2742 (region_model::impl_call_errno_location): Delete decl.
2743 (region_model::impl_call_pipe): Delete decl.
2744 (region_model::impl_call_putenv): Delete decl.
2745 (region_model::impl_call_operator_new): Delete decl.
2746 (region_model::impl_call_operator_delete): Delete decl.
2747 * sm-fd.cc: Update comments.
2749 2022-11-16 David Malcolm <dmalcolm@redhat.com>
2751 PR analyzer/107711
2752 * analyzer-language.cc: Include "diagnostic.h".
2753 (maybe_stash_named_constant): Add logger param and use it to log
2754 the name being looked up, and the result.
2755 (stash_named_constants): New, splitting out from...
2756 (on_finish_translation_unit): ...this function. Call
2757 get_or_create_logfile and use the result to create a logger
2758 instance, passing it to stash_named_constants.
2759 * analyzer.h (get_or_create_any_logfile): New decl.
2760 * engine.cc (dump_fout, owns_dump_fout): New globals, split out
2761 from run_checkers.
2762 (get_or_create_any_logfile): New function, split out from...
2763 (run_checkers): ...here, so that the logfile can be opened by
2764 on_finish_translation_unit. Clear the globals when closing the
2765 dump file.
2767 2022-11-16 David Malcolm <dmalcolm@redhat.com>
2769 * analyzer.h (known_function::matches_call_types_p): New vfunc.
2770 (known_function::impl_call_pre): Provide base implementation.
2771 (known_function::impl_call_post): New vfunc.
2772 (register_known_functions): New.
2773 * engine.cc (impl_run_checkers): Call register_known_functions.
2774 * region-model-impl-calls.cc (region_model::impl_call_accept):
2775 Convert to...
2776 (class known_function_accept): ...this.
2777 (region_model::impl_call_bind): Convert to...
2778 (class known_function_bind): ...this.
2779 (region_model::impl_call_connect): Convert to...
2780 (class known_function_connect): ...this.
2781 (region_model::impl_call_listen): Convert to...
2782 (class known_function_listen): ...this.
2783 (region_model::impl_call_socket): Convert to...
2784 (class known_function_socket): ...this.
2785 (register_known_functions): New.
2786 * region-model.cc (region_model::on_call_pre): Remove special
2787 case for "bind" in favor of the known_function-handling dispatch.
2788 Add call to known_function::matches_call_types_p to latter.
2789 (region_model::on_call_post): Remove special cases for "accept",
2790 "bind", "connect", "listen", and "socket" in favor of dispatch
2791 to known_function::impl_call_post.
2792 * region-model.h (region_model::impl_call_accept): Delete decl.
2793 (region_model::impl_call_bind): Delete decl.
2794 (region_model::impl_call_connect): Delete decl.
2795 (region_model::impl_call_listen): Delete decl.
2796 (region_model::impl_call_socket): Delete decl.
2797 * sm-fd.cc: Update comments.
2799 2022-11-16 David Malcolm <dmalcolm@redhat.com>
2801 * checker-event.cc: New file, split out from...
2802 * checker-path.cc: ...this file.
2804 2022-11-15 David Malcolm <dmalcolm@redhat.com>
2806 PR analyzer/106140
2807 * analyzer-language.cc (on_finish_translation_unit): Stash named
2808 constants "SOCK_STREAM" and "SOCK_DGRAM".
2809 * analyzer.opt (Wanalyzer-fd-phase-mismatch): New.
2810 (Wanalyzer-fd-type-mismatch): New.
2811 * engine.cc (impl_region_model_context::get_state_map_by_name):
2812 Add "out_sm_context" param. Allow out_sm_idx to be NULL.
2813 * exploded-graph.h
2814 (impl_region_model_context::get_state_map_by_name):
2815 Add "out_sm_context" param.
2816 * region-model-impl-calls.cc (region_model::impl_call_accept): New.
2817 (region_model::impl_call_bind): New.
2818 (region_model::impl_call_connect): New.
2819 (region_model::impl_call_listen): New.
2820 (region_model::impl_call_socket): New.
2821 * region-model.cc (region_model::on_call_pre): Special-case
2822 "bind".
2823 (region_model::on_call_post): Special-case "accept", "bind",
2824 "connect", "listen", and "socket".
2825 * region-model.h (region_model::impl_call_accept): New decl.
2826 (region_model::impl_call_bind): New decl.
2827 (region_model::impl_call_connect): New decl.
2828 (region_model::impl_call_listen): New decl.
2829 (region_model::impl_call_socket): New decl.
2830 (region_model::on_socket): New decl.
2831 (region_model::on_bind): New decl.
2832 (region_model::on_listen): New decl.
2833 (region_model::on_accept): New decl.
2834 (region_model::on_connect): New decl.
2835 (region_model::add_constraint): Make public.
2836 (region_model::check_for_poison): Make public.
2837 (region_model_context::get_state_map_by_name): Add out_sm_context param.
2838 (region_model_context::get_fd_map): Likewise.
2839 (region_model_context::get_malloc_map): Likewise.
2840 (region_model_context::get_taint_map): Likewise.
2841 (noop_region_model_context::get_state_map_by_name): Likewise.
2842 (region_model_context_decorator::get_state_map_by_name): Likewise.
2843 * sm-fd.cc: Include "analyzer/supergraph.h" and
2844 "analyzer/analyzer-language.h".
2845 (enum expected_phase): New enum.
2846 (fd_state_machine::m_new_datagram_socket): New.
2847 (fd_state_machine::m_new_stream_socket): New.
2848 (fd_state_machine::m_new_unknown_socket): New.
2849 (fd_state_machine::m_bound_datagram_socket): New.
2850 (fd_state_machine::m_bound_stream_socket): New.
2851 (fd_state_machine::m_bound_unknown_socket): New.
2852 (fd_state_machine::m_listening_stream_socket): New.
2853 (fd_state_machine::m_m_connected_stream_socket): New.
2854 (fd_state_machine::m_SOCK_STREAM): New.
2855 (fd_state_machine::m_SOCK_DGRAM): New.
2856 (fd_diagnostic::describe_state_change): Handle socket states.
2857 (fd_diagnostic::get_meaning_for_state_change): Likewise.
2858 (class fd_phase_mismatch): New.
2859 (enum expected_type): New enum.
2860 (class fd_type_mismatch): New.
2861 (fd_state_machine::fd_state_machine): Initialize new states and
2862 stashed named constants.
2863 (fd_state_machine::is_socket_fd_p): New.
2864 (fd_state_machine::is_datagram_socket_fd_p): New.
2865 (fd_state_machine::is_stream_socket_fd_p): New.
2866 (fd_state_machine::on_close): Handle the socket states.
2867 (fd_state_machine::check_for_open_fd): Complain about fncalls on
2868 sockets in the wrong phase. Support socket FDs.
2869 (add_constraint_ge_zero): New.
2870 (fd_state_machine::get_state_for_socket_type): New.
2871 (fd_state_machine::on_socket): New.
2872 (fd_state_machine::check_for_socket_fd): New.
2873 (fd_state_machine::check_for_new_socket_fd): New.
2874 (fd_state_machine::on_bind): New.
2875 (fd_state_machine::on_listen): New.
2876 (fd_state_machine::on_accept): New.
2877 (fd_state_machine::on_connect): New.
2878 (fd_state_machine::can_purge_p): Don't purge socket values.
2879 (get_fd_state): New.
2880 (region_model::mark_as_valid_fd): Use get_fd_state.
2881 (region_model::on_socket): New.
2882 (region_model::on_bind): New.
2883 (region_model::on_listen): New.
2884 (region_model::on_accept): New.
2885 (region_model::on_connect): New.
2886 * sm-fd.dot: Update to reflect sm-fd.cc changes.
2888 2022-11-15 David Malcolm <dmalcolm@redhat.com>
2890 PR analyzer/106302
2891 * analyzer-language.cc: New file.
2892 * analyzer-language.h: New file.
2893 * analyzer.h (get_stashed_constant_by_name): New decl.
2894 (log_stashed_constants): New decl.
2895 * engine.cc (impl_run_checkers): Call log_stashed_constants.
2896 * region-model-impl-calls.cc
2897 (region_model::impl_call_analyzer_dump_named_constant): New.
2898 * region-model.cc (region_model::on_stmt_pre): Handle
2899 __analyzer_dump_named_constant.
2900 * region-model.h
2901 (region_model::impl_call_analyzer_dump_named_constant): New decl.
2902 * sm-fd.cc (fd_state_machine::m_O_ACCMODE): New.
2903 (fd_state_machine::m_O_RDONLY): New.
2904 (fd_state_machine::m_O_WRONLY): New.
2905 (fd_state_machine::fd_state_machine): Initialize the new fields.
2906 (fd_state_machine::get_access_mode_from_flag): Use the new fields,
2907 rather than using the host values.
2909 2022-11-13 David Malcolm <dmalcolm@redhat.com>
2911 PR analyzer/106235
2912 * analyzer.opt (Wanalyzer-tainted-assertion): New.
2913 * checker-path.cc (checker_path::fixup_locations): Pass false to
2914 pending_diagnostic::fixup_location.
2915 * diagnostic-manager.cc (get_emission_location): Pass true to
2916 pending_diagnostic::fixup_location.
2917 * pending-diagnostic.cc (pending_diagnostic::fixup_location): Add
2918 bool param.
2919 * pending-diagnostic.h (pending_diagnostic::fixup_location): Add
2920 bool param to decl.
2921 * sm-taint.cc (taint_state_machine::m_tainted_control_flow): New.
2922 (taint_diagnostic::describe_state_change): Drop "final".
2923 (class tainted_assertion): New.
2924 (taint_state_machine::taint_state_machine): Initialize
2925 m_tainted_control_flow.
2926 (taint_state_machine::alt_get_inherited_state): Support
2927 comparisons being tainted, based on their arguments.
2928 (is_assertion_failure_handler_p): New.
2929 (taint_state_machine::on_stmt): Complain about calls to assertion
2930 failure handlers guarded by an attacker-controller conditional.
2931 Detect attacker-controlled gcond conditionals and gswitch index
2932 values.
2933 (taint_state_machine::check_control_flow_arg_for_taint): New.
2935 2022-11-11 David Malcolm <dmalcolm@redhat.com>
2937 * sm-fd.dot: Fix typo in comment.
2938 * sm-file.dot: New file.
2939 * varargs.cc: Fix typo in comment.
2940 * varargs.dot: New file.
2942 2022-11-11 David Malcolm <dmalcolm@redhat.com>
2944 * checker-path.h: Split out checker_event and its subclasses to...
2945 * checker-event.h: ...this new header.
2947 2022-11-11 David Malcolm <dmalcolm@redhat.com>
2949 PR analyzer/106147
2950 * analyzer.opt (Wanalyzer-infinite-recursion): New.
2951 * call-string.cc (call_string::count_occurrences_of_function):
2952 New.
2953 * call-string.h (call_string::count_occurrences_of_function): New
2954 decl.
2955 * checker-path.cc (function_entry_event::function_entry_event):
2956 New ctor.
2957 (checker_path::add_final_event): Delete.
2958 * checker-path.h (function_entry_event::function_entry_event): New
2959 ctor.
2960 (function_entry_event::get_desc): Drop "final".
2961 (checker_path::add_final_event): Delete.
2962 * diagnostic-manager.cc
2963 (diagnostic_manager::emit_saved_diagnostic): Create the final
2964 event via a new pending_diagnostic::add_final_event vfunc, rather
2965 than checker_path::add_final_event.
2966 (diagnostic_manager::add_events_for_eedge): Create function entry
2967 events via a new pending_diagnostic::add_function_entry_event
2968 vfunc.
2969 * engine.cc (exploded_graph::process_node): When creating a new
2970 PK_BEFORE_SUPERNODE node, call
2971 exploded_graph::detect_infinite_recursion on it after adding the
2972 in-edge.
2973 * exploded-graph.h (exploded_graph::detect_infinite_recursion):
2974 New decl.
2975 (exploded_graph::find_previous_entry_to): New decl.
2976 * infinite-recursion.cc: New file.
2977 * pending-diagnostic.cc
2978 (pending_diagnostic::add_function_entry_event): New.
2979 (pending_diagnostic::add_final_event): New.
2980 * pending-diagnostic.h
2981 (pending_diagnostic::add_function_entry_event): New vfunc.
2982 (pending_diagnostic::add_final_event): New vfunc.
2984 2022-11-10 David Malcolm <dmalcolm@redhat.com>
2986 PR analyzer/99671
2987 * analyzer.opt (Wanalyzer-deref-before-check): New warning.
2988 * diagnostic-manager.cc
2989 (null_assignment_sm_context::set_next_state): Only add state
2990 change events for transition to "null" state.
2991 (null_assignment_sm_context::is_transition_to_null): New.
2992 * engine.cc (impl_region_model_context::on_pop_frame): New.
2993 * exploded-graph.h (impl_region_model_context::on_pop_frame): New
2994 decl.
2995 * program-state.cc (sm_state_map::clear_any_state): New.
2996 (sm_state_map::can_merge_with_p): New.
2997 (program_state::can_merge_with_p): Replace requirement that
2998 sm-states be equal in favor of an attempt to merge them.
2999 * program-state.h (sm_state_map::clear_any_state): New decl.
3000 (sm_state_map::can_merge_with_p): New decl.
3001 * region-model.cc (region_model::eval_condition): Make const.
3002 (region_model::pop_frame): Call ctxt->on_pop_frame.
3003 * region-model.h (region_model::eval_condition): Make const.
3004 (region_model_context::on_pop_frame): New vfunc.
3005 (noop_region_model_context::on_pop_frame): New.
3006 (region_model_context_decorator::on_pop_frame): New.
3007 * sm-malloc.cc (enum resource_state): Add RS_ASSUMED_NON_NULL.
3008 (allocation_state::dump_to_pp): Drop "final".
3009 (struct assumed_non_null_state): New subclass.
3010 (malloc_state_machine::m_assumed_non_null): New.
3011 (assumed_non_null_p): New.
3012 (class deref_before_check): New.
3013 (assumed_non_null_state::dump_to_pp): New.
3014 (malloc_state_machine::get_or_create_assumed_non_null_state_for_frame):
3015 New.
3016 (malloc_state_machine::maybe_assume_non_null): New.
3017 (malloc_state_machine::on_stmt): Transition from start state to
3018 "assumed-non-null" state for pointers passed to
3019 __attribute__((nonnull)) arguments, and for pointers explicitly
3020 dereferenced. Call maybe_complain_about_deref_before_check for
3021 pointers explicitly compared against NULL.
3022 (malloc_state_machine::maybe_complain_about_deref_before_check):
3023 New.
3024 (malloc_state_machine::on_deallocator_call): Also transition
3025 "assumed-non-null" states to "freed".
3026 (malloc_state_machine::on_pop_frame): New.
3027 (malloc_state_machine::maybe_get_merged_states_nonequal): New.
3028 * sm-malloc.dot: Update for changes to sm-malloc.cc.
3029 * sm.h (state_machine::on_pop_frame): New.
3030 (state_machine::maybe_get_merged_state): New.
3031 (state_machine::maybe_get_merged_states_nonequal): New.
3033 2022-11-09 David Malcolm <dmalcolm@redhat.com>
3035 * checker-path.cc (checker_event::debug): New.
3036 (checker_path::add_event): Move here from checker-path.h. Add
3037 logging.
3038 * checker-path.h (checker_event::debug): New decl.
3039 (checker_path::checker_path): Add logger param.
3040 (checker_path::add_event): Move definition from here to
3041 checker-path.cc.
3042 (checker_path::m_logger): New field.
3043 * diagnostic-manager.cc
3044 (diagnostic_manager::emit_saved_diagnostic): Pass logger to
3045 checker_path ctor.
3046 (diagnostic_manager::add_events_for_eedge): Log scope when
3047 processing a run of stmts.
3049 2022-11-08 David Malcolm <dmalcolm@redhat.com>
3051 PR analyzer/101962
3052 * region-model-impl-calls.cc: Update comment.
3053 * region-model.cc (region_model::check_symbolic_bounds): Fix
3054 layout of "void" return. Replace usage of
3055 eval_condition_without_cm with eval_condition.
3056 (region_model::eval_condition): Take over body of...
3057 (region_model::eval_condition_without_cm): ...this subroutine,
3058 dropping the latter. Eliminating this distinction avoids issues
3059 where constraints were not considered when recursing.
3060 (region_model::compare_initial_and_pointer): Update comment.
3061 (region_model::symbolic_greater_than): Replace usage of
3062 eval_condition_without_cm with eval_condition.
3063 * region-model.h
3064 (region_model::eval_condition_without_cm): Delete decl.
3066 2022-11-08 David Malcolm <dmalcolm@redhat.com>
3068 * region-model-impl-calls.cc
3069 (region_model::impl_call_errno_location): New.
3070 * region-model-manager.cc
3071 (region_model_manager::region_model_manager): Initialize
3072 m_thread_local_region and m_errno_region.
3073 * region-model-manager.h (region_model_manager::get_errno_region):
3074 New accessor.
3075 (region_model_manager::m_thread_local_region): New.
3076 (region_model_manager::m_errno_region): New.
3077 * region-model.cc (region_model::on_call_pre): Special-case
3078 "__errno_location".
3079 (region_model::set_errno): New.
3080 * region-model.h (impl_call_errno_location): New decl.
3081 (region_model::set_errno): New decl.
3082 * region.cc (thread_local_region::dump_to_pp): New.
3083 (errno_region::dump_to_pp): New.
3084 * region.h (enum memory_space): Add MEMSPACE_THREAD_LOCAL.
3085 (enum region_kind): Add RK_THREAD_LOCAL and RK_ERRNO.
3086 (class thread_local_region): New.
3087 (is_a_helper <const thread_local_region *>::test): New.
3088 (class errno_region): New.
3089 (is_a_helper <const errno_region *>::test): New.
3090 * store.cc (binding_cluster::escaped_p): New.
3091 (store::escaped_p): Treat errno as always having escaped.
3092 (store::replay_call_summary_cluster): Handle RK_THREAD_LOCAL and
3093 RK_ERRNO.
3094 * store.h (binding_cluster::escaped_p): Remove definition.
3096 2022-11-08 David Malcolm <dmalcolm@redhat.com>
3098 * call-info.cc (success_call_info::get_desc): Delete.
3099 (failed_call_info::get_desc): Likewise.
3100 (succeed_or_fail_call_info::get_desc): New.
3101 * call-info.h (class succeed_or_fail_call_info): New.
3102 (class success_call_info): Convert to a subclass of
3103 succeed_or_fail_call_info.
3104 (class failed_call_info): Likewise.
3106 2022-11-08 David Malcolm <dmalcolm@redhat.com>
3108 * region-model-impl-calls.cc (region_model::impl_call_strchr):
3109 Move to on_call_post. Handle both outcomes using bifurcation,
3110 rather than just the "not found" case.
3111 * region-model.cc (region_model::on_call_pre): Move
3112 BUILT_IN_STRCHR and "strchr" to...
3113 (region_model::on_call_post): ...here.
3115 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3117 * analyzer.h: Use std::unique_ptr for state machines from plugins.
3118 * engine.cc: Likewise.
3120 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3122 * analyzer.h: Use std::unique_ptr for known functions.
3123 * engine.cc: Likewise.
3124 * known-function-manager.cc: Likewise.
3125 * known-function-manager.h: Likewise.
3127 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3129 * analysis-plan.cc: Define INCLUDE_MEMORY before including
3130 system.h.
3131 * analyzer-pass.cc: Likewise.
3132 * analyzer-selftests.cc: Likewise.
3133 * analyzer.cc: Likewise.
3134 * analyzer.h: Use std::unique_ptr in bifurcation code.
3135 * call-string.cc: Define INCLUDE_MEMORY before including system.h.
3136 * complexity.cc: Likewise.
3137 * engine.cc: Use std::unique_ptr in bifurcation code.
3138 * exploded-graph.h: Likewise.
3139 * known-function-manager.cc: Define INCLUDE_MEMORY before
3140 including system.h.
3141 * region-model-impl-calls.cc: Use std::unique_ptr in bifurcation
3142 code.
3143 * region-model.cc: Likewise.
3144 * region-model.h: Likewise.
3145 * supergraph.cc: Define INCLUDE_MEMORY before including system.h.
3147 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3149 * call-info.cc: Use std::unique_ptr for checker_event.
3150 * checker-path.cc: Likewise.
3151 * checker-path.h: Likewise.
3152 * diagnostic-manager.cc: Likewise.
3153 * engine.cc: Likewise.
3154 * pending-diagnostic.cc: Likewise.
3155 * sm-signal.cc: Likewise.
3156 * varargs.cc: Likewise.
3158 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3160 * diagnostic-manager.cc: Include "make-unique.h".
3161 Use std::unique_ptr for feasibility_problems and exploded_path.
3162 Delete explicit saved_diagnostic dtor.
3163 * diagnostic-manager.h: Likewise.
3164 * engine.cc: Likewise.
3165 * exploded-graph.h: Likewise.
3166 * feasible-graph.cc: Likewise.
3167 * feasible-graph.h: Likewise.
3169 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3171 * checker-path.cc (rewind_event::rewind_event): Update for usage of
3172 std::unique_ptr on custom_edge_info.
3173 * engine.cc (exploded_node::on_longjmp): Likewise.
3174 (exploded_edge::exploded_edge): Likewise.
3175 (exploded_edge::~exploded_edge): Delete.
3176 (exploded_graph::add_function_entry): Update for usage of
3177 std::unique_ptr on custom_edge_info.
3178 (exploded_graph::add_edge): Likewise.
3179 (add_tainted_args_callback): Likewise.
3180 (exploded_graph::maybe_create_dynamic_call): Likewise.
3181 (exploded_graph::process_node): Likewise.
3182 * exploded-graph.h (exploded_edge::~exploded_edge): Delete.
3183 (exploded_edge::m_custom_info): Use std::unique_ptr.
3184 (exploded_edge::add_edge): Likewise.
3185 * sm-signal.cc (register_signal_handler::impl_transition): Use
3186 make_unique.
3188 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3190 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic): Make
3191 stmt_finder const.
3192 (saved_diagnostic::~saved_diagnostic): Remove explicit delete of
3193 m_stmt_finder.
3194 (diagnostic_manager::add_diagnostic): Make stmt_finder const.
3195 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic):
3196 Likewise.
3197 (saved_diagnostic::m_stmt_finder): Convert to std::unique_ptr.
3198 (diagnostic_manager::add_diagnostic): Make stmt_finder const.
3199 * engine.cc (impl_sm_context::impl_sm_context): Likewise.
3200 (impl_sm_context::m_stmt_finder): Likewise.
3201 (leak_stmt_finder::clone): Convert return type to std::unique_ptr.
3202 * exploded-graph.h (stmt_finder::clone): Likewise.
3204 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3206 * call-info.cc: Add define of INCLUDE_MEMORY.
3207 * call-summary.cc: Likewise.
3208 * checker-path.cc: Likewise.
3209 * constraint-manager.cc: Likewise.
3210 * diagnostic-manager.cc: Likewise.
3211 (saved_diagnostic::saved_diagnostic): Use std::unique_ptr for
3212 param d and field m_d.
3213 (saved_diagnostic::~saved_diagnostic): Remove explicit delete of m_d.
3214 (saved_diagnostic::add_note): Use std::unique_ptr for
3215 param pn.
3216 (saved_diagnostic::get_pending_diagnostic): Update for conversion
3217 of m_sd.m_d to unique_ptr.
3218 (diagnostic_manager::add_diagnostic): Use std::unique_ptr for
3219 param d. Remove explicit deletion.
3220 (diagnostic_manager::add_note): Use std::unique_ptr for param pn.
3221 (diagnostic_manager::emit_saved_diagnostic): Update for conversion
3222 of m_sd.m_d to unique_ptr.
3223 (null_assignment_sm_context::warn): Use std::unique_ptr for
3224 param d. Remove explicit deletion.
3225 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Use
3226 std::unique_ptr for param d.
3227 (saved_diagnostic::add_note): Likewise for param pn.
3228 (saved_diagnostic::m_d): Likewise.
3229 (diagnostic_manager::add_diagnostic): Use std::unique_ptr for
3230 param d.
3231 (diagnostic_manager::add_note): Use std::unique_ptr for param pn.
3232 * engine.cc: Include "make-unique.h".
3233 (impl_region_model_context::warn): Update to use std::unique_ptr
3234 for param, removing explicit deletion.
3235 (impl_region_model_context::add_note): Likewise.
3236 (impl_sm_context::warn): Update to use std::unique_ptr
3237 for param.
3238 (impl_region_model_context::on_state_leak): Likewise for result of
3239 on_leak.
3240 (exploded_node::on_longjmp): Use make_unique when creating
3241 pending_diagnostic.
3242 (exploded_graph::process_node): Likewise.
3243 * exploded-graph.h (impl_region_model_context::warn): Update to
3244 use std::unique_ptr for param.
3245 (impl_region_model_context::add_note): Likewise.
3246 * feasible-graph.cc: Add define of INCLUDE_MEMORY.
3247 * pending-diagnostic.cc: Likewise.
3248 * pending-diagnostic.h: Include analyzer.sm.h"
3249 * program-point.cc: Add define of INCLUDE_MEMORY.
3250 * program-state.cc: Likewise.
3251 * region-model-asm.cc: Likewise.
3252 * region-model-impl-calls.cc: Likewise. Include "make-unique.h".
3253 (region_model::impl_call_putenv): Use make_unique when creating
3254 pending_diagnostic.
3255 * region-model-manager.cc: Add define of INCLUDE_MEMORY.
3256 * region-model-reachability.cc: Likewise.
3257 * region-model.cc: Likewise. Include "make-unique.h".
3258 (region_model::get_gassign_result): Use make_unique when creating
3259 pending_diagnostic.
3260 (region_model::check_for_poison): Likewise.
3261 (region_model::on_stmt_pre): Likewise.
3262 (region_model::check_symbolic_bounds): Likewise.
3263 (region_model::check_region_bounds): Likewise.
3264 (annotating_ctxt: make_note): Use std::unique_ptr for result.
3265 (region_model::deref_rvalue): Use make_unique when creating
3266 pending_diagnostic.
3267 (region_model::check_for_writable_region): Likewise.
3268 (region_model::check_region_size): Likewise.
3269 (region_model::check_dynamic_size_for_floats): Likewise.
3270 (region_model::maybe_complain_about_infoleak): Likewise.
3271 (noop_region_model_context::add_note): Use std::unique_ptr for
3272 param. Remove explicit deletion.
3273 * region-model.h: Include "analyzer/pending-diagnostic.h".
3274 (region_model_context::warn): Convert param to std::unique_ptr.
3275 (region_model_context::add_note): Likewise.
3276 (noop_region_model_context::warn): Likewise.
3277 (noop_region_model_context::add_note): Likewise.
3278 (region_model_context_decorator::warn): Likewise.
3279 (region_model_context_decorator::add_note): Likewise.
3280 (note_adding_context::warn): Likewise.
3281 (note_adding_context::make_note): Likewise for return type.
3282 (test_region_model_context::warn): Convert param to
3283 std::unique_ptr.
3284 * region.cc: Add define of INCLUDE_MEMORY.
3285 * sm-fd.cc: Likewise. Include "make-unique.h".
3286 (fd_state_machine::check_for_fd_attrs): Use make_unique when
3287 creating pending_diagnostics.
3288 (fd_state_machine::on_open): Likewise.
3289 (fd_state_machine::on_creat): Likewise.
3290 (fd_state_machine::check_for_dup): Likewise.
3291 (fd_state_machine::on_close): Likewise.
3292 (fd_state_machine::check_for_open_fd): Likewise.
3293 (fd_state_machine::on_leak): Likewise, converting return type to
3294 std::unique_ptr.
3295 * sm-file.cc: Add define of INCLUDE_MEMORY. Include
3296 "make-unique.h".
3297 (fileptr_state_machine::on_stmt): Use make_unique when creating
3298 pending_diagnostic.
3299 (fileptr_state_machine::on_leak): Likewise, converting return type
3300 to std::unique_ptr.
3301 * sm-malloc.cc: Add define of INCLUDE_MEMORY. Include
3302 "make-unique.h".
3303 (malloc_state_machine::on_stmt): Use make_unique when creating
3304 pending_diagnostic.
3305 (malloc_state_machine::handle_free_of_non_heap): Likewise.
3306 (malloc_state_machine::on_deallocator_call): Likewise.
3307 (malloc_state_machine::on_realloc_call): Likewise.
3308 (malloc_state_machine::on_leak): Likewise, converting return type
3309 to std::unique_ptr.
3310 * sm-pattern-test.cc: Add define of INCLUDE_MEMORY. Include
3311 "make-unique.h".
3312 (pattern_test_state_machine::on_condition): Use make_unique when
3313 creating pending_diagnostic.
3314 * sm-sensitive.cc: Add define of INCLUDE_MEMORY. Include
3315 "make-unique.h".
3316 (sensitive_state_machine::warn_for_any_exposure): Use make_unique
3317 when creating pending_diagnostic.
3318 * sm-signal.cc: Add define of INCLUDE_MEMORY. Include
3319 "make-unique.h".
3320 (signal_state_machine::on_stmt): Use make_unique when creating
3321 pending_diagnostic.
3322 * sm-taint.cc: Add define of INCLUDE_MEMORY. Include
3323 "make-unique.h".
3324 (taint_state_machine::check_for_tainted_size_arg): Use make_unique
3325 when creating pending_diagnostic.
3326 (taint_state_machine::check_for_tainted_divisor): Likewise.
3327 (region_model::check_region_for_taint): Likewise.
3328 (region_model::check_dynamic_size_for_taint): Likewise.
3329 * sm.cc: Add define of INCLUDE_MEMORY. Include
3330 "analyzer/pending-diagnostic.h".
3331 (state_machine::on_leak): Move here from sm.h, changing return
3332 type to std::unique_ptr.
3333 * sm.h (state_machine::on_leak): Change return type to
3334 std::unique_ptr. Move defn of base impl to sm.cc
3335 (sm_context::warn): Convert param d to std_unique_ptr.
3336 * state-purge.cc: Add define of INCLUDE_MEMORY.
3337 * store.cc: Likewise.
3338 * svalue.cc: Likewise.
3339 * trimmed-graph.cc: Likewise.
3340 * varargs.cc: Likewise. Include "make-unique.h".
3341 (va_list_state_machine::check_for_ended_va_list): Use make_unique
3342 when creating pending_diagnostic.
3343 (va_list_state_machine::on_leak): Likewise, converting return type
3344 to std::unique_ptr.
3345 (region_model::impl_call_va_arg): Use make_unique when creating
3346 pending_diagnostic.
3348 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3350 PR analyzer/107486
3351 * analyzer.cc (is_pipe_call_p): New.
3352 * analyzer.h (is_pipe_call_p): New decl.
3353 * region-model.cc (region_model::on_call_pre): Use it.
3354 (region_model::on_call_post): Likewise.
3356 2022-10-26 David Malcolm <dmalcolm@redhat.com>
3358 * sm-fd.cc (fd_state_machine::on_open): Transition to "unchecked"
3359 when the mode is symbolic, rather than just on integer constants.
3360 (fd_state_machine::check_for_open_fd): Don't complain about
3361 unchecked values in the start state.
3363 2022-10-26 David Malcolm <dmalcolm@redhat.com>
3365 * sm-fd.dot: New file.
3367 2022-10-24 David Malcolm <dmalcolm@redhat.com>
3369 PR analyzer/107349
3370 * varargs.cc (get_va_copy_arg): Fix the non-pointer case.
3372 2022-10-24 David Malcolm <dmalcolm@redhat.com>
3374 PR analyzer/107345
3375 * region-model.cc (region_model::eval_condition_without_cm):
3376 Ensure that constants are on the right-hand side before checking
3377 for them.
3379 2022-10-24 David Malcolm <dmalcolm@redhat.com>
3381 * engine.cc (impl_region_model_context::get_malloc_map): Replace
3382 with...
3383 (impl_region_model_context::get_state_map_by_name): ...this.
3384 (impl_region_model_context::get_fd_map): Delete.
3385 (impl_region_model_context::get_taint_map): Delete.
3386 * exploded-graph.h (impl_region_model_context::get_fd_map):
3387 Delete.
3388 (impl_region_model_context::get_malloc_map): Delete.
3389 (impl_region_model_context::get_taint_map): Delete.
3390 (impl_region_model_context::get_state_map_by_name): New.
3391 * region-model.h (region_model_context::get_state_map_by_name):
3392 New vfunc.
3393 (region_model_context::get_fd_map): Convert from vfunc to
3394 function.
3395 (region_model_context::get_malloc_map): Likewise.
3396 (region_model_context::get_taint_map): Likewise.
3397 (noop_region_model_context::get_state_map_by_name): New.
3398 (noop_region_model_context::get_fd_map): Delete.
3399 (noop_region_model_context::get_malloc_map): Delete.
3400 (noop_region_model_context::get_taint_map): Delete.
3401 (region_model_context_decorator::get_state_map_by_name): New.
3402 (region_model_context_decorator::get_fd_map): Delete.
3403 (region_model_context_decorator::get_malloc_map): Delete.
3404 (region_model_context_decorator::get_taint_map): Delete.
3406 2022-10-24 David Malcolm <dmalcolm@redhat.com>
3408 PR analyzer/106300
3409 * engine.cc (impl_region_model_context::get_fd_map): New.
3410 * exploded-graph.h (impl_region_model_context::get_fd_map): New
3411 decl.
3412 * region-model-impl-calls.cc (region_model::impl_call_pipe): New.
3413 * region-model.cc (region_model::update_for_int_cst_return): New,
3414 based on...
3415 (region_model::update_for_zero_return): ...this. Reimplement in
3416 terms of the former.
3417 (region_model::on_call_pre): Handle "pipe" and "pipe2".
3418 (region_model::on_call_post): Likewise.
3419 * region-model.h (region_model::impl_call_pipe): New decl.
3420 (region_model::update_for_int_cst_return): New decl.
3421 (region_model::mark_as_valid_fd): New decl.
3422 (region_model_context::get_fd_map): New pure virtual fn.
3423 (noop_region_model_context::get_fd_map): New.
3424 (region_model_context_decorator::get_fd_map): New.
3425 * sm-fd.cc: Include "analyzer/program-state.h".
3426 (fd_state_machine::describe_state_change): Handle transitions from
3427 start state to valid states.
3428 (fd_state_machine::mark_as_valid_fd): New.
3429 (fd_state_machine::on_stmt): Add missing return for "creat".
3430 (region_model::mark_as_valid_fd): New.
3432 2022-10-19 David Malcolm <dmalcolm@redhat.com>
3434 PR analyzer/105765
3435 * varargs.cc (get_BT_VALIST_ARG): Rename to...
3436 (get_va_copy_arg): ...this, and update logic for determining level
3437 of indirection of va_copy's argument to use type of argument,
3438 rather than looking at va_list_type_node, to correctly handle
3439 __builtin_ms_va_copy.
3440 (get_stateful_BT_VALIST_ARG): Rename to...
3441 (get_stateful_va_copy_arg): ...this.
3442 (va_list_state_machine::on_va_copy): Update for renaming.
3443 (region_model::impl_call_va_copy): Likewise.
3445 2022-10-13 David Malcolm <dmalcolm@redhat.com>
3447 PR analyzer/107210
3448 * svalue.cc (constant_svalue::maybe_fold_bits_within): Only
3449 attempt to extract individual bits when tree_fits_uhwi_p.
3451 2022-10-07 David Malcolm <dmalcolm@redhat.com>
3453 PR analyzer/105783
3454 * region-model.cc (selftest::get_bit): New function.
3455 (selftest::test_bits_within_svalue_folding): New.
3456 (selfftest::analyzer_region_model_cc_tests): Call it.
3457 * svalue.cc (constant_svalue::maybe_fold_bits_within): Handle the
3458 case of extracting a single bit.
3460 2022-10-06 David Malcolm <dmalcolm@redhat.com>
3462 PR analyzer/107158
3463 * store.cc (store::replay_call_summary_cluster): Eliminate
3464 special-casing of RK_HEAP_ALLOCATED in favor of sharing code with
3465 RK_DECL, avoiding an ICE due to attempting to bind a
3466 compound_svalue into a binding_cluster when an svalue in the
3467 summary cluster converts to a compound_svalue in the caller.
3469 2022-10-06 David Malcolm <dmalcolm@redhat.com>
3471 * call-summary.cc (call_summary_replay::dump_to_pp): Bulletproof
3472 against NULL caller regions/svalues.
3474 2022-10-05 David Malcolm <dmalcolm@redhat.com>
3476 * analysis-plan.cc: Simplify includes.
3477 * analyzer-pass.cc: Likewise.
3478 * analyzer-selftests.cc: Likewise.
3479 * analyzer.cc: Likewise.
3480 * analyzer.h: Add includes of "json.h" and "tristate.h".
3481 * call-info.cc: Simplify includes.
3482 * call-string.cc: Likewise.
3483 * call-summary.cc: Likewise.
3484 * checker-path.cc: Likewise.
3485 * complexity.cc: Likewise.
3486 * constraint-manager.cc: Likewise.
3487 * diagnostic-manager.cc: Likewise.
3488 * engine.cc: Likewise.
3489 * feasible-graph.cc: Likewise.
3490 * known-function-manager.cc: Likewise.
3491 * pending-diagnostic.cc: Likewise.
3492 * program-point.cc: Likewise.
3493 * program-state.cc: Likewise.
3494 * region-model-asm.cc: Likewise.
3495 * region-model-impl-calls.cc: Likewise.
3496 * region-model-manager.cc: Likewise.
3497 * region-model-reachability.cc: Likewise.
3498 * region-model.cc: Likewise.
3499 * region-model.h: Include "selftest.h".
3500 * region.cc: Simplify includes.
3501 * sm-fd.cc: Likewise.
3502 * sm-file.cc: Likewise.
3503 * sm-malloc.cc: Likewise.
3504 * sm-pattern-test.cc: Likewise.
3505 * sm-sensitive.cc: Likewise.
3506 * sm-signal.cc: Likewise.
3507 * sm-taint.cc: Likewise.
3508 * sm.cc: Likewise.
3509 * state-purge.cc: Likewise.
3510 * store.cc: Likewise.
3511 * store.h: Likewise.
3512 * supergraph.cc: Likewise.
3513 * svalue.cc: Likewise.
3514 * svalue.h: Likewise.
3515 * trimmed-graph.cc: Likewise.
3516 * varargs.cc: Likewise.
3518 2022-10-05 David Malcolm <dmalcolm@redhat.com>
3520 PR analyzer/107060
3521 * call-summary.cc
3522 (call_summary_replay::convert_svalue_from_summary_1): Handle NULL
3523 results from convert_svalue_from_summary in SK_UNARY_OP and
3524 SK_BIN_OP.
3525 * engine.cc (impl_region_model_context::on_unknown_change): Bail
3526 out on svalues that can't have associated state.
3527 * region-model-impl-calls.cc
3528 (region_model::impl_call_analyzer_get_unknown_ptr): New.
3529 * region-model.cc (region_model::on_stmt_pre): Handle
3530 "__analyzer_get_unknown_ptr".
3531 * region-model.h
3532 (region_model::impl_call_analyzer_get_unknown_ptr): New decl.
3533 * store.cc (store::replay_call_summary_cluster): Avoid trying to
3534 create binding clusters for base regions that shouldn't have them.
3536 2022-10-05 Martin Liska <mliska@suse.cz>
3538 * call-summary.cc (call_summary_replay::call_summary_replay):
3539 Remove unused variable and arguments.
3540 * call-summary.h: Likewise.
3541 * engine.cc (exploded_node::on_stmt): Likewise.
3542 (exploded_node::replay_call_summaries): Likewise.
3543 (exploded_node::replay_call_summary): Likewise.
3544 * exploded-graph.h (class exploded_node): Likewise.
3546 2022-10-05 David Malcolm <dmalcolm@redhat.com>
3548 PR analyzer/107072
3549 * analyzer-logging.h: Include "diagnostic-core.h".
3550 * analyzer.h: Include "function.h".
3551 (class call_summary): New forward decl.
3552 (class call_summary_replay): New forward decl.
3553 (struct per_function_data): New forward decl.
3554 (struct interesting_t): New forward decl.
3555 (custom_edge_info::update_state): New vfunc.
3556 * call-info.cc (custom_edge_info::update_state): New.
3557 * call-summary.cc: New file.
3558 * call-summary.h: New file.
3559 * constraint-manager.cc: Include "analyzer/call-summary.h".
3560 (class replay_fact_visitor): New.
3561 (constraint_manager::replay_call_summary): New.
3562 * constraint-manager.h (constraint_manager::replay_call_summary):
3563 New.
3564 * engine.cc: Include "analyzer/call-summary.h".
3565 (exploded_node::on_stmt): Handle call summaries.
3566 (class call_summary_edge_info): New.
3567 (exploded_node::replay_call_summaries): New.
3568 (exploded_node::replay_call_summary): New.
3569 (per_function_data::~per_function_data): New.
3570 (per_function_data::add_call_summary): Move here from header and
3571 reimplement.
3572 (exploded_graph::process_node): Call update_state rather than
3573 update_model when handling bifurcation
3574 (viz_callgraph_node::dump_dot): Use a regular label rather
3575 than an HTML table; add summaries to dump.
3576 * exploded-graph.h: Include "alloc-pool.h", "fibonacci_heap.h",
3577 "supergraph.h", "sbitmap.h", "shortest-paths.h", "analyzer/sm.h",
3578 "analyzer/program-state.h", and "analyzer/diagnostic-manager.h".
3579 (exploded_node::replay_call_summaries): New decl.
3580 (exploded_node::replay_call_summary): New decl.
3581 (per_function_data::~per_function_data): New decl.
3582 (per_function_data::add_call_summary): Move implemention from
3583 header.
3584 (per_function_data::m_summaries): Update type of element.
3585 * known-function-manager.h: Include "analyzer/analyzer-logging.h".
3586 * program-point.h: Include "pretty-print.h" and
3587 "analyzer/call-string.h".
3588 * program-state.cc: Include "analyzer/call-summary.h".
3589 (sm_state_map::replay_call_summary): New.
3590 (program_state::replay_call_summary): New.
3591 * program-state.h (sm_state_map::replay_call_summary): New decl.
3592 (program_state::replay_call_summary): New decl.
3593 * region-model-manager.cc
3594 (region_model_manager::get_or_create_asm_output_svalue): New
3595 overload.
3596 * region-model-manager.h
3597 (region_model_manager::get_or_create_asm_output_svalue): New
3598 overload decl.
3599 * region-model.cc: Include "analyzer/call-summary.h".
3600 (region_model::maybe_update_for_edge): Remove call to
3601 region_model::update_for_call_summary on
3602 SUPEREDGE_INTRAPROCEDURAL_CALL.
3603 (region_model::update_for_call_summary): Delete.
3604 (region_model::replay_call_summary): New.
3605 * region-model.h (region_model::replay_call_summary): New decl.
3606 (region_model::update_for_call_summary): Delete decl.
3607 * store.cc: Include "analyzer/call-summary.h".
3608 (store::replay_call_summary): New.
3609 (store::replay_call_summary_cluster): New.
3610 * store.h: Include "tristate.h".
3611 (is_a_helper <const ana::concrete_binding *>::test): New.
3612 (store::replay_call_summary): New decl.
3613 (store::replay_call_summary_cluster): New decl.
3614 * supergraph.cc (get_ultimate_function_for_cgraph_edge): Remove
3615 "static" from decl.
3616 (supergraph_call_edge): Make stmt param const.
3617 * supergraph.h: Include "ordered-hash-map.h", "cfg.h",
3618 "basic-block.h", "gimple.h", "gimple-iterator.h", and "digraph.h".
3619 (supergraph_call_edge): Make stmt param const.
3620 (get_ultimate_function_for_cgraph_edge): New decl.
3621 * svalue.cc (compound_svalue::compound_svalue): Assert that we're
3622 not nesting compound_svalues.
3623 * svalue.h: Include "json.h", "analyzer/store.h", and
3624 "analyzer/program-point.h".
3625 (asm_output_svalue::get_num_outputs): New accessor.
3627 2022-10-05 David Malcolm <dmalcolm@redhat.com>
3629 * region-model.h: Include "analyzer/region-model-manager.h"
3630 (class region_model_manager): Move decl to...
3631 * region-model-manager.h: ...this new file.
3633 2022-10-05 David Malcolm <dmalcolm@redhat.com>
3635 * region-model-manager.cc
3636 (region_model_manager::maybe_fold_unaryop): Fold -(-(VAL)) to VAL.
3638 2022-10-05 David Malcolm <dmalcolm@redhat.com>
3640 * region-model-manager.cc
3641 (region_model_manager::get_or_create_widening_svalue): Use a
3642 function_point rather than a program_point.
3643 * region-model.cc (selftest::test_widening_constraints): Likewise.
3644 * region-model.h
3645 (region_model_manager::get_or_create_widening_svalue): Likewise.
3646 (model_merger::get_function_point): New.
3647 * svalue.cc (svalue::can_merge_p): Use a function_point rather
3648 than a program_point.
3649 (svalue::can_merge_p): Likewise.
3650 * svalue.h (widening_svalue::key_t): Likewise.
3651 (widening_svalue::widening_svalue): Likewise.
3653 2022-09-12 Martin Liska <mliska@suse.cz>
3655 * region-model.cc (region_model::maybe_complain_about_infoleak):
3656 Remove unused fields.
3658 2022-09-11 Tim Lange <mail@tim-lange.me>
3660 PR analyzer/106845
3661 * region-model.cc (region_model::check_region_bounds):
3662 Bail out if 0 bytes were accessed.
3663 * store.cc (byte_range::dump_to_pp):
3664 Add special case for empty ranges.
3665 (byte_range::exceeds_p): Restrict to non-empty ranges.
3666 (byte_range::falls_short_of_p): Restrict to non-empty ranges.
3667 * store.h (bit_range::empty_p): New function.
3668 (bit_range::get_last_byte_offset): Restrict to non-empty ranges.
3669 (byte_range::empty_p): New function.
3670 (byte_range::get_last_byte_offset): Restrict to non-empty ranges.
3672 2022-09-09 David Malcolm <dmalcolm@redhat.com>
3674 * analyzer.opt (Wanalyzer-exposure-through-uninit-copy): New.
3675 * checker-path.cc (region_creation_event::region_creation_event):
3676 Add "capacity" and "kind" params.
3677 (region_creation_event::get_desc): Generalize to different kinds
3678 of event.
3679 (checker_path::add_region_creation_event): Convert to...
3680 (checker_path::add_region_creation_events): ...this.
3681 * checker-path.h (enum rce_kind): New.
3682 (region_creation_event::region_creation_event): Add "capacity" and
3683 "kind" params.
3684 (region_creation_event::m_capacity): New field.
3685 (region_creation_event::m_rce_kind): New field.
3686 (checker_path::add_region_creation_event): Convert to...
3687 (checker_path::add_region_creation_events): ...this.
3688 * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
3689 Update for multiple region creation events.
3690 (diagnostic_manager::add_event_on_final_node): Likewise.
3691 (diagnostic_manager::add_events_for_eedge): Likewise.
3692 * region-model-impl-calls.cc (call_details::get_logger): New.
3693 * region-model.cc: Define INCLUDE_MEMORY before including
3694 "system.h". Include "gcc-rich-location.h".
3695 (class record_layout): New.
3696 (class exposure_through_uninit_copy): New.
3697 (contains_uninit_p): New.
3698 (region_model::maybe_complain_about_infoleak): New.
3699 * region-model.h (call_details::get_logger): New decl.
3700 (region_model::maybe_complain_about_infoleak): New decl.
3701 (region_model::mark_as_tainted): New decl.
3702 * sm-taint.cc (region_model::mark_as_tainted): New.
3704 2022-09-09 David Malcolm <dmalcolm@redhat.com>
3706 * analyzer.h (class known_function_manager): New forward decl.
3707 (class known_function): New.
3708 (plugin_analyzer_init_iface::register_known_function): New.
3709 * engine.cc: Include "analyzer/known-function-manager.h".
3710 (plugin_analyzer_init_impl::plugin_analyzer_init_impl): Add
3711 known_fn_mgr param.
3712 (plugin_analyzer_init_impl::register_state_machine): Add
3713 LOC_SCOPE.
3714 (plugin_analyzer_init_impl::register_known_function): New.
3715 (plugin_analyzer_init_impl::m_known_fn_mgr): New.
3716 (impl_run_checkers): Update plugin callback invocation to use
3717 eng's known_function_manager.
3718 * known-function-manager.cc: New file.
3719 * known-function-manager.h: New file.
3720 * region-model-manager.cc
3721 (region_model_manager::region_model_manager): Pass logger to
3722 m_known_fn_mgr's ctor.
3723 * region-model.cc (region_model::update_for_zero_return): New.
3724 (region_model::update_for_nonzero_return): New.
3725 (maybe_simplify_upper_bound): New.
3726 (region_model::maybe_get_copy_bounds): New.
3727 (region_model::get_known_function): New.
3728 (region_model::on_call_pre): Handle plugin-supplied known
3729 functions.
3730 * region-model.h: Include "analyzer/known-function-manager.h".
3731 (region_model_manager::get_known_function_manager): New.
3732 (region_model_manager::m_known_fn_mgr): New.
3733 (call_details::get_model): New accessor.
3734 (region_model::maybe_get_copy_bounds): New decl.
3735 (region_model::update_for_zero_return): New decl.
3736 (region_model::update_for_nonzero_return): New decl.
3737 (region_model::get_known_function): New decl.
3738 (region_model::get_known_function_manager): New.
3740 2022-09-08 Tim Lange <mail@tim-lange.me>
3742 PR analyzer/106625
3743 * analyzer.h (region_offset): Eliminate m_is_symbolic member.
3744 * region-model-impl-calls.cc (region_model::impl_call_realloc):
3745 Refine implementation to be more precise.
3746 * region-model.cc (class symbolic_past_the_end):
3747 Abstract diagnostic class to complain about accesses past the end
3748 with symbolic values.
3749 (class symbolic_buffer_overflow):
3750 Concrete diagnostic class to complain about buffer overflows with
3751 symbolic values.
3752 (class symbolic_buffer_overread):
3753 Concrete diagnostic class to complain about buffer overreads with
3754 symbolic values.
3755 (region_model::check_symbolic_bounds): New function.
3756 (maybe_get_integer_cst_tree): New helper function.
3757 (region_model::check_region_bounds):
3758 Add call to check_symbolic_bounds if offset is not concrete.
3759 (region_model::eval_condition_without_cm):
3760 Add support for EQ_EXPR and GT_EXPR with binaryop_svalues.
3761 (is_positive_svalue): New hleper function.
3762 (region_model::symbolic_greater_than):
3763 New function to handle GT_EXPR comparisons with symbolic values.
3764 (region_model::structural_equality): New function to compare
3765 whether two svalues are structured the same, i.e. evaluate to
3766 the same value.
3767 (test_struct): Reflect changes to region::calc_offset.
3768 (test_var): Likewise.
3769 (test_array_2): Likewise and add selftest with symbolic i.
3770 * region-model.h (class region_model): Add check_symbolic_bounds,
3771 symbolic_greater_than and structural_equality.
3772 * region.cc (region::get_offset):
3773 Reflect changes to region::calc_offset.
3774 (region::calc_offset):
3775 Compute the symbolic offset if the offset is not concrete.
3776 (region::get_relative_symbolic_offset): New function to return the
3777 symbolic offset in bytes relative to its parent.
3778 (field_region::get_relative_symbolic_offset): Likewise.
3779 (element_region::get_relative_symbolic_offset): Likewise.
3780 (offset_region::get_relative_symbolic_offset): Likewise.
3781 (bit_range_region::get_relative_symbolic_offset): Likewise.
3782 * region.h: Add get_relative_symbolic_offset.
3783 * store.cc (binding_key::make):
3784 Reflect changes to region::calc_offset.
3785 (binding_map::apply_ctor_val_to_range): Likewise.
3786 (binding_map::apply_ctor_pair_to_child_region): Likewise.
3787 (binding_cluster::bind_compound_sval): Likewise.
3788 (binding_cluster::get_any_binding): Likewise.
3789 (binding_cluster::maybe_get_compound_binding): Likewise.
3791 2022-09-05 Tim Lange <mail@tim-lange.me>
3793 * region-model-impl-calls.cc (region_model::impl_call_strcpy):
3794 Handle the constant string case.
3795 * region-model.cc (region_model::get_string_size):
3796 New function to get the string size from a region or svalue.
3797 * region-model.h (class region_model): Add get_string_size.
3799 2022-09-05 Tim Lange <mail@tim-lange.me>
3801 * region.cc (cast_region::get_relative_concrete_offset):
3802 New overloaded method.
3803 * region.h: Add cast_region::get_relative_concrete_offset.
3805 2022-08-22 Martin Liska <mliska@suse.cz>
3807 * region-model.cc: Add missing final keyword.
3809 2022-08-18 Tim Lange <mail@tim-lange.me>
3811 PR analyzer/106181
3812 * analyzer.opt: Add Wanalyzer-imprecise-floating-point-arithmetic.
3813 * region-model.cc (is_any_cast_p): Formatting.
3814 (region_model::check_region_size): Ensure precondition.
3815 (class imprecise_floating_point_arithmetic): New abstract
3816 diagnostic class for all floating-point related warnings.
3817 (class float_as_size_arg): Concrete diagnostic class to complain
3818 about floating-point operands inside the size argument.
3819 (class contains_floating_point_visitor):
3820 New visitor to find floating-point operands inside svalues.
3821 (region_model::check_dynamic_size_for_floats): New function.
3822 (region_model::set_dynamic_extents):
3823 Call to check_dynamic_size_for_floats.
3824 * region-model.h (class region_model):
3825 Add region_model::check_dynamic_size_for_floats.
3827 2022-08-16 Martin Liska <mliska@suse.cz>
3829 * region-model.cc: Fix -Winconsistent-missing-override clang
3830 warning.
3831 * region.h: Likewise.
3833 2022-08-15 David Malcolm <dmalcolm@redhat.com>
3835 PR analyzer/106626
3836 * region-model.cc (buffer_overread::emit): Fix copy&paste error in
3837 direction of the access in the note.
3839 2022-08-15 David Malcolm <dmalcolm@redhat.com>
3841 PR analyzer/106573
3842 * region-model.cc (region_model::on_call_pre): Use check_call_args
3843 when ensuring that we call get_arg_svalue on all args. Remove
3844 redundant call from handling for stdio builtins.
3846 2022-08-15 Immad Mir <mirimmad@outlook.com>
3848 PR analyzer/106551
3849 * sm-fd.cc (check_for_dup): exit early if first
3850 argument is invalid for all dup functions.
3852 2022-08-12 Tim Lange <mail@tim-lange.me>
3854 PR analyzer/106000
3855 * analyzer.opt: Add Wanalyzer-out-of-bounds.
3856 * region-model.cc (class out_of_bounds): Diagnostics base class
3857 for all out-of-bounds diagnostics.
3858 (class past_the_end): Base class derived from out_of_bounds for
3859 the buffer_overflow and buffer_overread diagnostics.
3860 (class buffer_overflow): Buffer overflow diagnostics.
3861 (class buffer_overread): Buffer overread diagnostics.
3862 (class buffer_underflow): Buffer underflow diagnostics.
3863 (class buffer_underread): Buffer overread diagnostics.
3864 (region_model::check_region_bounds): New function to check region
3865 bounds for out-of-bounds accesses.
3866 (region_model::check_region_access):
3867 Add call to check_region_bounds.
3868 (region_model::get_representative_tree): New function that accepts
3869 a region instead of an svalue.
3870 * region-model.h (class region_model):
3871 Add region_model::check_region_bounds.
3872 * region.cc (region::symbolic_p): New predicate.
3873 (offset_region::get_byte_size_sval): Only return the remaining
3874 byte size on offset_regions.
3875 * region.h: Add region::symbolic_p.
3876 * store.cc (byte_range::intersects_p):
3877 Add new function equivalent to bit_range::intersects_p.
3878 (byte_range::exceeds_p): New function.
3879 (byte_range::falls_short_of_p): New function.
3880 * store.h (struct byte_range): Add byte_range::intersects_p,
3881 byte_range::exceeds_p and byte_range::falls_short_of_p.
3883 2022-08-12 Tim Lange <mail@tim-lange.me>
3885 PR analyzer/106539
3886 * region-model-impl-calls.cc (region_model::impl_call_realloc):
3887 Use the result of get_copied_size as the size for the
3888 sized_regions in realloc.
3889 (success_with_move::get_copied_size): New function.
3891 2022-08-11 Immad Mir <mirimmad@outlook.com>
3893 PR analyzer/106551
3894 * sm-fd.cc (check_for_dup): handle the m_start
3895 state when transitioning the state of LHS
3896 of dup, dup2 and dup3 call.
3898 2022-08-09 David Malcolm <dmalcolm@redhat.com>
3900 PR analyzer/106573
3901 * region-model.cc (region_model::on_call_pre): Ensure that we call
3902 get_arg_svalue on all arguments.
3904 2022-08-05 David Malcolm <dmalcolm@redhat.com>
3906 PR analyzer/105947
3907 * analyzer.opt (Wanalyzer-jump-through-null): New option.
3908 * engine.cc (class jump_through_null): New.
3909 (exploded_graph::process_node): Complain about jumps through NULL
3910 function pointers.
3912 2022-08-02 Immad Mir <mirimmad@outlook.com>
3914 PR analyzer/106298
3915 * sm-fd.cc (fd_state_machine::on_open): Add
3916 creat, dup, dup2 and dup3 functions.
3917 (enum dup): New.
3918 (fd_state_machine::valid_to_unchecked_state): New.
3919 (fd_state_machine::on_creat): New.
3920 (fd_state_machine::on_dup): New.
3922 2022-07-28 David Malcolm <dmalcolm@redhat.com>
3924 PR analyzer/105893
3925 * analyzer.opt (Wanalyzer-putenv-of-auto-var): New.
3926 * region-model-impl-calls.cc (class putenv_of_auto_var): New.
3927 (region_model::impl_call_putenv): New.
3928 * region-model.cc (region_model::on_call_pre): Handle putenv.
3929 * region-model.h (region_model::impl_call_putenv): New decl.
3931 2022-07-28 David Malcolm <dmalcolm@redhat.com>
3933 * sm-malloc.cc (free_of_non_heap::emit): Add comment about CWE.
3934 * sm-taint.cc (tainted_size::emit): Likewise.
3936 2022-07-28 David Malcolm <dmalcolm@redhat.com>
3938 * region.h: Add notes to the comment describing the region
3939 class hierarchy.
3941 2022-07-27 Immad Mir <mirimmad@outlook.com>
3943 PR analyzer/106286
3944 * sm-fd.cc:
3945 (fd_diagnostic::get_meaning_for_state_change): New.
3947 2022-07-26 David Malcolm <dmalcolm@redhat.com>
3949 PR analyzer/106319
3950 * store.cc (store::set_value): Don't strip away casts if the
3951 region has NULL type.
3953 2022-07-26 David Malcolm <dmalcolm@redhat.com>
3955 * region.h (code_region::get_element): Remove stray decl.
3956 (function_region::get_element): Likewise.
3958 2022-07-25 Martin Liska <mliska@suse.cz>
3960 * sm-fd.cc: Run dos2unix and fix coding style issues.
3962 2022-07-23 Immad Mir <mirimmad@outlook.com>
3964 * sm-fd.cc (fd_param_diagnostic): New diagnostic class.
3965 (fd_access_mode_mismatch): Change inheritance from fd_diagnostic
3966 to fd_param_diagnostic. Add new overloaded constructor.
3967 (fd_use_after_close): Likewise.
3968 (unchecked_use_of_fd): Likewise and also change name to fd_use_without_check.
3969 (double_close): Change name to fd_double_close.
3970 (enum access_directions): New.
3971 (fd_state_machine::on_stmt): Handle calls to function with the
3972 new three function attributes.
3973 (fd_state_machine::check_for_fd_attrs): New.
3974 (fd_state_machine::on_open): Use the new overloaded constructors
3975 of diagnostic classes.
3977 2022-07-22 David Malcolm <dmalcolm@redhat.com>
3979 PR analyzer/106413
3980 * varargs.cc (region_model::impl_call_va_start): Avoid iterating
3981 through non-existant variadic arguments by initializing the
3982 impl_region to "UNKNOWN" if the va_start occurs in the top-level
3983 function to the analysis.
3985 2022-07-22 David Malcolm <dmalcolm@redhat.com>
3987 PR analyzer/106401
3988 * store.cc (binding_cluster::binding_cluster): Remove overzealous
3989 assertion; we're checking for tracked_p in
3990 store::get_or_create_cluster.
3992 2022-07-22 Tim Lange <mail@tim-lange.me>
3994 PR analyzer/106394
3995 * region-model.cc (capacity_compatible_with_type): Always return true
3996 if alloc_size is zero.
3998 2022-07-21 David Malcolm <dmalcolm@redhat.com>
4000 PR analyzer/106383
4001 * varargs.cc (region_model::impl_call_va_arg): When determining if
4002 we're doing interprocedural analysis, use the stack depth of the
4003 frame in which va_start was called, rather than the current stack
4004 depth.
4006 2022-07-21 David Malcolm <dmalcolm@redhat.com>
4008 * sm-taint.cc (tainted_array_index::emit): Bulletproof against
4009 NULL m_arg.
4010 (tainted_array_index::describe_final_event): Likewise.
4011 (tainted_size::emit): Likewise.
4012 (tainted_size::describe_final_event): Likewise.
4014 2022-07-21 David Malcolm <dmalcolm@redhat.com>
4016 PR analyzer/106374
4017 * region.cc (decl_region::get_svalue_for_initializer): Bail out on
4018 untracked regions.
4020 2022-07-20 David Malcolm <dmalcolm@redhat.com>
4022 PR analyzer/106373
4023 * sm-taint.cc (taint_state_machine::on_condition): Potentially
4024 update the state of the RHS as well as the LHS.
4026 2022-07-20 David Malcolm <dmalcolm@redhat.com>
4028 PR analyzer/106359
4029 * region.h (string_region::tracked_p): New.
4030 * store.cc (binding_cluster::binding_cluster): Move here from
4031 store.h. Add assertion that base_region is tracked_p.
4032 * store.h (binding_cluster::binding_cluster): Move to store.cc.
4034 2022-07-19 David Malcolm <dmalcolm@redhat.com>
4036 PR analyzer/106321
4037 * constraint-manager.h (bounded_ranges::get_count): New.
4038 (bounded_ranges::get_range): New.
4039 * engine.cc (impl_region_model_context::on_bounded_ranges): New.
4040 * exploded-graph.h (impl_region_model_context::on_bounded_ranges):
4041 New decl.
4042 * region-model.cc (region_model::apply_constraints_for_gswitch):
4043 Potentially call ctxt->on_bounded_ranges.
4044 * region-model.h (region_model_context::on_bounded_ranges): New
4045 vfunc.
4046 (noop_region_model_context::on_bounded_ranges): New.
4047 (region_model_context_decorator::on_bounded_ranges): New.
4048 * sm-taint.cc: Include "analyzer/constraint-manager.h".
4049 (taint_state_machine::on_bounded_ranges): New.
4050 * sm.h (state_machine::on_bounded_ranges): New.
4052 2022-07-19 David Malcolm <dmalcolm@redhat.com>
4054 * engine.cc (exploded_graph::process_node): Show any description
4055 of the out-edge when logging it for consideration.
4057 2022-07-15 David Malcolm <dmalcolm@redhat.com>
4059 PR analyzer/106284
4060 * sm-taint.cc (taint_state_machine::on_condition): Handle range
4061 checks optimized by build_range_check.
4063 2022-07-15 Jonathan Wakely <jwakely@redhat.com>
4065 * call-info.cc (call_info::print): Adjust to new label_text API.
4066 * checker-path.cc (checker_event::dump): Likewise.
4067 (region_creation_event::get_desc): Likewise.
4068 (state_change_event::get_desc): Likewise.
4069 (superedge_event::should_filter_p): Likewise.
4070 (start_cfg_edge_event::get_desc): Likewise.
4071 (call_event::get_desc): Likewise.
4072 (return_event::get_desc): Likewise.
4073 (warning_event::get_desc): Likewise.
4074 (checker_path::dump): Likewise.
4075 (checker_path::debug): Likewise.
4076 * diagnostic-manager.cc (diagnostic_manager::prune_for_sm_diagnostic):
4077 Likewise.
4078 (diagnostic_manager::prune_interproc_events): Likewise.
4079 * engine.cc (feasibility_state::maybe_update_for_edge):
4080 Likewise.
4081 * program-state.cc (sm_state_map::to_json): Likewise.
4082 * region-model-impl-calls.cc (region_model::impl_call_analyzer_describe): Likewise.
4083 (region_model::impl_call_analyzer_dump_capacity): Likewise.
4084 * region.cc (region::to_json): Likewise.
4085 * sm-malloc.cc (inform_nonnull_attribute): Likewise.
4086 * store.cc (binding_map::to_json): Likewise.
4087 (store::to_json): Likewise.
4088 * supergraph.cc (superedge::dump): Likewise.
4089 * svalue.cc (svalue::to_json): Likewise.
4091 2022-07-07 David Malcolm <dmalcolm@redhat.com>
4093 * checker-path.cc (start_cfg_edge_event::get_desc): Update for
4094 superedge::get_description returning a label_text.
4095 * engine.cc (feasibility_state::maybe_update_for_edge): Likewise.
4096 * supergraph.cc (superedge::dump): Likewise.
4097 (superedge::get_description): Convert return type from char * to
4098 label_text.
4099 * supergraph.h (superedge::get_description): Likewise.
4101 2022-07-07 David Malcolm <dmalcolm@redhat.com>
4103 * call-info.cc (call_info::print): Update for removal of
4104 label_text::maybe_free in favor of automatic memory management.
4105 * checker-path.cc (checker_event::dump): Likewise.
4106 (checker_event::prepare_for_emission): Likewise.
4107 (state_change_event::get_desc): Likewise.
4108 (superedge_event::should_filter_p): Likewise.
4109 (start_cfg_edge_event::get_desc): Likewise.
4110 (warning_event::get_desc): Likewise.
4111 (checker_path::dump): Likewise.
4112 (checker_path::debug): Likewise.
4113 * diagnostic-manager.cc
4114 (diagnostic_manager::prune_for_sm_diagnostic): Likewise.
4115 (diagnostic_manager::prune_interproc_events): Likewise.
4116 * program-state.cc (sm_state_map::to_json): Likewise.
4117 * region.cc (region::to_json): Likewise.
4118 * sm-malloc.cc (inform_nonnull_attribute): Likewise.
4119 * store.cc (binding_map::to_json): Likewise.
4120 (store::to_json): Likewise.
4121 * svalue.cc (svalue::to_json): Likewise.
4123 2022-07-07 David Malcolm <dmalcolm@redhat.com>
4125 PR analyzer/106225
4126 * sm-taint.cc (taint_state_machine::on_stmt): Move handling of
4127 assignments from division to...
4128 (taint_state_machine::check_for_tainted_divisor): ...this new
4129 function. Reject warning when the divisor is known to be non-zero.
4130 * sm.cc: Include "analyzer/program-state.h".
4131 (sm_context::get_old_region_model): New.
4132 * sm.h (sm_context::get_old_region_model): New decl.
4134 2022-07-06 Immad Mir <mirimmad@outlook.com>
4136 PR analyzer/106184
4137 * sm-fd.cc (fd_state_machine): Change ordering of initialization
4138 of state m_invalid so that the order of initializers is same as
4139 the ordering of the fields in the class decl.
4141 2022-07-06 Immad Mir <mirimmad@outlook.com>
4143 * sm-fd.cc (use_after_close): save the "close" event and
4144 show it where possible.
4146 2022-07-06 David Malcolm <dmalcolm@redhat.com>
4148 PR analyzer/106204
4149 * region-model.cc (within_short_circuited_stmt_p): Move extraction
4150 of assign_stmt to caller.
4151 (due_to_ifn_deferred_init_p): New.
4152 (region_model::check_for_poison): Move extraction of assign_stmt
4153 from within_short_circuited_stmt_p to here. Share logic with
4154 call to due_to_ifn_deferred_init_p.
4156 2022-07-02 Tim Lange <mail@tim-lange.me>
4158 PR analyzer/105900
4159 * analyzer.opt: Added Wanalyzer-allocation-size.
4160 * checker-path.cc (region_creation_event::get_desc): Added call to new
4161 virtual function pending_diagnostic::describe_region_creation_event.
4162 * checker-path.h: Added region_creation_event::get_desc.
4163 * diagnostic-manager.cc (diagnostic_manager::add_event_on_final_node):
4164 New function.
4165 * diagnostic-manager.h:
4166 Added diagnostic_manager::add_event_on_final_node.
4167 * pending-diagnostic.h (struct region_creation): New event_desc struct.
4168 (pending_diagnostic::describe_region_creation_event): Added virtual
4169 function to overwrite description of a region creation.
4170 * region-model.cc (class dubious_allocation_size): New class.
4171 (capacity_compatible_with_type): New helper function.
4172 (class size_visitor): New class.
4173 (struct_or_union_with_inheritance_p): New helper function.
4174 (is_any_cast_p): New helper function.
4175 (region_model::check_region_size): New function.
4176 (region_model::set_value): Added call to
4177 region_model::check_region_size.
4178 * region-model.h (class region_model): New function check_region_size.
4179 * svalue.cc (region_svalue::accept): Changed to post-order traversal.
4180 (initial_svalue::accept): Likewise.
4181 (unaryop_svalue::accept): Likewise.
4182 (binop_svalue::accept): Likewise.
4183 (sub_svalue::accept): Likewise.
4184 (repeated_svalue::accept): Likewise.
4185 (bits_within_svalue::accept): Likewise.
4186 (widening_svalue::accept): Likewise.
4187 (unmergeable_svalue::accept): Likewise.
4188 (compound_svalue::accept): Likewise.
4189 (conjured_svalue::accept): Likewise.
4190 (asm_output_svalue::accept): Likewise.
4191 (const_fn_result_svalue::accept): Likewise.
4193 2022-07-02 Immad Mir <mirimmad17@gmail.com>
4195 PR analyzer/106003
4196 * analyzer.opt (Wanalyzer-fd-leak): New option.
4197 (Wanalyzer-fd-access-mode-mismatch): New option.
4198 (Wanalyzer-fd-use-without-check): New option.
4199 (Wanalyzer-fd-double-close): New option.
4200 (Wanalyzer-fd-use-after-close): New option.
4201 * sm.h (make_fd_state_machine): New decl.
4202 * sm.cc (make_checkers): Call make_fd_state_machine.
4203 * sm-fd.cc: New file.
4205 2022-06-24 David Malcolm <dmalcolm@redhat.com>
4207 * call-string.cc: Add includes of "analyzer/analyzer.h"
4208 and "analyzer/analyzer-logging.h".
4209 (call_string::call_string): Delete copy ctor.
4210 (call_string::operator=): Delete.
4211 (call_string::operator==): Delete.
4212 (call_string::hash): Delete.
4213 (call_string::push_call): Make const, returning the resulting
4214 call_string.
4215 (call_string::pop): Delete.
4216 (call_string::cmp_ptr_ptr): New.
4217 (call_string::validate): Assert that m_parent is non-NULL, or
4218 m_elements is empty.
4219 (call_string::call_string): Move default ctor here from
4220 call-string.h and reimplement. Add ctor taking a parent
4221 and an element.
4222 (call_string::~call_string): New.
4223 (call_string::recursive_log): New.
4224 * call-string.h (call_string::call_string): Move default ctor's
4225 defn to call-string.cc. Delete copy ctor. Add ctor taking a
4226 parent and an element.
4227 (call_string::operator=): Delete.
4228 (call_string::operator==): Delete.
4229 (call_string::hash): Delete.
4230 (call_string::push_call): Make const, returning the resulting
4231 call_string.
4232 (call_string::pop): Delete decl.
4233 (call_string::get_parent): New.
4234 (call_string::cmp_ptr_ptr): New decl.
4235 (call_string::get_top_of_stack): New.
4236 (struct call_string::hashmap_traits_t): New.
4237 (class call_string): Add friend class region_model_manager. Add
4238 DISABLE_COPY_AND_ASSIGN.
4239 (call_string::~call_string): New decl.
4240 (call_string::recursive_log): New decl.
4241 (call_string::m_parent): New field.
4242 (call_string::m_children): New field.
4243 * constraint-manager.cc (selftest::test_many_constants): Pass
4244 model manager to program_point::origin.
4245 * engine.cc (exploded_graph::exploded_graph): Likewise.
4246 (exploded_graph::add_function_entry): Likewise for
4247 program_point::from_function_entry.
4248 (add_tainted_args_callback): Likewise.
4249 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
4250 Update for change to program_point.get_call_string.
4251 (exploded_graph::process_node): Likewise.
4252 (class function_call_string_cluster): Convert m_cs from a
4253 call_string to a const call_string &.
4254 (struct function_call_string): Likewise.
4255 (pod_hash_traits<function_call_string>::hash): Use pointer_hash
4256 for m_cs.
4257 (pod_hash_traits<function_call_string>::equal): Update for change
4258 to m_cs.
4259 (root_cluster::add_node): Update for change to
4260 function_call_string.
4261 (viz_callgraph_node::dump_dot): Update for change to call_string.
4262 * exploded-graph.h (per_call_string_data::m_key): Convert to a
4263 reference.
4264 (struct eg_call_string_hash_map_traits): Delete.
4265 (exploded_graph::call_string_data_map_t): Remove traits class.
4266 * program-point.cc: Move include of "analyzer/call-string.h" to
4267 after "analyzer/analyzer-logging.h".
4268 (program_point::print): Update for conversion of m_call_string to
4269 a pointer.
4270 (program_point::to_json): Likewise.
4271 (program_point::push_to_call_stack): Update for immutability of
4272 call strings.
4273 (program_point::pop_from_call_stack): Likewise.
4274 (program_point::hash): Use pointer hashing for m_call_string.
4275 (program_point::get_function_at_depth): Update for change to
4276 m_call_string.
4277 (program_point::validate): Update for changes to call_string.
4278 (program_point::on_edge): Likewise.
4279 (program_point::origin): Move here from call-string.h. Add
4280 region_model_manager param and use it to get empty call string.
4281 (program_point::from_function_entry): Likewise.
4282 (selftest::test_function_point_ordering): Likewise.
4283 (selftest::test_function_point_ordering): Likewise.
4284 * program-point.h (program_point::program_point): Update for
4285 change to m_call_string.
4286 (program_point::get_call_string): Likewise.
4287 (program_point::get_stack_depth): Likewise.
4288 (program_point::origin): Add region_model_manager param, and move
4289 defn to call-string.cc.
4290 (program_point::from_function_entry): Likewise.
4291 (program_point::empty): Drop call_string.
4292 (program_point::deleted): Likewise.
4293 (program_point::program_point): New private ctor.
4294 (program_point::m_call_string): Convert from call_string to const
4295 call_string *.
4296 * program-state.cc (selftest::test_program_state_merging): Update
4297 for call_string changes.
4298 (selftest::test_program_state_merging_2): Likewise.
4299 * region-model-manager.cc
4300 (region_model_manager::region_model_manager): Construct
4301 m_empty_call_string.
4302 (region_model_manager::log_stats): Log the call strings.
4303 * region-model.cc (assert_region_models_merge): Pass the
4304 region_model_manager when creating program_point instances.
4305 (selftest::test_state_merging): Likewise.
4306 (selftest::test_constraint_merging): Likewise.
4307 (selftest::test_widening_constraints): Likewise.
4308 (selftest::test_iteration_1): Likewise.
4309 * region-model.h (region_model_manager::get_empty_call_string):
4310 New.
4311 (region_model_manager::m_empty_call_string): New.
4312 * sm-signal.cc (register_signal_handler::impl_transition): Update
4313 for changes to call_string.
4315 2022-06-24 David Malcolm <dmalcolm@redhat.com>
4317 * call-string.cc (call_string::calc_recursion_depth): Whitespace
4318 cleanups.
4319 (call_string::cmp): Likewise.
4320 (call_string::get_caller_node): Likewise.
4321 (call_string::validate): Likewise.
4322 * engine.cc (dynamic_call_info_t::add_events_to_path): Likewise.
4323 (exploded_graph::get_per_function_data): Likewise.
4324 (exploded_graph::maybe_create_dynamic_call): Likewise.
4325 (exploded_graph::maybe_create_dynamic_call): Likewise.
4326 (exploded_graph::process_node): Likewise.
4328 2022-06-16 David Malcolm <dmalcolm@redhat.com>
4330 * varargs.cc (va_arg_type_mismatch::emit): Associate the warning
4331 with CWE-686 ("Function Call With Incorrect Argument Type").
4333 2022-06-16 David Malcolm <dmalcolm@redhat.com>
4335 * varargs.cc: Include "diagnostic-metadata.h".
4336 (va_list_exhausted::emit): Associate the warning with
4337 CWE-685 ("Function Call With Incorrect Number of Arguments").
4339 2022-06-16 David Malcolm <dmalcolm@redhat.com>
4341 * sm-file.cc (double_fclose::emit): Associate the warning with
4342 CWE-1341 ("Multiple Releases of Same Resource or Handle").
4344 2022-06-15 David Malcolm <dmalcolm@redhat.com>
4346 PR analyzer/105962
4347 * analyzer.opt (fanalyzer-undo-inlining): New option.
4348 * checker-path.cc: Include "diagnostic-core.h" and
4349 "inlining-iterator.h".
4350 (event_kind_to_string): Handle EK_INLINED_CALL.
4351 (class inlining_info): New class.
4352 (checker_event::checker_event): Move here from checker-path.h.
4353 Store original fndecl and depth, and calculate effective fndecl
4354 and depth based on inlining information.
4355 (checker_event::dump): Emit original depth as well as effective
4356 depth when they differ; likewise for fndecl.
4357 (region_creation_event::get_desc): Use m_effective_fndecl.
4358 (inlined_call_event::get_desc): New.
4359 (inlined_call_event::get_meaning): New.
4360 (checker_path::inject_any_inlined_call_events): New.
4361 * checker-path.h (enum event_kind): Add EK_INLINED_CALL.
4362 (checker_event::checker_event): Make protected, and move
4363 definition to checker-path.cc.
4364 (checker_event::get_fndecl): Use effective fndecl.
4365 (checker_event::get_stack_depth): Use effective stack depth.
4366 (checker_event::get_logical_location): Use effective stack depth.
4367 (checker_event::get_original_stack_depth): New.
4368 (checker_event::m_fndecl): Rename to...
4369 (checker_event::m_original_fndecl): ...this.
4370 (checker_event::m_depth): Rename to...
4371 (checker_event::m_original_depth): ...this.
4372 (checker_event::m_effective_fndecl): New field.
4373 (checker_event::m_effective_depth): New field.
4374 (class inlined_call_event): New checker_event subclass.
4375 (checker_path::inject_any_inlined_call_events): New decl.
4376 * diagnostic-manager.cc: Include "inlining-iterator.h".
4377 (diagnostic_manager::emit_saved_diagnostic): Call
4378 checker_path::inject_any_inlined_call_events.
4379 (diagnostic_manager::prune_for_sm_diagnostic): Handle
4380 EK_INLINED_CALL.
4381 * engine.cc (tainted_args_function_custom_event::get_desc): Use
4382 effective fndecl.
4383 * inlining-iterator.h: New file.
4385 2022-06-15 David Malcolm <dmalcolm@redhat.com>
4387 * diagnostic-manager.cc (saved_diagnostic::dump_dot_id): New.
4388 (saved_diagnostic::dump_as_dot_node): New.
4389 * diagnostic-manager.h (saved_diagnostic::dump_dot_id): New decl.
4390 (saved_diagnostic::dump_as_dot_node): New decl.
4391 * engine.cc (exploded_node::dump_dot): Add nodes for saved
4392 diagnostics.
4394 2022-06-02 David Malcolm <dmalcolm@redhat.com>
4396 * checker-path.cc (checker_event::get_meaning): New.
4397 (function_entry_event::get_meaning): New.
4398 (state_change_event::get_desc): Add dump of meaning of the event
4399 to the -fanalyzer-verbose-state-changes output.
4400 (state_change_event::get_meaning): New.
4401 (cfg_edge_event::get_meaning): New.
4402 (call_event::get_meaning): New.
4403 (return_event::get_meaning): New.
4404 (start_consolidated_cfg_edges_event::get_meaning): New.
4405 (warning_event::get_meaning): New.
4406 * checker-path.h: Include "tree-logical-location.h".
4407 (checker_event::checker_event): Construct m_logical_loc.
4408 (checker_event::get_logical_location): New.
4409 (checker_event::get_meaning): New decl.
4410 (checker_event::m_logical_loc): New.
4411 (function_entry_event::get_meaning): New decl.
4412 (state_change_event::get_meaning): New decl.
4413 (cfg_edge_event::get_meaning): New decl.
4414 (call_event::get_meaning): New decl.
4415 (return_event::get_meaning): New decl.
4416 (start_consolidated_cfg_edges_event::get_meaning): New.
4417 (warning_event::get_meaning): New decl.
4418 * pending-diagnostic.h: Include "diagnostic-path.h".
4419 (pending_diagnostic::get_meaning_for_state_change): New vfunc.
4420 * sm-file.cc (file_diagnostic::get_meaning_for_state_change): New
4421 vfunc impl.
4422 * sm-malloc.cc (malloc_diagnostic::get_meaning_for_state_change):
4423 Likewise.
4424 * sm-sensitive.cc
4425 (exposure_through_output_file::get_meaning_for_state_change):
4426 Likewise.
4427 * sm-taint.cc (taint_diagnostic::get_meaning_for_state_change):
4428 Likewise.
4429 * varargs.cc
4430 (va_list_sm_diagnostic::get_meaning_for_state_change): Likewise.
4432 2022-05-23 David Malcolm <dmalcolm@redhat.com>
4434 * call-info.cc: Add "final" and "override" to all vfunc
4435 implementations that were missing them, as appropriate.
4436 * engine.cc: Likewise.
4437 * region-model.cc: Likewise.
4438 * sm-malloc.cc: Likewise.
4439 * supergraph.h: Likewise.
4440 * svalue.cc: Likewise.
4441 * varargs.cc: Likewise.
4443 2022-05-20 David Malcolm <dmalcolm@redhat.com>
4445 * analyzer-pass.cc: Replace uses of "FINAL" and "OVERRIDE" with
4446 "final" and "override".
4447 * call-info.h: Likewise.
4448 * checker-path.h: Likewise.
4449 * constraint-manager.cc: Likewise.
4450 * diagnostic-manager.cc: Likewise.
4451 * engine.cc: Likewise.
4452 * exploded-graph.h: Likewise.
4453 * feasible-graph.h: Likewise.
4454 * pending-diagnostic.h: Likewise.
4455 * region-model-impl-calls.cc: Likewise.
4456 * region-model.cc: Likewise.
4457 * region-model.h: Likewise.
4458 * region.h: Likewise.
4459 * sm-file.cc: Likewise.
4460 * sm-malloc.cc: Likewise.
4461 * sm-pattern-test.cc: Likewise.
4462 * sm-sensitive.cc: Likewise.
4463 * sm-signal.cc: Likewise.
4464 * sm-taint.cc: Likewise.
4465 * state-purge.h: Likewise.
4466 * store.cc: Likewise.
4467 * store.h: Likewise.
4468 * supergraph.h: Likewise.
4469 * svalue.h: Likewise.
4470 * trimmed-graph.h: Likewise.
4471 * varargs.cc: Likewise.
4473 2022-05-16 David Malcolm <dmalcolm@redhat.com>
4475 PR analyzer/105103
4476 * analyzer.cc (make_label_text_n): New.
4477 * analyzer.h (class var_arg_region): New forward decl.
4478 (make_label_text_n): New decl.
4479 * analyzer.opt (Wanalyzer-va-arg-type-mismatch): New option.
4480 (Wanalyzer-va-list-exhausted): New option.
4481 (Wanalyzer-va-list-leak): New option.
4482 (Wanalyzer-va-list-use-after-va-end): New option.
4483 * checker-path.cc (call_event::get_desc): Split out decl access
4484 into..
4485 (call_event::get_caller_fndecl): ...this new function and...
4486 (call_event::get_callee_fndecl): ...this new function.
4487 * checker-path.h (call_event::get_desc): Drop "FINAL".
4488 (call_event::get_caller_fndecl): New decl.
4489 (call_event::get_callee_fndecl): New decl.
4490 (class call_event): Make fields protected.
4491 * diagnostic-manager.cc (null_assignment_sm_context::warn): New
4492 overload.
4493 (null_assignment_sm_context::get_new_program_state): New.
4494 (diagnostic_manager::add_events_for_superedge): Move case
4495 SUPEREDGE_CALL to a new pending_diagnostic::add_call_event vfunc.
4496 * engine.cc (impl_sm_context::warn): Implement new override.
4497 (impl_sm_context::get_new_program_state): New.
4498 * pending-diagnostic.cc: Include "analyzer/diagnostic-manager.h",
4499 "cpplib.h", "digraph.h", "ordered-hash-map.h", "cfg.h",
4500 "basic-block.h", "gimple.h", "gimple-iterator.h", "cgraph.h"
4501 "analyzer/supergraph.h", "analyzer/program-state.h",
4502 "alloc-pool.h", "fibonacci_heap.h", "shortest-paths.h",
4503 "sbitmap.h", "analyzer/exploded-graph.h", "diagnostic-path.h",
4504 and "analyzer/checker-path.h".
4505 (ht_ident_eq): New.
4506 (fixup_location_in_macro_p): New.
4507 (pending_diagnostic::fixup_location): New.
4508 (pending_diagnostic::add_call_event): New.
4509 * pending-diagnostic.h (pending_diagnostic::fixup_location): Drop
4510 no-op inline implementation in favor of the more complex
4511 implementation above.
4512 (pending_diagnostic::add_call_event): New vfunc.
4513 * region-model-impl-calls.cc: Include "analyzer/sm.h",
4514 "diagnostic-path.h", and "analyzer/pending-diagnostic.h".
4515 * region-model-manager.cc
4516 (region_model_manager::get_var_arg_region): New.
4517 (region_model_manager::log_stats): Log m_var_arg_regions.
4518 * region-model.cc (region_model::on_call_pre): Handle IFN_VA_ARG,
4519 BUILT_IN_VA_START, and BUILT_IN_VA_COPY.
4520 (region_model::on_call_post): Handle BUILT_IN_VA_END.
4521 (region_model::get_representative_path_var_1): Handle RK_VAR_ARG.
4522 (region_model::push_frame): Push variadic arguments.
4523 * region-model.h (region_model_manager::get_var_arg_region): New
4524 decl.
4525 (region_model_manager::m_var_arg_regions): New field.
4526 (region_model::impl_call_va_start): New decl.
4527 (region_model::impl_call_va_copy): New decl.
4528 (region_model::impl_call_va_arg): New decl.
4529 (region_model::impl_call_va_end): New decl.
4530 * region.cc (alloca_region::dump_to_pp): Dump the id.
4531 (var_arg_region::dump_to_pp): New.
4532 (var_arg_region::get_frame_region): New.
4533 * region.h (enum region_kind): Add RK_VAR_ARG.
4534 (region::dyn_cast_var_arg_region): New.
4535 (class var_arg_region): New.
4536 (is_a_helper <const var_arg_region *>::test): New.
4537 (struct default_hash_traits<var_arg_region::key_t>): New.
4538 * sm.cc (make_checkers): Call make_va_list_state_machine.
4539 * sm.h (sm_context::warn): New vfunc.
4540 (sm_context::get_old_svalue): Drop unused decl.
4541 (sm_context::get_new_program_state): New vfunc.
4542 (make_va_list_state_machine): New decl.
4543 * varargs.cc: New file.
4545 2022-05-16 Martin Liska <mliska@suse.cz>
4547 * engine.cc (exploded_node::get_dot_fillcolor): Use ARRAY_SIZE.
4548 * function-set.cc (test_stdio_example): Likewise.
4549 * sm-file.cc (get_file_using_fns): Likewise.
4550 * sm-malloc.cc (malloc_state_machine::unaffected_by_call_p): Likewise.
4551 * sm-signal.cc (get_async_signal_unsafe_fns): Likewise.
4553 2022-05-13 Richard Biener <rguenther@suse.de>
4555 * supergraph.cc: Re-order gimple-fold.h include.
4557 2022-05-11 David Malcolm <dmalcolm@redhat.com>
4559 * checker-path.cc (state_change_event::get_desc): Call maybe_free
4560 on label_text temporaries.
4561 * diagnostic-manager.cc
4562 (diagnostic_manager::prune_for_sm_diagnostic): Likewise.
4563 * engine.cc (exploded_graph::~exploded_graph): Fix leak of
4564 m_per_point_data and m_per_call_string_data values. Simplify
4565 cleanup of m_per_function_stats and m_per_point_data values.
4566 (feasibility_state::maybe_update_for_edge): Fix leak of result of
4567 superedge::get_description.
4568 * region-model-manager.cc
4569 (region_model_manager::~region_model_manager): Move cleanup of
4570 m_setjmp_values to match the ordering of the fields within
4571 region_model_manager. Fix leak of values within
4572 m_repeated_values_map, m_bits_within_values_map,
4573 m_asm_output_values_map, and m_const_fn_result_values_map.
4575 2022-04-28 David Malcolm <dmalcolm@redhat.com>
4577 PR analyzer/105285
4578 * store.cc (binding_cluster::get_any_binding): Handle accessing
4579 sub_svalues of clusters where the base region has a symbolic
4580 binding.
4582 2022-04-28 David Malcolm <dmalcolm@redhat.com>
4584 * diagnostic-manager.cc (epath_finder::process_worklist_item):
4585 Call dump_feasible_path when a path that reaches the the target
4586 enode is found.
4587 (epath_finder::dump_feasible_path): New.
4588 * engine.cc (feasibility_state::dump_to_pp): New.
4589 * exploded-graph.h (feasibility_state::dump_to_pp): New decl.
4590 * feasible-graph.cc (feasible_graph::dump_feasible_path): New.
4591 * feasible-graph.h (feasible_graph::dump_feasible_path): New
4592 decls.
4593 * program-point.cc (function_point::print): Fix missing trailing
4594 newlines.
4595 * program-point.h (program_point::print_source_line): Remove
4596 unimplemented decl.
4598 2022-04-25 David Malcolm <dmalcolm@redhat.com>
4600 PR analyzer/105365
4601 PR analyzer/105366
4602 * svalue.cc
4603 (cmp_cst): Rename to...
4604 (cmp_csts_same_type): ...this. Convert all recursive calls to
4605 calls to...
4606 (cmp_csts_and_types): ....this new function.
4607 (svalue::cmp_ptr): Update for renaming of cmp_cst
4609 2022-04-14 David Malcolm <dmalcolm@redhat.com>
4611 PR analyzer/105264
4612 * region-model-reachability.cc (reachable_regions::handle_parm):
4613 Use maybe_get_deref_base_region rather than just region_svalue, to
4614 handle pointer arithmetic also.
4615 * svalue.cc (svalue::maybe_get_deref_base_region): New.
4616 * svalue.h (svalue::maybe_get_deref_base_region): New decl.
4618 2022-04-14 David Malcolm <dmalcolm@redhat.com>
4620 PR analyzer/105252
4621 * svalue.cc (cmp_cst): When comparing VECTOR_CSTs, compare the
4622 types of the encoded elements before calling cmp_cst on them.
4624 2022-04-09 David Malcolm <dmalcolm@redhat.com>
4626 PR analyzer/103892
4627 * region-model-manager.cc
4628 (region_model_manager::get_unknown_symbolic_region): New,
4629 extracted from...
4630 (region_model_manager::get_field_region): ...here.
4631 (region_model_manager::get_element_region): Use it here.
4632 (region_model_manager::get_offset_region): Likewise.
4633 (region_model_manager::get_sized_region): Likewise.
4634 (region_model_manager::get_cast_region): Likewise.
4635 (region_model_manager::get_bit_range): Likewise.
4636 * region-model.h
4637 (region_model_manager::get_unknown_symbolic_region): New decl.
4638 * region.cc (symbolic_region::symbolic_region): Handle sval_ptr
4639 having NULL type.
4640 (symbolic_region::dump_to_pp): Handle having NULL type.
4642 2022-04-07 David Malcolm <dmalcolm@redhat.com>
4644 PR analyzer/102208
4645 * store.cc (binding_map::remove_overlapping_bindings): Add
4646 "always_overlap" param, using it to generalize to the case where
4647 we want to remove all bindings. Update "uncertainty" logic to
4648 only record maybe-bound values for cases where there is a symbolic
4649 write involved.
4650 (binding_cluster::mark_region_as_unknown): Split param "reg" into
4651 "reg_to_bind" and "reg_for_overlap".
4652 (binding_cluster::maybe_get_compound_binding): Pass "false" to
4653 binding_map::remove_overlapping_bindings new "always_overlap" param.
4654 (binding_cluster::remove_overlapping_bindings): Determine
4655 "always_overlap" and pass it to
4656 binding_map::remove_overlapping_bindings.
4657 (store::set_value): Pass uncertainty to remove_overlapping_bindings
4658 call. Update for new param of
4659 binding_cluster::mark_region_as_unknown, passing both the base
4660 region of the iter_cluster, and the lhs_reg.
4661 (store::mark_region_as_unknown): Update for new param of
4662 binding_cluster::mark_region_as_unknown, passing "reg" for both.
4663 (store::remove_overlapping_bindings): Add param "uncertainty", and
4664 pass it on to call to
4665 binding_cluster::remove_overlapping_bindings.
4666 * store.h (binding_map::remove_overlapping_bindings): Add
4667 "always_overlap" param.
4668 (binding_cluster::mark_region_as_unknown): Split param "reg" into
4669 "reg_to_bind" and "reg_for_overlap".
4670 (store::remove_overlapping_bindings): Add param "uncertainty".
4672 2022-03-29 David Malcolm <dmalcolm@redhat.com>
4674 PR testsuite/105085
4675 * region-model-manager.cc (dump_untracked_region): Skip decls in
4676 the constant pool.
4678 2022-03-29 David Malcolm <dmalcolm@redhat.com>
4680 PR analyzer/105087
4681 * analyzer.h (class conjured_purge): New forward decl.
4682 * region-model-asm.cc (region_model::on_asm_stmt): Add
4683 conjured_purge param to calls binding_cluster::on_asm and
4684 region_model_manager::get_or_create_conjured_svalue.
4685 * region-model-impl-calls.cc
4686 (call_details::get_or_create_conjured_svalue): Likewise for call
4687 to region_model_manager::get_or_create_conjured_svalue.
4688 (region_model::impl_call_fgets): Remove call to
4689 region_model::purge_state_involving, as this is now done
4690 implicitly by call_details::get_or_create_conjured_svalue.
4691 (region_model::impl_call_fread): Likewise.
4692 (region_model::impl_call_strchr): Pass conjured_purge param to
4693 call to region_model_manager::get_or_create_conjured_svalue.
4694 * region-model-manager.cc (conjured_purge::purge): New.
4695 (region_model_manager::get_or_create_conjured_svalue): Add
4696 param "p". Use it to purge state when reusing an existing
4697 conjured_svalue.
4698 * region-model.cc (region_model::on_call_pre): Replace call to
4699 region_model::purge_state_involving with passing conjured_purge
4700 to region_model_manager::get_or_create_conjured_svalue.
4701 (region_model::handle_unrecognized_call): Pass conjured_purge to
4702 store::on_unknown_fncall.
4703 * region-model.h
4704 (region_model_manager::get_or_create_conjured_svalue): Add param
4705 "p".
4706 * store.cc (binding_cluster::on_unknown_fncall): Likewise. Pass
4707 it on to region_model_manager::get_or_create_conjured_svalue.
4708 (binding_cluster::on_asm): Likewise.
4709 (store::on_unknown_fncall): Add param "p" and pass it on to
4710 binding_cluster::on_unknown_fncall.
4711 * store.h (binding_cluster::on_unknown_fncall): Add param p.
4712 (binding_cluster::on_asm): Likewise.
4713 (store::on_unknown_fncall): Likewise.
4714 * svalue.h (class conjured_purge): New.
4716 2022-03-29 David Malcolm <dmalcolm@redhat.com>
4718 PR analyzer/105074
4719 * region.cc (ipa_ref_requires_tracking): Drop "context_fndecl",
4720 instead using the ref->referring to get the cgraph node of the
4721 caller.
4722 (symnode_requires_tracking_p): Likewise.
4724 2022-03-26 David Malcolm <dmalcolm@redhat.com>
4726 PR analyzer/105057
4727 * store.cc (binding_cluster::make_unknown_relative_to): Reject
4728 attempts to create a cluster for untracked base regions.
4729 (store::set_value): Likewise.
4730 (store::fill_region): Likewise.
4731 (store::mark_region_as_unknown): Likewise.
4733 2022-03-25 David Malcolm <dmalcolm@redhat.com>
4735 PR analyzer/104954
4736 * analyzer.opt (-fdump-analyzer-untracked): New option.
4737 * engine.cc (impl_run_checkers): Handle it.
4738 * region-model-asm.cc (region_model::on_asm_stmt): Don't attempt
4739 to clobber regions with !tracked_p ().
4740 * region-model-manager.cc (dump_untracked_region): New.
4741 (region_model_manager::dump_untracked_regions): New.
4742 (frame_region::dump_untracked_regions): New.
4743 * region-model.h (region_model_manager::dump_untracked_regions):
4744 New decl.
4745 * region.cc (ipa_ref_requires_tracking): New.
4746 (symnode_requires_tracking_p): New.
4747 (decl_region::calc_tracked_p): New.
4748 * region.h (region::tracked_p): New vfunc.
4749 (frame_region::dump_untracked_regions): New decl.
4750 (class decl_region): Note that this is also used fo SSA names.
4751 (decl_region::decl_region): Initialize m_tracked.
4752 (decl_region::tracked_p): New.
4753 (decl_region::calc_tracked_p): New decl.
4754 (decl_region::m_tracked): New.
4755 * store.cc (store::get_or_create_cluster): Assert that we
4756 don't try to create clusters for base regions that aren't
4757 trackable.
4758 (store::mark_as_escaped): Don't mark base regions that we're not
4759 tracking.
4761 2022-03-23 David Malcolm <dmalcolm@redhat.com>
4763 PR analyzer/104979
4764 * engine.cc (impl_run_checkers): Create the engine after the
4765 supergraph, and pass the supergraph to the engine.
4766 * region-model.cc (region_model::get_lvalue_1): Pass ctxt to
4767 frame_region::get_region_for_local.
4768 (region_model::update_for_return_gcall): Pass the lvalue for the
4769 result to pop_frame as a tree, rather than as a region.
4770 (region_model::pop_frame): Update for above change, determining
4771 the destination region after the frame is popped and thus with
4772 respect to the caller frame rather than the called frame.
4773 Likewise, set the value of the region to the return value after
4774 the frame is popped.
4775 (engine::engine): Add supergraph pointer.
4776 (selftest::test_stack_frames): Set the DECL_CONTECT of PARM_DECLs.
4777 (selftest::test_get_representative_path_var): Likewise.
4778 (selftest::test_state_merging): Likewise.
4779 * region-model.h (region_model::pop_frame): Convert first param
4780 from a const region * to a tree.
4781 (engine::engine): Add param "sg".
4782 (engine::m_sg): New field.
4783 * region.cc: Include "analyzer/sm.h" and
4784 "analyzer/program-state.h".
4785 (frame_region::get_region_for_local): Add "ctxt" param.
4786 Add assertions that VAR_DECLs are locals, and that expr is for the
4787 correct function.
4788 * region.h (frame_region::get_region_for_local): Add "ctxt" param.
4790 2022-03-23 David Malcolm <dmalcolm@redhat.com>
4792 PR analyzer/105017
4793 * sm-taint.cc (taint_diagnostic::subclass_equal_p): Check
4794 m_has_bounds as well as m_arg.
4795 (tainted_allocation_size::subclass_equal_p): Chain up to base
4796 class implementation. Also check m_mem_space.
4797 (tainted_allocation_size::emit): Add note showing stack-based vs
4798 heap-based allocations.
4800 2022-03-23 David Malcolm <dmalcolm@redhat.com>
4802 PR analyzer/104997
4803 * diagnostic-manager.cc (diagnostic_manager::add_diagnostic):
4804 Convert return type from "void" to "bool", reporting success vs
4805 failure to caller, for both overloads.
4806 * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
4807 Likewise.
4808 * engine.cc (impl_region_model_context::warn): Propagate return
4809 value from diagnostic_manager::add_diagnostic.
4811 2022-03-18 David Malcolm <dmalcolm@redhat.com>
4813 PR analyzer/104943
4814 PR analyzer/104954
4815 PR analyzer/103533
4816 * analyzer.h (class state_purge_per_decl): New forward decl.
4817 * engine.cc (impl_run_checkers): Pass region_model_manager to
4818 state_purge_map ctor.
4819 * program-point.cc (function_point::final_stmt_p): New.
4820 (function_point::get_next): New.
4821 * program-point.h (function_point::final_stmt_p): New decl.
4822 (function_point::get_next): New decl.
4823 * program-state.cc (program_state::prune_for_point): Generalize to
4824 purge local decls as well as SSA names.
4825 (program_state::can_purge_base_region_p): New.
4826 * program-state.h (program_state::can_purge_base_region_p): New
4827 decl.
4828 * region-model.cc (struct append_ssa_names_cb_data): Rename to...
4829 (struct append_regions_cb_data): ...this.
4830 (region_model::get_ssa_name_regions_for_current_frame): Rename
4831 to...
4832 (region_model::get_regions_for_current_frame): ...this, updating
4833 for other renamings.
4834 (region_model::append_ssa_names_cb): Rename to...
4835 (region_model::append_regions_cb): ...this, and drop the requirement
4836 that the subregion be a SSA name.
4837 * region-model.h (struct append_ssa_names_cb_data): Rename decl
4838 to...
4839 (struct append_regions_cb_data): ...this.
4840 (region_model::get_ssa_name_regions_for_current_frame): Rename
4841 decl to...
4842 (region_model::get_regions_for_current_frame): ...this.
4843 (region_model::append_ssa_names_cb): Rename decl to...
4844 (region_model::append_regions_cb): ...this.
4845 * state-purge.cc: Include "tristate.h", "selftest.h",
4846 "analyzer/store.h", "analyzer/region-model.h", and
4847 "gimple-walk.h".
4848 (get_candidate_for_purging): New.
4849 (class gimple_op_visitor): New.
4850 (my_load_cb): New.
4851 (my_store_cb): New.
4852 (my_addr_cb): New.
4853 (state_purge_map::state_purge_map): Add "mgr" param. Update for
4854 renamings. Find uses of local variables.
4855 (state_purge_map::~state_purge_map): Update for renaming of m_map
4856 to m_ssa_map. Clean up m_decl_map.
4857 (state_purge_map::get_or_create_data_for_decl): New.
4858 (state_purge_per_ssa_name::state_purge_per_ssa_name): Update for
4859 inheriting from state_purge_per_tree.
4860 (state_purge_per_ssa_name::add_to_worklist): Likewise.
4861 (state_purge_per_decl::state_purge_per_decl): New.
4862 (state_purge_per_decl::add_needed_at): New.
4863 (state_purge_per_decl::add_pointed_to_at): New.
4864 (state_purge_per_decl::process_worklists): New.
4865 (state_purge_per_decl::add_to_worklist): New.
4866 (same_binding_p): New.
4867 (fully_overwrites_p): New.
4868 (state_purge_per_decl::process_point_backwards): New.
4869 (state_purge_per_decl::process_point_forwards): New.
4870 (state_purge_per_decl::needed_at_point_p): New.
4871 (state_purge_annotator::print_needed): Generalize to print local
4872 decls as well as SSA names.
4873 * state-purge.h (class state_purge_map): Update leading comment.
4874 (state_purge_map::map_t): Rename to...
4875 (state_purge_map::ssa_map_t): ...this.
4876 (state_purge_map::iterator): Rename to...
4877 (state_purge_map::ssa_iterator): ...this.
4878 (state_purge_map::decl_map_t): New typedef.
4879 (state_purge_map::decl_iterator): New typedef.
4880 (state_purge_map::state_purge_map): Add "mgr" param.
4881 (state_purge_map::get_data_for_ssa_name): Update for renaming.
4882 (state_purge_map::get_any_data_for_decl): New.
4883 (state_purge_map::get_or_create_data_for_decl): New decl.
4884 (state_purge_map::begin): Rename to...
4885 (state_purge_map::begin_ssas): ...this.
4886 (state_purge_map::end): Rename to...
4887 (state_purge_map::end_ssa): ...this.
4888 (state_purge_map::begin_decls): New.
4889 (state_purge_map::end_decls): New.
4890 (state_purge_map::m_map): Rename to...
4891 (state_purge_map::m_ssa_map): ...this.
4892 (state_purge_map::m_decl_map): New field.
4893 (class state_purge_per_tree): New class.
4894 (class state_purge_per_ssa_name): Inherit from state_purge_per_tree.
4895 (state_purge_per_ssa_name::get_function): Move to base class.
4896 (state_purge_per_ssa_name::point_set_t): Likewise.
4897 (state_purge_per_ssa_name::m_fun): Likewise.
4898 (class state_purge_per_decl): New.
4900 2022-03-17 David Malcolm <dmalcolm@redhat.com>
4902 * state-purge.cc (state_purge_annotator::add_node_annotations):
4903 Avoid duplicate before-supernode annotations when returning from
4904 an interprocedural call. Show after-supernode annotations.
4906 2022-03-17 David Malcolm <dmalcolm@redhat.com>
4908 * program-point.cc (program_point::get_next): Fix missing
4909 increment of index.
4911 2022-03-16 David Malcolm <dmalcolm@redhat.com>
4913 PR analyzer/104955
4914 * diagnostic-manager.cc (get_emission_location): New.
4915 (diagnostic_manager::diagnostic_manager): Initialize
4916 m_num_disabled_diagnostics.
4917 (diagnostic_manager::add_diagnostic): Reject diagnostics that
4918 will eventually be rejected due to being disabled.
4919 (diagnostic_manager::emit_saved_diagnostics): Log the number
4920 of disabled diagnostics.
4921 (diagnostic_manager::emit_saved_diagnostic): Split out logic for
4922 determining emission location to get_emission_location.
4923 * diagnostic-manager.h
4924 (diagnostic_manager::m_num_disabled_diagnostics): New field.
4925 * engine.cc (stale_jmp_buf::get_controlling_option): New.
4926 (stale_jmp_buf::emit): Use it.
4927 * pending-diagnostic.h
4928 (pending_diagnostic::get_controlling_option): New vfunc.
4929 * region-model.cc
4930 (poisoned_value_diagnostic::get_controlling_option): New.
4931 (poisoned_value_diagnostic::emit): Use it.
4932 (shift_count_negative_diagnostic::get_controlling_option): New.
4933 (shift_count_negative_diagnostic::emit): Use it.
4934 (shift_count_overflow_diagnostic::get_controlling_option): New.
4935 (shift_count_overflow_diagnostic::emit): Use it.
4936 (dump_path_diagnostic::get_controlling_option): New.
4937 (dump_path_diagnostic::emit): Use it.
4938 (write_to_const_diagnostic::get_controlling_option): New.
4939 (write_to_const_diagnostic::emit): Use it.
4940 (write_to_string_literal_diagnostic::get_controlling_option): New.
4941 (write_to_string_literal_diagnostic::emit): Use it.
4942 * sm-file.cc (double_fclose::get_controlling_option): New.
4943 (double_fclose::emit): Use it.
4944 (file_leak::get_controlling_option): New.
4945 (file_leak::emit): Use it.
4946 * sm-malloc.cc (mismatching_deallocation::get_controlling_option):
4947 New.
4948 (mismatching_deallocation::emit): Use it.
4949 (double_free::get_controlling_option): New.
4950 (double_free::emit): Use it.
4951 (possible_null_deref::get_controlling_option): New.
4952 (possible_null_deref::emit): Use it.
4953 (possible_null_arg::get_controlling_option): New.
4954 (possible_null_arg::emit): Use it.
4955 (null_deref::get_controlling_option): New.
4956 (null_deref::emit): Use it.
4957 (null_arg::get_controlling_option): New.
4958 (null_arg::emit): Use it.
4959 (use_after_free::get_controlling_option): New.
4960 (use_after_free::emit): Use it.
4961 (malloc_leak::get_controlling_option): New.
4962 (malloc_leak::emit): Use it.
4963 (free_of_non_heap::get_controlling_option): New.
4964 (free_of_non_heap::emit): Use it.
4965 * sm-pattern-test.cc (pattern_match::get_controlling_option): New.
4966 (pattern_match::emit): Use it.
4967 * sm-sensitive.cc
4968 (exposure_through_output_file::get_controlling_option): New.
4969 (exposure_through_output_file::emit): Use it.
4970 * sm-signal.cc (signal_unsafe_call::get_controlling_option): New.
4971 (signal_unsafe_call::emit): Use it.
4972 * sm-taint.cc (tainted_array_index::get_controlling_option): New.
4973 (tainted_array_index::emit): Use it.
4974 (tainted_offset::get_controlling_option): New.
4975 (tainted_offset::emit): Use it.
4976 (tainted_size::get_controlling_option): New.
4977 (tainted_size::emit): Use it.
4978 (tainted_divisor::get_controlling_option): New.
4979 (tainted_divisor::emit): Use it.
4980 (tainted_allocation_size::get_controlling_option): New.
4981 (tainted_allocation_size::emit): Use it.
4983 2022-03-15 David Malcolm <dmalcolm@redhat.com>
4985 * store.cc (store::store): Presize m_cluster_map.
4987 2022-03-10 David Malcolm <dmalcolm@redhat.com>
4989 PR analyzer/104863
4990 * constraint-manager.cc (constraint_manager::add_constraint):
4991 Refresh the EC IDs when adding constraints implied by offsets.
4993 2022-03-10 David Malcolm <dmalcolm@redhat.com>
4995 PR analyzer/104793
4996 * analyzer.h (class pending_note): New forward decl.
4997 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
4998 Initialize m_notes.
4999 (saved_diagnostic::operator==): Compare m_notes.
5000 (saved_diagnostic::add_note): New.
5001 (saved_diagnostic::emit_any_notes): New.
5002 (diagnostic_manager::add_note): New.
5003 (diagnostic_manager::emit_saved_diagnostic): Call emit_any_notes
5004 after emitting the warning.
5005 * diagnostic-manager.h (saved_diagnostic::add_note): New decl.
5006 (saved_diagnostic::emit_any_notes): New decl.
5007 (saved_diagnostic::m_notes): New field.
5008 (diagnostic_manager::add_note): New decl.
5009 * engine.cc (impl_region_model_context::add_note): New.
5010 * exploded-graph.h (impl_region_model_context::add_note): New
5011 decl.
5012 * pending-diagnostic.h (class pending_note): New.
5013 (class pending_note_subclass): New template.
5014 * region-model.cc (class reason_attr_access): New.
5015 (check_external_function_for_access_attr): Add class
5016 annotating_ctxt and use it when checking region.
5017 (noop_region_model_context::add_note): New.
5018 * region-model.h (region_model_context::add_note): New vfunc.
5019 (noop_region_model_context::add_note): New decl.
5020 (class region_model_context_decorator): New.
5021 (class note_adding_context): New.
5023 2022-03-10 David Malcolm <dmalcolm@redhat.com>
5025 PR analyzer/104793
5026 * region-model.cc
5027 (region_model::check_external_function_for_access_attr): New.
5028 (region_model::handle_unrecognized_call): Call it.
5029 * region-model.h
5030 (region_model::check_external_function_for_access_attr): New decl.
5031 (region_model::handle_unrecognized_call): New decl.
5033 2022-03-10 David Malcolm <dmalcolm@redhat.com>
5035 * sm-taint.cc (taint_state_machine::check_for_tainted_size_arg):
5036 Avoid generating duplicate saved_diagnostics by only handling the
5037 rdwr_map entry for the ptrarg, not the duplicate entry for the
5038 sizarg.
5040 2022-03-07 David Malcolm <dmalcolm@redhat.com>
5042 PR analyzer/101983
5043 * engine.cc (returning_from_function_p): New.
5044 (impl_region_model_context::on_state_leak): Use it when rejecting
5045 leaks at the return from "main".
5047 2022-03-07 Jakub Jelinek <jakub@redhat.com>
5049 * store.cc: Fix up duplicated word issue in a comment.
5050 * analyzer.cc: Likewise.
5051 * engine.cc: Likewise.
5052 * sm-taint.cc: Likewise.
5054 2022-03-04 David Malcolm <dmalcolm@redhat.com>
5056 PR analyzer/103521
5057 * analyzer.opt (-param=analyzer-max-svalue-depth=): Reduce from 13
5058 to 12.
5060 2022-02-23 David Malcolm <dmalcolm@redhat.com>
5062 PR analyzer/104434
5063 * analyzer.h (class const_fn_result_svalue): New decl.
5064 * region-model-impl-calls.cc (call_details::get_manager): New.
5065 * region-model-manager.cc
5066 (region_model_manager::get_or_create_const_fn_result_svalue): New.
5067 (region_model_manager::log_stats): Log
5068 m_const_fn_result_values_map.
5069 * region-model.cc (const_fn_p): New.
5070 (maybe_get_const_fn_result): New.
5071 (region_model::on_call_pre): Handle fndecls with
5072 __attribute__((const)) by calling the above rather than making
5073 a conjured_svalue.
5074 * region-model.h (visitor::visit_const_fn_result_svalue): New.
5075 (region_model_manager::get_or_create_const_fn_result_svalue): New
5076 decl.
5077 (region_model_manager::const_fn_result_values_map_t): New typedef.
5078 (region_model_manager::m_const_fn_result_values_map): New field.
5079 (call_details::get_manager): New decl.
5080 * svalue.cc (svalue::cmp_ptr): Handle SK_CONST_FN_RESULT.
5081 (const_fn_result_svalue::dump_to_pp): New.
5082 (const_fn_result_svalue::dump_input): New.
5083 (const_fn_result_svalue::accept): New.
5084 * svalue.h (enum svalue_kind): Add SK_CONST_FN_RESULT.
5085 (svalue::dyn_cast_const_fn_result_svalue): New.
5086 (class const_fn_result_svalue): New.
5087 (is_a_helper <const const_fn_result_svalue *>::test): New.
5088 (template <> struct default_hash_traits<const_fn_result_svalue::key_t>):
5089 New.
5091 2022-02-17 David Malcolm <dmalcolm@redhat.com>
5093 PR analyzer/104576
5094 * region-model.cc: Include "calls.h".
5095 (region_model::on_call_pre): Use flags_from_decl_or_type to
5096 generalize check for DECL_PURE_P to also check for ECF_CONST.
5098 2022-02-16 David Malcolm <dmalcolm@redhat.com>
5100 PR analyzer/104560
5101 * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
5102 Add region creation events for globals of interest.
5103 (null_assignment_sm_context::get_old_program_state): New.
5104 (diagnostic_manager::add_events_for_eedge): Move check for
5105 changing dynamic extents from PK_BEFORE_STMT case to after the
5106 switch on the dst_point's kind so that we can emit them for the
5107 final stmt in a basic block.
5108 * engine.cc (impl_sm_context::get_old_program_state): New.
5109 * sm-malloc.cc (malloc_state_machine::get_default_state): Rewrite
5110 detection of m_non_heap to use get_memory_space.
5111 (free_of_non_heap::free_of_non_heap): Add freed_reg param.
5112 (free_of_non_heap::subclass_equal_p): Update for changes to
5113 fields.
5114 (free_of_non_heap::emit): Drop m_kind in favor of
5115 get_memory_space.
5116 (free_of_non_heap::describe_state_change): Remove logic for
5117 detecting alloca.
5118 (free_of_non_heap::mark_interesting_stuff): Add region-creation of
5119 m_freed_reg.
5120 (free_of_non_heap::get_memory_space): New.
5121 (free_of_non_heap::kind): Drop enum.
5122 (free_of_non_heap::m_freed_reg): New field.
5123 (free_of_non_heap::m_kind): Drop field.
5124 (malloc_state_machine::on_stmt): Drop transition to m_non_heap.
5125 (malloc_state_machine::handle_free_of_non_heap): New function,
5126 split out from on_deallocator_call and on_realloc_call, adding
5127 detection of the freed region.
5128 (malloc_state_machine::on_deallocator_call): Use it.
5129 (malloc_state_machine::on_realloc_call): Likewise.
5130 * sm.h (sm_context::get_old_program_state): New vfunc.
5132 2022-02-15 David Malcolm <dmalcolm@redhat.com>
5134 PR analyzer/104524
5135 * region-model-manager.cc
5136 (region_model_manager::maybe_fold_sub_svalue): Only call
5137 get_or_create_cast if type is non-NULL.
5139 2022-02-15 David Malcolm <dmalcolm@redhat.com>
5141 PR analyzer/102692
5142 * exploded-graph.h (impl_region_model_context::get_stmt): New.
5143 * region-model.cc: Include "gimple-ssa.h", "tree-phinodes.h",
5144 "tree-ssa-operands.h", and "ssa-iterators.h".
5145 (within_short_circuited_stmt_p): New.
5146 (region_model::check_for_poison): Don't warn about uninit values
5147 if within_short_circuited_stmt_p.
5148 * region-model.h (region_model_context::get_stmt): New vfunc.
5149 (noop_region_model_context::get_stmt): New.
5151 2022-02-11 David Malcolm <dmalcolm@redhat.com>
5153 PR analyzer/104274
5154 * region-model.cc (region_model::check_for_poison): Ignore
5155 uninitialized uses of empty types.
5157 2022-02-10 David Malcolm <dmalcolm@redhat.com>
5159 PR analyzer/98797
5160 * region-model-manager.cc
5161 (region_model_manager::maybe_fold_sub_svalue): Generalize getting
5162 individual chars of a STRING_CST from element_region to any
5163 subregion which is a concrete access of a single byte from its
5164 parent region.
5165 * region.cc (region::get_relative_concrete_byte_range): New.
5166 * region.h (region::get_relative_concrete_byte_range): New decl.
5168 2022-02-09 David Malcolm <dmalcolm@redhat.com>
5170 PR analyzer/104452
5171 * region-model.cc (selftest::test_bit_range_regions): New.
5172 (selftest::analyzer_region_model_cc_tests): Call it.
5173 * region.h (bit_range_region::key_t::hash): Fix hashing of m_bits
5174 to avoid using uninitialized data.
5176 2022-02-07 David Malcolm <dmalcolm@redhat.com>
5178 PR analyzer/104417
5179 * sm-taint.cc (tainted_allocation_size::tainted_allocation_size):
5180 Remove overzealous assertion.
5181 (tainted_allocation_size::emit): Likewise.
5182 (region_model::check_dynamic_size_for_taint): Likewise.
5184 2022-02-07 David Malcolm <dmalcolm@redhat.com>
5186 PR analyzer/103872
5187 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
5188 Reimplement in terms of a get_store_value followed by a set_value.
5190 2022-02-03 David Malcolm <dmalcolm@redhat.com>
5192 PR analyzer/104369
5193 * engine.cc (exploded_graph::process_node): Use the node for any
5194 diagnostics, avoiding ICE if a bifurcation update adds a
5195 saved_diagnostic, such as for a tainted realloc size.
5196 * region-model-impl-calls.cc
5197 (region_model::impl_call_realloc::success_no_move::update_model):
5198 Require the old pointer to be non-NULL to be able successfully
5199 grow in place. Use model->deref_rvalue rather than maybe_get_region
5200 to support the old pointer being symbolic.
5201 (region_model::impl_call_realloc::success_with_move::update_model):
5202 Likewise. Add a constraint that the new pointer != the old pointer.
5203 Use a sized_region when setting the value of the new region.
5204 Handle the case where we don't know the dynamic size of the old
5205 region by marking the new region as unknown.
5206 * sm-taint.cc (tainted_allocation_size::tainted_allocation_size):
5207 Update assertion to also allow for MEMSPACE_UNKNOWN.
5208 (tainted_allocation_size::emit): Likewise.
5209 (region_model::check_dynamic_size_for_taint): Likewise.
5211 2022-02-03 David Malcolm <dmalcolm@redhat.com>
5213 * region-model-impl-calls.cc (region_model::impl_call_calloc): Use
5214 a sized_region when calling zero_fill_region.
5216 2022-02-02 David Malcolm <dmalcolm@redhat.com>
5218 * region-model.cc (region_model::on_return): Replace usage of
5219 copy_region with get_rvalue/set_value pair.
5220 (region_model::pop_frame): Likewise.
5221 (selftest::test_compound_assignment): Likewise.
5222 * region-model.h (region_model::copy_region): Delete decl.
5223 * region.cc (region_model::copy_region): Delete.
5225 2022-02-02 David Malcolm <dmalcolm@redhat.com>
5227 * region.cc (region::calc_offset): Consolidate effectively
5228 identical cases.
5230 2022-02-02 David Malcolm <dmalcolm@redhat.com>
5232 * analyzer.h (class bit_range_region): New forward decl.
5233 * region-model-manager.cc (region_model_manager::get_bit_range):
5234 New.
5235 (region_model_manager::log_stats): Handle m_bit_range_regions.
5236 * region-model.cc (region_model::get_lvalue_1): Handle
5237 BIT_FIELD_REF.
5238 * region-model.h (region_model_manager::get_bit_range): New decl.
5239 (region_model_manager::m_bit_range_regions): New field.
5240 * region.cc (region::get_base_region): Handle RK_BIT_RANGE.
5241 (region::base_region_p): Likewise.
5242 (region::calc_offset): Likewise.
5243 (bit_range_region::dump_to_pp): New.
5244 (bit_range_region::get_byte_size): New.
5245 (bit_range_region::get_bit_size): New.
5246 (bit_range_region::get_byte_size_sval): New.
5247 (bit_range_region::get_relative_concrete_offset): New.
5248 * region.h (enum region_kind): Add RK_BIT_RANGE.
5249 (region::dyn_cast_bit_range_region): New vfunc.
5250 (class bit_range_region): New.
5251 (is_a_helper <const bit_range_region *>::test): New.
5252 (default_hash_traits<bit_range_region::key_t>): New.
5254 2022-02-02 David Malcolm <dmalcolm@redhat.com>
5256 PR analyzer/104270
5257 * region-model.cc (region_model::on_call_pre): Handle
5258 IFN_DEFERRED_INIT.
5260 2022-01-27 David Malcolm <dmalcolm@redhat.com>
5262 * checker-path.cc (event_kind_to_string): Handle
5263 EK_REGION_CREATION.
5264 (region_creation_event::region_creation_event): New.
5265 (region_creation_event::get_desc): New.
5266 (checker_path::add_region_creation_event): New.
5267 * checker-path.h (enum event_kind): Add EK_REGION_CREATION.
5268 (class region_creation_event): New subclass.
5269 (checker_path::add_region_creation_event): New decl.
5270 * diagnostic-manager.cc
5271 (diagnostic_manager::emit_saved_diagnostic): Pass NULL for new
5272 param to add_events_for_eedge when handling trailing eedge.
5273 (diagnostic_manager::build_emission_path): Create an interesting_t
5274 instance, allow the pending diagnostic to populate it, and pass it
5275 to the calls to add_events_for_eedge.
5276 (diagnostic_manager::add_events_for_eedge): Add "interest" param.
5277 Use it to add region_creation_events for on-stack regions created
5278 within at function entry, and when pertinent dynamically-sized
5279 regions are created.
5280 (diagnostic_manager::prune_for_sm_diagnostic): Add case for
5281 EK_REGION_CREATION.
5282 * diagnostic-manager.h (diagnostic_manager::add_events_for_eedge):
5283 Add "interest" param.
5284 * pending-diagnostic.cc: Include "selftest.h", "tristate.h",
5285 "analyzer/call-string.h", "analyzer/program-point.h",
5286 "analyzer/store.h", and "analyzer/region-model.h".
5287 (interesting_t::add_region_creation): New.
5288 (interesting_t::dump_to_pp): New.
5289 * pending-diagnostic.h (struct interesting_t): New.
5290 (pending_diagnostic::mark_interesting_stuff): New vfunc.
5291 * region-model.cc
5292 (poisoned_value_diagnostic::poisoned_value_diagnostic): Add
5293 (poisoned_value_diagnostic::operator==): Compare m_pkind and
5294 m_src_region fields.
5295 (poisoned_value_diagnostic::mark_interesting_stuff): New.
5296 (poisoned_value_diagnostic::m_src_region): New.
5297 (region_model::check_for_poison): Call
5298 get_region_for_poisoned_expr for uninit values and pass the resul
5299 to the diagnostic.
5300 (region_model::get_region_for_poisoned_expr): New.
5301 (region_model::deref_rvalue): Pass NULL for
5302 poisoned_value_diagnostic's src_region.
5303 * region-model.h (region_model::get_region_for_poisoned_expr): New
5304 decl.
5305 * region.h (frame_region::get_fndecl): New.
5307 2022-01-27 Martin Liska <mliska@suse.cz>
5309 PR analyzer/104247
5310 * constraint-manager.cc (bounded_ranges_manager::log_stats):
5311 Cast to long for format purpose.
5312 * region-model-manager.cc (log_uniq_map): Likewise.
5314 2022-01-26 David Malcolm <dmalcolm@redhat.com>
5316 PR analyzer/104224
5317 * region-model.cc (region_model::check_call_args): New.
5318 (region_model::on_call_pre): Call it when ignoring stdio builtins.
5319 * region-model.h (region_model::check_call_args): New decl
5321 2022-01-26 David Malcolm <dmalcolm@redhat.com>
5323 PR analyzer/94362
5324 * constraint-manager.cc (range::add_bound): Fix tests for
5325 discarding redundant constraints. Perform test for rejecting
5326 unsatisfiable constraints earlier so that they don't update
5327 the object on failure.
5328 (selftest::test_range): New.
5329 (selftest::test_constant_comparisons): Add test coverage for
5330 existing constraints becoming narrower until they are
5331 unsatisfiable.
5332 (selftest::run_constraint_manager_tests): Call test_range.
5334 2022-01-22 David Malcolm <dmalcolm@redhat.com>
5336 PR analyzer/104159
5337 * region-model-manager.cc
5338 (region_model_manager::get_or_create_cast): Bail out if the types
5339 are the same. Don't attempt to handle casts involving vector
5340 types.
5342 2022-01-20 David Malcolm <dmalcolm@redhat.com>
5344 PR analyzer/94362
5345 * constraint-manager.cc (bound::ensure_closed): Convert param to
5346 enum bound_kind.
5347 (range::constrained_to_single_element): Likewise.
5348 (range::add_bound): New.
5349 (constraint_manager::add_constraint): Handle SVAL + OFFSET
5350 compared to a constant.
5351 (constraint_manager::get_ec_bounds): Rewrite in terms of
5352 range::add_bound.
5353 (constraint_manager::eval_condition): Reject if range::add_bound
5354 fails.
5355 (selftest::test_constant_comparisons): Add test coverage for
5356 various impossible combinations of integer comparisons.
5357 * constraint-manager.h (enum bound_kind): New.
5358 (struct bound): Likewise.
5359 (bound::ensure_closed): Convert to param to enum bound_kind.
5360 (struct range): Convert to...
5361 (class range): ...this, making fields private.
5362 (range::add_bound): New decls.
5363 * region-model.cc (region_model::add_constraint): Fail if
5364 constraint_manager::add_constraint fails.
5366 2022-01-18 David Malcolm <dmalcolm@redhat.com>
5368 PR analyzer/104089
5369 * region-model-manager.cc
5370 (region_model_manager::get_or_create_constant_svalue): Assert that
5371 we have a CONSTANT_CLASS_P.
5372 (region_model_manager::maybe_fold_unaryop): Only fold a constant
5373 when fold_unary's result is a constant or a cast of a constant.
5375 2022-01-18 David Malcolm <dmalcolm@redhat.com>
5377 PR analyzer/104062
5378 * region-model-manager.cc
5379 (region_model_manager::maybe_fold_sub_svalue): Avoid casting to
5380 NULL type when folding access to repeated svalue.
5382 2022-01-17 Martin Liska <mliska@suse.cz>
5384 * analyzer.cc (is_special_named_call_p): Rename .c names to .cc.
5385 (is_named_call_p): Likewise.
5386 * region-model-asm.cc (deterministic_p): Likewise.
5387 * region.cc (field_region::get_relative_concrete_offset): Likewise.
5388 * sm-malloc.cc (method_p): Likewise.
5389 * supergraph.cc (superedge::dump_dot): Likewise.
5391 2022-01-14 David Malcolm <dmalcolm@redhat.com>
5393 * sm-taint.cc (taint_state_machine::combine_states): Handle combination
5394 of has_ub and has_lb.
5396 2022-01-14 David Malcolm <dmalcolm@redhat.com>
5398 PR analyzer/104029
5399 * sm-taint.cc (taint_state_machine::alt_get_inherited_state):
5400 Remove gcc_unreachable from default case for unary ops.
5402 2022-01-14 David Malcolm <dmalcolm@redhat.com>
5404 * engine.cc: Include "stringpool.h", "attribs.h", and
5405 "tree-dfa.h".
5406 (mark_params_as_tainted): New.
5407 (class tainted_args_function_custom_event): New.
5408 (class tainted_args_function_info): New.
5409 (exploded_graph::add_function_entry): Handle functions with
5410 "tainted_args" attribute.
5411 (class tainted_args_field_custom_event): New.
5412 (class tainted_args_callback_custom_event): New.
5413 (class tainted_args_call_info): New.
5414 (add_tainted_args_callback): New.
5415 (add_any_callbacks): New.
5416 (exploded_graph::build_initial_worklist): Likewise.
5417 (exploded_graph::build_initial_worklist): Find callbacks that are
5418 reachable from global initializers, calling add_any_callbacks on
5419 them.
5421 2022-01-12 David Malcolm <dmalcolm@redhat.com>
5423 PR analyzer/103940
5424 * engine.cc (impl_sm_context::impl_sm_context): Add
5425 "unknown_side_effects" param and use it to initialize
5426 new m_unknown_side_effects field.
5427 (impl_sm_context::unknown_side_effects_p): New.
5428 (impl_sm_context::m_unknown_side_effects): New.
5429 (exploded_node::on_stmt): Pass unknown_side_effects to sm_ctxt
5430 ctor.
5431 * sm-taint.cc: Include "stringpool.h" and "attribs.h".
5432 (tainted_size::tainted_size): Drop "dir" param.
5433 (tainted_size::get_kind): Drop "FINAL".
5434 (tainted_size::emit): Likewise.
5435 (tainted_size::m_dir): Drop unused field.
5436 (class tainted_access_attrib_size): New subclass.
5437 (taint_state_machine::on_stmt): Call check_for_tainted_size_arg on
5438 external functions with unknown side effects.
5439 (taint_state_machine::check_for_tainted_size_arg): New.
5440 (region_model::check_region_for_taint): Drop "dir" param from
5441 tainted_size ctor.
5442 * sm.h (sm_context::unknown_side_effects_p): New.
5444 2022-01-11 David Malcolm <dmalcolm@redhat.com>
5446 PR analyzer/102692
5447 * diagnostic-manager.cc
5448 (class auto_disable_complexity_checks): Rename to...
5449 (class auto_checking_feasibility): ...this, updating
5450 the calls accordingly.
5451 (epath_finder::explore_feasible_paths): Update for renaming.
5452 * region-model-manager.cc
5453 (region_model_manager::region_model_manager): Update for change from
5454 m_check_complexity to m_checking_feasibility.
5455 (region_model_manager::reject_if_too_complex): Likewise.
5456 (region_model_manager::get_or_create_unknown_svalue): Handle
5457 m_checking_feasibility.
5458 (region_model_manager::create_unique_svalue): New.
5459 (region_model_manager::maybe_fold_binop): Handle BIT_AND_EXPR and
5460 BIT_IOR_EXPRs on booleans where we know the result.
5461 * region-model.cc (test_binop_svalue_folding): Add test coverage
5462 for the above.
5463 * region-model.h (region_model_manager::create_unique_svalue): New
5464 decl.
5465 (region_model_manager::enable_complexity_check): Replace with...
5466 (region_model_manager::begin_checking_feasibility): ...this.
5467 (region_model_manager::disable_complexity_check): Replace with...
5468 (region_model_manager::end_checking_feasibility): ...this.
5469 (region_model_manager::m_check_complexity): Replace with...
5470 (region_model_manager::m_checking_feasibility): ...this.
5471 (region_model_manager::m_managed_dynamic_svalues): New field.
5473 2022-01-08 David Malcolm <dmalcolm@redhat.com>
5475 * engine.cc (impl_run_checkers): Pass logger to engine ctor.
5476 * region-model-manager.cc
5477 (region_model_manager::region_model_manager): Add logger param and
5478 use it to initialize m_logger.
5479 * region-model.cc (engine::engine): New.
5480 * region-model.h (region_model_manager::region_model_manager):
5481 Add logger param.
5482 (region_model_manager::get_logger): New.
5483 (region_model_manager::m_logger): New field.
5484 (engine::engine): New.
5485 * store.cc (store_manager::get_logger): New.
5486 (store::set_value): Log scope. Log when marking a cluster as
5487 unknown due to possible aliasing.
5488 * store.h (store_manager::get_logger): New decl.
5490 2022-01-08 David Malcolm <dmalcolm@redhat.com>
5492 * region-model-impl-calls.cc (cmp_decls): New.
5493 (cmp_decls_ptr_ptr): New.
5494 (region_model::impl_call_analyzer_dump_escaped): New.
5495 * region-model.cc (region_model::on_stmt_pre): Handle
5496 __analyzer_dump_escaped.
5497 * region-model.h (region_model::impl_call_analyzer_dump_escaped):
5498 New decl.
5499 * store.h (binding_cluster::get_base_region): New accessor.
5501 2022-01-08 David Malcolm <dmalcolm@redhat.com>
5503 * region.cc (region::is_named_decl_p): New.
5504 * region.h (region::is_named_decl_p): New decl.
5506 2022-01-06 David Malcolm <dmalcolm@redhat.com>
5508 PR analyzer/103546
5509 * store.cc (store::eval_alias_1): Refactor handling of decl
5510 regions, adding a test for may_be_aliased, rejecting those for
5511 which it returns false.
5513 2021-12-12 Jonathan Wakely <jwakely@redhat.com>
5515 * engine.cc: Define INCLUDE_MEMORY instead of INCLUDE_UNIQUE_PTR.
5517 2021-12-06 David Malcolm <dmalcolm@redhat.com>
5519 PR analyzer/103533
5520 * constraint-manager.cc (equiv_class::contains_non_constant_p):
5521 New.
5522 (constraint_manager::canonicalize): Call it when determining
5523 redundant ECs.
5524 (selftest::test_purging): New selftest.
5525 (selftest::run_constraint_manager_tests): Likewise.
5526 * constraint-manager.h (equiv_class::contains_non_constant_p):
5527 New decl.
5529 2021-12-01 David Malcolm <dmalcolm@redhat.com>
5531 PR analyzer/102471
5532 * region-model-reachability.cc (reachable_regions::handle_parm):
5533 Treat all svalues within a compound parm has reachable, and those
5534 wrapped in a cast.
5536 2021-11-29 David Malcolm <dmalcolm@redhat.com>
5538 PR analyzer/103217
5539 * store.cc (binding_cluster::can_merge_p): For the "key is bound"
5540 vs "key is not bound" merger case, check that the bound svalue
5541 is mergeable before merging it to "unknown", rejecting the merger
5542 otherwise.
5544 2021-11-19 David Malcolm <dmalcolm@redhat.com>
5546 PR analyzer/103217
5547 * engine.cc (exploded_graph::get_or_create_node): Pass in
5548 m_ext_state to program_state::can_merge_with_p.
5549 (exploded_graph::process_worklist): Likewise.
5550 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
5551 Likewise.
5552 (exploded_graph::process_node): Add missing call to detect_leaks
5553 when handling phi nodes.
5554 * program-state.cc (program_state::can_merge_with_p): Add
5555 "ext_state" param. Pass it and state ptrs to
5556 region_model::can_merge_with_p.
5557 (selftest::test_program_state_merging): Update for new ext_state
5558 param of program_state::can_merge_with_p.
5559 (selftest::test_program_state_merging_2): Likewise.
5560 * program-state.h (program_state::can_purge_p): Make const.
5561 (program_state::can_merge_with_p): Add "ext_state" param.
5562 * region-model.cc: Include "analyzer/program-state.h".
5563 (region_model::can_merge_with_p): Add params "ext_state",
5564 "state_a", and "state_b", use them when creating model_merger
5565 object.
5566 (model_merger::mergeable_svalue_p): New.
5567 * region-model.h (region_model::can_merge_with_p): Add params
5568 "ext_state", "state_a", and "state_b".
5569 (model_merger::model_merger) Likewise, initializing new fields.
5570 (model_merger::mergeable_svalue_p): New decl.
5571 (model_merger::m_ext_state): New field.
5572 (model_merger::m_state_a): New field.
5573 (model_merger::m_state_b): New field.
5574 * svalue.cc (svalue::can_merge_p): Call
5575 model_merger::mergeable_svalue_p on both states and reject the
5576 merger accordingly.
5578 2021-11-17 David Malcolm <dmalcolm@redhat.com>
5580 PR analyzer/102695
5581 * region-model-impl-calls.cc (region_model::impl_call_strchr): New.
5582 * region-model-manager.cc
5583 (region_model_manager::maybe_fold_unaryop): Simplify cast to
5584 pointer type of an existing pointer to a region.
5585 * region-model.cc (region_model::on_call_pre): Handle
5586 BUILT_IN_STRCHR and "strchr".
5587 (write_to_const_diagnostic::emit): Add auto_diagnostic_group. Add
5588 alternate wordings for functions and labels.
5589 (write_to_const_diagnostic::describe_final_event): Add alternate
5590 wordings for functions and labels.
5591 (region_model::check_for_writable_region): Handle RK_FUNCTION and
5592 RK_LABEL.
5593 * region-model.h (region_model::impl_call_strchr): New decl.
5595 2021-11-16 David Malcolm <dmalcolm@redhat.com>
5597 PR analyzer/102662
5598 * constraint-manager.cc (bounded_range::operator==): Require the
5599 types to be the same for equality.
5601 2021-11-13 David Malcolm <dmalcolm@redhat.com>
5603 * analyzer.opt (Wanalyzer-tainted-allocation-size): New.
5604 (Wanalyzer-tainted-divisor): New.
5605 (Wanalyzer-tainted-offset): New.
5606 (Wanalyzer-tainted-size): New.
5607 * engine.cc (impl_region_model_context::get_taint_map): New.
5608 * exploded-graph.h (impl_region_model_context::get_taint_map):
5609 New decl.
5610 * program-state.cc (sm_state_map::get_state): Call
5611 alt_get_inherited_state.
5612 (sm_state_map::impl_set_state): Modify states within
5613 compound svalues.
5614 (program_state::impl_call_analyzer_dump_state): Undo casts.
5615 (selftest::test_program_state_1): Update for new context param of
5616 create_region_for_heap_alloc.
5617 (selftest::test_program_state_merging): Likewise.
5618 * region-model-impl-calls.cc (region_model::impl_call_alloca):
5619 Likewise.
5620 (region_model::impl_call_calloc): Likewise.
5621 (region_model::impl_call_malloc): Likewise.
5622 (region_model::impl_call_operator_new): Likewise.
5623 (region_model::impl_call_realloc): Likewise.
5624 * region-model.cc (region_model::check_region_access): Call
5625 check_region_for_taint.
5626 (region_model::get_representative_path_var_1): Handle binops.
5627 (region_model::create_region_for_heap_alloc): Add "ctxt" param and
5628 pass it to set_dynamic_extents.
5629 (region_model::create_region_for_alloca): Likewise.
5630 (region_model::set_dynamic_extents): Add "ctxt" param and use it
5631 to call check_dynamic_size_for_taint.
5632 (selftest::test_state_merging): Update for new context param of
5633 create_region_for_heap_alloc.
5634 (selftest::test_malloc_constraints): Likewise.
5635 (selftest::test_malloc): Likewise.
5636 (selftest::test_alloca): Likewise for create_region_for_alloca.
5637 * region-model.h (region_model::create_region_for_heap_alloc): Add
5638 "ctxt" param.
5639 (region_model::create_region_for_alloca): Likewise.
5640 (region_model::set_dynamic_extents): Likewise.
5641 (region_model::check_dynamic_size_for_taint): New decl.
5642 (region_model::check_region_for_taint): New decl.
5643 (region_model_context::get_taint_map): New vfunc.
5644 (noop_region_model_context::get_taint_map): New.
5645 * sm-taint.cc: Remove include of "diagnostic-event-id.h"; add
5646 includes of "gimple-iterator.h", "tristate.h", "selftest.h",
5647 "ordered-hash-map.h", "cgraph.h", "cfg.h", "digraph.h",
5648 "analyzer/supergraph.h", "analyzer/call-string.h",
5649 "analyzer/program-point.h", "analyzer/store.h",
5650 "analyzer/region-model.h", and "analyzer/program-state.h".
5651 (enum bounds): Move to top of file.
5652 (class taint_diagnostic): New.
5653 (class tainted_array_index): Convert to subclass of taint_diagnostic.
5654 (tainted_array_index::emit): Add CWE-129. Reword warning to use
5655 "attacker-controlled" rather than "tainted".
5656 (tainted_array_index::describe_state_change): Move to
5657 taint_diagnostic::describe_state_change.
5658 (tainted_array_index::describe_final_event): Reword to use
5659 "attacker-controlled" rather than "tainted".
5660 (class tainted_offset): New.
5661 (class tainted_size): New.
5662 (class tainted_divisor): New.
5663 (class tainted_allocation_size): New.
5664 (taint_state_machine::alt_get_inherited_state): New.
5665 (taint_state_machine::on_stmt): In assignment handling, remove
5666 ARRAY_REF handling in favor of check_region_for_taint. Add
5667 detection of tainted divisors.
5668 (taint_state_machine::get_taint): New.
5669 (taint_state_machine::combine_states): New.
5670 (region_model::check_region_for_taint): New.
5671 (region_model::check_dynamic_size_for_taint): New.
5672 * sm.h (state_machine::alt_get_inherited_state): New.
5674 2021-11-12 David Malcolm <dmalcolm@redhat.com>
5676 * engine.cc (exploded_node::on_stmt_pre): Return when handling
5677 "__analyzer_dump_state".
5679 2021-11-11 Richard Biener <rguenther@suse.de>
5681 * supergraph.cc: Include bitmap.h.
5683 2021-11-04 David Malcolm <dmalcolm@redhat.com>
5685 * program-state.cc (sm_state_map::dump): Use default_tree_printer
5686 as format decoder.
5688 2021-09-16 Maxim Blinov <maxim.blinov@embecosm.com>
5690 PR bootstrap/102242
5691 * engine.cc (INCLUDE_UNIQUE_PTR): Define.
5693 2021-09-08 David Malcolm <dmalcolm@redhat.com>
5695 PR analyzer/102225
5696 * analyzer.h (compat_types_p): New decl.
5697 * constraint-manager.cc
5698 (constraint_manager::get_or_add_equiv_class): Guard against NULL
5699 type when checking for pointer types.
5700 * region-model-impl-calls.cc (region_model::impl_call_realloc):
5701 Guard against NULL lhs type/region. Guard against the size value
5702 not being of a compatible type for dynamic extents.
5703 * region-model.cc (compat_types_p): Make non-static.
5705 2021-08-30 David Malcolm <dmalcolm@redhat.com>
5707 PR analyzer/99260
5708 * analyzer.h (class custom_edge_info): New class, adapted from
5709 exploded_edge::custom_info_t. Make member functions const.
5710 Make update_model return bool, converting edge param from
5711 reference to a pointer, and adding a ctxt param.
5712 (class path_context): New class.
5713 * call-info.cc: New file.
5714 * call-info.h: New file.
5715 * engine.cc: Include "analyzer/call-info.h" and <memory>.
5716 (impl_region_model_context::impl_region_model_context): Update for
5717 new m_path_ctxt field.
5718 (impl_region_model_context::bifurcate): New.
5719 (impl_region_model_context::terminate_path): New.
5720 (impl_region_model_context::get_malloc_map): New.
5721 (impl_sm_context::impl_sm_context): Update for new m_path_ctxt
5722 field.
5723 (impl_sm_context::get_fndecl_for_call): Likewise.
5724 (impl_sm_context::set_next_state): Likewise.
5725 (impl_sm_context::warn): Likewise.
5726 (impl_sm_context::is_zero_assignment): Likewise.
5727 (impl_sm_context::get_path_context): New.
5728 (impl_sm_context::m_path_ctxt): New.
5729 (impl_region_model_context::on_condition): Update for new
5730 path_ctxt param. Handle m_enode_for_diag being NULL.
5731 (impl_region_model_context::on_phi): Update for new path_ctxt
5732 param.
5733 (exploded_node::on_stmt): Add path_ctxt param, updating ctor calls
5734 to use it as necessary. Use it to bail out after sm-handling,
5735 if needed.
5736 (exploded_node::detect_leaks): Update for new path_ctxt param.
5737 (dynamic_call_info_t::update_model): Update for conversion of
5738 exploded_edge::custom_info_t to custom_edge_info.
5739 (dynamic_call_info_t::add_events_to_path): Likewise.
5740 (rewind_info_t::update_model): Likewise.
5741 (rewind_info_t::add_events_to_path): Likewise.
5742 (exploded_edge::exploded_edge): Likewise.
5743 (exploded_graph::add_edge): Likewise.
5744 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
5745 Update for new path_ctxt param.
5746 (class impl_path_context): New.
5747 (exploded_graph::process_node): Update for new path_ctxt param.
5748 Create an impl_path_context and pass it to exploded_node::on_stmt.
5749 Use it to terminate iterating stmts if terminate_path is called
5750 on it. After processing a run of stmts, query path_ctxt to
5751 potentially terminate the analysis path, and/or to "bifurcate" the
5752 analysis into multiple additional paths.
5753 (feasibility_state::maybe_update_for_edge): Update for new
5754 update_model ctxt param.
5755 * exploded-graph.h
5756 (impl_region_model_context::impl_region_model_context): Add
5757 path_ctxt param.
5758 (impl_region_model_context::bifurcate): New.
5759 (impl_region_model_context::terminate_path): New
5760 (impl_region_model_context::get_ext_state): New.
5761 (impl_region_model_context::get_malloc_map): New.
5762 (impl_region_model_context::m_path_ctxt): New field.
5763 (exploded_node::on_stmt): Add path_ctxt param.
5764 (class exploded_edge::custom_info_t): Move to analyzer.h, renaming
5765 to custom_edge_info, and making the changes as noted in analyzer.h
5766 above.
5767 (exploded_edge::exploded_edge): Update for these changes to
5768 exploded_edge::custom_info_t.
5769 (exploded_edge::m_custom_info): Likewise.
5770 (class dynamic_call_info_t): Likewise.
5771 (class rewind_info_t): Likewise.
5772 (exploded_graph::add_edge): Likewise.
5773 * program-state.cc (program_state::on_edge): Update for new
5774 path_ctxt param.
5775 (program_state::push_call): Likewise.
5776 (program_state::returning_call): Likewise.
5777 (program_state::prune_for_point): Likewise.
5778 * region-model-impl-calls.cc: Include "analyzer/call-info.h".
5779 (call_details::get_fndecl_for_call): New.
5780 (region_model::impl_call_realloc): Reimplement.
5781 * region-model.cc (region_model::on_call_pre): Move call to
5782 impl_call_realloc to...
5783 (region_model::on_call_post): ...here. Consolidate creation
5784 of call_details instance.
5785 (noop_region_model_context::bifurcate): New.
5786 (noop_region_model_context::terminate_path): New.
5787 * region-model.h (call_details::get_call_stmt): New.
5788 (call_details::get_fndecl_for_call): New.
5789 (region_model::on_realloc_with_move): New.
5790 (region_model_context::bifurcate): New.
5791 (region_model_context::terminate_path): New.
5792 (region_model_context::get_ext_state): New.
5793 (region_model_context::get_malloc_map): New.
5794 (noop_region_model_context::bifurcate): New.
5795 (noop_region_model_context::terminate_path): New.
5796 (noop_region_model_context::get_ext_state): New.
5797 (noop_region_model_context::get_malloc_map): New.
5798 * sm-malloc.cc: Include "analyzer/program-state.h".
5799 (malloc_state_machine::on_realloc_call): Reimplement.
5800 (malloc_state_machine::on_realloc_with_move): New.
5801 (region_model::on_realloc_with_move): New.
5802 * sm-signal.cc (class signal_delivery_edge_info_t): Update for
5803 conversion from exploded_edge::custom_info_t to custom_edge_info.
5804 * sm.h (sm_context::get_path_context): New.
5805 * svalue.cc (svalue::maybe_get_constant): Call
5806 unwrap_any_unmergeable.
5808 2021-08-25 Ankur Saini <arsenic@sourceware.org>
5810 PR analyzer/101980
5811 * engine.cc (exploded_graph::maybe_create_dynamic_call): Don't create
5812 calls if max recursion limit is reached.
5814 2021-08-23 David Malcolm <dmalcolm@redhat.com>
5816 * analyzer.h (struct rejected_constraint): Convert to...
5817 (class rejected_constraint): ...this.
5818 (class bounded_ranges): New forward decl.
5819 (class bounded_ranges_manager): New forward decl.
5820 * constraint-manager.cc: Include "analyzer/analyzer-logging.h" and
5821 "tree-pretty-print.h".
5822 (can_plus_one_p): New.
5823 (plus_one): New.
5824 (can_minus_one_p): New.
5825 (minus_one): New.
5826 (bounded_range::bounded_range): New.
5827 (dump_cst): New.
5828 (bounded_range::dump_to_pp): New.
5829 (bounded_range::dump): New.
5830 (bounded_range::to_json): New.
5831 (bounded_range::set_json_attr): New.
5832 (bounded_range::contains_p): New.
5833 (bounded_range::intersects_p): New.
5834 (bounded_range::operator==): New.
5835 (bounded_range::cmp): New.
5836 (bounded_ranges::bounded_ranges): New.
5837 (bounded_ranges::bounded_ranges): New.
5838 (bounded_ranges::bounded_ranges): New.
5839 (bounded_ranges::canonicalize): New.
5840 (bounded_ranges::validate): New.
5841 (bounded_ranges::operator==): New.
5842 (bounded_ranges::dump_to_pp): New.
5843 (bounded_ranges::dump): New.
5844 (bounded_ranges::to_json): New.
5845 (bounded_ranges::eval_condition): New.
5846 (bounded_ranges::contain_p): New.
5847 (bounded_ranges::cmp): New.
5848 (bounded_ranges_manager::~bounded_ranges_manager): New.
5849 (bounded_ranges_manager::get_or_create_empty): New.
5850 (bounded_ranges_manager::get_or_create_point): New.
5851 (bounded_ranges_manager::get_or_create_range): New.
5852 (bounded_ranges_manager::get_or_create_union): New.
5853 (bounded_ranges_manager::get_or_create_intersection): New.
5854 (bounded_ranges_manager::get_or_create_inverse): New.
5855 (bounded_ranges_manager::consolidate): New.
5856 (bounded_ranges_manager::get_or_create_ranges_for_switch): New.
5857 (bounded_ranges_manager::create_ranges_for_switch): New.
5858 (bounded_ranges_manager::make_case_label_ranges): New.
5859 (bounded_ranges_manager::log_stats): New.
5860 (bounded_ranges_constraint::print): New.
5861 (bounded_ranges_constraint::to_json): New.
5862 (bounded_ranges_constraint::operator==): New.
5863 (bounded_ranges_constraint::add_to_hash): New.
5864 (constraint_manager::constraint_manager): Update for new field
5865 m_bounded_ranges_constraints.
5866 (constraint_manager::operator=): Likewise.
5867 (constraint_manager::hash): Likewise.
5868 (constraint_manager::operator==): Likewise.
5869 (constraint_manager::print): Likewise.
5870 (constraint_manager::dump_to_pp): Likewise.
5871 (constraint_manager::to_json): Likewise.
5872 (constraint_manager::add_unknown_constraint): Update the lhs_ec_id
5873 if necessary in existing constraints when combining equivalence
5874 classes. Add similar code for handling
5875 m_bounded_ranges_constraints.
5876 (constraint_manager::add_constraint_internal): Add comment.
5877 (constraint_manager::add_bounded_ranges): New.
5878 (constraint_manager::eval_condition): Use new field
5879 m_bounded_ranges_constraints.
5880 (constraint_manager::purge): Update bounded_ranges_constraint
5881 instances.
5882 (constraint_manager::canonicalize): Update for new field.
5883 (merger_fact_visitor::on_ranges): New.
5884 (constraint_manager::for_each_fact): Use new field
5885 m_bounded_ranges_constraints.
5886 (constraint_manager::validate): Fix off-by-one error needed due
5887 to bug fixed above in add_unknown_constraint. Validate the EC IDs
5888 in m_bounded_ranges_constraints.
5889 (constraint_manager::get_range_manager): New.
5890 (selftest::assert_dump_bounded_range_eq): New.
5891 (ASSERT_DUMP_BOUNDED_RANGE_EQ): New.
5892 (selftest::test_bounded_range): New.
5893 (selftest::assert_dump_bounded_ranges_eq): New.
5894 (ASSERT_DUMP_BOUNDED_RANGES_EQ): New.
5895 (selftest::test_bounded_ranges): New.
5896 (selftest::run_constraint_manager_tests): Call the new selftests.
5897 * constraint-manager.h (struct bounded_range): New.
5898 (struct bounded_ranges): New.
5899 (template <> struct default_hash_traits<bounded_ranges::key_t>): New.
5900 (class bounded_ranges_manager): New.
5901 (fact_visitor::on_ranges): New pure virtual function.
5902 (class bounded_ranges_constraint): New.
5903 (constraint_manager::add_bounded_ranges): New decl.
5904 (constraint_manager::get_range_manager): New decl.
5905 (constraint_manager::m_bounded_ranges_constraints): New field.
5906 * diagnostic-manager.cc (epath_finder::process_worklist_item):
5907 Transfer ownership of rc to add_feasibility_problem.
5908 * engine.cc (feasibility_problem::dump_to_pp): Use get_model.
5909 * feasible-graph.cc (infeasible_node::dump_dot): Update for
5910 conversion of m_rc to a pointer.
5911 (feasible_graph::add_feasibility_problem): Pass RC by pointer and
5912 take ownership.
5913 * feasible-graph.h (infeasible_node::infeasible_node): Pass RC by
5914 pointer and take ownership.
5915 (infeasible_node::~infeasible_node): New.
5916 (infeasible_node::m_rc): Convert to a pointer.
5917 (feasible_graph::add_feasibility_problem): Pass RC by pointer and
5918 take ownership.
5919 * region-model-manager.cc: Include
5920 "analyzer/constraint-manager.h".
5921 (region_model_manager::region_model_manager): Initializer new
5922 field m_range_mgr.
5923 (region_model_manager::~region_model_manager): Delete it.
5924 (region_model_manager::log_stats): Call log_stats on it.
5925 * region-model.cc (region_model::add_constraint): Use new subclass
5926 rejected_op_constraint.
5927 (region_model::apply_constraints_for_gswitch): Reimplement using
5928 bounded_ranges_manager.
5929 (rejected_constraint::dump_to_pp): Convert to...
5930 (rejected_op_constraint::dump_to_pp): ...this.
5931 (rejected_ranges_constraint::dump_to_pp): New.
5932 * region-model.h (struct purge_stats): Add field
5933 m_num_bounded_ranges_constraints.
5934 (region_model_manager::get_range_manager): New.
5935 (region_model_manager::m_range_mgr): New.
5936 (region_model::get_range_manager): New.
5937 (struct rejected_constraint): Split into...
5938 (class rejected_constraint):...this new abstract base class,
5939 and...
5940 (class rejected_op_constraint): ...this new concrete subclass.
5941 (class rejected_ranges_constraint): New.
5942 * supergraph.cc: Include "tree-cfg.h".
5943 (supergraph::supergraph): Drop idx param from add_cfg_edge.
5944 (supergraph::add_cfg_edge): Drop idx param.
5945 (switch_cfg_superedge::switch_cfg_superedge): Move here from
5946 header. Populate m_case_labels with all cases which go to DST.
5947 (switch_cfg_superedge::dump_label_to_pp): Reimplement to use
5948 m_case_labels.
5949 (switch_cfg_superedge::get_case_label): Delete.
5950 * supergraph.h (supergraphadd_cfg_edge): Drop "idx" param.
5951 (switch_cfg_superedge::switch_cfg_superedge): Drop idx param and
5952 move implementation to supergraph.cc.
5953 (switch_cfg_superedge::get_case_label): Delete.
5954 (switch_cfg_superedge::get_case_labels): New.
5955 (switch_cfg_superedge::m_idx): Delete.
5956 (switch_cfg_superedge::m_case_labels): New field.
5958 2021-08-23 David Malcolm <dmalcolm@redhat.com>
5960 PR analyzer/101875
5961 * sm-file.cc (file_diagnostic::describe_state_change): Handle
5962 change.m_expr being NULL.
5964 2021-08-23 David Malcolm <dmalcolm@redhat.com>
5966 PR analyzer/101837
5967 * analyzer.cc (maybe_reconstruct_from_def_stmt): Bail if fn is
5968 NULL, and assert that it's non-NULL before passing it to
5969 build_call_array_loc.
5971 2021-08-23 David Malcolm <dmalcolm@redhat.com>
5973 PR analyzer/101962
5974 * region-model.cc (region_model::eval_condition_without_cm):
5975 Refactor comparison against zero, adding a check for
5976 POINTER_PLUS_EXPR of non-NULL.
5978 2021-08-23 David Malcolm <dmalcolm@redhat.com>
5980 * store.cc (bit_range::intersects_p): New overload.
5981 (bit_range::operator-): New.
5982 (binding_cluster::maybe_get_compound_binding): Handle the partial
5983 overlap case.
5984 (selftest::test_bit_range_intersects_p): Add test coverage for
5985 new overload of bit_range::intersects_p.
5986 * store.h (bit_range::intersects_p): New overload.
5987 (bit_range::operator-): New.
5989 2021-08-23 Ankur Saini <arsenic@sourceware.org>
5991 PR analyzer/102020
5992 * diagnostic-manager.cc
5993 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Fix typo.
5995 2021-08-21 Ankur Saini <arsenic@sourceware.org>
5997 PR analyzer/101980
5998 * diagnostic-manager.cc
5999 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Use
6000 caller_model only when the supergraph_edge doesn't exixt.
6001 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
6002 Likewise.
6003 * engine.cc (exploded_graph::create_dynamic_call): Rename to...
6004 (exploded_graph::maybe_create_dynamic_call): ...this, return call
6005 creation status.
6006 (exploded_graph::process_node): Handle calls which were not dynamically
6007 discovered.
6008 * exploded-graph.h (exploded_graph::create_dynamic_call): Rename to...
6009 (exploded_graph::maybe_create_dynamic_call): ...this.
6010 * region-model.cc (region_model::update_for_gcall): New param, use it
6011 to push call to frame.
6012 (region_model::update_for_call_superedge): Pass callee function to
6013 update_for_gcall.
6014 * region-model.h (region_model::update_for_gcall): New param.
6016 2021-08-18 Ankur Saini <arsenic@sourceware.org>
6018 PR analyzer/97114
6019 * region-model.cc (region_model::get_rvalue_1): Add case for
6020 OBJ_TYPE_REF.
6022 2021-08-18 Ankur Saini <arsenic@sourceware.org>
6024 PR analyzer/100546
6025 * analysis-plan.cc (analysis_plan::use_summary_p): Don't use call
6026 summaries if there is no callgraph edge
6027 * checker-path.cc (call_event::call_event): Handle calls events that
6028 are not represented by a supergraph call edge
6029 (return_event::return_event): Likewise.
6030 (call_event::get_desc): Work with new call_event structure.
6031 (return_event::get_desc): Likeise.
6032 * checker-path.h (call_event::m_src_snode): New field.
6033 (call_event::m_dest_snode): New field.
6034 (return_event::m_src_snode): New field.
6035 (return_event::m_dest_snode): New field.
6036 * diagnostic-manager.cc
6037 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>:
6038 Refactor to work with edges without callgraph edge.
6039 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
6040 Likewise.
6041 * engine.cc (dynamic_call_info_t::update_model): New function.
6042 (dynamic_call_info_t::add_events_to_path): New function.
6043 (exploded_graph::create_dynamic_call): New function.
6044 (exploded_graph::process_node): Work with dynamically discovered calls.
6045 * exploded-graph.h (class dynamic_call_info_t): New class.
6046 (exploded_graph::create_dynamic_call): New decl.
6047 * program-point.cc (program_point::push_to_call_stack): New function.
6048 (program_point::pop_from_call_stack): New function.
6049 * program-point.h (program_point::push_to_call_stack): New decl.
6050 (program_point::pop_from_call_stack): New decl.
6051 * program-state.cc (program_state::push_call): New function.
6052 (program_state::returning_call): New function.
6053 * program-state.h (program_state::push_call): New decl.
6054 (program_state::returning_call): New decl.
6055 * region-model.cc (region_model::update_for_gcall) New function.
6056 (region_model::update_for_return_gcall): New function.
6057 (egion_model::update_for_call_superedge): Get the underlying gcall and
6058 update for gcall.
6059 (region_model::update_for_return_superedge): Likewise.
6060 * region-model.h (region_model::update_for_gcall): New decl.
6061 (region_model::update_for_return_gcall): New decl.
6062 * state-purge.cc (state_purge_per_ssa_name::process_point): Update to
6063 work with calls without underlying cgraph edge.
6064 * supergraph.cc (supergraph::supergraph) Split snodes at every callsite.
6065 * supergraph.h (supernode::get_returning_call) New accessor.
6067 2021-08-04 David Malcolm <dmalcolm@redhat.com>
6069 PR analyzer/101570
6070 * analyzer.cc (maybe_reconstruct_from_def_stmt): Add GIMPLE_ASM
6071 case.
6072 * analyzer.h (class asm_output_svalue): New forward decl.
6073 (class reachable_regions): New forward decl.
6074 * complexity.cc (complexity::from_vec_svalue): New.
6075 * complexity.h (complexity::from_vec_svalue): New decl.
6076 * engine.cc (feasibility_state::maybe_update_for_edge): Handle
6077 asm stmts by calling on_asm_stmt.
6078 * region-model-asm.cc: New file.
6079 * region-model-manager.cc
6080 (region_model_manager::maybe_fold_asm_output_svalue): New.
6081 (region_model_manager::get_or_create_asm_output_svalue): New.
6082 (region_model_manager::log_stats): Log m_asm_output_values_map.
6083 * region-model.cc (region_model::on_stmt_pre): Handle GIMPLE_ASM.
6084 * region-model.h (visitor::visit_asm_output_svalue): New.
6085 (region_model_manager::get_or_create_asm_output_svalue): New decl.
6086 (region_model_manager::maybe_fold_asm_output_svalue): New decl.
6087 (region_model_manager::asm_output_values_map_t): New typedef.
6088 (region_model_manager::m_asm_output_values_map): New field.
6089 (region_model::on_asm_stmt): New.
6090 * store.cc (binding_cluster::on_asm): New.
6091 * store.h (binding_cluster::on_asm): New decl.
6092 * svalue.cc (svalue::cmp_ptr): Handle SK_ASM_OUTPUT.
6093 (asm_output_svalue::dump_to_pp): New.
6094 (asm_output_svalue::dump_input): New.
6095 (asm_output_svalue::input_idx_to_asm_idx): New.
6096 (asm_output_svalue::accept): New.
6097 * svalue.h (enum svalue_kind): Add SK_ASM_OUTPUT.
6098 (svalue::dyn_cast_asm_output_svalue): New.
6099 (class asm_output_svalue): New.
6100 (is_a_helper <const asm_output_svalue *>::test): New.
6101 (struct default_hash_traits<asm_output_svalue::key_t>): New.
6103 2021-08-03 Jakub Jelinek <jakub@redhat.com>
6105 PR analyzer/101721
6106 * sm-malloc.cc (known_allocator_p): Only check DECL_FUNCTION_CODE on
6107 BUILT_IN_NORMAL builtins.
6109 2021-07-29 Ankur Saini <arsenic@sourceware.org>
6111 * call-string.cc (call_string::element_t::operator==): New operator.
6112 (call_String::element_t::operator!=): New operator.
6113 (call_string::element_t::get_caller_function): New function.
6114 (call_string::element_t::get_callee_function): New function.
6115 (call_string::call_string): Refactor to Initialise m_elements.
6116 (call_string::operator=): Refactor to work with m_elements.
6117 (call_string::operator==): Likewise.
6118 (call_string::to_json): Likewise.
6119 (call_string::hash): Refactor to hash e.m_caller.
6120 (call_string::push_call): Refactor to work with m_elements.
6121 (call_string::push_call): New overload to push call via supernodes.
6122 (call_string::pop): Refactor to work with m_elements.
6123 (call_string::calc_recursion_depth): Likewise.
6124 (call_string::cmp): Likewise.
6125 (call_string::validate): Likewise.
6126 (call_string::operator[]): Likewise.
6127 * call-string.h (class supernode): New forward decl.
6128 (struct call_string::element_t): New struct.
6129 (call_string::call_string): Refactor to initialise m_elements.
6130 (call_string::bool empty_p): Refactor to work with m_elements.
6131 (call_string::get_callee_node): New decl.
6132 (call_string::get_caller_node): New decl.
6133 (m_elements): Replaces m_return_edges.
6134 * program-point.cc (program_point::get_function_at_depth): Refactor to
6135 work with new call-string format.
6136 (program_point::validate): Likewise.
6137 (program_point::on_edge): Likewise.
6139 2021-07-28 David Malcolm <dmalcolm@redhat.com>
6141 * region-model.cc (region_model::on_call_pre): Treat
6142 IFN_UBSAN_BOUNDS, BUILT_IN_STACK_SAVE, and BUILT_IN_STACK_RESTORE
6143 as no-ops, rather than handling them as unknown functions.
6145 2021-07-28 David Malcolm <dmalcolm@redhat.com>
6147 * region-model-impl-calls.cc (region_model::impl_call_alloca):
6148 Drop redundant return value.
6149 (region_model::impl_call_builtin_expect): Likewise.
6150 (region_model::impl_call_calloc): Likewise.
6151 (region_model::impl_call_malloc): Likewise.
6152 (region_model::impl_call_memset): Likewise.
6153 (region_model::impl_call_operator_new): Likewise.
6154 (region_model::impl_call_operator_delete): Likewise.
6155 (region_model::impl_call_strlen): Likewise.
6156 * region-model.cc (region_model::on_call_pre): Fix return value of
6157 known functions that don't have unknown side-effects.
6158 * region-model.h (region_model::impl_call_alloca): Drop redundant
6159 return value.
6160 (region_model::impl_call_builtin_expect): Likewise.
6161 (region_model::impl_call_calloc): Likewise.
6162 (region_model::impl_call_malloc): Likewise.
6163 (region_model::impl_call_memset): Likewise.
6164 (region_model::impl_call_strlen): Likewise.
6165 (region_model::impl_call_operator_new): Likewise.
6166 (region_model::impl_call_operator_delete): Likewise.
6168 2021-07-28 Siddhesh Poyarekar <siddhesh@gotplt.org>
6170 * analyzer.cc (is_named_call_p, is_std_named_call_p): Make
6171 first argument a const_tree.
6172 * analyzer.h (is_named_call_p, -s_std_named_call_p): Likewise.
6173 * sm-malloc.cc (known_allocator_p): New function.
6174 (malloc_state_machine::on_stmt): Use it.
6176 2021-07-28 Siddhesh Poyarekar <siddhesh@gotplt.org>
6178 * sm-malloc.cc
6179 (malloc_state_machine::get_or_create_deallocator): Recognize
6180 __builtin_free.
6182 2021-07-26 David Malcolm <dmalcolm@redhat.com>
6184 * region-model.cc (region_model::on_call_pre): Always set conjured
6185 LHS, not just for SSA names.
6187 2021-07-23 David Malcolm <dmalcolm@redhat.com>
6189 * diagnostic-manager.cc
6190 (class auto_disable_complexity_checks): New.
6191 (epath_finder::explore_feasible_paths): Use it to disable
6192 complexity checks whilst processing the worklist.
6193 * region-model-manager.cc
6194 (region_model_manager::region_model_manager): Initialize
6195 m_check_complexity.
6196 (region_model_manager::reject_if_too_complex): Bail if
6197 m_check_complexity is false.
6198 * region-model.h
6199 (region_model_manager::enable_complexity_check): New.
6200 (region_model_manager::disable_complexity_check): New.
6201 (region_model_manager::m_check_complexity): New.
6203 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6205 PR analyzer/101547
6206 * sm-file.cc (file_leak::emit): Handle m_arg being NULL.
6207 (file_leak::describe_final_event): Handle ev.m_expr being NULL.
6209 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6211 PR analyzer/101522
6212 * store.cc (binding_cluster::purge_state_involving): Don't change
6213 m_map whilst iterating through it.
6215 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6217 * region-model.cc (region_model::handle_phi): Add "old_state"
6218 param and use it.
6219 (region_model::update_for_phis): Update so that all of the phi
6220 stmts are effectively handled simultaneously, rather than in
6221 order.
6222 * region-model.h (region_model::handle_phi): Add "old_state"
6223 param.
6224 * state-purge.cc (self_referential_phi_p): Replace with...
6225 (name_used_by_phis_p): ...this new function.
6226 (state_purge_per_ssa_name::process_point): Update to use the
6227 above, so that all phi stmts at a basic block are effectively
6228 considered simultaneously, and only consider the phi arguments for
6229 the pertinent in-edge.
6230 * supergraph.cc (cfg_superedge::get_phi_arg_idx): New.
6231 (cfg_superedge::get_phi_arg): Use the above.
6232 * supergraph.h (cfg_superedge::get_phi_arg_idx): New decl.
6234 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6236 * state-purge.cc (state_purge_annotator::add_node_annotations):
6237 Rather than erroneously always using the NULL in-edge, determine
6238 each relevant in-edge, and print the appropriate data for each
6239 in-edge. Use print_needed to print the data as comma-separated
6240 lists of SSA names.
6241 (print_vec_of_names): Add "within_table" param and use it.
6242 (state_purge_annotator::add_stmt_annotations): Factor out
6243 collation and printing code into...
6244 (state_purge_annotator::print_needed): ...this new function.
6245 * state-purge.h (state_purge_annotator::print_needed): New decl.
6247 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6249 * program-point.cc (function_point::print): Show src BB index at
6250 BEFORE_SUPERNODE.
6252 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6254 * svalue.cc (infix_p): New.
6255 (binop_svalue::dump_to_pp): Use it to print MIN_EXPR and MAX_EXPR
6256 in prefix form, rather than infix.
6258 2021-07-19 David Malcolm <dmalcolm@redhat.com>
6260 PR analyzer/101503
6261 * constraint-manager.cc (constraint_manager::add_constraint): Use
6262 can_have_associated_state_p rather than testing for unknown.
6263 (constraint_manager::get_or_add_equiv_class): Likewise.
6264 * program-state.cc (sm_state_map::set_state): Likewise.
6265 (sm_state_map::impl_set_state): Add assertion.
6266 * region-model-manager.cc
6267 (region_model_manager::maybe_fold_unaryop): Handle poisoned
6268 values.
6269 (region_model_manager::maybe_fold_binop): Move handling of unknown
6270 values...
6271 (region_model_manager::get_or_create_binop): ...to here, and
6272 generalize to use can_have_associated_state_p.
6273 (region_model_manager::maybe_fold_sub_svalue): Use
6274 can_have_associated_state_p rather than testing for unknown.
6275 (region_model_manager::maybe_fold_repeated_svalue): Use unknown
6276 when the size or repeated value is "unknown"/"poisoned".
6277 * region-model.cc (region_model::purge_state_involving): Reject
6278 attempts to purge unknown/poisoned svalues, as these svalues
6279 should not have state associated with them.
6280 * svalue.cc (sub_svalue::sub_svalue): Assert that we're building
6281 on top of an svalue with can_have_associated_state_p.
6282 (repeated_svalue::repeated_svalue): Likewise.
6283 (bits_within_svalue::bits_within_svalue): Likewise.
6284 * svalue.h (svalue::can_have_associated_state_p): New.
6285 (unknown_svalue::can_have_associated_state_p): New.
6286 (poisoned_svalue::can_have_associated_state_p): New.
6287 (unaryop_svalue::unaryop_svalue): Assert that we're building on
6288 top of an svalue with can_have_associated_state_p.
6289 (binop_svalue::binop_svalue): Likewise.
6290 (widening_svalue::widening_svalue): Likewise.
6292 2021-07-16 David Malcolm <dmalcolm@redhat.com>
6294 * analyzer.h (enum access_direction): New.
6295 * engine.cc (exploded_node::on_longjmp): Update for new param of
6296 get_store_value.
6297 * program-state.cc (program_state::prune_for_point): Likewise.
6298 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
6299 Replace call to check_for_writable_region with call to
6300 check_region_for_write.
6301 (region_model::impl_call_memset): Likewise.
6302 (region_model::impl_call_strcpy): Likewise.
6303 * region-model-reachability.cc (reachable_regions::add): Update
6304 for new param of get_store_value.
6305 * region-model.cc (region_model::get_rvalue_1): Likewise, also for
6306 get_rvalue_for_bits.
6307 (region_model::get_store_value): Add ctxt param and use it to call
6308 check_region_for_read.
6309 (region_model::get_rvalue_for_bits): Add ctxt param and use it to
6310 call get_store_value.
6311 (region_model::check_region_access): New.
6312 (region_model::check_region_for_write): New.
6313 (region_model::check_region_for_read): New.
6314 (region_model::set_value): Update comment. Replace call to
6315 check_for_writable_region with call to check_region_for_write.
6316 * region-model.h (region_model::get_rvalue_for_bits): Add ctxt
6317 param.
6318 (region_model::get_store_value): Add ctxt param.
6319 (region_model::check_region_access): New decl.
6320 (region_model::check_region_for_write): New decl.
6321 (region_model::check_region_for_read): New decl.
6322 * region.cc (region_model::copy_region): Update call to
6323 get_store_value.
6324 * svalue.cc (initial_svalue::implicitly_live_p): Likewise.
6326 2021-07-16 David Malcolm <dmalcolm@redhat.com>
6328 * engine.cc (exploded_node::on_stmt_pre): Handle
6329 __analyzer_dump_state.
6330 * program-state.cc (extrinsic_state::get_sm_idx_by_name): New.
6331 (program_state::impl_call_analyzer_dump_state): New.
6332 * program-state.h (extrinsic_state::get_sm_idx_by_name): New decl.
6333 (program_state::impl_call_analyzer_dump_state): New decl.
6334 * region-model-impl-calls.cc
6335 (call_details::get_arg_string_literal): New.
6336 * region-model.h (call_details::get_arg_string_literal): New decl.
6338 2021-07-16 David Malcolm <dmalcolm@redhat.com>
6340 * program-state.cc (program_state::detect_leaks): Simplify using
6341 svalue::maybe_get_region.
6342 * region-model-impl-calls.cc (region_model::impl_call_fgets): Likewise.
6343 (region_model::impl_call_fread): Likewise.
6344 (region_model::impl_call_free): Likewise.
6345 (region_model::impl_call_operator_delete): Likewise.
6346 * region-model.cc (selftest::test_stack_frames): Likewise.
6347 (selftest::test_state_merging): Likewise.
6348 * svalue.cc (svalue::maybe_get_region): New.
6349 * svalue.h (svalue::maybe_get_region): New decl.
6351 2021-07-15 David Malcolm <dmalcolm@redhat.com>
6353 * svalue.h (is_a_helper <placeholder_svalue *>::test): Make
6354 param and template param const.
6355 (is_a_helper <widening_svalue *>::test): Likewise.
6356 (is_a_helper <compound_svalue *>::test): Likewise.
6357 (is_a_helper <conjured_svalue *>::test): Likewise.
6359 2021-07-15 David Malcolm <dmalcolm@redhat.com>
6361 PR analyzer/95006
6362 PR analyzer/94713
6363 PR analyzer/94714
6364 * analyzer.cc (maybe_reconstruct_from_def_stmt): Split out
6365 GIMPLE_ASSIGN case into...
6366 (get_diagnostic_tree_for_gassign_1): New.
6367 (get_diagnostic_tree_for_gassign): New.
6368 * analyzer.h (get_diagnostic_tree_for_gassign): New decl.
6369 * analyzer.opt (Wanalyzer-write-to-string-literal): New.
6370 * constraint-manager.cc (class svalue_purger): New.
6371 (constraint_manager::purge_state_involving): New.
6372 * constraint-manager.h
6373 (constraint_manager::purge_state_involving): New.
6374 * diagnostic-manager.cc (saved_diagnostic::supercedes_p): New.
6375 (dedupe_winners::handle_interactions): New.
6376 (diagnostic_manager::emit_saved_diagnostics): Call it.
6377 * diagnostic-manager.h (saved_diagnostic::supercedes_p): New decl.
6378 * engine.cc (impl_region_model_context::warn): Convert return type
6379 to bool. Return false if the diagnostic isn't saved.
6380 (impl_region_model_context::purge_state_involving): New.
6381 (impl_sm_context::get_state): Use NULL ctxt when querying old
6382 rvalue.
6383 (impl_sm_context::set_next_state): Use new sval when querying old
6384 state.
6385 (class dump_path_diagnostic): Move to region-model.cc
6386 (exploded_node::on_stmt): Move to on_stmt_pre and on_stmt_post.
6387 Remove call to purge_state_involving.
6388 (exploded_node::on_stmt_pre): New, based on the above. Move most
6389 of it to region_model::on_stmt_pre.
6390 (exploded_node::on_stmt_post): Likewise, moving to
6391 region_model::on_stmt_post.
6392 (class stale_jmp_buf): Fix parent class to use curiously recurring
6393 template pattern.
6394 (feasibility_state::maybe_update_for_edge): Call on_call_pre and
6395 on_call_post on gcalls.
6396 * exploded-graph.h (impl_region_model_context::warn): Return bool.
6397 (impl_region_model_context::purge_state_involving): New decl.
6398 (exploded_node::on_stmt_pre): New decl.
6399 (exploded_node::on_stmt_post): New decl.
6400 * pending-diagnostic.h (pending_diagnostic::use_of_uninit_p): New.
6401 (pending_diagnostic::supercedes_p): New.
6402 * program-state.cc (sm_state_map::get_state): Inherit state for
6403 conjured_svalue as well as initial_svalue.
6404 (sm_state_map::purge_state_involving): Also support SK_CONJURED.
6405 * region-model-impl-calls.cc (call_details::get_uncertainty):
6406 Handle m_ctxt being NULL.
6407 (call_details::get_or_create_conjured_svalue): New.
6408 (region_model::impl_call_fgets): New.
6409 (region_model::impl_call_fread): New.
6410 * region-model-manager.cc
6411 (region_model_manager::get_or_create_initial_value): Return an
6412 uninitialized poisoned value for regions that can't have initial
6413 values.
6414 * region-model-reachability.cc
6415 (reachable_regions::mark_escaped_clusters): Handle ctxt being
6416 NULL.
6417 * region-model.cc (region_to_value_map::purge_state_involving): New.
6418 (poisoned_value_diagnostic::use_of_uninit_p): New.
6419 (poisoned_value_diagnostic::emit): Handle POISON_KIND_UNINIT.
6420 (poisoned_value_diagnostic::describe_final_event): Likewise.
6421 (region_model::check_for_poison): New.
6422 (region_model::on_assignment): Call it.
6423 (class dump_path_diagnostic): Move here from engine.cc.
6424 (region_model::on_stmt_pre): New, based on exploded_node::on_stmt.
6425 (region_model::on_call_pre): Move the setting of the LHS to a
6426 conjured svalue to before the checks for specific functions.
6427 Handle "fgets", "fgets_unlocked", and "fread".
6428 (region_model::purge_state_involving): New.
6429 (region_model::handle_unrecognized_call): Handle ctxt being NULL.
6430 (region_model::get_rvalue): Call check_for_poison.
6431 (selftest::test_stack_frames): Use NULL for context when getting
6432 uninitialized rvalue.
6433 (selftest::test_alloca): Likewise.
6434 * region-model.h (region_to_value_map::purge_state_involving): New
6435 decl.
6436 (call_details::get_or_create_conjured_svalue): New decl.
6437 (region_model::on_stmt_pre): New decl.
6438 (region_model::purge_state_involving): New decl.
6439 (region_model::impl_call_fgets): New decl.
6440 (region_model::impl_call_fread): New decl.
6441 (region_model::check_for_poison): New decl.
6442 (region_model_context::warn): Return bool.
6443 (region_model_context::purge_state_involving): New.
6444 (noop_region_model_context::warn): Return bool.
6445 (noop_region_model_context::purge_state_involving): New.
6446 (test_region_model_context:: warn): Return bool.
6447 * region.cc (region::get_memory_space): New.
6448 (region::can_have_initial_svalue_p): New.
6449 (region::involves_p): New.
6450 * region.h (enum memory_space): New.
6451 (region::get_memory_space): New decl.
6452 (region::can_have_initial_svalue_p): New decl.
6453 (region::involves_p): New decl.
6454 * sm-malloc.cc (use_after_free::supercedes_p): New.
6455 * store.cc (binding_cluster::purge_state_involving): New.
6456 (store::purge_state_involving): New.
6457 * store.h (class symbolic_binding): New forward decl.
6458 (binding_key::dyn_cast_symbolic_binding): New.
6459 (symbolic_binding::dyn_cast_symbolic_binding): New.
6460 (binding_cluster::purge_state_involving): New.
6461 (store::purge_state_involving): New.
6462 * svalue.cc (svalue::can_merge_p): Reject attempts to merge
6463 poisoned svalues with other svalues, so that we identify
6464 paths in which a variable is conditionally uninitialized.
6465 (involvement_visitor::visit_conjured_svalue): New.
6466 (svalue::involves_p): Also handle SK_CONJURED.
6467 (poison_kind_to_str): Handle POISON_KIND_UNINIT.
6468 (poisoned_svalue::maybe_fold_bits_within): New.
6469 * svalue.h (enum poison_kind): Add POISON_KIND_UNINIT.
6470 (poisoned_svalue::maybe_fold_bits_within): New decl.
6472 2021-07-15 David Malcolm <dmalcolm@redhat.com>
6474 * analyzer.opt (fdump-analyzer-exploded-paths): New.
6475 * diagnostic-manager.cc
6476 (diagnostic_manager::emit_saved_diagnostic): Implement it.
6477 * engine.cc (exploded_path::dump_to_pp): Add ext_state param and
6478 use it to dump states if non-NULL.
6479 (exploded_path::dump): Likewise.
6480 (exploded_path::dump_to_file): New.
6481 * exploded-graph.h (exploded_path::dump_to_pp): Add ext_state
6482 param.
6483 (exploded_path::dump): Likewise.
6484 (exploded_path::dump): Likewise.
6485 (exploded_path::dump_to_file): New.
6487 2021-07-15 David Malcolm <dmalcolm@redhat.com>
6489 * analyzer.cc (fixup_tree_for_diagnostic_1): Use DECL_DEBUG_EXPR
6490 if it's available.
6491 * engine.cc (readability): Likewise.
6493 2021-07-15 David Malcolm <dmalcolm@redhat.com>
6495 * state-purge.cc (self_referential_phi_p): New.
6496 (state_purge_per_ssa_name::process_point): Don't purge an SSA name
6497 at its def-stmt if the def-stmt is self-referential.
6499 2021-07-07 David Malcolm <dmalcolm@redhat.com>
6501 * diagnostic-manager.cc (null_assignment_sm_context::get_state):
6502 New overload.
6503 (null_assignment_sm_context::set_next_state): New overload.
6504 (null_assignment_sm_context::get_diagnostic_tree): New.
6505 * engine.cc (impl_sm_context::get_state): New overload.
6506 (impl_sm_context::set_next_state): New overload.
6507 (impl_sm_context::get_diagnostic_tree): New overload.
6508 (impl_region_model_context::on_condition): Convert params from
6509 tree to const svalue *.
6510 * exploded-graph.h (impl_region_model_context::on_condition):
6511 Likewise.
6512 * region-model.cc (region_model::on_call_pre): Move handling of
6513 internal calls to before checking for get_fndecl_for_call.
6514 (region_model::add_constraints_from_binop): New.
6515 (region_model::add_constraint): Split out into a new overload
6516 working on const svalue * rather than tree. Call
6517 add_constraints_from_binop. Drop call to
6518 add_any_constraints_from_ssa_def_stmt.
6519 (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
6520 (region_model::add_any_constraints_from_gassign): Delete.
6521 (region_model::add_any_constraints_from_gcall): Delete.
6522 * region-model.h
6523 (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
6524 (region_model::add_any_constraints_from_gassign): Delete.
6525 (region_model::add_any_constraints_from_gcall): Delete.
6526 (region_model::add_constraint): Add overload decl.
6527 (region_model::add_constraints_from_binop): New decl.
6528 (region_model_context::on_condition): Convert params from tree to
6529 const svalue *.
6530 (noop_region_model_context::on_condition): Likewise.
6531 * sm-file.cc (fileptr_state_machine::condition): Likewise.
6532 * sm-malloc.cc (malloc_state_machine::on_condition): Likewise.
6533 * sm-pattern-test.cc: Include tristate.h, selftest.h,
6534 analyzer/call-string.h, analyzer/program-point.h,
6535 analyzer/store.h, and analyzer/region-model.h.
6536 (pattern_test_state_machine::on_condition): Convert params from tree to
6537 const svalue *.
6538 * sm-sensitive.cc (sensitive_state_machine::on_condition): Delete.
6539 * sm-signal.cc (signal_state_machine::on_condition): Delete.
6540 * sm-taint.cc (taint_state_machine::on_condition): Convert params
6541 from tree to const svalue *.
6542 * sm.cc: Include tristate.h, selftest.h, analyzer/call-string.h,
6543 analyzer/program-point.h, analyzer/store.h, and
6544 analyzer/region-model.h.
6545 (any_pointer_p): Add overload taking const svalue *sval.
6546 * sm.h (any_pointer_p): Add overload taking const svalue *sval.
6547 (state_machine::on_condition): Convert params from tree to
6548 const svalue *. Provide no-op default implementation.
6549 (sm_context::get_state): Add overload taking const svalue *sval.
6550 (sm_context::set_next_state): Likewise.
6551 (sm_context::on_transition): Likewise.
6552 (sm_context::get_diagnostic_tree): Likewise.
6553 * svalue.cc (svalue::all_zeroes_p): New.
6554 (constant_svalue::all_zeroes_p): New.
6555 (repeated_svalue::all_zeroes_p): Convert to vfunc.
6556 * svalue.h (svalue::all_zeroes_p): New decl.
6557 (constant_svalue::all_zeroes_p): New decl.
6558 (repeated_svalue::all_zeroes_p): Convert decl to vfunc.
6560 2021-06-30 David Malcolm <dmalcolm@redhat.com>
6562 PR analyzer/95006
6563 * analyzer.h (class repeated_svalue): New forward decl.
6564 (class bits_within_svalue): New forward decl.
6565 (class sized_region): New forward decl.
6566 (get_field_at_bit_offset): New forward decl.
6567 * engine.cc (exploded_graph::get_or_create_node): Validate the
6568 merged state.
6569 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
6570 Validate the states at each stage.
6571 * program-state.cc (program_state::validate): Validate
6572 m_region_model.
6573 * region-model-impl-calls.cc (region_model::impl_call_memset):
6574 Replace special-case logic for handling constant sizes with
6575 a call to fill_region of a sized_region with the given fill value.
6576 * region-model-manager.cc (maybe_undo_optimize_bit_field_compare):
6577 Drop DK_direct.
6578 (region_model_manager::maybe_fold_sub_svalue): Fold element-based
6579 subregions of an initial value into initial values of an element.
6580 Fold subvalues of repeated svalues.
6581 (region_model_manager::maybe_fold_repeated_svalue): New.
6582 (region_model_manager::get_or_create_repeated_svalue): New.
6583 (get_bit_range_for_field): New.
6584 (get_byte_range_for_field): New.
6585 (get_field_at_byte_range): New.
6586 (region_model_manager::maybe_fold_bits_within_svalue): New.
6587 (region_model_manager::get_or_create_bits_within): New.
6588 (region_model_manager::get_sized_region): New.
6589 (region_model_manager::log_stats): Update for addition of
6590 m_repeated_values_map, m_bits_within_values_map, and
6591 m_sized_regions.
6592 * region-model.cc (region_model::validate): New.
6593 (region_model::on_assignment): Drop enum binding_kind.
6594 (region_model::get_initial_value_for_global): Likewise.
6595 (region_model::get_rvalue_for_bits): Replace body with call to
6596 get_or_create_bits_within.
6597 (region_model::get_capacity): Handle RK_SIZED.
6598 (region_model::set_value): Drop enum binding_kind.
6599 (region_model::fill_region): New.
6600 (region_model::get_representative_path_var_1): Handle RK_SIZED.
6601 * region-model.h (visitor::visit_repeated_svalue): New.
6602 (visitor::visit_bits_within_svalue): New.
6603 (region_model_manager::get_or_create_repeated_svalue): New decl.
6604 (region_model_manager::get_or_create_bits_within): New decl.
6605 (region_model_manager::get_sized_region): New decl.
6606 (region_model_manager::maybe_fold_repeated_svalue): New decl.
6607 (region_model_manager::maybe_fold_bits_within_svalue): New decl.
6608 (region_model_manager::repeated_values_map_t): New typedef.
6609 (region_model_manager::m_repeated_values_map): New field.
6610 (region_model_manager::bits_within_values_map_t): New typedef.
6611 (region_model_manager::m_bits_within_values_map): New field.
6612 (region_model_manager::m_sized_regions): New field.
6613 (region_model::fill_region): New decl.
6614 * region.cc (region::get_base_region): Handle RK_SIZED.
6615 (region::base_region_p): Likewise.
6616 (region::get_byte_size_sval): New.
6617 (get_field_at_bit_offset): Make non-static.
6618 (region::calc_offset): Move implementation of cases to
6619 get_relative_concrete_offset vfunc implementations. Handle
6620 RK_SIZED.
6621 (region::get_relative_concrete_offset): New.
6622 (decl_region::get_svalue_for_initializer): Drop enum binding_kind.
6623 (field_region::get_relative_concrete_offset): New, from
6624 region::calc_offset.
6625 (element_region::get_relative_concrete_offset): Likewise.
6626 (offset_region::get_relative_concrete_offset): Likewise.
6627 (sized_region::accept): New.
6628 (sized_region::dump_to_pp): New.
6629 (sized_region::get_byte_size): New.
6630 (sized_region::get_bit_size): New.
6631 * region.h (enum region_kind): Add RK_SIZED.
6632 (region::dyn_cast_sized_region): New.
6633 (region::get_byte_size): Make virtual.
6634 (region::get_bit_size): Likewise.
6635 (region::get_byte_size_sval): New decl.
6636 (region::get_relative_concrete_offset): New decl.
6637 (field_region::get_relative_concrete_offset): New decl.
6638 (element_region::get_relative_concrete_offset): Likewise.
6639 (offset_region::get_relative_concrete_offset): Likewise.
6640 (class sized_region): New.
6641 * store.cc (binding_kind_to_string): Delete.
6642 (binding_key::make): Drop enum binding_kind.
6643 (binding_key::dump_to_pp): Delete.
6644 (binding_key::cmp_ptrs): Drop enum binding_kind.
6645 (bit_range::contains_p): New.
6646 (byte_range::dump): New.
6647 (byte_range::contains_p): New.
6648 (byte_range::cmp): New.
6649 (concrete_binding::dump_to_pp): Drop enum binding_kind.
6650 (concrete_binding::cmp_ptr_ptr): Likewise.
6651 (symbolic_binding::dump_to_pp): Likewise.
6652 (symbolic_binding::cmp_ptr_ptr): Likewise.
6653 (binding_map::apply_ctor_val_to_range): Likewise.
6654 (binding_map::apply_ctor_pair_to_child_region): Likewise.
6655 (binding_map::get_overlapping_bindings): New.
6656 (binding_map::remove_overlapping_bindings): New.
6657 (binding_cluster::validate): New.
6658 (binding_cluster::bind): Drop enum binding_kind.
6659 (binding_cluster::bind_compound_sval): Likewise.
6660 (binding_cluster::purge_region): Likewise.
6661 (binding_cluster::zero_fill_region): Reimplement in terms of...
6662 (binding_cluster::fill_region): New.
6663 (binding_cluster::mark_region_as_unknown): Drop enum binding_kind.
6664 (binding_cluster::get_binding): Likewise.
6665 (binding_cluster::get_binding_recursive): Likewise.
6666 (binding_cluster::get_any_binding): Likewise.
6667 (binding_cluster::maybe_get_compound_binding): Reimplement.
6668 (binding_cluster::get_overlapping_bindings): Delete.
6669 (binding_cluster::remove_overlapping_bindings): Reimplement in
6670 terms of binding_map::remove_overlapping_bindings.
6671 (binding_cluster::can_merge_p): Update for removal of
6672 enum binding_kind.
6673 (binding_cluster::on_unknown_fncall): Drop enum binding_kind.
6674 (binding_cluster::maybe_get_simple_value): Likewise.
6675 (store_manager::get_concrete_binding): Likewise.
6676 (store_manager::get_symbolic_binding): Likewise.
6677 (store::validate): New.
6678 (store::set_value): Drop enum binding_kind.
6679 (store::zero_fill_region): Reimplement in terms of...
6680 (store::fill_region): New.
6681 (selftest::test_binding_key_overlap): Drop enum binding_kind.
6682 * store.h (enum binding_kind): Delete.
6683 (binding_kind_to_string): Delete decl.
6684 (binding_key::make): Drop enum binding_kind.
6685 (binding_key::dump_to_pp): Make pure virtual.
6686 (binding_key::get_kind): Delete.
6687 (binding_key::mark_deleted): Delete.
6688 (binding_key::mark_empty): Delete.
6689 (binding_key::is_deleted): Delete.
6690 (binding_key::is_empty): Delete.
6691 (binding_key::binding_key): Delete.
6692 (binding_key::impl_hash): Delete.
6693 (binding_key::impl_eq): Delete.
6694 (binding_key::m_kind): Delete.
6695 (bit_range::get_last_bit_offset): New.
6696 (bit_range::contains_p): New.
6697 (byte_range::contains_p): New.
6698 (byte_range::operator==): New.
6699 (byte_range::get_start_byte_offset): New.
6700 (byte_range::get_next_byte_offset): New.
6701 (byte_range::get_last_byte_offset): New.
6702 (byte_range::as_bit_range): New.
6703 (byte_range::cmp): New.
6704 (concrete_binding::concrete_binding): Drop enum binding_kind.
6705 (concrete_binding::hash): Likewise.
6706 (concrete_binding::operator==): Likewise.
6707 (concrete_binding::mark_deleted): New.
6708 (concrete_binding::mark_empty): New.
6709 (concrete_binding::is_deleted): New.
6710 (concrete_binding::is_empty): New.
6711 (default_hash_traits<ana::concrete_binding>::empty_zero_p): Make false.
6712 (symbolic_binding::symbolic_binding): Drop enum binding_kind.
6713 (symbolic_binding::hash): Likewise.
6714 (symbolic_binding::operator==): Likewise.
6715 (symbolic_binding::mark_deleted): New.
6716 (symbolic_binding::mark_empty): New.
6717 (symbolic_binding::is_deleted): New.
6718 (symbolic_binding::is_empty): New.
6719 (binding_map::remove_overlapping_bindings): New decl.
6720 (binding_map::get_overlapping_bindings): New decl.
6721 (binding_cluster::validate): New decl.
6722 (binding_cluster::bind): Drop enum binding_kind.
6723 (binding_cluster::fill_region): New decl.
6724 (binding_cluster::get_binding): Drop enum binding_kind.
6725 (binding_cluster::get_binding_recursive): Likewise.
6726 (binding_cluster::get_overlapping_bindings): Delete.
6727 (store::validate): New decl.
6728 (store::set_value): Drop enum binding_kind.
6729 (store::fill_region): New decl.
6730 (store_manager::get_concrete_binding): Drop enum binding_kind.
6731 (store_manager::get_symbolic_binding): Likewise.
6732 * svalue.cc (svalue::cmp_ptr): Handle SK_REPEATED and
6733 SK_BITS_WITHIN.
6734 (svalue::extract_bit_range): New.
6735 (svalue::maybe_fold_bits_within): New.
6736 (constant_svalue::maybe_fold_bits_within): New.
6737 (unknown_svalue::maybe_fold_bits_within): New.
6738 (unaryop_svalue::maybe_fold_bits_within): New.
6739 (repeated_svalue::repeated_svalue): New.
6740 (repeated_svalue::dump_to_pp): New.
6741 (repeated_svalue::accept): New.
6742 (repeated_svalue::all_zeroes_p): New.
6743 (repeated_svalue::maybe_fold_bits_within): New.
6744 (bits_within_svalue::bits_within_svalue): New.
6745 (bits_within_svalue::dump_to_pp): New.
6746 (bits_within_svalue::maybe_fold_bits_within): New.
6747 (bits_within_svalue::accept): New.
6748 (bits_within_svalue::implicitly_live_p): New.
6749 (compound_svalue::maybe_fold_bits_within): New.
6750 * svalue.h (enum svalue_kind): Add SK_REPEATED and SK_BITS_WITHIN.
6751 (svalue::dyn_cast_repeated_svalue): New.
6752 (svalue::dyn_cast_bits_within_svalue): New.
6753 (svalue::extract_bit_range): New decl.
6754 (svalue::maybe_fold_bits_within): New vfunc decl.
6755 (region_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6756 (region_svalue::key_t::is_empty): Likewise.
6757 (default_hash_traits<region_svalue::key_t>::empty_zero_p): Make false.
6758 (constant_svalue::maybe_fold_bits_within): New.
6759 (unknown_svalue::maybe_fold_bits_within): New.
6760 (poisoned_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6761 (poisoned_svalue::key_t::is_empty): Likewise.
6762 (default_hash_traits<poisoned_svalue::key_t>::empty_zero_p): Make
6763 false.
6764 (setjmp_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6765 (setjmp_svalue::key_t::is_empty): Likewise.
6766 (default_hash_traits<setjmp_svalue::key_t>::empty_zero_p): Make
6767 false.
6768 (unaryop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6769 (unaryop_svalue::key_t::is_empty): Likewise.
6770 (unaryop_svalue::maybe_fold_bits_within): New.
6771 (default_hash_traits<unaryop_svalue::key_t>::empty_zero_p): Make
6772 false.
6773 (binop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6774 (binop_svalue::key_t::is_empty): Likewise.
6775 (default_hash_traits<binop_svalue::key_t>::empty_zero_p): Make
6776 false.
6777 (sub_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6778 (sub_svalue::key_t::is_empty): Likewise.
6779 (default_hash_traits<sub_svalue::key_t>::empty_zero_p): Make
6780 false.
6781 (class repeated_svalue): New.
6782 (is_a_helper <const repeated_svalue *>::test): New.
6783 (struct default_hash_traits<repeated_svalue::key_t>): New.
6784 (class bits_within_svalue): New.
6785 (is_a_helper <const bits_within_svalue *>::test): New.
6786 (struct default_hash_traits<bits_within_svalue::key_t>): New.
6787 (widening_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6788 (widening_svalue::key_t::is_empty): Likewise.
6789 (default_hash_traits<widening_svalue::key_t>::empty_zero_p): Make
6790 false.
6791 (compound_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6792 (compound_svalue::key_t::is_empty): Likewise.
6793 (compound_svalue::maybe_fold_bits_within): New.
6794 (default_hash_traits<compound_svalue::key_t>::empty_zero_p): Make
6795 false.
6797 2021-06-28 David Malcolm <dmalcolm@redhat.com>
6799 * analyzer.h (byte_offset_t): New typedef.
6800 * store.cc (bit_range::dump_to_pp): Dump as a byte range if
6801 possible.
6802 (bit_range::as_byte_range): New.
6803 (byte_range::dump_to_pp): New.
6804 * store.h (class byte_range): New forward decl.
6805 (struct bit_range): Add comment.
6806 (bit_range::as_byte_range): New decl.
6807 (struct byte_range): New.
6809 2021-06-22 David Malcolm <dmalcolm@redhat.com>
6811 PR analyzer/101143
6812 * region-model.cc (compat_types_p): New function.
6813 (region_model::create_region_for_heap_alloc): Convert assertion to
6814 an error check.
6815 (region_model::create_region_for_alloca): Likewise.
6817 2021-06-18 David Malcolm <dmalcolm@redhat.com>
6819 * store.cc (binding_cluster::get_any_binding): Make symbolic reads
6820 from a cluster with concrete bindings return unknown.
6822 2021-06-18 David Malcolm <dmalcolm@redhat.com>
6824 * region-model-manager.cc
6825 (region_model_manager::get_or_create_int_cst): New.
6826 (region_model_manager::maybe_undo_optimize_bit_field_compare): Use
6827 it to simplify away a local tree.
6828 * region-model.cc (region_model::on_setjmp): Likewise.
6829 (region_model::on_longjmp): Likewise.
6830 * region-model.h (region_model_manager::get_or_create_int_cst):
6831 New decl.
6832 * store.cc (binding_cluster::zero_fill_region): Use it to simplify
6833 away a local tree.
6835 2021-06-18 David Malcolm <dmalcolm@redhat.com>
6837 * checker-path.cc (class custom_event): Make abstract to allow for
6838 custom vfuncs, splitting existing implementation into...
6839 (class precanned_custom_event): New subclass.
6840 (custom_event::get_desc): Move to...
6841 (precanned_custom_event::get_desc): ...subclass.
6842 * checker-path.h (class custom_event): Make abstract to allow for
6843 custom vfuncs, splitting existing implementation into...
6844 (class precanned_custom_event): New subclass.
6845 * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
6846 Use precanned_custom_event.
6847 * engine.cc
6848 (stale_jmp_buf::maybe_add_custom_events_for_superedge): Likewise.
6849 * sm-signal.cc (signal_delivery_edge_info_t::add_events_to_path):
6850 Likewise.
6852 2021-06-15 David Malcolm <dmalcolm@redhat.com>
6854 PR analyzer/99212
6855 PR analyzer/101082
6856 * engine.cc: Include "target.h".
6857 (impl_run_checkers): Log BITS_BIG_ENDIAN, BYTES_BIG_ENDIAN, and
6858 WORDS_BIG_ENDIAN.
6859 * region-model-manager.cc
6860 (region_model_manager::maybe_fold_binop): Move support for masking
6861 via ARG0 & CST into...
6862 (region_model_manager::maybe_undo_optimize_bit_field_compare):
6863 ...this new function. Flatten by converting from nested
6864 conditionals to a series of early return statements to reject
6865 failures. Reject if type is not unsigned_char_type_node.
6866 Handle BYTES_BIG_ENDIAN when determining which bits are bound
6867 in the binding_map.
6868 * region-model.h
6869 (region_model_manager::maybe_undo_optimize_bit_field_compare):
6870 New decl.
6871 * store.cc (bit_range::dump): New function.
6872 * store.h (bit_range::dump): New decl.
6874 2021-06-15 David Malcolm <dmalcolm@redhat.com>
6876 * engine.cc (exploded_node::on_stmt): Handle __analyzer_dump_capacity.
6877 (exploded_node::on_stmt): Drop m_sm_changes from on_stmt_flags.
6878 (state_change_requires_new_enode_p): New function...
6879 (exploded_graph::process_node): Call it, rather than querying
6880 flags.m_sm_changes, so that dynamic-extent differences can also
6881 trigger the splitting of nodes.
6882 * exploded-graph.h (struct on_stmt_flags): Drop field m_sm_changes.
6883 * program-state.cc (program_state::detect_leaks): Purge dead
6884 heap-allocated regions from dynamic extents.
6885 (selftest::test_program_state_1): Fix type of "size_in_bytes".
6886 (selftest::test_program_state_merging): Likewise.
6887 * region-model-impl-calls.cc
6888 (region_model::impl_call_analyzer_dump_capacity): New.
6889 (region_model::impl_call_free): Remove dynamic extents from the
6890 freed region.
6891 * region-model-reachability.h
6892 (reachable_regions::begin_mutable_base_regs): New.
6893 (reachable_regions::end_mutable_base_regs): New.
6894 * region-model.cc: Include "tree-object-size.h".
6895 (region_model::region_model): Support new field m_dynamic_extents.
6896 (region_model::operator=): Likewise.
6897 (region_model::operator==): Likewise.
6898 (region_model::dump_to_pp): Dump sizes of dynamic regions.
6899 (region_model::handle_unrecognized_call): Purge dynamic extents
6900 from any regions that have escaped mutably:.
6901 (region_model::get_capacity): New function.
6902 (region_model::add_constraint): Unset dynamic extents when a
6903 heap-allocated region's address is NULL.
6904 (region_model::unbind_region_and_descendents): Purge dynamic
6905 extents of unbound regions.
6906 (region_model::can_merge_with_p): Call
6907 m_dynamic_extents.can_merge_with_p.
6908 (region_model::create_region_for_heap_alloc): Assert that
6909 size_in_bytes's type is compatible with size_type_node. Update
6910 for renaming of record_dynamic_extents to set_dynamic_extents.
6911 (region_model::create_region_for_alloca): Likewise.
6912 (region_model::record_dynamic_extents): Rename to...
6913 (region_model::set_dynamic_extents): ...this. Assert that
6914 size_in_bytes's type is compatible with size_type_node. Add it
6915 to the m_dynamic_extents map.
6916 (region_model::get_dynamic_extents): New.
6917 (region_model::unset_dynamic_extents): New.
6918 (selftest::test_state_merging): Fix type of "size".
6919 (selftest::test_malloc_constraints): Likewise.
6920 (selftest::test_malloc): Verify dynamic extents.
6921 (selftest::test_alloca): Likewise.
6922 * region-model.h (region_to_value_map::is_empty): New.
6923 (region_model::dynamic_extents_t): New typedef.
6924 (region_model::impl_call_analyzer_dump_capacity): New decl.
6925 (region_model::get_dynamic_extents): New function.
6926 (region_model::get_dynamic_extents): New decl.
6927 (region_model::set_dynamic_extents): New decl.
6928 (region_model::unset_dynamic_extents): New decl.
6929 (region_model::get_capacity): New decl.
6930 (region_model::record_dynamic_extents): Rename to set_dynamic_extents.
6931 (region_model::m_dynamic_extents): New field.
6933 2021-06-15 David Malcolm <dmalcolm@redhat.com>
6935 * region-model.cc (region_to_value_map::operator=): New.
6936 (region_to_value_map::operator==): New.
6937 (region_to_value_map::dump_to_pp): New.
6938 (region_to_value_map::dump): New.
6939 (region_to_value_map::can_merge_with_p): New.
6940 * region-model.h (class region_to_value_map): New class.
6942 2021-06-13 Trevor Saunders <tbsaunde@tbsaunde.org>
6944 * call-string.cc (call_string::call_string): Use range based for
6945 to iterate over vec<>.
6946 (call_string::to_json): Likewise.
6947 (call_string::hash): Likewise.
6948 (call_string::calc_recursion_depth): Likewise.
6949 * checker-path.cc (checker_path::fixup_locations): Likewise.
6950 * constraint-manager.cc (equiv_class::equiv_class): Likewise.
6951 (equiv_class::to_json): Likewise.
6952 (equiv_class::hash): Likewise.
6953 (constraint_manager::to_json): Likewise.
6954 * engine.cc (impl_region_model_context::on_svalue_leak):
6955 Likewise.
6956 (on_liveness_change): Likewise.
6957 (impl_region_model_context::on_unknown_change): Likewise.
6958 * program-state.cc (sm_state_map::set_state): Likewise.
6959 * region-model.cc (test_canonicalization_4): Likewise.
6961 2021-06-11 David Malcolm <dmalcolm@redhat.com>
6963 * engine.cc (worklist::key_t::cmp): Move sort by call_string to
6964 before SCC.
6966 2021-06-09 David Malcolm <dmalcolm@redhat.com>
6968 * region-model.cc (region_model::get_lvalue_1): Make const.
6969 (region_model::get_lvalue): Likewise.
6970 (region_model::get_rvalue_1): Likewise.
6971 (region_model::get_rvalue): Likewise.
6972 (region_model::deref_rvalue): Likewise.
6973 (region_model::get_rvalue_for_bits): Likewise.
6974 * region-model.h (region_model::get_lvalue): Likewise.
6975 (region_model::get_rvalue): Likewise.
6976 (region_model::deref_rvalue): Likewise.
6977 (region_model::get_rvalue_for_bits): Likewise.
6978 (region_model::get_lvalue_1): Likewise.
6979 (region_model::get_rvalue_1): Likewise.
6981 2021-06-08 David Malcolm <dmalcolm@redhat.com>
6983 PR analyzer/99212
6984 * region-model-manager.cc
6985 (region_model_manager::maybe_fold_binop): Add support for folding
6986 BIT_AND_EXPR of compound_svalue and a mask constant.
6987 * region-model.cc (region_model::get_rvalue_1): Implement
6988 BIT_FIELD_REF in terms of...
6989 (region_model::get_rvalue_for_bits): New function.
6990 * region-model.h (region_model::get_rvalue_for_bits): New decl.
6991 * store.cc (bit_range::from_mask): New function.
6992 (selftest::test_bit_range_intersects_p): New selftest.
6993 (selftest::assert_bit_range_from_mask_eq): New.
6994 (ASSERT_BIT_RANGE_FROM_MASK_EQ): New macro.
6995 (selftest::assert_no_bit_range_from_mask_eq): New.
6996 (ASSERT_NO_BIT_RANGE_FROM_MASK): New macro.
6997 (selftest::test_bit_range_from_mask): New selftest.
6998 (selftest::analyzer_store_cc_tests): Call the new selftests.
6999 * store.h (bit_range::intersects_p): New.
7000 (bit_range::from_mask): New decl.
7001 (concrete_binding::get_bit_range): New accessor.
7002 (store_manager::get_concrete_binding): New overload taking
7003 const bit_range &.
7005 2021-06-08 David Malcolm <dmalcolm@redhat.com>
7007 * analyzer.h (int_size_in_bits): New decl.
7008 * region.cc (int_size_in_bits): New function.
7009 (region::get_bit_size): Reimplement in terms of the above.
7011 2021-06-08 David Malcolm <dmalcolm@redhat.com>
7013 * store.cc (concrete_binding::dump_to_pp): Move bulk of
7014 implementation to...
7015 (bit_range::dump_to_pp): ...this new function.
7016 (bit_range::cmp): New.
7017 (concrete_binding::overlaps_p): Update for use of bit_range.
7018 (concrete_binding::cmp_ptr_ptr): Likewise.
7019 * store.h (struct bit_range): New.
7020 (class concrete_binding): Replace fields m_start_bit_offset and
7021 m_size_in_bits with new field m_bit_range.
7023 2021-06-08 David Malcolm <dmalcolm@redhat.com>
7025 * svalue.h (conjured_svalue::iterator_t): Delete.
7027 2021-06-03 David Malcolm <dmalcolm@redhat.com>
7029 * store.h (store::get_direct_binding): Remove unused decl.
7030 (store::get_default_binding): Likewise.
7032 2021-06-03 David Malcolm <dmalcolm@redhat.com>
7034 * svalue.cc (poisoned_svalue::dump_to_pp): Dump type.
7035 (compound_svalue::dump_to_pp): Dump any type.
7037 2021-05-18 David Malcolm <dmalcolm@redhat.com>
7039 PR analyzer/100615
7040 * sm-malloc.cc: Include "analyzer/function-set.h".
7041 (malloc_state_machine::on_stmt): Call unaffected_by_call_p and
7042 bail on the functions it recognizes.
7043 (malloc_state_machine::unaffected_by_call_p): New.
7045 2021-05-10 Martin Liska <mliska@suse.cz>
7047 * sm-file.cc (is_file_using_fn_p): Use startswith
7048 function instead of strncmp.
7050 2021-05-10 Martin Liska <mliska@suse.cz>
7052 * program-state.cc (program_state::operator=): Remove
7053 __cplusplus >= 201103.
7054 (program_state::program_state): Likewise.
7055 * program-state.h: Likewise.
7056 * region-model.h (class region_model): Remove dead code.
7058 2021-04-24 David Malcolm <dmalcolm@redhat.com>
7060 PR analyzer/100244
7061 * sm-malloc.cc (free_of_non_heap::describe_state_change):
7062 Bulletproof against change.m_expr being NULL.
7064 2021-04-13 David Malcolm <dmalcolm@redhat.com>
7066 PR analyzer/98599
7067 * supergraph.cc (saved_uids::make_uid_unique): New.
7068 (saved_uids::restore_uids): New.
7069 (supergraph::supergraph): Replace assignments to stmt->uid with
7070 calls to m_stmt_uids.make_uid_unique.
7071 (supergraph::~supergraph): New.
7072 * supergraph.h (class saved_uids): New.
7073 (supergraph::~supergraph): New decl.
7074 (supergraph::m_stmt_uids): New field.
7076 2021-04-10 David Malcolm <dmalcolm@redhat.com>
7078 PR analyzer/100011
7079 * region-model.cc (region_model::on_assignment): Avoid NULL
7080 dereference if ctxt is NULL when assigning from a STRING_CST.
7082 2021-04-08 David Malcolm <dmalcolm@redhat.com>
7084 PR analyzer/99042
7085 PR analyzer/99774
7086 * engine.cc
7087 (impl_region_model_context::impl_region_model_context): Add
7088 uncertainty param and use it to initialize m_uncertainty.
7089 (impl_region_model_context::get_uncertainty): New.
7090 (impl_sm_context::get_fndecl_for_call): Add NULL for new
7091 uncertainty param when constructing impl_region_model_context.
7092 (impl_sm_context::get_state): Likewise.
7093 (impl_sm_context::set_next_state): Likewise.
7094 (impl_sm_context::warn): Likewise.
7095 (exploded_node::on_stmt): Add uncertainty param
7096 and use it when constructing impl_region_model_context.
7097 (exploded_node::on_edge): Add uncertainty param and pass
7098 to on_edge call.
7099 (exploded_node::detect_leaks): Create uncertainty_t and pass to
7100 impl_region_model_context.
7101 (exploded_graph::get_or_create_node): Create uncertainty_t and
7102 pass to prune_for_point.
7103 (maybe_process_run_of_before_supernode_enodes): Create
7104 uncertainty_t and pass to impl_region_model_context.
7105 (exploded_graph::process_node): Create uncertainty_t instances and
7106 pass around as needed.
7107 * exploded-graph.h
7108 (impl_region_model_context::impl_region_model_context): Add
7109 uncertainty param.
7110 (impl_region_model_context::get_uncertainty): New decl.
7111 (impl_region_model_context::m_uncertainty): New field.
7112 (exploded_node::on_stmt): Add uncertainty param.
7113 (exploded_node::on_edge): Likewise.
7114 * program-state.cc (sm_state_map::on_liveness_change): Get
7115 uncertainty from context and use it to unset sm-state from
7116 svalues as appropriate.
7117 (program_state::on_edge): Add uncertainty param and use it when
7118 constructing impl_region_model_context. Fix indentation.
7119 (program_state::prune_for_point): Add uncertainty param and use it
7120 when constructing impl_region_model_context.
7121 (program_state::detect_leaks): Get any uncertainty from ctxt and
7122 use it to get maybe-live svalues for dest_state, rather than
7123 definitely-live ones; use this when determining which svalues
7124 have leaked.
7125 (selftest::test_program_state_merging): Create uncertainty_t and
7126 pass to impl_region_model_context.
7127 * program-state.h (program_state::on_edge): Add uncertainty param.
7128 (program_state::prune_for_point): Likewise.
7129 * region-model-impl-calls.cc (call_details::get_uncertainty): New.
7130 (region_model::impl_call_memcpy): Pass uncertainty to
7131 mark_region_as_unknown call.
7132 (region_model::impl_call_memset): Likewise.
7133 (region_model::impl_call_strcpy): Likewise.
7134 * region-model-reachability.cc (reachable_regions::handle_sval):
7135 Also add sval to m_mutable_svals.
7136 * region-model.cc (region_model::on_assignment): Pass any
7137 uncertainty from ctxt to the store::set_value call.
7138 (region_model::handle_unrecognized_call): Get any uncertainty from
7139 ctxt and use it to record mutable svalues at the unknown call.
7140 (region_model::get_reachable_svalues): Add uncertainty param and
7141 use it to mark any maybe-bound svalues as being reachable.
7142 (region_model::set_value): Pass any uncertainty from ctxt to the
7143 store::set_value call.
7144 (region_model::mark_region_as_unknown): Add uncertainty param and
7145 pass it on to the store::mark_region_as_unknown call.
7146 (region_model::update_for_call_summary): Add uncertainty param and
7147 pass it on to the region_model::mark_region_as_unknown call.
7148 * region-model.h (call_details::get_uncertainty): New decl.
7149 (region_model::get_reachable_svalues): Add uncertainty param.
7150 (region_model::mark_region_as_unknown): Add uncertainty param.
7151 (region_model_context::get_uncertainty): New vfunc.
7152 (noop_region_model_context::get_uncertainty): New vfunc
7153 implementation.
7154 * store.cc (dump_svalue_set): New.
7155 (uncertainty_t::dump_to_pp): New.
7156 (uncertainty_t::dump): New.
7157 (binding_cluster::clobber_region): Pass NULL for uncertainty to
7158 remove_overlapping_bindings.
7159 (binding_cluster::mark_region_as_unknown): Add uncertainty param
7160 and pass it to remove_overlapping_bindings.
7161 (binding_cluster::remove_overlapping_bindings): Add uncertainty param.
7162 Use it to record any svalues that were in clobbered bindings.
7163 (store::set_value): Add uncertainty param. Pass it to
7164 binding_cluster::mark_region_as_unknown when handling symbolic
7165 regions.
7166 (store::mark_region_as_unknown): Add uncertainty param and pass it
7167 to binding_cluster::mark_region_as_unknown.
7168 (store::remove_overlapping_bindings): Add uncertainty param and
7169 pass it to binding_cluster::remove_overlapping_bindings.
7170 * store.h (binding_cluster::mark_region_as_unknown): Add
7171 uncertainty param.
7172 (binding_cluster::remove_overlapping_bindings): Likewise.
7173 (store::set_value): Likewise.
7174 (store::mark_region_as_unknown): Likewise.
7176 2021-04-05 David Malcolm <dmalcolm@redhat.com>
7178 PR analyzer/99906
7179 * analyzer.cc (maybe_reconstruct_from_def_stmt): Fix NULL
7180 dereference on calls with zero arguments.
7181 * sm-malloc.cc (malloc_state_machine::on_stmt): When handling
7182 __attribute__((nonnull)), only call get_diagnostic_tree if the
7183 result will be used.
7185 2021-04-05 David Malcolm <dmalcolm@redhat.com>
7187 PR analyzer/99886
7188 * diagnostic-manager.cc
7189 (diagnostic_manager::prune_interproc_events): Use signed integers
7190 when subtracting one from path->num_events ().
7191 (diagnostic_manager::consolidate_conditions): Likewise. Convert
7192 next_idx to a signed int.
7194 2021-04-01 David Malcolm <dmalcolm@redhat.com>
7196 * diagnostic-manager.cc (diagnostic_manager::add_diagnostic): Make
7197 enode param non-constant, and call add_diagnostic on it. Add
7198 enode index to log message.
7199 (diagnostic_manager::add_diagnostic): Make enode param
7200 non-constant.
7201 * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
7202 Likewise for both decls.
7203 * engine.cc
7204 (impl_region_model_context::impl_region_model_context): Likewise
7205 for enode_for_diag.
7206 (impl_sm_context::impl_sm_context): Likewise.
7207 (impl_sm_context::m_enode_for_diag): Likewise.
7208 (exploded_node::dump_dot): Don't pass the diagnostic manager
7209 to dump_saved_diagnostics.
7210 (exploded_node::dump_saved_diagnostics): Drop param. Iterate
7211 directly through all saved diagnostics for the enode, rather
7212 than all saved diagnostics in the diagnostic_manager and
7213 filtering.
7214 (exploded_node::on_stmt): Make non-const.
7215 (exploded_node::on_edge): Likewise.
7216 (exploded_node::on_longjmp): Likewise.
7217 (exploded_node::detect_leaks): Likewise.
7218 (exploded_graph::get_or_create_node): Make enode_for_diag param
7219 non-const.
7220 (exploded_graph_annotator::print_enode): Iterate
7221 directly through all saved diagnostics for the enode, rather
7222 than all saved diagnostics in the diagnostic_manager and
7223 filtering.
7224 * exploded-graph.h
7225 (impl_region_model_context::impl_region_model_context): Make
7226 enode_for_diag param non-constant.
7227 (impl_region_model_context::m_enode_for_diag): Likewise.
7228 (exploded_node::dump_saved_diagnostics): Drop param.
7229 (exploded_node::on_stmt): Make non-const.
7230 (exploded_node::on_edge): Likewise.
7231 (exploded_node::on_longjmp): Likewise.
7232 (exploded_node::detect_leaks): Likewise.
7233 (exploded_node::add_diagnostic): New.
7234 (exploded_node::get_num_diagnostics): New.
7235 (exploded_node::get_saved_diagnostic): New.
7236 (exploded_node::m_saved_diagnostics): New.
7237 (exploded_graph::get_or_create_node): Make enode_for_diag param
7238 non-constant.
7239 * feasible-graph.cc (feasible_node::dump_dot): Drop
7240 diagnostic_manager from call to dump_saved_diagnostics.
7241 * program-state.cc (program_state::on_edge): Convert enode param
7242 to non-const pointer.
7243 (program_state::prune_for_point): Likewise for enode_for_diag
7244 param.
7245 * program-state.h (program_state::on_edge): Convert enode param
7246 to non-const pointer.
7247 (program_state::prune_for_point): Likewise for enode_for_diag
7248 param.
7250 2021-03-31 David Malcolm <dmalcolm@redhat.com>
7252 PR analyzer/99771
7253 * analyzer.cc (maybe_reconstruct_from_def_stmt): New.
7254 (fixup_tree_for_diagnostic_1): New.
7255 (fixup_tree_for_diagnostic): New.
7256 * analyzer.h (fixup_tree_for_diagnostic): New decl.
7257 * checker-path.cc (call_event::get_desc): Call
7258 fixup_tree_for_diagnostic and use it for the call_with_state call.
7259 (warning_event::get_desc): Likewise for the final_event and
7260 make_label_text calls.
7261 * engine.cc (impl_region_model_context::on_state_leak): Likewise
7262 for the on_leak and add_diagnostic calls.
7263 * region-model.cc (region_model::get_representative_tree):
7264 Likewise for the result.
7266 2021-03-30 David Malcolm <dmalcolm@redhat.com>
7268 * region.h (region::dump_to_pp): Remove old decl.
7270 2021-03-30 David Malcolm <dmalcolm@redhat.com>
7272 * sm-file.cc (fileptr_state_machine::on_stmt): Only call
7273 get_diagnostic_tree if the result will be used.
7274 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
7275 (malloc_state_machine::on_deallocator_call): Likewise.
7276 (malloc_state_machine::on_realloc_call): Likewise.
7277 (malloc_state_machine::on_realloc_call): Likewise.
7278 * sm-sensitive.cc
7279 (sensitive_state_machine::warn_for_any_exposure): Likewise.
7280 * sm-taint.cc (taint_state_machine::on_stmt): Likewise.
7282 2021-03-25 David Malcolm <dmalcolm@redhat.com>
7284 PR analyzer/93695
7285 PR analyzer/99044
7286 PR analyzer/99716
7287 * engine.cc (exploded_node::on_stmt): Clear sm-state involving
7288 an SSA name at the def-stmt of that SSA name.
7289 * program-state.cc (sm_state_map::purge_state_involving): New.
7290 * program-state.h (sm_state_map::purge_state_involving): New decl.
7291 * region-model.cc (selftest::test_involves_p): New.
7292 (selftest::analyzer_region_model_cc_tests): Call it.
7293 * svalue.cc (class involvement_visitor): New class
7294 (svalue::involves_p): New.
7295 * svalue.h (svalue::involves_p): New decl.
7297 2021-03-19 David Malcolm <dmalcolm@redhat.com>
7299 PR analyzer/99614
7300 * diagnostic-manager.cc (class epath_finder): Add
7301 DISABLE_COPY_AND_ASSIGN.
7303 2021-03-15 Martin Liska <mliska@suse.cz>
7305 * sm-file.cc (get_file_using_fns): Add missing comma in initializer.
7307 2021-03-11 David Malcolm <dmalcolm@redhat.com>
7309 PR analyzer/96374
7310 * analyzer.opt (-param=analyzer-max-infeasible-edges=): New param.
7311 (fdump-analyzer-feasibility): New flag.
7312 * diagnostic-manager.cc: Include "analyzer/trimmed-graph.h" and
7313 "analyzer/feasible-graph.h".
7314 (epath_finder::epath_finder): Convert m_sep to a pointer and
7315 only create it if !flag_analyzer_feasibility.
7316 (epath_finder::~epath_finder): New.
7317 (epath_finder::m_sep): Convert to a pointer.
7318 (epath_finder::get_best_epath): Add param "diag_idx" and use it
7319 when logging. Rather than finding the shortest path and then
7320 checking feasibility, instead use explore_feasible_paths unless
7321 !flag_analyzer_feasibility, in which case simply use the shortest
7322 path, and note if it is infeasible. Update for m_sep becoming a
7323 pointer.
7324 (class feasible_worklist): New.
7325 (epath_finder::explore_feasible_paths): New.
7326 (epath_finder::process_worklist_item): New.
7327 (class dump_eg_with_shortest_path): New.
7328 (epath_finder::dump_trimmed_graph): New.
7329 (epath_finder::dump_feasible_graph): New.
7330 (saved_diagnostic::saved_diagnostic): Add "idx" param, using it
7331 on new field m_idx.
7332 (saved_diagnostic::to_json): Dump m_idx.
7333 (saved_diagnostic::calc_best_epath): Pass m_idx to get_best_epath.
7334 Remove assertion that m_problem was set when m_best_epath is NULL.
7335 (diagnostic_manager::add_diagnostic): Pass an index when created
7336 saved_diagnostic instances.
7337 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add
7338 "idx" param.
7339 (saved_diagnostic::get_index): New accessor.
7340 (saved_diagnostic::m_idx): New field.
7341 * engine.cc (exploded_node::dump_dot): Call args.dump_extra_info.
7342 Move code to...
7343 (exploded_node::dump_processed_stmts): ...this new function and...
7344 (exploded_node::dump_saved_diagnostics): ...this new function.
7345 Add index of each diagnostic.
7346 (exploded_edge::dump_dot): Move bulk of code to...
7347 (exploded_edge::dump_dot_label): ...this new function.
7348 * exploded-graph.h (eg_traits::dump_args_t::dump_extra_info): New
7349 vfunc.
7350 (exploded_node::dump_processed_stmts): New decl.
7351 (exploded_node::dump_saved_diagnostics): New decl.
7352 (exploded_edge::dump_dot_label): New decl.
7353 * feasible-graph.cc: New file.
7354 * feasible-graph.h: New file.
7355 * trimmed-graph.cc: New file.
7356 * trimmed-graph.h: New file.
7358 2021-03-11 David Malcolm <dmalcolm@redhat.com>
7360 * diagnostic-manager.cc (epath_finder::epath_finder):
7361 Update shortest_paths init for new param.
7363 2021-03-10 David Malcolm <dmalcolm@redhat.com>
7365 PR analyzer/96374
7366 * engine.cc (exploded_path::feasible_p): Move "snodes_visited" and
7367 "model" locals into a new class feasibility_state. Move heart
7368 of per-edge processing into
7369 feasibility_state::maybe_update_for_edge.
7370 (feasibility_state::feasibility_state): New.
7371 (feasibility_state::maybe_update_for_edge): New, based on loop
7372 body in exploded_path::feasible_p.
7373 * exploded-graph.h (class feasibility_state): New.
7375 2021-03-10 David Malcolm <dmalcolm@redhat.com>
7377 * supergraph.h
7378 (callgraph_superedge::dyn_cast_callgraph_superedge): New.
7379 (call_superedge::dyn_cast_callgraph_superedge): Delete.
7380 (return_superedge::dyn_cast_callgraph_superedge): Delete.
7382 2021-03-02 Martin Liska <mliska@suse.cz>
7384 * diagnostic-manager.cc (diagnostic_manager::emit_saved_diagnostics):
7385 Do not pass engine.
7387 2021-02-26 David Malcolm <dmalcolm@redhat.com>
7389 * engine.cc (exploded_path::exploded_path): New copy-ctor.
7390 * exploded-graph.h (exploded_path::operator=): Drop decl.
7392 2021-02-26 David Malcolm <dmalcolm@redhat.com>
7394 PR analyzer/96374
7395 * diagnostic-manager.cc (class epath_finder): New.
7396 (epath_finder::get_best_epath): New.
7397 (saved_diagnostic::saved_diagnostic): Update for replacement of
7398 m_state and m_epath_length with m_best_epath.
7399 (saved_diagnostic::~saved_diagnostic): Delete m_best_epath.
7400 (saved_diagnostic::to_json): Update "path_length" to be optional.
7401 (saved_diagnostic::calc_best_epath): New, based on
7402 dedupe_winners::add and parts of dedupe_key::dedupe_key.
7403 (saved_diagnostic::get_epath_length): New.
7404 (saved_diagnostic::add_duplicate): New.
7405 (dedupe_key::dedupe_key): Drop epath param. Move invocation of
7406 stmt_finder to saved_diagnostic::calc_best_epath.
7407 (class dedupe_candidate): Delete.
7408 (class dedupe_hash_map_traits): Update to use saved_diagnotic *
7409 rather than dedupe_candidate * as the value_type/compare_type.
7410 (dedupe_winners::~dedupe_winners): Don't delete the values.
7411 (dedupe_winners::add): Convert param from shortest_exploded_paths to
7412 epath_finder. Drop "eg" param. Drop dedupe_candidate, moving
7413 path generation and feasiblity checking to
7414 epath_finder::get_best_epath. Update winner-selection for move
7415 of epaths from dedupe_candidate to saved_diagnostic.
7416 (dedupe_winners::emit_best): Update for removal of class
7417 dedupe_candidate.
7418 (dedupe_winners::map_t): Update to use saved_diagnotic * rather
7419 than dedupe_candidate * as the value_type/compare_type.
7420 (diagnostic_manager::emit_saved_diagnostics): Move
7421 shortest_exploded_paths instance into epath_finder and pass that
7422 around instead.
7423 (diagnostic_manager::emit_saved_diagnostic): Drop epath, stmt
7424 and num_dupes params, instead getting these from the
7425 saved_diagnostic. Use correct location in inform_n call.
7426 * diagnostic-manager.h (class epath_finder): New forward decl.
7427 (saved_diagnostic::status): Drop enum.
7428 (saved_diagnostic::set_feasible): Drop.
7429 (saved_diagnostic::set_infeasible): Drop.
7430 (saved_diagnostic::get_status): Drop.
7431 (saved_diagnostic::calc_best_epath): New decl.
7432 (saved_diagnostic::get_best_epath): New decl.
7433 (saved_diagnostic::get_epath_length): New decl.
7434 (saved_diagnostic::set_epath_length): Drop.
7435 (saved_diagnostic::get_epath_length): Drop inline implementation.
7436 (saved_diagnostic::add_duplicate): New.
7437 (saved_diagnostic::get_num_dupes): New.
7438 (saved_diagnostic::m_d): Document ownership.
7439 (saved_diagnostic::m_trailing_eedge): Make const.
7440 (saved_diagnostic::m_status): Drop field.
7441 (saved_diagnostic::m_epath_length): Drop field.
7442 (saved_diagnostic::m_best_epath): New field.
7443 (saved_diagnostic::m_problem): Document ownership.
7444 (saved_diagnostic::m_duplicates): New field.
7445 (diagnostic_manager::emit_saved_diagnostic): Drop params epath,
7446 stmt, and num_dupes.
7447 * engine.cc (exploded_graph_annotator::print_saved_diagnostic):
7448 Update for changes to saved_diagnostic class.
7449 * exploded-graph.h (exploded_path::feasible_p): Drop unused
7450 overloaded decl.
7452 2021-02-25 David Malcolm <dmalcolm@redhat.com>
7454 PR analyzer/99193
7455 * region-model-impl-calls.cc (region_model::impl_call_realloc): New.
7456 * region-model.cc (region_model::on_call_pre): Call it.
7457 * region-model.h (region_model::impl_call_realloc): New decl.
7458 * sm-malloc.cc (enum wording): Add WORDING_REALLOCATED.
7459 (malloc_state_machine::m_realloc): New field.
7460 (use_after_free::describe_state_change): Add case for
7461 WORDING_REALLOCATED.
7462 (use_after_free::describe_final_event): Likewise.
7463 (malloc_state_machine::malloc_state_machine): Initialize
7464 m_realloc.
7465 (malloc_state_machine::on_stmt): Handle realloc by calling...
7466 (malloc_state_machine::on_realloc_call): New.
7468 2021-02-22 David Malcolm <dmalcolm@redhat.com>
7470 PR analyzer/99196
7471 * engine.cc (exploded_node::on_stmt): Provide terminate_path
7472 flag as a way for on_call_pre to terminate the current analysis
7473 path.
7474 * region-model-impl-calls.cc (call_details::num_args): New.
7475 (region_model::impl_call_error): New.
7476 * region-model.cc (region_model::on_call_pre): Add param
7477 "out_terminate_path". Handle "error" and "error_at_line".
7478 * region-model.h (call_details::num_args): New decl.
7479 (region_model::on_call_pre): Add param "out_terminate_path".
7480 (region_model::impl_call_error): New decl.
7482 2021-02-17 David Malcolm <dmalcolm@redhat.com>
7484 PR analyzer/98969
7485 * constraint-manager.cc (dead_svalue_purger::should_purge_p):
7486 Update for change to svalue::live_p.
7487 * program-state.cc (sm_state_map::on_liveness_change): Likewise.
7488 (program_state::detect_leaks): Likewise.
7489 * region-model-reachability.cc (reachable_regions::init_cluster):
7490 When dealing with a symbolic region, if the underlying pointer is
7491 implicitly live, add the region to the reachable regions.
7492 * region-model.cc (region_model::compare_initial_and_pointer):
7493 Move logic for detecting initial values of params to
7494 initial_svalue::initial_value_of_param_p.
7495 * svalue.cc (svalue::live_p): Convert "live_svalues" from a
7496 reference to a pointer; support it being NULL.
7497 (svalue::implicitly_live_p): Convert first param from a
7498 refererence to a pointer.
7499 (region_svalue::implicitly_live_p): Likewise.
7500 (constant_svalue::implicitly_live_p): Likewise.
7501 (initial_svalue::implicitly_live_p): Likewise. Treat the initial
7502 values of params for the top level frame as still live.
7503 (initial_svalue::initial_value_of_param_p): New function, taken
7504 from a test in region_model::compare_initial_and_pointer.
7505 (unaryop_svalue::implicitly_live_p): Convert first param from a
7506 refererence to a pointer.
7507 (binop_svalue::implicitly_live_p): Likewise.
7508 (sub_svalue::implicitly_live_p): Likewise.
7509 (unmergeable_svalue::implicitly_live_p): Likewise.
7510 * svalue.h (svalue::live_p): Likewise.
7511 (svalue::implicitly_live_p): Likewise.
7512 (region_svalue::implicitly_live_p): Likewise.
7513 (constant_svalue::implicitly_live_p): Likewise.
7514 (initial_svalue::implicitly_live_p): Likewise.
7515 (initial_svalue::initial_value_of_param_p): New decl.
7516 (unaryop_svalue::implicitly_live_p): Convert first param from a
7517 refererence to a pointer.
7518 (binop_svalue::implicitly_live_p): Likewise.
7519 (sub_svalue::implicitly_live_p): Likewise.
7520 (unmergeable_svalue::implicitly_live_p): Likewise.
7522 2021-02-12 David Malcolm <dmalcolm@redhat.com>
7524 PR analyzer/98969
7525 * engine.cc (readability): Add names for the various arbitrary
7526 values. Handle NOP_EXPR and INTEGER_CST.
7527 (readability_comparator): Combine the readability tests for
7528 tree and stack depth, rather than performing them sequentially.
7529 (impl_region_model_context::on_state_leak): Strip off top-level
7530 casts.
7531 * region-model.cc (region_model::get_representative_path_var): Add
7532 type-checking, moving the bulk of the implementation to...
7533 (region_model::get_representative_path_var_1): ...here. Respect
7534 types in casts by recursing and re-adding the cast, rather than
7535 merely stripping them off. Use the correct type when handling
7536 region_svalue.
7537 (region_model::get_representative_tree): Strip off any top-level
7538 cast.
7539 (region_model::get_representative_path_var): Add type-checking,
7540 moving the bulk of the implementation to...
7541 (region_model::get_representative_path_var_1): ...here.
7542 * region-model.h (region_model::get_representative_path_var_1):
7543 New decl
7544 (region_model::get_representative_path_var_1): New decl.
7545 * store.cc (append_pathvar_with_type): New.
7546 (binding_cluster::get_representative_path_vars): Cast path_vars
7547 to the correct type when adding them to *OUT_PVS.
7549 2021-02-09 David Malcolm <dmalcolm@redhat.com>
7551 PR analyzer/98575
7552 * sm-file.cc (is_file_using_fn_p): Support "_IO_"-prefixed
7553 variants.
7555 2021-02-09 David Malcolm <dmalcolm@redhat.com>
7557 PR analyzer/98575
7558 * store.cc (store::set_value): Treat a pointer written to *UNKNOWN
7559 as having escaped.
7561 2021-02-02 David Malcolm <dmalcolm@redhat.com>
7563 PR analyzer/93355
7564 PR analyzer/96374
7565 * engine.cc (toplevel_function_p): Simplify so that
7566 we only reject functions with a "__analyzer_" prefix.
7567 (add_any_callbacks): Delete.
7568 (exploded_graph::build_initial_worklist): Update for
7569 dropped param of toplevel_function_p.
7570 (exploded_graph::build_initial_worklist): Don't bother
7571 looking for callbacks that are reachable from global
7572 initializers.
7574 2021-02-01 David Malcolm <dmalcolm@redhat.com>
7576 PR analyzer/98918
7577 * region-model-manager.cc
7578 (region_model_manager::get_or_create_initial_value):
7579 Fold the initial value of *UNKNOWN_PTR to an UNKNOWN value.
7580 (region_model_manager::get_field_region): Fold the value
7581 of UNKNOWN_PTR->FIELD to *UNKNOWN_PTR_OF_&FIELD_TYPE.
7583 2021-01-29 David Malcolm <dmalcolm@redhat.com>
7585 * checker-path.cc (event_kind_to_string): Handle
7586 EK_START_CONSOLIDATED_CFG_EDGES and
7587 EK_END_CONSOLIDATED_CFG_EDGES.
7588 (start_consolidated_cfg_edges_event::get_desc): New.
7589 (checker_path::cfg_edge_pair_at_p): New.
7590 * checker-path.h (enum event_kind): Add
7591 EK_START_CONSOLIDATED_CFG_EDGES and
7592 EK_END_CONSOLIDATED_CFG_EDGES.
7593 (class start_consolidated_cfg_edges_event): New class.
7594 (class end_consolidated_cfg_edges_event): New class.
7595 (checker_path::delete_events): New.
7596 (checker_path::replace_event): New.
7597 (checker_path::cfg_edge_pair_at_p): New decl.
7598 * diagnostic-manager.cc (diagnostic_manager::prune_path): Call
7599 consolidate_conditions.
7600 (same_line_as_p): New.
7601 (diagnostic_manager::consolidate_conditions): New.
7602 * diagnostic-manager.h
7603 (diagnostic_manager::consolidate_conditions): New decl.
7605 2021-01-18 David Malcolm <dmalcolm@redhat.com>
7607 * analyzer.h (is_std_named_call_p): New decl.
7608 * diagnostic-manager.cc (path_builder::get_sm): New.
7609 (state_change_event_creator::state_change_event_creator): Add "pb"
7610 param.
7611 (state_change_event_creator::on_global_state_change): Don't consider
7612 state changes affecting other state_machines.
7613 (state_change_event_creator::on_state_change): Likewise.
7614 (state_change_event_creator::m_pb): New field.
7615 (diagnostic_manager::add_events_for_eedge): Pass pb to visitor
7616 ctor.
7617 * region-model-impl-calls.cc
7618 (region_model::impl_deallocation_call): New.
7619 * region-model.cc: Include "attribs.h".
7620 (region_model::on_call_post): Handle fndecls referenced by
7621 __attribute__((deallocated_by(FOO))).
7622 * region-model.h (region_model::impl_deallocation_call): New decl.
7623 * sm-malloc.cc: Include "stringpool.h" and "attribs.h". Add
7624 leading comment.
7625 (class api): Delete.
7626 (enum resource_state): Update comment for change from api to
7627 deallocator and deallocator_set.
7628 (allocation_state::allocation_state): Drop api param. Add
7629 "deallocators" and "deallocator".
7630 (allocation_state::m_api): Drop field in favor of...
7631 (allocation_state::m_deallocators): New field.
7632 (allocation_state::m_deallocator): New field.
7633 (enum wording): Add WORDING_DEALLOCATED.
7634 (struct deallocator): New.
7635 (struct standard_deallocator): New.
7636 (struct custom_deallocator): New.
7637 (struct deallocator_set): New.
7638 (struct custom_deallocator_set): New.
7639 (struct standard_deallocator_set): New.
7640 (struct deallocator_set_map_traits): New.
7641 (malloc_state_machine::m_malloc): Drop field
7642 (malloc_state_machine::m_scalar_new): Likewise.
7643 (malloc_state_machine::m_vector_new): Likewise.
7644 (malloc_state_machine::m_free): New field
7645 (malloc_state_machine::m_scalar_delete): Likewise.
7646 (malloc_state_machine::m_vector_delete): Likewise.
7647 (malloc_state_machine::deallocator_map_t): New typedef.
7648 (malloc_state_machine::m_deallocator_map): New field.
7649 (malloc_state_machine::deallocator_set_cache_t): New typedef.
7650 (malloc_state_machine::m_custom_deallocator_set_cache): New field.
7651 (malloc_state_machine::custom_deallocator_set_map_t): New typedef.
7652 (malloc_state_machine::m_custom_deallocator_set_map): New field.
7653 (malloc_state_machine::m_dynamic_sets): New field.
7654 (malloc_state_machine::m_dynamic_deallocators): New field.
7655 (api::api): Delete.
7656 (deallocator::deallocator): New ctor.
7657 (deallocator::hash): New.
7658 (deallocator::dump_to_pp): New.
7659 (deallocator::cmp): New.
7660 (deallocator::cmp_ptr_ptr): New.
7661 (standard_deallocator::standard_deallocator): New ctor.
7662 (deallocator_set::deallocator_set): New ctor.
7663 (deallocator_set::dump): New.
7664 (custom_deallocator_set::custom_deallocator_set): New ctor.
7665 (custom_deallocator_set::contains_p): New.
7666 (custom_deallocator_set::maybe_get_single): New.
7667 (custom_deallocator_set::dump_to_pp): New.
7668 (standard_deallocator_set::standard_deallocator_set): New ctor.
7669 (standard_deallocator_set::contains_p): New.
7670 (standard_deallocator_set::maybe_get_single): New.
7671 (standard_deallocator_set::dump_to_pp): New.
7672 (start_p): New.
7673 (class mismatching_deallocation): Update for conversion from api
7674 to deallocator_set and deallocator.
7675 (double_free::emit): Use %qs.
7676 (class use_after_free): Update for conversion from api to
7677 deallocator_set and deallocator.
7678 (malloc_leak::describe_state_change): Only emit "allocated here" on
7679 a start->nonnull transition, rather than on other transitions to
7680 nonnull.
7681 (allocation_state::dump_to_pp): Update for conversion from api to
7682 deallocator_set.
7683 (allocation_state::get_nonnull): Likewise.
7684 (malloc_state_machine::malloc_state_machine): Likewise.
7685 (malloc_state_machine::~malloc_state_machine): New.
7686 (malloc_state_machine::add_state): Update for conversion from api
7687 to deallocator_set.
7688 (malloc_state_machine::get_or_create_custom_deallocator_set): New.
7689 (malloc_state_machine::maybe_create_custom_deallocator_set): New.
7690 (malloc_state_machine::get_or_create_deallocator): New.
7691 (malloc_state_machine::on_stmt): Update for conversion from api
7692 to deallocator_set. Handle "__attribute__((malloc(FOO)))", and
7693 the special attribute set on FOO.
7694 (malloc_state_machine::on_allocator_call): Update for conversion
7695 from api to deallocator_set. Add "returns_nonnull" param and use
7696 it to affect which state to transition to.
7697 (malloc_state_machine::on_deallocator_call): Update for conversion
7698 from api to deallocator_set.
7700 2021-01-14 David Malcolm <dmalcolm@redhat.com>
7702 * engine.cc (strongly_connected_components::to_json): New.
7703 (worklist::to_json): New.
7704 (exploded_graph::to_json): JSON-ify the worklist.
7705 * exploded-graph.h (strongly_connected_components::to_json): New
7706 decl.
7707 (worklist::to_json): New decl.
7708 * store.cc (store::to_json): Fix comment.
7709 * supergraph.cc (supernode::to_json): Fix reference to
7710 "returning_call" in comment. Add optional "fun" to JSON.
7711 (edge_kind_to_string): New.
7712 (superedge::to_json): Add "kind" to JSON.
7714 2021-01-14 David Malcolm <dmalcolm@redhat.com>
7716 PR analyzer/98679
7717 * analyzer.h (region_offset::operator==): Make const.
7718 * pending-diagnostic.h (pending_diagnostic::equal_p): Likewise.
7719 * store.h (binding_cluster::for_each_value): Likewise.
7720 (binding_cluster::for_each_binding): Likewise.
7722 2021-01-12 David Malcolm <dmalcolm@redhat.com>
7724 PR analyzer/98628
7725 * store.cc (binding_cluster::make_unknown_relative_to): Don't mark
7726 dereferenced unknown pointers as having escaped.
7728 2021-01-07 David Malcolm <dmalcolm@redhat.com>
7730 PR analyzer/98580
7731 * region.cc (decl_region::get_svalue_for_initializer): Gracefully
7732 handle when LTO writes out DECL_INITIAL as error_mark_node.
7734 2021-01-07 David Malcolm <dmalcolm@redhat.com>
7736 PR analyzer/97074
7737 * store.cc (binding_cluster::can_merge_p): Add "out_store" param
7738 and pass to calls to binding_cluster::make_unknown_relative_to.
7739 (binding_cluster::make_unknown_relative_to): Add "out_store"
7740 param. Use it to mark base regions that are pointed to by
7741 pointers that become unknown as having escaped.
7742 (store::can_merge_p): Pass out_store to
7743 binding_cluster::can_merge_p.
7744 * store.h (binding_cluster::can_merge_p): Add "out_store" param.
7745 (binding_cluster::make_unknown_relative_to): Likewise.
7746 * svalue.cc (region_svalue::implicitly_live_p): New vfunc.
7747 * svalue.h (region_svalue::implicitly_live_p): New vfunc decl.
7749 2021-01-07 David Malcolm <dmalcolm@redhat.com>
7751 PR analyzer/98564
7752 * engine.cc (exploded_path::feasible_p): Add missing call to
7753 bitmap_clear.
7755 2021-01-06 David Malcolm <dmalcolm@redhat.com>
7757 PR analyzer/97072
7758 * region-model-reachability.cc (reachable_regions::init_cluster):
7759 Convert symbolic region handling to a switch statement. Add cases
7760 to handle SK_UNKNOWN and SK_CONJURED.
7762 2021-01-05 David Malcolm <dmalcolm@redhat.com>
7764 PR analyzer/98293
7765 * store.cc (binding_map::apply_ctor_to_region): When "index" is
7766 NULL, iterate through the fields for RECORD_TYPEs, rather than
7767 creating an INTEGER_CST index.
7769 2020-11-30 David Malcolm <dmalcolm@redhat.com>
7771 * analyzer-pass.cc: Include "analyzer/analyzer.h" for the
7772 declaration of sorry_no_analyzer; include "tree.h" and
7773 "function.h" as these are needed by it.
7775 2020-11-30 David Malcolm <dmalcolm@redhat.com>
7777 * analyzer-pass.cc (pass_analyzer::execute): Move sorry call to...
7778 (sorry_no_analyzer): New.
7779 * analyzer.h (class state_machine): New forward decl.
7780 (class logger): New forward decl.
7781 (class plugin_analyzer_init_iface): New.
7782 (sorry_no_analyzer): New decl.
7783 * checker-path.cc (checker_path::fixup_locations): New.
7784 * checker-path.h (checker_event::set_location): New.
7785 (checker_path::fixup_locations): New decl.
7786 * diagnostic-manager.cc
7787 (diagnostic_manager::emit_saved_diagnostic): Call
7788 checker_path::fixup_locations, and call fixup_location
7789 on the primary location.
7790 * engine.cc: Include "plugin.h".
7791 (class plugin_analyzer_init_impl): New.
7792 (impl_run_checkers): Invoke PLUGIN_ANALYZER_INIT callbacks.
7793 * pending-diagnostic.h (pending_diagnostic::fixup_location): New
7794 vfunc.
7796 2020-11-18 David Malcolm <dmalcolm@redhat.com>
7798 PR analyzer/97893
7799 * sm-malloc.cc (null_deref::emit): Use CWE-476 rather than
7800 CWE-690, as this isn't due to an unchecked return value.
7801 (null_arg::emit): Likewise.
7803 2020-11-12 David Malcolm <dmalcolm@redhat.com>
7805 * checker-path.h (checker_event::get_id_ptr): New.
7806 * diagnostic-manager.cc (path_builder::path_builder): Add "sd"
7807 param and use it to initialize new field "m_sd".
7808 (path_builder::get_pending_diagnostic): New.
7809 (path_builder::m_sd): New field.
7810 (diagnostic_manager::emit_saved_diagnostic): Pass sd to
7811 path_builder ctor.
7812 (diagnostic_manager::add_events_for_superedge): Call new
7813 maybe_add_custom_events_for_superedge vfunc.
7814 * engine.cc (stale_jmp_buf::stale_jmp_buf): Add "setjmp_point"
7815 param and use it to initialize new field "m_setjmp_point".
7816 Initialize new field "m_stack_pop_event".
7817 (stale_jmp_buf::maybe_add_custom_events_for_superedge): New vfunc
7818 implementation.
7819 (stale_jmp_buf::describe_final_event): New vfunc implementation.
7820 (stale_jmp_buf::m_setjmp_point): New field.
7821 (stale_jmp_buf::m_stack_pop_event): New field.
7822 (exploded_node::on_longjmp): Pass setjmp_point to stale_jmp_buf
7823 ctor.
7824 * pending-diagnostic.h
7825 (pending_diagnostic::maybe_add_custom_events_for_superedge): New
7826 vfunc.
7828 2020-11-12 David Malcolm <dmalcolm@redhat.com>
7830 PR tree-optimization/97424
7831 * analyzer.opt (Wanalyzer-shift-count-negative): New.
7832 (Wanalyzer-shift-count-overflow): New.
7833 * region-model.cc (class shift_count_negative_diagnostic): New.
7834 (class shift_count_overflow_diagnostic): New.
7835 (region_model::get_gassign_result): Complain about shift counts that
7836 are negative or are >= the operand's type's width.
7838 2020-11-10 Martin Liska <mliska@suse.cz>
7840 * constraint-manager.cc (constraint_manager::merge): Remove
7841 unused code.
7842 * constraint-manager.h: Likewise.
7843 * program-state.cc (sm_state_map::sm_state_map): Likewise.
7844 (program_state::program_state): Likewise.
7845 (test_sm_state_map): Likewise.
7846 * program-state.h: Likewise.
7847 * region-model-reachability.cc (reachable_regions::reachable_regions): Likewise.
7848 * region-model-reachability.h: Likewise.
7849 * region-model.cc (region_model::handle_unrecognized_call): Likewise.
7850 (region_model::get_reachable_svalues): Likewise.
7851 (region_model::can_merge_with_p): Likewise.
7853 2020-11-05 David Malcolm <dmalcolm@redhat.com>
7855 PR analyzer/97668
7856 * svalue.cc (cmp_cst): Handle COMPLEX_CST.
7858 2020-10-29 David Malcolm <dmalcolm@redhat.com>
7860 * program-state.cc (sm_state_map::on_liveness_change): Sort the
7861 leaking svalues before calling on_state_leak.
7862 (program_state::detect_leaks): Likewise when calling
7863 on_svalue_leak.
7864 * region-model-reachability.cc
7865 (reachable_regions::mark_escaped_clusters): Likewise when
7866 calling on_escaped_function.
7868 2020-10-29 David Malcolm <dmalcolm@redhat.com>
7870 PR analyzer/97608
7871 * region-model-reachability.cc (reachable_regions::handle_sval):
7872 Operands of reachable reversible operations are reachable.
7874 2020-10-29 David Malcolm <dmalcolm@redhat.com>
7876 * analyzer.h (class state_machine): New forward decl.
7877 (class logger): Likewise.
7878 (class visitor): Likewise.
7879 * complexity.cc: New file, taken from svalue.cc.
7880 * complexity.h: New file, taken from region-model.h.
7881 * region-model.h: Include "analyzer/svalue.h" and
7882 "analyzer/region.h". Move struct complexity to complexity.h.
7883 Move svalue, its subclasses and supporting decls to svalue.h.
7884 Move region, its subclasses and supporting decls to region.h.
7885 * region.cc: Include "analyzer/region.h".
7886 (symbolic_region::symbolic_region): Move here from region-model.h.
7887 * region.h: New file, based on material from region-model.h.
7888 * svalue.cc: Include "analyzer/svalue.h".
7889 (complexity::complexity): Move to complexity.cc.
7890 (complexity::from_pair): Likewise.
7891 * svalue.h: New file, based on material from region-model.h.
7893 2020-10-29 David Malcolm <dmalcolm@redhat.com>
7895 * program-state.cc (sm_state_map::print): Guard the printing of
7896 the origin pointer with !flag_dump_noaddr.
7897 * region.cc (string_region::dump_to_pp): Likewise for
7898 m_string_cst.
7900 2020-10-27 David Malcolm <dmalcolm@redhat.com>
7902 PR analyzer/97568
7903 * region-model.cc (region_model::get_initial_value_for_global):
7904 Move check that !DECL_EXTERNAL from here to...
7905 * region.cc (decl_region::get_svalue_for_initializer): ...here,
7906 using it to reject zero initialization.
7908 2020-10-27 Markus Böck <markus.boeck02@gmail.com>
7910 PR analyzer/96608
7911 * store.h (hash): Cast to intptr_t instead of long
7913 2020-10-27 David Malcolm <dmalcolm@redhat.com>
7915 * constraint-manager.cc (svalue_cmp_by_ptr): Delete.
7916 (equiv_class::canonicalize): Use svalue::cmp_ptr_ptr instead.
7917 (equiv_class_cmp): Eliminate pointer comparison.
7918 * diagnostic-manager.cc (dedupe_key::comparator): If they are at
7919 the same location, also compare epath ength and pending_diagnostic
7920 kind.
7921 * engine.cc (readability_comparator): If two path_vars have the
7922 same readability, then impose an arbitrary ordering on them.
7923 (worklist::key_t::cmp): If two points have the same plan ordering,
7924 continue the comparison. Call sm_state_map::cmp rather than
7925 comparing hash values.
7926 * program-state.cc (sm_state_map::entry_t::cmp): New.
7927 (sm_state_map::cmp): New.
7928 * program-state.h (sm_state_map::entry_t::cmp): New decl.
7929 (sm_state_map::elements): New.
7930 (sm_state_map::cmp): New.
7932 2020-10-27 David Malcolm <dmalcolm@redhat.com>
7934 * engine.cc (setjmp_record::cmp): New.
7935 (supernode_cluster::dump_dot): Avoid embedding pointer in cluster
7936 name.
7937 (supernode_cluster::cmp_ptr_ptr): New.
7938 (function_call_string_cluster::dump_dot): Avoid embedding pointer
7939 in cluster name. Sort m_map when dumping child clusters.
7940 (function_call_string_cluster::cmp_ptr_ptr): New.
7941 (root_cluster::dump_dot): Sort m_map when dumping child clusters.
7942 * program-point.cc (function_point::cmp): New.
7943 (function_point::cmp_ptr): New.
7944 * program-point.h (function_point::cmp): New decl.
7945 (function_point::cmp_ptr): New decl.
7946 * program-state.cc (sm_state_map::print): Sort the values. Guard
7947 the printing of pointers with !flag_dump_noaddr.
7948 (program_state::prune_for_point): Sort the regions.
7949 (log_set_of_svalues): Sort the values. Guard the printing of
7950 pointers with !flag_dump_noaddr.
7951 * region-model-manager.cc (log_uniq_map): Sort the values.
7952 * region-model-reachability.cc (dump_set): New function template.
7953 (reachable_regions::dump_to_pp): Use it.
7954 * region-model.h (svalue::cmp_ptr): New decl.
7955 (svalue::cmp_ptr_ptr): New decl.
7956 (setjmp_record::cmp): New decl.
7957 (placeholder_svalue::get_name): New accessor.
7958 (widening_svalue::get_point): New accessor.
7959 (compound_svalue::get_map): New accessor.
7960 (conjured_svalue::get_stmt): New accessor.
7961 (conjured_svalue::get_id_region): New accessor.
7962 (region::cmp_ptrs): Rename to...
7963 (region::cmp_ptr_ptr): ...this.
7964 * region.cc (region::cmp_ptrs): Rename to...
7965 (region::cmp_ptr_ptr): ...this.
7966 * state-purge.cc
7967 (state_purge_per_ssa_name::state_purge_per_ssa_name): Sort
7968 m_points_needing_name when dumping.
7969 * store.cc (concrete_binding::cmp_ptr_ptr): New.
7970 (symbolic_binding::cmp_ptr_ptr): New.
7971 (binding_map::cmp): New.
7972 (get_sorted_parent_regions): Update for renaming of
7973 region::cmp_ptrs to region::cmp_ptr_ptr.
7974 (store::dump_to_pp): Likewise.
7975 (store::to_json): Likewise.
7976 (store::can_merge_p): Sort the base regions before considering
7977 them.
7978 * store.h (concrete_binding::cmp_ptr_ptr): New decl.
7979 (symbolic_binding::cmp_ptr_ptr): New decl.
7980 (binding_map::cmp): New decl.
7981 * supergraph.cc (supergraph::supergraph): Assign UIDs to the
7982 gimple stmts.
7983 * svalue.cc (cmp_cst): New.
7984 (svalue::cmp_ptr): New.
7985 (svalue::cmp_ptr_ptr): New.
7987 2020-10-27 David Malcolm <dmalcolm@redhat.com>
7989 * engine.cc (exploded_graph::get_or_create_node): Fix off-by-one
7990 when imposing param_analyzer_max_enodes_per_program_point limit.
7992 2020-10-27 David Malcolm <dmalcolm@redhat.com>
7994 * region-model.cc (region_model::get_representative_path_var):
7995 Implement case RK_LABEL.
7996 * region-model.h (label_region::get_label): New accessor.
7998 2020-10-22 David Malcolm <dmalcolm@redhat.com>
8000 PR analyzer/97514
8001 * engine.cc (exploded_graph::add_function_entry): Handle failure
8002 to create an enode, rather than asserting.
8004 2020-10-22 David Malcolm <dmalcolm@redhat.com>
8006 PR analyzer/97489
8007 * engine.cc (exploded_graph::add_function_entry): Assert that we
8008 have a function body.
8009 (exploded_graph::on_escaped_function): Reject fndecls that don't
8010 have a function body.
8012 2020-10-14 David Malcolm <dmalcolm@redhat.com>
8014 PR analyzer/93388
8015 * region-model.cc (region_model::get_initial_value_for_global):
8016 Fall back to returning an initial_svalue if
8017 decl_region::get_svalue_for_initializer fails.
8018 * region.cc (decl_region::get_svalue_for_initializer): Don't
8019 attempt to create a compound_svalue if the region has an unknown
8020 size.
8022 2020-10-14 David Malcolm <dmalcolm@redhat.com>
8024 PR analyzer/93723
8025 * store.cc (binding_map::apply_ctor_to_region): Remove redundant
8026 assertion.
8028 2020-10-12 David Malcolm <dmalcolm@redhat.com>
8030 PR analyzer/97258
8031 * engine.cc (impl_region_model_context::on_escaped_function): New
8032 vfunc.
8033 (exploded_graph::add_function_entry): Use m_functions_with_enodes
8034 to implement idempotency.
8035 (add_any_callbacks): New.
8036 (exploded_graph::build_initial_worklist): Use the above to find
8037 callbacks that are reachable from global initializers.
8038 (exploded_graph::on_escaped_function): New.
8039 * exploded-graph.h
8040 (impl_region_model_context::on_escaped_function): New decl.
8041 (exploded_graph::on_escaped_function): New decl.
8042 (exploded_graph::m_functions_with_enodes): New field.
8043 * region-model-reachability.cc
8044 (reachable_regions::reachable_regions): Replace "store" param with
8045 "model" param; use it to initialize m_model.
8046 (reachable_regions::add): When getting the svalue for the region,
8047 call get_store_value on the model rather than using an initial
8048 value.
8049 (reachable_regions::mark_escaped_clusters): Add ctxt param and
8050 use it to call on_escaped_function when a function_region escapes.
8051 * region-model-reachability.h
8052 (reachable_regions::reachable_regions): Replace "store" param with
8053 "model" param.
8054 (reachable_regions::mark_escaped_clusters): Add ctxt param.
8055 (reachable_regions::m_model): New field.
8056 * region-model.cc (region_model::handle_unrecognized_call): Update
8057 for change in reachable_regions ctor.
8058 (region_model::handle_unrecognized_call): Pass ctxt to
8059 mark_escaped_clusters.
8060 (region_model::get_reachable_svalues): Update for change in
8061 reachable_regions ctor.
8062 (region_model::get_initial_value_for_global): Read-only variables
8063 keep their initial values.
8064 * region-model.h (region_model_context::on_escaped_function): New
8065 vfunc.
8066 (noop_region_model_context::on_escaped_function): New.
8068 2020-10-12 David Malcolm <dmalcolm@redhat.com>
8070 * analyzer.opt (Wanalyzer-write-to-const): New.
8071 (Wanalyzer-write-to-string-literal): New.
8072 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
8073 Call check_for_writable_region.
8074 (region_model::impl_call_memset): Likewise.
8075 (region_model::impl_call_strcpy): Likewise.
8076 * region-model.cc (class write_to_const_diagnostic): New.
8077 (class write_to_string_literal_diagnostic): New.
8078 (region_model::check_for_writable_region): New.
8079 (region_model::set_value): Call check_for_writable_region.
8080 * region-model.h (region_model::check_for_writable_region): New
8081 decl.
8083 2020-10-07 David Malcolm <dmalcolm@redhat.com>
8085 PR analyzer/97116
8086 * sm-malloc.cc (method_p): New.
8087 (describe_argument_index): New.
8088 (inform_nonnull_attribute): Use describe_argument_index.
8089 (possible_null_arg::describe_final_event): Likewise.
8090 (null_arg::describe_final_event): Likewise.
8092 2020-09-29 David Malcolm <dmalcolm@redhat.com>
8094 PR analyzer/95188
8095 * engine.cc (stmt_requires_new_enode_p): Split enodes before
8096 "signal" calls.
8098 2020-09-29 David Malcolm <dmalcolm@redhat.com>
8100 * constraint-manager.cc
8101 (constraint_manager::add_constraint_internal): Whitespace fixes.
8102 Silence -Wsign-compare warning.
8103 * engine.cc (maybe_process_run_of_before_supernode_enodes):
8104 Silence -Wsign-compare warning.
8106 2020-09-28 David Malcolm <dmalcolm@redhat.com>
8108 * region-model.h (binop_svalue::dyn_cast_binop_svalue): Remove
8109 redundant "virtual". Add FINAL OVERRIDE.
8110 (widening_svalue::dyn_cast_widening_svalue): Add FINAL OVERRIDE.
8111 (compound_svalue::dyn_cast_compound_svalue): Likewise.
8112 (conjured_svalue::dyn_cast_conjured_svalue): Likewise.
8114 2020-09-28 David Malcolm <dmalcolm@redhat.com>
8116 * diagnostic-manager.cc (null_assignment_sm_context::m_visitor):
8117 Remove unused field.
8119 2020-09-28 David Malcolm <dmalcolm@redhat.com>
8121 PR analyzer/97233
8122 * analyzer.cc (is_longjmp_call_p): Require the initial argument
8123 to be a pointer.
8124 * engine.cc (exploded_node::on_longjmp): Likewise.
8126 2020-09-28 David Malcolm <dmalcolm@redhat.com>
8128 * program-state.cc (sm_state_map::print): Update check
8129 for m_global_state being the start state.
8131 2020-09-26 David Malcolm <dmalcolm@redhat.com>
8133 PR analyzer/96646
8134 PR analyzer/96841
8135 * region-model.cc (region_model::get_representative_path_var):
8136 When handling offset_region, wrap the MEM_REF's first argument in
8137 an ADDR_EXPR of pointer type, rather than simply using the tree
8138 for the parent region. Require the MEM_REF's second argument to
8139 be an integer constant.
8141 2020-09-24 David Malcolm <dmalcolm@redhat.com>
8143 * analyzer.h (struct rejected_constraint): New decl.
8144 * analyzer.opt (fanalyzer-feasibility): New option.
8145 * diagnostic-manager.cc (path_builder::path_builder): Add
8146 "problem" param and use it to initialize new field.
8147 (path_builder::get_feasibility_problem): New accessor.
8148 (path_builder::m_feasibility_problem): New field.
8149 (dedupe_winners::add): Remove inversion of logic in "if" clause,
8150 swapping if/else suites. In the !feasible_p suite, inspect
8151 flag_analyzer_feasibility and add code to handle when this
8152 is off, accepting the infeasible path, but recording the
8153 feasibility_problem.
8154 (diagnostic_manager::emit_saved_diagnostic): Pass the
8155 feasibility_problem to the path_builder.
8156 (diagnostic_manager::add_events_for_eedge): If we have
8157 a feasibility_problem at this edge, use it to add a custom event.
8158 * engine.cc (exploded_path::feasible_p): Pass a
8159 rejected_constraint ** to model.maybe_update_for_edge and transfer
8160 ownership of any created instance to any feasibility_problem.
8161 (feasibility_problem::dump_to_pp): New.
8162 * exploded-graph.h (feasibility_problem::feasibility_problem):
8163 Drop "model" param; add rejected_constraint * param.
8164 (feasibility_problem::~feasibility_problem): New.
8165 (feasibility_problem::dump_to_pp): New decl.
8166 (feasibility_problem::m_model): Drop field.
8167 (feasibility_problem::m_rc): New field.
8168 * program-point.cc (function_point::get_location): Handle
8169 PK_BEFORE_SUPERNODE and PK_AFTER_SUPERNODE.
8170 * program-state.cc (program_state::on_edge): Pass NULL to new
8171 param of region_model::maybe_update_for_edge.
8172 * region-model.cc (region_model::add_constraint): New overload
8173 adding a rejected_constraint ** param.
8174 (region_model::maybe_update_for_edge): Add rejected_constraint **
8175 param and pass it to the various apply_constraints_for_ calls.
8176 (region_model::apply_constraints_for_gcond): Add
8177 rejected_constraint ** param and pass it to add_constraint calls.
8178 (region_model::apply_constraints_for_gswitch): Likewise.
8179 (region_model::apply_constraints_for_exception): Likewise.
8180 (rejected_constraint::dump_to_pp): New.
8181 * region-model.h (region_model::maybe_update_for_edge):
8182 Add rejected_constraint ** param.
8183 (region_model::add_constraint): New overload adding a
8184 rejected_constraint ** param.
8185 (region_model::apply_constraints_for_gcond): Add
8186 rejected_constraint ** param.
8187 (region_model::apply_constraints_for_gswitch): Likewise.
8188 (region_model::apply_constraints_for_exception): Likewise.
8189 (struct rejected_constraint): New.
8191 2020-09-23 David Malcolm <dmalcolm@redhat.com>
8193 PR analyzer/97178
8194 * engine.cc (impl_run_checkers): Update for change to ext_state
8195 ctor.
8196 * program-state.cc (selftest::test_sm_state_map): Pass an engine
8197 instance to ext_state ctor.
8198 (selftest::test_program_state_1): Likewise.
8199 (selftest::test_program_state_2): Likewise.
8200 (selftest::test_program_state_merging): Likewise.
8201 (selftest::test_program_state_merging_2): Likewise.
8202 * program-state.h (extrinsic_state::extrinsic_state): Remove NULL
8203 default value for "eng" param.
8205 2020-09-23 Tobias Burnus <tobias@codesourcery.com>
8207 * analyzer-logging.cc: Guard '#pragma ... ignored "-Wformat-diag"'
8208 by '#if __GNUC__ >= 10'
8209 * analyzer.h: Likewise.
8210 * call-string.cc: Likewise.
8212 2020-09-23 David Malcolm <dmalcolm@redhat.com>
8214 * engine.cc (exploded_node::on_stmt): Replace sequence of dyn_cast
8215 with switch.
8217 2020-09-22 David Malcolm <dmalcolm@redhat.com>
8219 * analysis-plan.cc: Include "json.h".
8220 * analyzer.opt (fdump-analyzer-json): New.
8221 * call-string.cc: Include "json.h".
8222 (call_string::to_json): New.
8223 * call-string.h (call_string::to_json): New decl.
8224 * checker-path.cc: Include "json.h".
8225 * constraint-manager.cc: Include "json.h".
8226 (equiv_class::to_json): New.
8227 (constraint::to_json): New.
8228 (constraint_manager::to_json): New.
8229 * constraint-manager.h (equiv_class::to_json): New decl.
8230 (constraint::to_json): New decl.
8231 (constraint_manager::to_json): New decl.
8232 * diagnostic-manager.cc: Include "json.h".
8233 (saved_diagnostic::to_json): New.
8234 (diagnostic_manager::to_json): New.
8235 * diagnostic-manager.h (saved_diagnostic::to_json): New decl.
8236 (diagnostic_manager::to_json): New decl.
8237 * engine.cc: Include "json.h", <zlib.h>.
8238 (exploded_node::status_to_str): New.
8239 (exploded_node::to_json): New.
8240 (exploded_edge::to_json): New.
8241 (exploded_graph::to_json): New.
8242 (dump_analyzer_json): New.
8243 (impl_run_checkers): Call it.
8244 * exploded-graph.h (exploded_node::status_to_str): New decl.
8245 (exploded_node::to_json): New.
8246 (exploded_edge::to_json): New.
8247 (exploded_graph::to_json): New.
8248 * pending-diagnostic.cc: Include "json.h".
8249 * program-point.cc: Include "json.h".
8250 (program_point::to_json): New.
8251 * program-point.h (program_point::to_json): New decl.
8252 * program-state.cc: Include "json.h".
8253 (extrinsic_state::to_json): New.
8254 (sm_state_map::to_json): New.
8255 (program_state::to_json): New.
8256 * program-state.h (extrinsic_state::to_json): New decl.
8257 (sm_state_map::to_json): New decl.
8258 (program_state::to_json): New decl.
8259 * region-model-impl-calls.cc: Include "json.h".
8260 * region-model-manager.cc: Include "json.h".
8261 * region-model-reachability.cc: Include "json.h".
8262 * region-model.cc: Include "json.h".
8263 * region-model.h (svalue::to_json): New decl.
8264 (region::to_json): New decl.
8265 * region.cc: Include "json.h".
8266 (region::to_json: New.
8267 * sm-file.cc: Include "json.h".
8268 * sm-malloc.cc: Include "json.h".
8269 * sm-pattern-test.cc: Include "json.h".
8270 * sm-sensitive.cc: Include "json.h".
8271 * sm-signal.cc: Include "json.h".
8272 (signal_delivery_edge_info_t::to_json): New.
8273 * sm-taint.cc: Include "json.h".
8274 * sm.cc: Include "diagnostic.h", "tree-diagnostic.h", and
8275 "json.h".
8276 (state_machine::state::to_json): New.
8277 (state_machine::to_json): New.
8278 * sm.h (state_machine::state::to_json): New.
8279 (state_machine::to_json): New.
8280 * state-purge.cc: Include "json.h".
8281 * store.cc: Include "json.h".
8282 (binding_key::get_desc): New.
8283 (binding_map::to_json): New.
8284 (binding_cluster::to_json): New.
8285 (store::to_json): New.
8286 * store.h (binding_key::get_desc): New decl.
8287 (binding_map::to_json): New decl.
8288 (binding_cluster::to_json): New decl.
8289 (store::to_json): New decl.
8290 * supergraph.cc: Include "json.h".
8291 (supergraph::to_json): New.
8292 (supernode::to_json): New.
8293 (superedge::to_json): New.
8294 * supergraph.h (supergraph::to_json): New decl.
8295 (supernode::to_json): New decl.
8296 (superedge::to_json): New decl.
8297 * svalue.cc: Include "json.h".
8298 (svalue::to_json): New.
8300 2020-09-21 David Malcolm <dmalcolm@redhat.com>
8302 PR analyzer/97130
8303 * region-model-impl-calls.cc (call_details::get_arg_type): New.
8304 * region-model.cc (region_model::on_call_pre): Check that the
8305 initial arg is a pointer before calling impl_call_memset and
8306 impl_call_strlen.
8307 * region-model.h (call_details::get_arg_type): New decl.
8309 2020-09-21 David Malcolm <dmalcolm@redhat.com>
8311 PR analyzer/93355
8312 * sm-malloc.cc (malloc_state_machine::get_default_state): Look at
8313 the base region when considering pointers. Treat pointers to
8314 decls as being non-heap.
8316 2020-09-18 David Malcolm <dmalcolm@redhat.com>
8318 * checker-path.cc (warning_event::get_desc): Handle global state
8319 changes.
8321 2020-09-18 David Malcolm <dmalcolm@redhat.com>
8323 * sm-malloc.cc (malloc_state_machine::on_stmt): Handle strdup and
8324 strndup as being malloc-like allocators.
8326 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8328 * engine.cc (strongly_connected_components::strong_connect): Only
8329 consider intraprocedural edges when creating SCCs.
8330 (worklist::key_t::cmp): Add comment. Treat call_string
8331 differences as more important than differences of program_point
8332 within a supernode.
8334 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8336 * engine.cc (supernode_cluster::dump_dot): Show the SCC id
8337 in the per-supernode clusters in FILENAME.eg.dot output.
8338 (exploded_graph_annotator::add_node_annotations):
8339 Show the SCC of the supernode in FILENAME.supernode.eg.dot output.
8340 * exploded-graph.h (worklist::scc_id): New.
8341 (exploded_graph::get_scc_id): New.
8343 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8345 * engine.cc (exploded_node::dump_dot): Show STATUS_BULK_MERGED.
8346 (exploded_graph::process_worklist): Call
8347 maybe_process_run_of_before_supernode_enodes.
8348 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
8349 New.
8350 (exploded_graph_annotator::print_enode): Show STATUS_BULK_MERGED.
8351 * exploded-graph.h (enum exploded_node::status): Add
8352 STATUS_BULK_MERGED.
8354 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8356 * engine.cc
8357 (exploded_graph::process_node) <case PK_BEFORE_SUPERNODE>:
8358 Simplify by using program_point::get_next.
8359 * program-point.cc (program_point::get_next): New.
8360 * program-point.h (program_point::get_next): New decl.
8362 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8364 * engine.cc (exploded_graph::get_or_create_node): Show the
8365 program point when issuing -Wanalyzer-too-complex due to hitting
8366 the per-program-point limit.
8368 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8370 * region-model.cc (region_model::on_call_pre): Treat getchar as
8371 having no side-effects.
8373 2020-09-15 David Malcolm <dmalcolm@redhat.com>
8375 PR analyzer/96650
8376 * constraint-manager.cc (merger_fact_visitor::on_fact): Replace
8377 assertion that add_constraint succeeded with an assertion that
8378 if it fails, -fanalyzer-transitivity is off.
8380 2020-09-14 David Malcolm <dmalcolm@redhat.com>
8382 * analyzer.opt (-param=analyzer-max-constraints=): New param.
8383 * constraint-manager.cc
8384 (constraint_manager::add_constraint_internal): Silently reject
8385 attempts to add constraints when the above limit is reached.
8387 2020-09-14 David Malcolm <dmalcolm@redhat.com>
8389 PR analyzer/96653
8390 * constraint-manager.cc
8391 (constraint_manager::get_or_add_equiv_class): Don't accumulate
8392 transitive closure of all constraints on constants.
8394 2020-09-14 David Malcolm <dmalcolm@redhat.com>
8396 PR analyzer/97029
8397 * analyzer.cc (is_setjmp_call_p): Require the initial arg to be a
8398 pointer.
8399 * region-model.cc (region_model::deref_rvalue): Assert that the
8400 svalue is of pointer type.
8402 2020-09-11 David Malcolm <dmalcolm@redhat.com>
8404 PR analyzer/96798
8405 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
8406 New.
8407 (region_model::impl_call_strcpy): New.
8408 * region-model.cc (region_model::on_call_pre): Flag unhandled
8409 builtins that are non-pure as having unknown side-effects.
8410 Implement BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_STRCPY,
8411 BUILT_IN_STRCPY_CHK, BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED,
8412 BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_FPUTC,
8413 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
8414 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
8415 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR,
8416 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED,
8417 BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF.
8418 * region-model.h (region_model::impl_call_memcpy): New decl.
8419 (region_model::impl_call_strcpy): New decl.
8421 2020-09-09 David Malcolm <dmalcolm@redhat.com>
8423 PR analyzer/94355
8424 * analyzer.opt (Wanalyzer-mismatching-deallocation): New warning.
8425 * region-model-impl-calls.cc
8426 (region_model::impl_call_operator_new): New.
8427 (region_model::impl_call_operator_delete): New.
8428 * region-model.cc (region_model::on_call_pre): Detect operator new
8429 and operator delete.
8430 (region_model::on_call_post): Likewise.
8431 (region_model::maybe_update_for_edge): Detect EH edges and call...
8432 (region_model::apply_constraints_for_exception): New function.
8433 * region-model.h (region_model::impl_call_operator_new): New decl.
8434 (region_model::impl_call_operator_delete): New decl.
8435 (region_model::apply_constraints_for_exception): New decl.
8436 * sm-malloc.cc (enum resource_state): New.
8437 (struct allocation_state): New state subclass.
8438 (enum wording): New.
8439 (struct api): New.
8440 (malloc_state_machine::custom_data_t): New typedef.
8441 (malloc_state_machine::add_state): New decl.
8442 (malloc_state_machine::m_unchecked)
8443 (malloc_state_machine::m_nonnull)
8444 (malloc_state_machine::m_freed): Delete these states in favor
8445 of...
8446 (malloc_state_machine::m_malloc)
8447 (malloc_state_machine::m_scalar_new)
8448 (malloc_state_machine::m_vector_new): ...this new api instances,
8449 which own their own versions of these states.
8450 (malloc_state_machine::on_allocator_call): New decl.
8451 (malloc_state_machine::on_deallocator_call): New decl.
8452 (api::api): New ctor.
8453 (dyn_cast_allocation_state): New.
8454 (as_a_allocation_state): New.
8455 (get_rs): New.
8456 (unchecked_p): New.
8457 (nonnull_p): New.
8458 (freed_p): New.
8459 (malloc_diagnostic::describe_state_change): Use unchecked_p and
8460 nonnull_p.
8461 (class mismatching_deallocation): New.
8462 (double_free::double_free): Add funcname param for initializing
8463 m_funcname.
8464 (double_free::emit): Use m_funcname in warning message rather
8465 than hardcoding "free".
8466 (double_free::describe_state_change): Likewise. Use freed_p.
8467 (double_free::describe_call_with_state): Use freed_p.
8468 (double_free::describe_final_event): Use m_funcname in message
8469 rather than hardcoding "free".
8470 (double_free::m_funcname): New field.
8471 (possible_null::describe_state_change): Use unchecked_p.
8472 (possible_null::describe_return_of_state): Likewise.
8473 (use_after_free::use_after_free): Add param for initializing m_api.
8474 (use_after_free::emit): Use m_api->m_dealloc_funcname in message
8475 rather than hardcoding "free".
8476 (use_after_free::describe_state_change): Use freed_p. Change the
8477 wording of the message based on the API.
8478 (use_after_free::describe_final_event): Use
8479 m_api->m_dealloc_funcname in message rather than hardcoding
8480 "free". Change the wording of the message based on the API.
8481 (use_after_free::m_api): New field.
8482 (malloc_leak::describe_state_change): Use unchecked_p. Update
8483 for renaming of m_malloc_event to m_alloc_event.
8484 (malloc_leak::describe_final_event): Update for renaming of
8485 m_malloc_event to m_alloc_event.
8486 (malloc_leak::m_malloc_event): Rename...
8487 (malloc_leak::m_alloc_event): ...to this.
8488 (free_of_non_heap::free_of_non_heap): Add param for initializing
8489 m_funcname.
8490 (free_of_non_heap::emit): Use m_funcname in message rather than
8491 hardcoding "free".
8492 (free_of_non_heap::describe_final_event): Likewise.
8493 (free_of_non_heap::m_funcname): New field.
8494 (allocation_state::dump_to_pp): New.
8495 (allocation_state::get_nonnull): New.
8496 (malloc_state_machine::malloc_state_machine): Update for changes
8497 to state fields and new api fields.
8498 (malloc_state_machine::add_state): New.
8499 (malloc_state_machine::on_stmt): Move malloc/calloc handling to
8500 on_allocator_call and call it, passing in the API pointer.
8501 Likewise for free, moving it to on_deallocator_call. Handle calls
8502 to operator new and delete in an analogous way. Use unchecked_p
8503 when testing for possibly-null-arg and possibly-null-deref, and
8504 transition to the non-null for the correct API. Remove redundant
8505 node param from call to on_zero_assignment. Use freed_p for
8506 use-after-free check, and pass in API.
8507 (malloc_state_machine::on_allocator_call): New, based on code in
8508 on_stmt.
8509 (malloc_state_machine::on_deallocator_call): Likewise.
8510 (malloc_state_machine::on_phi): Mark node param with
8511 ATTRIBUTE_UNUSED; don't pass it to on_zero_assignment.
8512 (malloc_state_machine::on_condition): Mark node param with
8513 ATTRIBUTE_UNUSED. Replace on_transition calls with get_state and
8514 set_next_state pairs, transitioning to the non-null state for the
8515 appropriate API.
8516 (malloc_state_machine::can_purge_p): Port to new state approach.
8517 (malloc_state_machine::on_zero_assignment): Replace on_transition
8518 calls with get_state and set_next_state pairs. Drop redundant
8519 node param.
8520 * sm.h (state_machine::add_custom_state): New.
8522 2020-09-09 David Malcolm <dmalcolm@redhat.com>
8524 * diagnostic-manager.cc
8525 (null_assignment_sm_context::warn_for_state): Replace with...
8526 (null_assignment_sm_context::warn): ...this.
8527 * engine.cc (impl_sm_context::warn_for_state): Replace with...
8528 (impl_sm_context::warn): ...this.
8529 * sm-file.cc (fileptr_state_machine::on_stmt): Replace
8530 warn_for_state and on_transition calls with a get_state
8531 test guarding warn and set_next_state calls.
8532 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
8533 * sm-pattern-test.cc (pattern_test_state_machine::on_condition):
8534 Replace warn_for_state call with warn call.
8535 * sm-sensitive.cc
8536 (sensitive_state_machine::warn_for_any_exposure): Replace
8537 warn_for_state call with a get_state test guarding a warn call.
8538 * sm-signal.cc (signal_state_machine::on_stmt): Likewise.
8539 * sm-taint.cc (taint_state_machine::on_stmt): Replace
8540 warn_for_state and on_transition calls with a get_state
8541 test guarding warn and set_next_state calls.
8542 * sm.h (sm_context::warn_for_state): Replace with...
8543 (sm_context::warn): ...this.
8545 2020-09-09 David Malcolm <dmalcolm@redhat.com>
8547 * diagnostic-manager.cc
8548 (null_assignment_sm_context::null_assignment_sm_context): Add old_state
8549 and ext_state params, initializing m_old_state and m_ext_state.
8550 (null_assignment_sm_context::on_transition): Split into...
8551 (null_assignment_sm_context::get_state): ...this new vfunc
8552 implementation and...
8553 (null_assignment_sm_context::set_next_state): ...this new vfunc
8554 implementation.
8555 (null_assignment_sm_context::m_old_state): New field.
8556 (null_assignment_sm_context::m_ext_state): New field.
8557 (diagnostic_manager::add_events_for_eedge): Pass in old state and
8558 ext_state when creating sm_ctxt.
8559 * engine.cc (impl_sm_context::on_transition): Split into...
8560 (impl_sm_context::get_state): ...this new vfunc
8561 implementation and...
8562 (impl_sm_context::set_next_state): ...this new vfunc
8563 implementation.
8564 * sm.h (sm_context::get_state): New pure virtual function.
8565 (sm_context::set_next_state): Likewise.
8566 (sm_context::on_transition): Convert from a pure virtual function
8567 to a regular function implemented in terms of get_state and
8568 set_next_state.
8570 2020-09-09 David Malcolm <dmalcolm@redhat.com>
8572 * checker-path.cc (state_change_event::get_desc): Update
8573 state_machine::get_state_name calls to state::get_name.
8574 (warning_event::get_desc): Likewise.
8575 * diagnostic-manager.cc
8576 (null_assignment_sm_context::on_transition): Update comparison
8577 against 0 with comparison with m_sm.get_start_state.
8578 (diagnostic_manager::prune_for_sm_diagnostic): Update
8579 state_machine::get_state_name calls to state::get_name.
8580 * engine.cc (impl_sm_context::on_transition): Likewise.
8581 (exploded_node::get_dot_fillcolor): Use get_id when summing
8582 the sm states.
8583 * program-state.cc (sm_state_map::sm_state_map): Don't hardcode
8584 0 as the start state when initializing m_global_state.
8585 (sm_state_map::print): Use dump_to_pp rather than get_state_name
8586 when dumping states.
8587 (sm_state_map::is_empty_p): Don't hardcode 0 as the start state
8588 when examining m_global_state.
8589 (sm_state_map::hash): Use get_id when hashing states.
8590 (selftest::test_sm_state_map): Use state objects rather than
8591 arbitrary hardcoded integers.
8592 (selftest::test_program_state_merging): Likewise.
8593 (selftest::test_program_state_merging_2): Likewise.
8594 * sm-file.cc (fileptr_state_machine::m_start): Move to base class.
8595 (file_diagnostic::describe_state_change): Use get_start_state.
8596 (fileptr_state_machine::fileptr_state_machine): Drop m_start
8597 initialization.
8598 * sm-malloc.cc (malloc_state_machine::m_start): Move to base
8599 class.
8600 (malloc_diagnostic::describe_state_change): Use get_start_state.
8601 (possible_null::describe_state_change): Likewise.
8602 (malloc_state_machine::malloc_state_machine): Drop m_start
8603 initialization.
8604 * sm-pattern-test.cc (pattern_test_state_machine::m_start): Move
8605 to base class.
8606 (pattern_test_state_machine::pattern_test_state_machine): Drop
8607 m_start initialization.
8608 * sm-sensitive.cc (sensitive_state_machine::m_start): Move to base
8609 class.
8610 (sensitive_state_machine::sensitive_state_machine): Drop m_start
8611 initialization.
8612 * sm-signal.cc (signal_state_machine::m_start): Move to base
8613 class.
8614 (signal_state_machine::signal_state_machine): Drop m_start
8615 initialization.
8616 * sm-taint.cc (taint_state_machine::m_start): Move to base class.
8617 (taint_state_machine::taint_state_machine): Drop m_start
8618 initialization.
8619 * sm.cc (state_machine::state::dump_to_pp): New.
8620 (state_machine::state_machine): Move here from sm.h. Initialize
8621 m_next_state_id and m_start.
8622 (state_machine::add_state): Reimplement in terms of state objects.
8623 (state_machine::get_state_name): Delete.
8624 (state_machine::get_state_by_name): Reimplement in terms of state
8625 objects. Make const.
8626 (state_machine::validate): Delete.
8627 (state_machine::dump_to_pp): Reimplement in terms of state
8628 objects.
8629 * sm.h (state_machine::state): New class.
8630 (state_machine::state_t): Convert typedef from "unsigned" to
8631 "const state_machine::state *".
8632 (state_machine::state_machine): Move to sm.cc.
8633 (state_machine::get_default_state): Use m_start rather than
8634 hardcoding 0.
8635 (state_machine::get_state_name): Delete.
8636 (state_machine::get_state_by_name): Make const.
8637 (state_machine::get_start_state): New accessor.
8638 (state_machine::alloc_state_id): New.
8639 (state_machine::m_state_names): Drop in favor of...
8640 (state_machine::m_states): New field
8641 (state_machine::m_start): New field
8642 (start_start_p): Delete.
8644 2020-09-08 David Malcolm <dmalcolm@redhat.com>
8646 PR analyzer/96949
8647 * store.cc (binding_map::apply_ctor_val_to_range): Add
8648 error-handling for the cases where we have symbolic offsets.
8650 2020-09-08 David Malcolm <dmalcolm@redhat.com>
8652 PR analyzer/96950
8653 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
8654 where min_index == max_index.
8655 (binding_map::apply_ctor_val_to_range): Replace assertion that we
8656 don't have a CONSTRUCTOR value with error-handling.
8658 2020-09-08 David Malcolm <dmalcolm@redhat.com>
8660 PR analyzer/96962
8661 * region-model.cc (region_model::on_call_pre): Fix guard on switch
8662 on built-ins to only consider BUILT_IN_NORMAL, rather than other
8663 kinds of build-ins.
8665 2020-09-01 David Malcolm <dmalcolm@redhat.com>
8667 PR analyzer/96792
8668 * region-model.cc (region_model::deref_rvalue): Add the constraint
8669 that PTR_SVAL is non-NULL.
8671 2020-08-31 David Malcolm <dmalcolm@redhat.com>
8673 PR analyzer/96798
8674 * region-model.cc (region_model::on_call_pre): Handle
8675 BUILT_IN_MEMSET_CHK.
8677 2020-08-31 David Malcolm <dmalcolm@redhat.com>
8679 * region-model.cc (region_model::on_call_pre): Gather handling of
8680 builtins and of internal fns into switch statements. Handle
8681 "alloca" and BUILT_IN_ALLOCA_WITH_ALIGN.
8683 2020-08-31 David Malcolm <dmalcolm@redhat.com>
8685 PR analyzer/96860
8686 * region.cc (decl_region::get_svalue_for_constructor): Support
8687 apply_ctor_to_region failing.
8688 * store.cc (binding_map::apply_ctor_to_region): Add failure
8689 handling.
8690 (binding_map::apply_ctor_val_to_range): Likewise.
8691 (binding_map::apply_ctor_pair_to_child_region): Likewise. Replace
8692 assertion that child_base_offset is not symbolic with error
8693 handling.
8694 * store.h (binding_map::apply_ctor_to_region): Convert return type
8695 from void to bool.
8696 (binding_map::apply_ctor_val_to_range): Likewise.
8697 (binding_map::apply_ctor_pair_to_child_region): Likewise.
8699 2020-08-31 David Malcolm <dmalcolm@redhat.com>
8701 PR analyzer/96763
8702 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
8703 by calling a new binding_map::apply_ctor_val_to_range subroutine.
8704 Split out the existing non-CONSTRUCTOR-handling code to a new
8705 apply_ctor_pair_to_child_region subroutine.
8706 (binding_map::apply_ctor_val_to_range): New.
8707 (binding_map::apply_ctor_pair_to_child_region): New, split out
8708 from binding_map::apply_ctor_to_region as noted above.
8709 * store.h (binding_map::apply_ctor_val_to_range): New decl.
8710 (binding_map::apply_ctor_pair_to_child_region): New decl.
8712 2020-08-31 David Malcolm <dmalcolm@redhat.com>
8714 PR analyzer/96764
8715 * region-model-manager.cc
8716 (region_model_manager::maybe_fold_unaryop): Handle VIEW_CONVERT_EXPR.
8717 (region_model_manager::get_or_create_cast): Move logic for
8718 real->integer casting to...
8719 (get_code_for_cast): ...this new function, and add logic for
8720 real->non-integer casts.
8721 (region_model_manager::maybe_fold_sub_svalue): Handle
8722 VIEW_CONVERT_EXPR.
8723 * region-model.cc
8724 (region_model::add_any_constraints_from_gassign): Likewise.
8725 * svalue.cc (svalue::maybe_undo_cast): Likewise.
8726 (unaryop_svalue::dump_to_pp): Likewise.
8728 2020-08-26 David Malcolm <dmalcolm@redhat.com>
8730 PR analyzer/94858
8731 * region-model-manager.cc
8732 (region_model_manager::get_or_create_widening_svalue): Assert that
8733 neither of the inputs are themselves widenings.
8734 * store.cc (store::eval_alias_1): The initial value of a pointer
8735 can't point to a region that was allocated on the heap after the
8736 beginning of the path. A widened pointer value can't alias anything
8737 that the initial pointer value can't alias.
8738 * svalue.cc (svalue::can_merge_p): Merge BINOP (X, OP, CST) with X
8739 to a widening svalue. Merge
8740 BINOP(WIDENING(BASE, BINOP(BASE, X)), X) and BINOP(BASE, X) to
8741 to the LHS of the first BINOP.
8743 2020-08-26 David Malcolm <dmalcolm@redhat.com>
8745 PR analyzer/96777
8746 * region-model.h (class compound_svalue): Document that all keys
8747 must be concrete.
8748 (compound_svalue::compound_svalue): Move definition to svalue.cc.
8749 * store.cc (binding_map::apply_ctor_to_region): Handle
8750 initializers for trailing arrays with incomplete size.
8751 * svalue.cc (compound_svalue::compound_svalue): Move definition
8752 here from region-model.h. Add assertion that all keys are
8753 concrete.
8755 2020-08-22 David Malcolm <dmalcolm@redhat.com>
8757 PR analyzer/94851
8758 * region-model-manager.cc
8759 (region_model_manager::maybe_fold_binop): Fold bitwise "& 0" to 0.
8761 2020-08-22 David Malcolm <dmalcolm@redhat.com>
8763 * store.cc (store::eval_alias): Make const. Split out 2nd half
8764 into store::eval_alias_1 and call it twice for symmetry, avoiding
8765 test duplication.
8766 (store::eval_alias_1): New function, split out from the above.
8767 * store.h (store::eval_alias): Make const.
8768 (store::eval_alias_1): New decl.
8770 2020-08-22 David Malcolm <dmalcolm@redhat.com>
8772 * region-model.cc (region_model::push_frame): Bind the default
8773 SSA name for each parm if it exists, falling back to the parm
8774 itself otherwise, rather than doing both.
8776 2020-08-20 David Malcolm <dmalcolm@redhat.com>
8778 PR analyzer/96723
8779 * region-model-manager.cc
8780 (region_model_manager::get_field_region): Assert that field is a
8781 FIELD_DECL.
8782 * region.cc (region::get_subregions_for_binding): In
8783 union-handling, filter the TYPE_FIELDS traversal to just FIELD_DECLs.
8785 2020-08-20 David Malcolm <dmalcolm@redhat.com>
8787 PR analyzer/96713
8788 * region-model.cc (region_model::get_gassign_result): For
8789 comparisons, only use eval_condition when the lhs has boolean
8790 type, and use get_or_create_constant_svalue on the boolean
8791 constants directly rather than via get_rvalue.
8793 2020-08-19 David Malcolm <dmalcolm@redhat.com>
8795 PR analyzer/96643
8796 * region-model.cc (region_model::deref_rvalue): Rather than
8797 attempting to handle all svalue kinds in the switch, only cover
8798 the special cases, and move symbolic-region handling to after
8799 the switch, thus implicitly handling the missing case SK_COMPOUND.
8801 2020-08-19 David Malcolm <dmalcolm@redhat.com>
8803 PR analyzer/96705
8804 * region-model-manager.cc
8805 (region_model_manager::maybe_fold_binop): Check that we have an
8806 integral type before calling build_int_cst.
8808 2020-08-19 David Malcolm <dmalcolm@redhat.com>
8810 PR analyzer/96699
8811 * region-model-manager.cc
8812 (region_model_manager::get_or_create_cast): Use FIX_TRUNC_EXPR for
8813 casting from REAL_TYPE to INTEGER_TYPE.
8815 2020-08-19 David Malcolm <dmalcolm@redhat.com>
8817 PR analyzer/96651
8818 * region-model.cc (region_model::called_from_main_p): New.
8819 (region_model::get_store_value): Move handling for globals into...
8820 (region_model::get_initial_value_for_global): ...this new
8821 function, and add logic for extracting values from decl
8822 initializers.
8823 * region-model.h (decl_region::get_svalue_for_constructor): New
8824 decl.
8825 (decl_region::get_svalue_for_initializer): New decl.
8826 (region_model::called_from_main_p): New decl.
8827 (region_model::get_initial_value_for_global): New.
8828 * region.cc (decl_region::maybe_get_constant_value): Move logic
8829 for getting an svalue from a CONSTRUCTOR node to...
8830 (decl_region::get_svalue_for_constructor): ...this new function.
8831 (decl_region::get_svalue_for_initializer): New.
8832 * store.cc (get_svalue_for_ctor_val): Rewrite in terms of
8833 region_model::get_rvalue.
8834 * store.h (binding_cluster::get_map): New accessor.
8836 2020-08-19 David Malcolm <dmalcolm@redhat.com>
8838 PR analyzer/96648
8839 * region.cc (get_field_at_bit_offset): Gracefully handle negative
8840 values for bit_offset.
8842 2020-08-18 David Malcolm <dmalcolm@redhat.com>
8844 * region-model.cc (region_model::get_rvalue_1): Fix name of local.
8846 2020-08-18 David Malcolm <dmalcolm@redhat.com>
8848 PR analyzer/96641
8849 * region-model.cc (region_model::get_rvalue_1): Handle
8850 unrecognized tree codes by returning "UNKNOWN.
8852 2020-08-18 David Malcolm <dmalcolm@redhat.com>
8854 PR analyzer/96640
8855 * region-model.cc (region_model::get_gassign_result): Handle various
8856 VEC_* tree codes by returning UNKNOWN.
8857 (region_model::on_assignment): Handle unrecognized tree codes by
8858 setting lhs to an unknown value, rather than issuing a "sorry" and
8859 asserting.
8861 2020-08-17 David Malcolm <dmalcolm@redhat.com>
8863 PR analyzer/96644
8864 * region-model-manager.cc (get_region_for_unexpected_tree_code):
8865 Handle ctxt being NULL.
8867 2020-08-17 David Malcolm <dmalcolm@redhat.com>
8869 PR analyzer/96639
8870 * region.cc (region::get_subregions_for_binding): Check for "type"
8871 being NULL.
8873 2020-08-17 David Malcolm <dmalcolm@redhat.com>
8875 PR analyzer/96642
8876 * store.cc (get_svalue_for_ctor_val): New.
8877 (binding_map::apply_ctor_to_region): Call it.
8879 2020-08-14 David Malcolm <dmalcolm@redhat.com>
8881 PR testsuite/96609
8882 PR analyzer/96616
8883 * region-model.cc (region_model::get_store_value): Call
8884 maybe_get_constant_value on decl_regions first.
8885 * region-model.h (decl_region::maybe_get_constant_value): New decl.
8886 * region.cc (decl_region::get_stack_depth): Likewise.
8887 (decl_region::maybe_get_constant_value): New.
8888 * store.cc (get_subregion_within_ctor): New.
8889 (binding_map::apply_ctor_to_region): New.
8890 * store.h (binding_map::apply_ctor_to_region): New decl.
8892 2020-08-14 David Malcolm <dmalcolm@redhat.com>
8894 PR analyzer/96611
8895 * store.cc (store::mark_as_escaped): Reject attempts to
8896 get a cluster for an unknown pointer.
8898 2020-08-13 David Malcolm <dmalcolm@redhat.com>
8900 PR analyzer/93032
8901 PR analyzer/93938
8902 PR analyzer/94011
8903 PR analyzer/94099
8904 PR analyzer/94399
8905 PR analyzer/94458
8906 PR analyzer/94503
8907 PR analyzer/94640
8908 PR analyzer/94688
8909 PR analyzer/94689
8910 PR analyzer/94839
8911 PR analyzer/95026
8912 PR analyzer/95042
8913 PR analyzer/95240
8914 * analyzer-logging.cc: Ignore "-Wformat-diag".
8915 (logger::enter_scope): Use inc_indent in both overloads.
8916 (logger::exit_scope): Use dec_indent.
8917 * analyzer-logging.h (logger::inc_indent): New.
8918 (logger::dec_indent): New.
8919 * analyzer-selftests.cc (run_analyzer_selftests): Call
8920 analyzer_store_cc_tests.
8921 * analyzer-selftests.h (analyzer_store_cc_tests): New decl.
8922 * analyzer.cc (get_stmt_location): New function.
8923 * analyzer.h (class initial_svalue): New forward decl.
8924 (class unaryop_svalue): New forward decl.
8925 (class binop_svalue): New forward decl.
8926 (class sub_svalue): New forward decl.
8927 (class unmergeable_svalue): New forward decl.
8928 (class placeholder_svalue): New forward decl.
8929 (class widening_svalue): New forward decl.
8930 (class compound_svalue): New forward decl.
8931 (class conjured_svalue): New forward decl.
8932 (svalue_set): New typedef.
8933 (class map_region): Delete.
8934 (class array_region): Delete.
8935 (class frame_region): New forward decl.
8936 (class function_region): New forward decl.
8937 (class label_region): New forward decl.
8938 (class decl_region): New forward decl.
8939 (class element_region): New forward decl.
8940 (class offset_region): New forward decl.
8941 (class cast_region): New forward decl.
8942 (class field_region): New forward decl.
8943 (class string_region): New forward decl.
8944 (class region_model_manager): New forward decl.
8945 (class store_manager): New forward decl.
8946 (class store): New forward decl.
8947 (class call_details): New forward decl.
8948 (struct svalue_id_merger_mapping): Delete.
8949 (struct canonicalization): Delete.
8950 (class function_point): New forward decl.
8951 (class engine): New forward decl.
8952 (dump_tree): New function decl.
8953 (print_quoted_type): New function decl.
8954 (readability_comparator): New function decl.
8955 (tree_cmp): New function decl.
8956 (class path_var): Move here from region-model.h
8957 (bit_offset_t, bit_size_t, byte_size_t): New typedefs.
8958 (class region_offset): New class.
8959 (get_stmt_location): New decl.
8960 (struct member_function_hash_traits): New struct.
8961 (class consolidation_map): New class.
8962 Ignore "-Wformat-diag".
8963 * analyzer.opt (-param=analyzer-max-svalue-depth=): New param.
8964 (-param=analyzer-max-enodes-for-full-dump=): New param.
8965 * call-string.cc: Ignore -Wformat-diag.
8966 * checker-path.cc: Move includes of "analyzer/call-string.h" and
8967 "analyzer/program-point.h" to before "analyzer/region-model.h",
8968 and also include "analyzer/store.h" before it.
8969 (state_change_event::state_change_event): Replace "tree var" param
8970 with "const svalue *sval". Convert "origin" param from tree to
8971 "const svalue *".
8972 (state_change_event::get_desc): Call get_representative_tree to
8973 convert the var and origin from const svalue * to tree. Use
8974 svalue::get_desc rather than %qE when describing state changes.
8975 (checker_path::add_final_event): Use get_stmt_location.
8976 * checker-path.h (state_change_event::state_change_event): Port
8977 from tree to const svalue *.
8978 (state_change_event::get_lvalue): Delete.
8979 (state_change_event::get_dest_function): New.
8980 (state_change_event::m_var): Replace with...
8981 (state_change_event::m_sval): ...this.
8982 (state_change_event::m_origin): Convert from tree to
8983 const svalue *.
8984 * constraint-manager.cc: Include "analyzer/call-string.h",
8985 "analyzer/program-point.h", and "analyzer/store.h" before
8986 "analyzer/region-model.h".
8987 (struct bound, struct range): Move to constraint-manager.h.
8988 (compare_constants): New function.
8989 (range::dump): Rename to...
8990 (range::dump_to_pp): ...this. Support NULL constants.
8991 (range::dump): Reintroduce for dumping to stderr.
8992 (range::constrained_to_single_element): Return result, rather than
8993 writing to *OUT.
8994 (range::eval_condition): New.
8995 (range::below_lower_bound): New.
8996 (range::above_upper_bound): New.
8997 (equiv_class::equiv_class): Port from svalue_id to const svalue *.
8998 (equiv_class::print): Likewise.
8999 (equiv_class::hash): Likewise.
9000 (equiv_class::operator==): Port from svalue_id to const svalue *.
9001 (equiv_class::add): Port from svalue_id to const svalue *. Drop
9002 "cm" param.
9003 (equiv_class::del): Port from svalue_id to const svalue *.
9004 (equiv_class::get_representative): Likewise.
9005 (equiv_class::remap_svalue_ids): Delete.
9006 (svalue_id_cmp_by_id): Rename to...
9007 (svalue_cmp_by_ptr): ...this, porting from svalue_id to
9008 const svalue *.
9009 (equiv_class::canonicalize): Update qsort comparator.
9010 (constraint::implied_by): New.
9011 (constraint_manager::constraint_manager): Copy m_mgr in copy ctor.
9012 (constraint_manager::dump_to_pp): Add "multiline" param
9013 (constraint_manager::dump): Pass "true" for "multiline".
9014 (constraint_manager::add_constraint): Port from svalue_id to
9015 const svalue *. Split out second part into...
9016 (constraint_manager::add_unknown_constraint): ...this new
9017 function. Remove self-constraints when merging equivalence
9018 classes.
9019 (constraint_manager::add_constraint_internal): Remove constraints
9020 that would be implied by the new constraint. Port from svalue_id
9021 to const svalue *.
9022 (constraint_manager::get_equiv_class_by_sid): Rename to...
9023 (constraint_manager::get_equiv_class_by_svalue): ...this, porting
9024 from svalue_id to const svalue *.
9025 (constraint_manager::get_or_add_equiv_class): Port from svalue_id
9026 to const svalue *.
9027 (constraint_manager::eval_condition): Make const. Call
9028 compare_constants and return early if it provides a known result.
9029 (constraint_manager::get_ec_bounds): New.
9030 (constraint_manager::eval_condition): New overloads. Make
9031 existing one const, and use compare_constants.
9032 (constraint_manager::purge): Convert "p" param to a template
9033 rather that an abstract base class. Port from svalue_id to
9034 const svalue *.
9035 (class dead_svalue_purger): New class.
9036 (constraint_manager::remap_svalue_ids): Delete.
9037 (constraint_manager::on_liveness_change): New.
9038 (equiv_class_cmp): Port from svalue_id to const svalue *.
9039 (constraint_manager::canonicalize): Likewise. Combine with
9040 purging of redundant equivalence classes and constraints.
9041 (class cleaned_constraint_manager): Delete.
9042 (class merger_fact_visitor): Make "m_cm_b" const. Add "m_merger"
9043 field.
9044 (merger_fact_visitor::fact): Port from svalue_id to const svalue *.
9045 Add special case for widening.
9046 (constraint_manager::merge): Port from svalue_id to const svalue *.
9047 (constraint_manager::clean_merger_input): Delete.
9048 (constraint_manager::for_each_fact): Port from svalue_id to
9049 const svalue *.
9050 (constraint_manager::validate): Likewise.
9051 (selftest::test_constraint_conditions): Provide a
9052 region_model_manager when creating region_model instances.
9053 Add test for self-equality not creating equivalence classes.
9054 (selftest::test_transitivity): Provide a region_model_manager when
9055 creating region_model instances. Verify that EC-merging happens
9056 when constraints are implied.
9057 (selftest::test_constant_comparisons): Provide a
9058 region_model_manager when creating region_model instances.
9059 (selftest::test_constraint_impl): Likewise. Remove over-specified
9060 assertions.
9061 (selftest::test_equality): Provide a region_model_manager when
9062 creating region_model instances.
9063 (selftest::test_many_constants): Likewise. Provide a
9064 program_point when testing merging.
9065 (selftest::run_constraint_manager_tests): Move call to
9066 test_constant_comparisons to outside the transitivity guard.
9067 * constraint-manager.h (struct bound): Move here from
9068 constraint-manager.cc.
9069 (struct range): Likewise.
9070 (struct::eval_condition): New decl.
9071 (struct::below_lower_bound): New decl.
9072 (struct::above_upper_bound): New decl.
9073 (equiv_class::add): Port from svalue_id to const svalue *.
9074 (equiv_class::del): Likewise.
9075 (equiv_class::get_representative): Likewise.
9076 (equiv_class::remap_svalue_ids): Drop.
9077 (equiv_class::m_cst_sid): Convert to..
9078 (equiv_class::m_cst_sval): ...this.
9079 (equiv_class::m_vars): Port from svalue_id to const svalue *.
9080 (constraint::bool implied_by): New decl.
9081 (fact_visitor::on_fact): Port from svalue_id to const svalue *.
9082 (constraint_manager::constraint_manager): Add mgr param.
9083 (constraint_manager::clone): Delete.
9084 (constraint_manager::maybe_get_constant): Delete.
9085 (constraint_manager::get_sid_for_constant): Delete.
9086 (constraint_manager::get_num_svalues): Delete.
9087 (constraint_manager::dump_to_pp): Add "multiline" param.
9088 (constraint_manager::get_equiv_class): Port from svalue_id to
9089 const svalue *.
9090 (constraint_manager::add_constraint): Likewise.
9091 (constraint_manager::get_equiv_class_by_sid): Rename to...
9092 (constraint_manager::get_equiv_class_by_svalue): ...this, porting
9093 from svalue_id to const svalue *.
9094 (constraint_manager::add_unknown_constraint): New decl.
9095 (constraint_manager::get_or_add_equiv_class): Port from svalue_id
9096 to const svalue *.
9097 (constraint_manager::eval_condition): Likewise. Add overloads.
9098 (constraint_manager::get_ec_bounds): New decl.
9099 (constraint_manager::purge): Convert to template.
9100 (constraint_manager::remap_svalue_ids): Delete.
9101 (constraint_manager::on_liveness_change): New decl.
9102 (constraint_manager::canonicalize): Drop param.
9103 (constraint_manager::clean_merger_input): Delete.
9104 (constraint_manager::m_mgr): New field.
9105 * diagnostic-manager.cc: Move includes of
9106 "analyzer/call-string.h" and "analyzer/program-point.h" to before
9107 "analyzer/region-model.h", and also include "analyzer/store.h"
9108 before it.
9109 (saved_diagnostic::saved_diagnostic): Add "sval" param.
9110 (diagnostic_manager::diagnostic_manager): Add engine param.
9111 (diagnostic_manager::add_diagnostic): Add "sval" param, passing it
9112 to saved_diagnostic ctor. Update overload to pass NULL for it.
9113 (dedupe_winners::dedupe_winners): Add engine param.
9114 (dedupe_winners::add): Add "eg" param. Pass m_engine to
9115 feasible_p.
9116 (dedupe_winner::m_engine): New field.
9117 (diagnostic_manager::emit_saved_diagnostics): Pass engine to
9118 dedupe_winners. Pass &eg when adding candidates. Pass svalue
9119 rather than tree to prune_path. Use get_stmt_location to get
9120 primary location of diagnostic.
9121 (diagnostic_manager::emit_saved_diagnostic): Likewise.
9122 (get_any_origin): Drop.
9123 (state_change_event_creator::on_global_state_change): Pass NULL
9124 const svalue * rather than NULL_TREE trees to state_change_event
9125 ctor.
9126 (state_change_event_creator::on_state_change): Port from tree and
9127 svalue_id to const svalue *.
9128 (for_each_state_change): Port from svalue_id to const svalue *.
9129 (struct null_assignment_sm_context): New.
9130 (diagnostic_manager::add_events_for_eedge): Add state change
9131 events for assignment to NULL.
9132 (diagnostic_manager::prune_path): Update param from tree to
9133 const svalue *.
9134 (diagnostic_manager::prune_for_sm_diagnostic): Port from tracking
9135 by tree to by const svalue *.
9136 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add sval
9137 param.
9138 (saved_diagnostic::m_sval): New field.
9139 (diagnostic_manager::diagnostic_manager): Add engine param.
9140 (diagnostic_manager::get_engine): New.
9141 (diagnostic_manager::add_diagnostic): Add "sval" param.
9142 (diagnostic_manager::prune_path): Likewise.
9143 (diagnostic_manager::prune_for_sm_diagnostic): New overload.
9144 (diagnostic_manager::m_eng): New field.
9145 * engine.cc: Move includes of "analyzer/call-string.h" and
9146 "analyzer/program-point.h" to before "analyzer/region-model.h",
9147 and also include "analyzer/store.h" before it.
9148 (impl_region_model_context::impl_region_model_context): Update for
9149 removal of m_change field.
9150 (impl_region_model_context::remap_svalue_ids): Delete.
9151 (impl_region_model_context::on_svalue_leak): New.
9152 (impl_region_model_context::on_svalue_purge): Delete.
9153 (impl_region_model_context::on_liveness_change): New.
9154 (impl_region_model_context::on_unknown_change): Update param
9155 from svalue_id to const svalue *. Add is_mutable param.
9156 (setjmp_svalue::compare_fields): Delete.
9157 (setjmp_svalue::accept): New.
9158 (setjmp_svalue::add_to_hash): Delete.
9159 (setjmp_svalue::dump_to_pp): New.
9160 (setjmp_svalue::print_details): Delete.
9161 (impl_sm_context::impl_sm_context): Drop "change" param.
9162 (impl_sm_context::get_fndecl_for_call): Drop "m_change".
9163 (impl_sm_context::on_transition): Drop ATTRIBUTE_UNUSED from
9164 "stmt" param. Drop m_change. Port from svalue_id to
9165 const svalue *.
9166 (impl_sm_context::warn_for_state): Drop m_change. Port from
9167 svalue_id to const svalue *.
9168 (impl_sm_context::get_readable_tree): Rename to...
9169 (impl_sm_context::get_diagnostic_tree): ...this. Port from
9170 svalue_id to const svalue *.
9171 (impl_sm_context::is_zero_assignment): New.
9172 (impl_sm_context::m_change): Delete field.
9173 (leak_stmt_finder::find_stmt): Handle m_var being NULL.
9174 (readability): Increase penalty for MEM_REF. For SSA_NAMEs,
9175 slightly favor the underlying var over the SSA name. Heavily
9176 penalize temporaries. Handle RESULT_DECL.
9177 (readability_comparator): Make non-static. Consider stack depths.
9178 (impl_region_model_context::on_state_leak): Convert from svalue_id
9179 to const svalue *, updating for region_model changes. Use
9180 id_equal.
9181 (impl_region_model_context::on_inherited_svalue): Delete.
9182 (impl_region_model_context::on_cast): Delete.
9183 (impl_region_model_context::on_condition): Drop m_change.
9184 (impl_region_model_context::on_phi): Likewise.
9185 (impl_region_model_context::on_unexpected_tree_code): Handle t
9186 being NULL.
9187 (point_and_state::validate): Update stack checking for
9188 region_model changes.
9189 (eg_traits::dump_args_t::show_enode_details_p): New.
9190 (exploded_node::exploded_node): Initialize m_num_processed_stmts.
9191 (exploded_node::get_processed_stmt): New function.
9192 (exploded_node::get_dot_fillcolor): Add more colors.
9193 (exploded_node::dump_dot): Guard the printing of the point and
9194 state with show_enode_details_p. Print the processed stmts for
9195 this enode after the initial state.
9196 (exploded_node::dump_to_pp): Pass true for new multiline param
9197 of program_state::dump_to_pp.
9198 (exploded_node::on_stmt): Drop "change" param. Log the stmt.
9199 Set input_location. Implement __analyzer_describe. Update
9200 implementation of __analyzer_dump and __analyzer_eval.
9201 Remove purging of sm-state for unknown fncalls from here.
9202 (exploded_node::on_edge): Drop "change" param.
9203 (exploded_node::on_longjmp): Port from region_id/svalue_id to
9204 const region */const svalue *. Call program_state::detect_leaks.
9205 Drop state_change.
9206 (exploded_node::detect_leaks): Update for changes to region_model.
9207 Call program_state::detect_leaks.
9208 (exploded_edge::exploded_edge): Drop ext_state and change params.
9209 (exploded_edge::dump_dot): "args" is no longer used. Drop dumping
9210 of m_change.
9211 (exploded_graph::exploded_graph): Pass engine to
9212 m_diagnostic_manager ctor. Use program_point::origin.
9213 (exploded_graph::add_function_entry): Drop ctxt. Use
9214 program_state::push_frame. Drop state_change.
9215 (exploded_graph::get_or_create_node): Drop "change" param. Add
9216 "enode_for_diag" param. Update dumping calls for API changes.
9217 Pass point to can_merge_with_p. Show enode indices
9218 within -Wanalyzer-too-complex diagnostic for hitting the per-point
9219 limit.
9220 (exploded_graph::add_edge): Drop "change" param. Log which nodes
9221 are being connected. Update for changes to exploded_edge ctor.
9222 (exploded_graph::get_per_program_point_data): New.
9223 (exploded_graph::process_worklist): Pass point to
9224 can_merge_with_p. Drop state_change. Update dumping call for API
9225 change.
9226 (exploded_graph::process_node): Drop state_change. Split the
9227 node in-place if an sm-state-change occurs. Update
9228 m_num_processed_stmts. Update dumping calls for API change.
9229 (exploded_graph::log_stats): Call engine::log_stats.
9230 (exploded_graph::dump_states_for_supernode): Update dumping
9231 call.
9232 (exploded_path::feasible_p): Add "eng" and "eg" params.
9233 Rename "i" to "end_idx". Pass the manager to the region_model
9234 ctor. Update for every processed stmt in the enode, not just the
9235 first. Keep track of which snodes have been visited, and call
9236 loop_replay_fixup when revisiting one.
9237 (enode_label::get_text): Update dump call for new param.
9238 (exploded_graph::dump_exploded_nodes): Likewise.
9239 (exploded_graph::get_node_by_index): New.
9240 (impl_run_checkers): Create engine instance and pass its address
9241 to extrinsic_state ctor.
9242 * exploded-graph.h
9243 (impl_region_model_context::impl_region_model_context): Drop
9244 "change" params.
9245 (impl_region_model_context::void remap_svalue_ids): Delete.
9246 (impl_region_model_context::on_svalue_purge): Delete.
9247 (impl_region_model_context::on_svalue_leak): New.
9248 (impl_region_model_context::on_liveness_change): New.
9249 (impl_region_model_context::on_state_leak): Update signature.
9250 (impl_region_model_context::on_inherited_svalue): Delete.
9251 (impl_region_model_context::on_cast): Delete.
9252 (impl_region_model_context::on_unknown_change): Update signature.
9253 (impl_region_model_context::m_change): Delete.
9254 (eg_traits::dump_args_t::show_enode_details_p): New.
9255 (exploded_node::on_stmt): Drop "change" param.
9256 (exploded_node::on_edge): Likewise.
9257 (exploded_node::get_processed_stmt): New decl.
9258 (exploded_node::m_num_processed_stmts): New field.
9259 (exploded_edge::exploded_edge): Drop ext_state and change params.
9260 (exploded_edge::m_change): Delete.
9261 (exploded_graph::get_engine): New accessor.
9262 (exploded_graph::get_or_create_node): Drop "change" param. Add
9263 "enode_for_diag" param.
9264 (exploded_graph::add_edge): Drop "change" param.
9265 (exploded_graph::get_per_program_point_data): New decl.
9266 (exploded_graph::get_node_by_index): New decl.
9267 (exploded_path::feasible_p): Add "eng" and "eg" params.
9268 * program-point.cc: Include "analyzer/store.h" before including
9269 "analyzer/region-model.h".
9270 (function_point::function_point): Move here from
9271 program-point.h.
9272 (function_point::get_function): Likewise.
9273 (function_point::from_function_entry): Likewise.
9274 (function_point::before_supernode): Likewise.
9275 (function_point::next_stmt): New function.
9276 * program-point.h (function_point::function_point): Move
9277 implementation from here to program-point.cc.
9278 (function_point::get_function): Likewise.
9279 (function_point::from_function_entry): Likewise.
9280 (function_point::before_supernode): Likewise.
9281 (function_point::next_stmt): New decl.
9282 (program_point::operator!=): New.
9283 (program_point::origin): New.
9284 (program_point::next_stmt): New.
9285 (program_point::m_function_point): Make non-const.
9286 * program-state.cc: Move includes of "analyzer/call-string.h" and
9287 "analyzer/program-point.h" to before "analyzer/region-model.h",
9288 and also include "analyzer/store.h" before it.
9289 (extrinsic_state::get_model_manager): New.
9290 (sm_state_map::sm_state_map): Pass in sm and sm_idx to ctor,
9291 rather than pass the around.
9292 (sm_state_map::clone_with_remapping): Delete.
9293 (sm_state_map::print): Remove "sm" param in favor of "m_sm". Add
9294 "simple" and "multiline" params and support multiline vs single
9295 line dumping.
9296 (sm_state_map::dump): Remove "sm" param in favor of "m_sm". Add
9297 "simple" param.
9298 (sm_state_map::hash): Port from svalue_id to const svalue *.
9299 (sm_state_map::operator==): Likewise.
9300 (sm_state_map::get_state): Likewise. Call canonicalize_svalue on
9301 input. Handle inheritance of sm-state. Call get_default_state.
9302 (sm_state_map::get_origin): Port from svalue_id to const svalue *.
9303 (sm_state_map::set_state): Likewise. Pass in ext_state. Reject
9304 attempts to set state on UNKNOWN.
9305 (sm_state_map::impl_set_state): Port from svalue_id to
9306 const svalue *. Pass in ext_state. Call canonicalize_svalue on
9307 input.
9308 (sm_state_map::purge_for_unknown_fncall): Delete.
9309 (sm_state_map::on_svalue_leak): New.
9310 (sm_state_map::remap_svalue_ids): Delete.
9311 (sm_state_map::on_liveness_change): New.
9312 (sm_state_map::on_unknown_change): Reimplement.
9313 (sm_state_map::on_svalue_purge): Delete.
9314 (sm_state_map::on_inherited_svalue): Delete.
9315 (sm_state_map::on_cast): Delete.
9316 (sm_state_map::validate): Delete.
9317 (sm_state_map::canonicalize_svalue): New.
9318 (program_state::program_state): Update to pass manager to
9319 region_model's ctor. Constify num_states and pass state machine
9320 and index to sm_state_map ctor.
9321 (program_state::print): Update for changes to dump API.
9322 (program_state::dump_to_pp): Ignore the summarize param. Add
9323 "multiline" param.
9324 (program_state::dump_to_file): Add "multiline" param.
9325 (program_state::dump): Pass "true" for new "multiline" param.
9326 (program_state::push_frame): New.
9327 (program_state::on_edge): Drop "change" param. Call
9328 program_state::detect_leaks.
9329 (program_state::prune_for_point): Add enode_for_diag param.
9330 Reimplement based on store class. Call detect_leaks
9331 (program_state::remap_svalue_ids): Delete.
9332 (program_state::get_representative_tree): Port from svalue_id to
9333 const svalue *.
9334 (program_state::can_merge_with_p): Add "point" param. Add early
9335 reject for sm-differences. Drop id remapping.
9336 (program_state::validate): Drop region model and sm_state_map
9337 validation.
9338 (state_change::sm_change::dump): Delete.
9339 (state_change::sm_change::remap_svalue_ids): Delete.
9340 (state_change::sm_change::on_svalue_purge): Delete.
9341 (log_set_of_svalues): New.
9342 (state_change::sm_change::validate): Delete.
9343 (state_change::state_change): Delete.
9344 (state_change::add_sm_change): Delete.
9345 (state_change::affects_p): Delete.
9346 (state_change::dump): Delete.
9347 (state_change::remap_svalue_ids): Delete.
9348 (state_change::on_svalue_purge): Delete.
9349 (state_change::validate): Delete.
9350 (selftest::assert_dump_eq): Delete.
9351 (ASSERT_DUMP_EQ): Delete.
9352 (selftest::test_sm_state_map): Update for changes to region_model
9353 and sm_state_map, porting from svalue_id to const svalue *.
9354 (selftest::test_program_state_dumping): Likewise. Drop test of
9355 dumping, renaming to...
9356 (selftest::test_program_state_1): ...this.
9357 (selftest::test_program_state_dumping_2): Likewise, renaming to...
9358 (selftest::test_program_state_2): ...this.
9359 (selftest::test_program_state_merging): Update for changes to
9360 region_model.
9361 (selftest::test_program_state_merging_2): Likewise.
9362 (selftest::analyzer_program_state_cc_tests): Update for renamed
9363 tests.
9364 * program-state.h (extrinsic_state::extrinsic_state): Add logger
9365 and engine params.
9366 (extrinsic_state::get_logger): New accessor.
9367 (extrinsic_state::get_engine): New accessor.
9368 (extrinsic_state::get_model_manager): New accessor.
9369 (extrinsic_state::m_logger): New field.
9370 (extrinsic_state::m_engine): New field.
9371 (struct default_hash_traits<svalue_id>): Delete.
9372 (pod_hash_traits<svalue_id>::hash): Delete.
9373 (pod_hash_traits<svalue_id>::equal): Delete.
9374 (pod_hash_traits<svalue_id>::mark_deleted): Delete.
9375 (pod_hash_traits<svalue_id>::mark_empty): Delete.
9376 (pod_hash_traits<svalue_id>::is_deleted): Delete.
9377 (pod_hash_traits<svalue_id>::is_empty): Delete.
9378 (sm_state_map::entry_t::entry_t): Port from svalue_id to
9379 const svalue *.
9380 (sm_state_map::entry_t::m_origin): Likewise.
9381 (sm_state_map::map_t): Likewise.
9382 (sm_state_map::sm_state_map): Add state_machine and index params.
9383 (sm_state_map::clone_with_remapping): Delete.
9384 (sm_state_map::print): Drop sm param; add simple and multiline
9385 params.
9386 (sm_state_map::dump): Drop sm param; add simple param.
9387 (sm_state_map::get_state): Port from svalue_id to const svalue *.
9388 Add ext_state param.
9389 (sm_state_map::get_origin): Likewise.
9390 (sm_state_map::set_state): Likewise.
9391 (sm_state_map::impl_set_state): Likewise.
9392 (sm_state_map::purge_for_unknown_fncall): Delete.
9393 (sm_state_map::remap_svalue_ids): Delete.
9394 (sm_state_map::on_svalue_purge): Delete.
9395 (sm_state_map::on_svalue_leak): New.
9396 (sm_state_map::on_liveness_change): New.
9397 (sm_state_map::on_inherited_svalue): Delete.
9398 (sm_state_map::on_cast): Delete.
9399 (sm_state_map::validate): Delete.
9400 (sm_state_map::on_unknown_change): Port from svalue_id to
9401 const svalue *. Add is_mutable and ext_state params.
9402 (sm_state_map::canonicalize_svalue): New.
9403 (sm_state_map::m_sm): New field.
9404 (sm_state_map::m_sm_idx): New field.
9405 (program_state::operator=): Delete.
9406 (program_state::dump_to_pp): Drop "summarize" param, adding
9407 "simple" and "multiline".
9408 (program_state::dump_to_file): Likewise.
9409 (program_state::dump): Rename "summarize" to "simple".
9410 (program_state::push_frame): New.
9411 (program_state::get_current_function): New.
9412 (program_state::on_edge): Drop "change" param.
9413 (program_state::prune_for_point): Likewise. Add enode_for_diag
9414 param.
9415 (program_state::remap_svalue_ids): Delete.
9416 (program_state::get_representative_tree): Port from svalue_id to
9417 const svalue *.
9418 (program_state::can_purge_p): Likewise. Pass ext_state to get_state.
9419 (program_state::can_merge_with_p): Add point param.
9420 (program_state::detect_leaks): New.
9421 (state_change_visitor::on_state_change): Port from tree and
9422 svalue_id to a pair of const svalue *.
9423 (class state_change): Delete.
9424 * region.cc: New file.
9425 * region-model-impl-calls.cc: New file.
9426 * region-model-manager.cc: New file.
9427 * region-model-reachability.cc: New file.
9428 * region-model-reachability.h: New file.
9429 * region-model.cc: Include "analyzer/call-string.h",
9430 "analyzer/program-point.h", and "analyzer/store.h" before
9431 "analyzer/region-model.h". Include
9432 "analyzer/region-model-reachability.h".
9433 (dump_tree): Make non-static.
9434 (dump_quoted_tree): Make non-static.
9435 (print_quoted_type): Make non-static.
9436 (path_var::dump): Delete.
9437 (dump_separator): Delete.
9438 (class impl_constraint_manager): Delete.
9439 (svalue_id::print): Delete.
9440 (svalue_id::dump_node_name_to_pp): Delete.
9441 (svalue_id::validate): Delete.
9442 (region_id::print): Delete.
9443 (region_id::dump_node_name_to_pp): Delete.
9444 (region_id::validate): Delete.
9445 (region_id_set::region_id_set): Delete.
9446 (svalue_id_set::svalue_id_set): Delete.
9447 (svalue::operator==): Delete.
9448 (svalue::hash): Delete.
9449 (svalue::print): Delete.
9450 (svalue::dump_dot_to_pp): Delete.
9451 (svalue::remap_region_ids): Delete.
9452 (svalue::walk_for_canonicalization): Delete.
9453 (svalue::get_child_sid): Delete.
9454 (svalue::maybe_get_constant): Delete.
9455 (region_svalue::compare_fields): Delete.
9456 (region_svalue::add_to_hash): Delete.
9457 (region_svalue::print_details): Delete.
9458 (region_svalue::dump_dot_to_pp): Delete.
9459 (region_svalue::remap_region_ids): Delete.
9460 (region_svalue::merge_values): Delete.
9461 (region_svalue::walk_for_canonicalization): Delete.
9462 (region_svalue::eval_condition): Delete.
9463 (constant_svalue::compare_fields): Delete.
9464 (constant_svalue::add_to_hash): Delete.
9465 (constant_svalue::merge_values): Delete.
9466 (constant_svalue::eval_condition): Move to svalue.cc.
9467 (constant_svalue::print_details): Delete.
9468 (constant_svalue::get_child_sid): Delete.
9469 (unknown_svalue::compare_fields): Delete.
9470 (unknown_svalue::add_to_hash): Delete.
9471 (unknown_svalue::print_details): Delete.
9472 (poison_kind_to_str): Move to svalue.cc.
9473 (poisoned_svalue::compare_fields): Delete.
9474 (poisoned_svalue::add_to_hash): Delete.
9475 (poisoned_svalue::print_details): Delete.
9476 (region_kind_to_str): Move to region.cc and reimplement.
9477 (region::operator==): Delete.
9478 (region::get_parent_region): Delete.
9479 (region::set_value): Delete.
9480 (region::become_active_view): Delete.
9481 (region::deactivate_any_active_view): Delete.
9482 (region::deactivate_view): Delete.
9483 (region::get_value): Delete.
9484 (region::get_inherited_child_sid): Delete.
9485 (region_model::copy_region): Delete.
9486 (region_model::copy_struct_region): Delete.
9487 (region_model::copy_union_region): Delete.
9488 (region_model::copy_array_region): Delete.
9489 (region::hash): Delete.
9490 (region::print): Delete.
9491 (region::dump_dot_to_pp): Delete.
9492 (region::dump_to_pp): Delete.
9493 (region::dump_child_label): Delete.
9494 (region::validate): Delete.
9495 (region::remap_svalue_ids): Delete.
9496 (region::remap_region_ids): Delete.
9497 (region::add_view): Delete.
9498 (region::get_view): Delete.
9499 (region::region): Move to region.cc.
9500 (region::add_to_hash): Delete.
9501 (region::print_fields): Delete.
9502 (region::non_null_p): Delete.
9503 (primitive_region::clone): Delete.
9504 (primitive_region::walk_for_canonicalization): Delete.
9505 (map_region::map_region): Delete.
9506 (map_region::compare_fields): Delete.
9507 (map_region::print_fields): Delete.
9508 (map_region::validate): Delete.
9509 (map_region::dump_dot_to_pp): Delete.
9510 (map_region::dump_child_label): Delete.
9511 (map_region::get_or_create): Delete.
9512 (map_region::get): Delete.
9513 (map_region::add_to_hash): Delete.
9514 (map_region::remap_region_ids): Delete.
9515 (map_region::unbind): Delete.
9516 (map_region::get_tree_for_child_region): Delete.
9517 (map_region::get_tree_for_child_region): Delete.
9518 (tree_cmp): Move to region.cc.
9519 (map_region::can_merge_p): Delete.
9520 (map_region::walk_for_canonicalization): Delete.
9521 (map_region::get_value_by_name): Delete.
9522 (struct_or_union_region::valid_key_p): Delete.
9523 (struct_or_union_region::compare_fields): Delete.
9524 (struct_region::clone): Delete.
9525 (struct_region::compare_fields): Delete.
9526 (union_region::clone): Delete.
9527 (union_region::compare_fields): Delete.
9528 (frame_region::compare_fields): Delete.
9529 (frame_region::clone): Delete.
9530 (frame_region::valid_key_p): Delete.
9531 (frame_region::print_fields): Delete.
9532 (frame_region::add_to_hash): Delete.
9533 (globals_region::compare_fields): Delete.
9534 (globals_region::clone): Delete.
9535 (globals_region::valid_key_p): Delete.
9536 (code_region::compare_fields): Delete.
9537 (code_region::clone): Delete.
9538 (code_region::valid_key_p): Delete.
9539 (array_region::array_region): Delete.
9540 (array_region::get_element): Delete.
9541 (array_region::clone): Delete.
9542 (array_region::compare_fields): Delete.
9543 (array_region::print_fields): Delete.
9544 (array_region::validate): Delete.
9545 (array_region::dump_dot_to_pp): Delete.
9546 (array_region::dump_child_label): Delete.
9547 (array_region::get_or_create): Delete.
9548 (array_region::get): Delete.
9549 (array_region::add_to_hash): Delete.
9550 (array_region::remap_region_ids): Delete.
9551 (array_region::get_key_for_child_region): Delete.
9552 (array_region::key_cmp): Delete.
9553 (array_region::walk_for_canonicalization): Delete.
9554 (array_region::key_from_constant): Delete.
9555 (array_region::constant_from_key): Delete.
9556 (function_region::compare_fields): Delete.
9557 (function_region::clone): Delete.
9558 (function_region::valid_key_p): Delete.
9559 (stack_region::stack_region): Delete.
9560 (stack_region::compare_fields): Delete.
9561 (stack_region::clone): Delete.
9562 (stack_region::print_fields): Delete.
9563 (stack_region::dump_child_label): Delete.
9564 (stack_region::validate): Delete.
9565 (stack_region::push_frame): Delete.
9566 (stack_region::get_current_frame_id): Delete.
9567 (stack_region::pop_frame): Delete.
9568 (stack_region::add_to_hash): Delete.
9569 (stack_region::remap_region_ids): Delete.
9570 (stack_region::can_merge_p): Delete.
9571 (stack_region::walk_for_canonicalization): Delete.
9572 (stack_region::get_value_by_name): Delete.
9573 (heap_region::heap_region): Delete.
9574 (heap_region::compare_fields): Delete.
9575 (heap_region::clone): Delete.
9576 (heap_region::walk_for_canonicalization): Delete.
9577 (root_region::root_region): Delete.
9578 (root_region::compare_fields): Delete.
9579 (root_region::clone): Delete.
9580 (root_region::print_fields): Delete.
9581 (root_region::validate): Delete.
9582 (root_region::dump_child_label): Delete.
9583 (root_region::push_frame): Delete.
9584 (root_region::get_current_frame_id): Delete.
9585 (root_region::pop_frame): Delete.
9586 (root_region::ensure_stack_region): Delete.
9587 (root_region::get_stack_region): Delete.
9588 (root_region::ensure_globals_region): Delete.
9589 (root_region::get_code_region): Delete.
9590 (root_region::ensure_code_region): Delete.
9591 (root_region::get_globals_region): Delete.
9592 (root_region::ensure_heap_region): Delete.
9593 (root_region::get_heap_region): Delete.
9594 (root_region::remap_region_ids): Delete.
9595 (root_region::can_merge_p): Delete.
9596 (root_region::add_to_hash): Delete.
9597 (root_region::walk_for_canonicalization): Delete.
9598 (root_region::get_value_by_name): Delete.
9599 (symbolic_region::symbolic_region): Delete.
9600 (symbolic_region::compare_fields): Delete.
9601 (symbolic_region::clone): Delete.
9602 (symbolic_region::walk_for_canonicalization): Delete.
9603 (symbolic_region::print_fields): Delete.
9604 (region_model::region_model): Add region_model_manager * param.
9605 Reimplement in terms of store, dropping impl_constraint_manager
9606 subclass.
9607 (region_model::operator=): Reimplement in terms of store
9608 (region_model::operator==): Likewise.
9609 (region_model::hash): Likewise.
9610 (region_model::print): Delete.
9611 (region_model::print_svalue): Delete.
9612 (region_model::dump_dot_to_pp): Delete.
9613 (region_model::dump_dot_to_file): Delete.
9614 (region_model::dump_dot): Delete.
9615 (region_model::dump_to_pp): Replace "summarize" param with
9616 "simple" and "multiline". Port to store-based implementation.
9617 (region_model::dump): Replace "summarize" param with "simple" and
9618 "multiline".
9619 (dump_vec_of_tree): Delete.
9620 (region_model::dump_summary_of_rep_path_vars): Delete.
9621 (region_model::validate): Delete.
9622 (svalue_id_cmp_by_constant_svalue_model): Delete.
9623 (svalue_id_cmp_by_constant_svalue): Delete.
9624 (region_model::canonicalize): Drop "ctxt" param. Reimplement in
9625 terms of store and constraints.
9626 (region_model::canonicalized_p): Remove NULL arg to canonicalize.
9627 (region_model::loop_replay_fixup): New.
9628 (poisoned_value_diagnostic::emit): Tweak wording of warnings.
9629 (region_model::check_for_poison): Delete.
9630 (region_model::get_gassign_result): New.
9631 (region_model::on_assignment): Port to store-based implementation.
9632 (region_model::on_call_pre): Delete calls to check_for_poison.
9633 Move implementations to region-model-impl-calls.c and port to
9634 store-based implementation.
9635 (region_model::on_call_post): Likewise.
9636 (class reachable_regions): Move to region-model-reachability.h/cc
9637 and port to store-based implementation.
9638 (region_model::handle_unrecognized_call): Port to store-based
9639 implementation.
9640 (region_model::get_reachable_svalues): New.
9641 (region_model::on_setjmp): Port to store-based implementation.
9642 (region_model::on_longjmp): Likewise.
9643 (region_model::handle_phi): Drop is_back_edge param and the logic
9644 using it.
9645 (region_model::get_lvalue_1): Port from region_id to const region *.
9646 (region_model::make_region_for_unexpected_tree_code): Delete.
9647 (assert_compat_types): If the check fails, use internal_error to
9648 show the types.
9649 (region_model::get_lvalue): Port from region_id to const region *.
9650 (region_model::get_rvalue_1): Port from svalue_id to const svalue *.
9651 (region_model::get_rvalue): Likewise.
9652 (region_model::get_or_create_ptr_svalue): Delete.
9653 (region_model::get_or_create_constant_svalue): Delete.
9654 (region_model::get_svalue_for_fndecl): Delete.
9655 (region_model::get_region_for_fndecl): Delete.
9656 (region_model::get_svalue_for_label): Delete.
9657 (region_model::get_region_for_label): Delete.
9658 (build_cast): Delete.
9659 (region_model::maybe_cast_1): Delete.
9660 (region_model::maybe_cast): Delete.
9661 (region_model::get_field_region): Delete.
9662 (region_model::get_store_value): New.
9663 (region_model::region_exists_p): New.
9664 (region_model::deref_rvalue): Port from svalue_id to const svalue *.
9665 (region_model::set_value): Likewise.
9666 (region_model::clobber_region): New.
9667 (region_model::purge_region): New.
9668 (region_model::zero_fill_region): New.
9669 (region_model::mark_region_as_unknown): New.
9670 (region_model::eval_condition): Port from svalue_id to
9671 const svalue *.
9672 (region_model::eval_condition_without_cm): Likewise.
9673 (region_model::compare_initial_and_pointer): New.
9674 (region_model::add_constraint): Port from svalue_id to
9675 const svalue *.
9676 (region_model::maybe_get_constant): Delete.
9677 (region_model::get_representative_path_var): New.
9678 (region_model::add_new_malloc_region): Delete.
9679 (region_model::get_representative_tree): Port to const svalue *.
9680 (region_model::get_representative_path_var): Port to
9681 const region *.
9682 (region_model::get_path_vars_for_svalue): Delete.
9683 (region_model::set_to_new_unknown_value): Delete.
9684 (region_model::update_for_phis): Don't pass is_back_edge to handle_phi.
9685 (region_model::update_for_call_superedge): Port from svalue_id to
9686 const svalue *.
9687 (region_model::update_for_return_superedge): Port to store-based
9688 implementation.
9689 (region_model::update_for_call_summary): Replace
9690 set_to_new_unknown_value with mark_region_as_unknown.
9691 (region_model::get_root_region): Delete.
9692 (region_model::get_stack_region_id): Delete.
9693 (region_model::push_frame): Delete.
9694 (region_model::get_current_frame_id): Delete.
9695 (region_model::get_current_function): Delete.
9696 (region_model::pop_frame): Delete.
9697 (region_model::on_top_level_param): New.
9698 (region_model::get_stack_depth): Delete.
9699 (region_model::get_function_at_depth): Delete.
9700 (region_model::get_globals_region_id): Delete.
9701 (region_model::add_svalue): Delete.
9702 (region_model::replace_svalue): Delete.
9703 (region_model::add_region): Delete.
9704 (region_model::get_svalue): Delete.
9705 (region_model::get_region): Delete.
9706 (make_region_for_type): Delete.
9707 (region_model::add_region_for_type): Delete.
9708 (region_model::on_top_level_param): New.
9709 (class restrict_to_used_svalues): Delete.
9710 (region_model::purge_unused_svalues): Delete.
9711 (region_model::push_frame): New.
9712 (region_model::remap_svalue_ids): Delete.
9713 (region_model::remap_region_ids): Delete.
9714 (region_model::purge_regions): Delete.
9715 (region_model::get_descendents): Delete.
9716 (region_model::delete_region_and_descendents): Delete.
9717 (region_model::poison_any_pointers_to_bad_regions): Delete.
9718 (region_model::can_merge_with_p): Delete.
9719 (region_model::get_current_function): New.
9720 (region_model::get_value_by_name): Delete.
9721 (region_model::convert_byte_offset_to_array_index): Delete.
9722 (region_model::pop_frame): New.
9723 (region_model::get_or_create_mem_ref): Delete.
9724 (region_model::get_stack_depth): New.
9725 (region_model::get_frame_at_index): New.
9726 (region_model::unbind_region_and_descendents): New.
9727 (struct bad_pointer_finder): New.
9728 (region_model::get_or_create_pointer_plus_expr): Delete.
9729 (region_model::poison_any_pointers_to_descendents): New.
9730 (region_model::get_or_create_view): Delete.
9731 (region_model::can_merge_with_p): New.
9732 (region_model::get_fndecl_for_call): Port from svalue_id to
9733 const svalue *.
9734 (struct append_ssa_names_cb_data): New.
9735 (get_ssa_name_regions_for_current_frame): New.
9736 (region_model::append_ssa_names_cb): New.
9737 (model_merger::dump_to_pp): Add "simple" param. Drop dumping of
9738 remappings.
9739 (model_merger::dump): Add "simple" param to both overloads.
9740 (model_merger::can_merge_values_p): Delete.
9741 (model_merger::record_regions): Delete.
9742 (model_merger::record_svalues): Delete.
9743 (svalue_id_merger_mapping::svalue_id_merger_mapping): Delete.
9744 (svalue_id_merger_mapping::dump_to_pp): Delete.
9745 (svalue_id_merger_mapping::dump): Delete.
9746 (region_model::create_region_for_heap_alloc): New.
9747 (region_model::create_region_for_alloca): New.
9748 (region_model::record_dynamic_extents): New.
9749 (canonicalization::canonicalization): Delete.
9750 (canonicalization::walk_rid): Delete.
9751 (canonicalization::walk_sid): Delete.
9752 (canonicalization::dump_to_pp): Delete.
9753 (canonicalization::dump): Delete.
9754 (inchash::add): Delete overloads for svalue_id and region_id.
9755 (engine::log_stats): New.
9756 (assert_condition): Add overload comparing svalues.
9757 (assert_dump_eq): Pass "true" for multiline.
9758 (selftest::test_dump): Update for rewrite of region_model.
9759 (selftest::test_dump_2): Rename to...
9760 (selftest::test_struct): ...this. Provide a region_model_manager
9761 when creating region_model instance. Remove dump test. Add
9762 checks for get_offset.
9763 (selftest::test_dump_3): Rename to...
9764 (selftest::test_array_1): ...this. Provide a region_model_manager
9765 when creating region_model instance. Remove dump test.
9766 (selftest::test_get_representative_tree): Port from svalue_id to
9767 new API. Add test coverage for various expressions.
9768 (selftest::test_unique_constants): Provide a region_model_manager
9769 for the region_model. Add test coverage for comparing const vs
9770 non-const.
9771 (selftest::test_svalue_equality): Delete.
9772 (selftest::test_region_equality): Delete.
9773 (selftest::test_unique_unknowns): New.
9774 (class purge_all_svalue_ids): Delete.
9775 (class purge_one_svalue_id): Delete.
9776 (selftest::test_purging_by_criteria): Delete.
9777 (selftest::test_initial_svalue_folding): New.
9778 (selftest::test_unaryop_svalue_folding): New.
9779 (selftest::test_binop_svalue_folding): New.
9780 (selftest::test_sub_svalue_folding): New.
9781 (selftest::test_purge_unused_svalues): Delete.
9782 (selftest::test_descendent_of_p): New.
9783 (selftest::test_assignment): Provide a region_model_manager for
9784 the region_model. Drop the dump test.
9785 (selftest::test_compound_assignment): Likewise.
9786 (selftest::test_stack_frames): Port to new implementation.
9787 (selftest::test_get_representative_path_var): Likewise.
9788 (selftest::test_canonicalization_1): Rename to...
9789 (selftest::test_equality_1): ...this. Port to new API, and add
9790 (selftest::test_canonicalization_2): Provide a
9791 region_model_manager when creating region_model instances.
9792 Remove redundant canicalization.
9793 (selftest::test_canonicalization_3): Provide a
9794 region_model_manager when creating region_model instances.
9795 Remove param from calls to region_model::canonicalize.
9796 (selftest::test_canonicalization_4): Likewise.
9797 (selftest::assert_region_models_merge): Constify
9798 out_merged_svalue. Port to new API.
9799 (selftest::test_state_merging): Provide a
9800 region_model_manager when creating region_model instances.
9801 Provide a program_point point when merging them. Replace
9802 set_to_new_unknown_value with usage of placeholder_svalues.
9803 Drop get_value_by_name. Port from svalue_id to const svalue *.
9804 Add test of heap allocation.
9805 (selftest::test_constraint_merging): Provide a
9806 region_model_manager when creating region_model instances.
9807 Provide a program_point point when merging them. Eliminate use
9808 of set_to_new_unknown_value.
9809 (selftest::test_widening_constraints): New.
9810 (selftest::test_iteration_1): New.
9811 (selftest::test_malloc_constraints): Port to store-based
9812 implementation.
9813 (selftest::test_var): New test.
9814 (selftest::test_array_2): New test.
9815 (selftest::test_mem_ref): New test.
9816 (selftest::test_POINTER_PLUS_EXPR_then_MEM_REF): New.
9817 (selftest::test_malloc): New.
9818 (selftest::test_alloca): New.
9819 (selftest::analyzer_region_model_cc_tests): Update for renamings.
9820 Call new functions.
9821 * region-model.h (class path_var): Move to analyzer.h.
9822 (class svalue_id): Delete.
9823 (class region_id): Delete.
9824 (class id_map): Delete.
9825 (svalue_id_map): Delete.
9826 (region_id_map): Delete.
9827 (id_map<T>::id_map): Delete.
9828 (id_map<T>::put): Delete.
9829 (id_map<T>::get_dst_for_src): Delete.
9830 (id_map<T>::get_src_for_dst): Delete.
9831 (id_map<T>::dump_to_pp): Delete.
9832 (id_map<T>::dump): Delete.
9833 (id_map<T>::update): Delete.
9834 (one_way_svalue_id_map): Delete.
9835 (one_way_region_id_map): Delete.
9836 (class region_id_set): Delete.
9837 (class svalue_id_set): Delete.
9838 (struct complexity): New.
9839 (class visitor): New.
9840 (enum svalue_kind): Add SK_SETJMP, SK_INITIAL, SK_UNARYOP,
9841 SK_BINOP, SK_SUB,SK_UNMERGEABLE, SK_PLACEHOLDER, SK_WIDENING,
9842 SK_COMPOUND, and SK_CONJURED.
9843 (svalue::operator==): Delete.
9844 (svalue::operator!=): Delete.
9845 (svalue::clone): Delete.
9846 (svalue::hash): Delete.
9847 (svalue::dump_dot_to_pp): Delete.
9848 (svalue::dump_to_pp): New.
9849 (svalue::dump): New.
9850 (svalue::get_desc): New.
9851 (svalue::dyn_cast_initial_svalue): New.
9852 (svalue::dyn_cast_unaryop_svalue): New.
9853 (svalue::dyn_cast_binop_svalue): New.
9854 (svalue::dyn_cast_sub_svalue): New.
9855 (svalue::dyn_cast_unmergeable_svalue): New.
9856 (svalue::dyn_cast_widening_svalue): New.
9857 (svalue::dyn_cast_compound_svalue): New.
9858 (svalue::dyn_cast_conjured_svalue): New.
9859 (svalue::maybe_undo_cast): New.
9860 (svalue::unwrap_any_unmergeable): New.
9861 (svalue::remap_region_ids): Delete
9862 (svalue::can_merge_p): New.
9863 (svalue::walk_for_canonicalization): Delete
9864 (svalue::get_complexity): New.
9865 (svalue::get_child_sid): Delete
9866 (svalue::accept): New.
9867 (svalue::live_p): New.
9868 (svalue::implicitly_live_p): New.
9869 (svalue::svalue): Add complexity param.
9870 (svalue::add_to_hash): Delete
9871 (svalue::print_details): Delete
9872 (svalue::m_complexity): New field.
9873 (region_svalue::key_t): New struct.
9874 (region_svalue::region_svalue): Port from region_id to
9875 const region_id *. Add complexity.
9876 (region_svalue::compare_fields): Delete.
9877 (region_svalue::clone): Delete.
9878 (region_svalue::dump_dot_to_pp): Delete.
9879 (region_svalue::get_pointee): Port from region_id to
9880 const region_id *.
9881 (region_svalue::remap_region_ids): Delete.
9882 (region_svalue::merge_values): Delete.
9883 (region_svalue::dump_to_pp): New.
9884 (region_svalue::accept): New.
9885 (region_svalue::walk_for_canonicalization): Delete.
9886 (region_svalue::eval_condition): Make params const.
9887 (region_svalue::add_to_hash): Delete.
9888 (region_svalue::print_details): Delete.
9889 (region_svalue::m_rid): Replace with...
9890 (region_svalue::m_reg): ...this.
9891 (is_a_helper <region_svalue *>::test): Convert to...
9892 (is_a_helper <const region_svalue *>::test): ...this.
9893 (template <> struct default_hash_traits<region_svalue::key_t>):
9894 New.
9895 (constant_svalue::constant_svalue): Add complexity.
9896 (constant_svalue::compare_fields): Delete.
9897 (constant_svalue::clone): Delete.
9898 (constant_svalue::add_to_hash): Delete.
9899 (constant_svalue::dump_to_pp): New.
9900 (constant_svalue::accept): New.
9901 (constant_svalue::implicitly_live_p): New.
9902 (constant_svalue::merge_values): Delete.
9903 (constant_svalue::eval_condition): Make params const.
9904 (constant_svalue::get_child_sid): Delete.
9905 (constant_svalue::print_details): Delete.
9906 (is_a_helper <constant_svalue *>::test): Convert to...
9907 (is_a_helper <const constant_svalue *>::test): ...this.
9908 (class unknown_svalue): Update leading comment.
9909 (unknown_svalue::unknown_svalue): Add complexity.
9910 (unknown_svalue::compare_fields): Delete.
9911 (unknown_svalue::add_to_hash): Delete.
9912 (unknown_svalue::dyn_cast_unknown_svalue): Delete.
9913 (unknown_svalue::print_details): Delete.
9914 (unknown_svalue::dump_to_pp): New.
9915 (unknown_svalue::accept): New.
9916 (poisoned_svalue::key_t): New struct.
9917 (poisoned_svalue::poisoned_svalue): Add complexity.
9918 (poisoned_svalue::compare_fields): Delete.
9919 (poisoned_svalue::clone): Delete.
9920 (poisoned_svalue::add_to_hash): Delete.
9921 (poisoned_svalue::dump_to_pp): New.
9922 (poisoned_svalue::accept): New.
9923 (poisoned_svalue::print_details): Delete.
9924 (is_a_helper <poisoned_svalue *>::test): Convert to...
9925 (is_a_helper <const poisoned_svalue *>::test): ...this.
9926 (template <> struct default_hash_traits<poisoned_svalue::key_t>):
9927 New.
9928 (setjmp_record::add_to_hash): New.
9929 (setjmp_svalue::key_t): New struct.
9930 (setjmp_svalue::compare_fields): Delete.
9931 (setjmp_svalue::clone): Delete.
9932 (setjmp_svalue::add_to_hash): Delete.
9933 (setjmp_svalue::setjmp_svalue): Add complexity.
9934 (setjmp_svalue::dump_to_pp): New.
9935 (setjmp_svalue::accept): New.
9936 (setjmp_svalue::void print_details): Delete.
9937 (is_a_helper <const setjmp_svalue *>::test): New.
9938 (template <> struct default_hash_traits<setjmp_svalue::key_t>): New.
9939 (class initial_svalue : public svalue): New.
9940 (is_a_helper <const initial_svalue *>::test): New.
9941 (class unaryop_svalue): New.
9942 (is_a_helper <const unaryop_svalue *>::test): New.
9943 (template <> struct default_hash_traits<unaryop_svalue::key_t>): New.
9944 (class binop_svalue): New.
9945 (is_a_helper <const binop_svalue *>::test): New.
9946 (template <> struct default_hash_traits<binop_svalue::key_t>): New.
9947 (class sub_svalue): New.
9948 (is_a_helper <const sub_svalue *>::test): New.
9949 (template <> struct default_hash_traits<sub_svalue::key_t>): New.
9950 (class unmergeable_svalue): New.
9951 (is_a_helper <const unmergeable_svalue *>::test): New.
9952 (class placeholder_svalue): New.
9953 (is_a_helper <placeholder_svalue *>::test): New.
9954 (class widening_svalue): New.
9955 (is_a_helper <widening_svalue *>::test): New.
9956 (template <> struct default_hash_traits<widening_svalue::key_t>): New.
9957 (class compound_svalue): New.
9958 (is_a_helper <compound_svalue *>::test): New.
9959 (template <> struct default_hash_traits<compound_svalue::key_t>): New.
9960 (class conjured_svalue): New.
9961 (is_a_helper <conjured_svalue *>::test): New.
9962 (template <> struct default_hash_traits<conjured_svalue::key_t>): New.
9963 (enum region_kind): Delete RK_PRIMITIVE, RK_STRUCT, RK_UNION, and
9964 RK_ARRAY. Add RK_LABEL, RK_DECL, RK_FIELD, RK_ELEMENT, RK_OFFSET,
9965 RK_CAST, RK_HEAP_ALLOCATED, RK_ALLOCA, RK_STRING, and RK_UNKNOWN.
9966 (region_kind_to_str): Delete.
9967 (region::~region): Move implementation to region.cc.
9968 (region::operator==): Delete.
9969 (region::operator!=): Delete.
9970 (region::clone): Delete.
9971 (region::get_id): New.
9972 (region::cmp_ids): New.
9973 (region::dyn_cast_map_region): Delete.
9974 (region::dyn_cast_array_region): Delete.
9975 (region::region_id get_parent): Delete.
9976 (region::get_parent_region): Convert to a simple accessor.
9977 (region::void set_value): Delete.
9978 (region::svalue_id get_value): Delete.
9979 (region::svalue_id get_value_direct): Delete.
9980 (region::svalue_id get_inherited_child_sid): Delete.
9981 (region::dyn_cast_frame_region): New.
9982 (region::dyn_cast_function_region): New.
9983 (region::dyn_cast_decl_region): New.
9984 (region::dyn_cast_field_region): New.
9985 (region::dyn_cast_element_region): New.
9986 (region::dyn_cast_offset_region): New.
9987 (region::dyn_cast_cast_region): New.
9988 (region::dyn_cast_string_region): New.
9989 (region::accept): New.
9990 (region::get_base_region): New.
9991 (region::base_region_p): New.
9992 (region::descendent_of_p): New.
9993 (region::maybe_get_frame_region): New.
9994 (region::maybe_get_decl): New.
9995 (region::hash): Delete.
9996 (region::rint): Delete.
9997 (region::dump_dot_to_pp): Delete.
9998 (region::get_desc): New.
9999 (region::dump_to_pp): Convert to vfunc, changing signature.
10000 (region::dump_child_label): Delete.
10001 (region::remap_svalue_ids): Delete.
10002 (region::remap_region_ids): Delete.
10003 (region::dump): New.
10004 (region::walk_for_canonicalization): Delete.
10005 (region::non_null_p): Drop region_model param.
10006 (region::add_view): Delete.
10007 (region::get_view): Delete.
10008 (region::get_active_view): Delete.
10009 (region::is_view_p): Delete.
10010 (region::cmp_ptrs): New.
10011 (region::validate): Delete.
10012 (region::get_offset): New.
10013 (region::get_byte_size): New.
10014 (region::get_bit_size): New.
10015 (region::get_subregions_for_binding): New.
10016 (region::region): Add complexity param. Convert parent from
10017 region_id to const region *. Drop svalue_id. Drop copy ctor.
10018 (region::symbolic_for_unknown_ptr_p): New.
10019 (region::add_to_hash): Delete.
10020 (region::print_fields): Delete.
10021 (region::get_complexity): New accessor.
10022 (region::become_active_view): Delete.
10023 (region::deactivate_any_active_view): Delete.
10024 (region::deactivate_view): Delete.
10025 (region::calc_offset): New.
10026 (region::m_parent_rid): Delete.
10027 (region::m_sval_id): Delete.
10028 (region::m_complexity): New.
10029 (region::m_id): New.
10030 (region::m_parent): New.
10031 (region::m_view_rids): Delete.
10032 (region::m_is_view): Delete.
10033 (region::m_active_view_rid): Delete.
10034 (region::m_cached_offset): New.
10035 (is_a_helper <region *>::test): Convert to...
10036 (is_a_helper <const region *>::test): ... this.
10037 (class primitive_region): Delete.
10038 (class space_region): New.
10039 (class map_region): Delete.
10040 (is_a_helper <map_region *>::test): Delete.
10041 (class frame_region): Reimplement.
10042 (template <> struct default_hash_traits<frame_region::key_t>):
10043 New.
10044 (class globals_region): Reimplement.
10045 (is_a_helper <globals_region *>::test): Convert to...
10046 (is_a_helper <const globals_region *>::test): ...this.
10047 (class struct_or_union_region): Delete.
10048 (is_a_helper <struct_or_union_region *>::test): Delete.
10049 (class code_region): Reimplement.
10050 (is_a_helper <const code_region *>::test): New.
10051 (class struct_region): Delete.
10052 (is_a_helper <struct_region *>::test): Delete.
10053 (class function_region): Reimplement.
10054 (is_a_helper <function_region *>::test): Convert to...
10055 (is_a_helper <const function_region *>::test): ...this.
10056 (class union_region): Delete.
10057 (is_a_helper <union_region *>::test): Delete.
10058 (class label_region): New.
10059 (is_a_helper <const label_region *>::test): New.
10060 (class scope_region): Delete.
10061 (class stack_region): Reimplement.
10062 (is_a_helper <stack_region *>::test): Convert to...
10063 (is_a_helper <const stack_region *>::test): ...this.
10064 (class heap_region): Reimplement.
10065 (is_a_helper <heap_region *>::test): Convert to...
10066 (is_a_helper <const heap_region *>::test): ...this.
10067 (class root_region): Reimplement.
10068 (is_a_helper <root_region *>::test): Convert to...
10069 (is_a_helper <const root_region *>::test): ...this.
10070 (class symbolic_region): Reimplement.
10071 (is_a_helper <const symbolic_region *>::test): New.
10072 (template <> struct default_hash_traits<symbolic_region::key_t>):
10073 New.
10074 (class decl_region): New.
10075 (is_a_helper <const decl_region *>::test): New.
10076 (class field_region): New.
10077 (template <> struct default_hash_traits<field_region::key_t>): New.
10078 (class array_region): Delete.
10079 (class element_region): New.
10080 (is_a_helper <array_region *>::test): Delete.
10081 (is_a_helper <const element_region *>::test): New.
10082 (template <> struct default_hash_traits<element_region::key_t>):
10083 New.
10084 (class offset_region): New.
10085 (is_a_helper <const offset_region *>::test): New.
10086 (template <> struct default_hash_traits<offset_region::key_t>):
10087 New.
10088 (class cast_region): New.
10089 (is_a_helper <const cast_region *>::test): New.
10090 (template <> struct default_hash_traits<cast_region::key_t>): New.
10091 (class heap_allocated_region): New.
10092 (class alloca_region): New.
10093 (class string_region): New.
10094 (is_a_helper <const string_region *>::test): New.
10095 (class unknown_region): New.
10096 (class region_model_manager): New.
10097 (struct append_ssa_names_cb_data): New.
10098 (class call_details): New.
10099 (region_model::region_model): Add region_model_manager param.
10100 (region_model::print_svalue): Delete.
10101 (region_model::dump_dot_to_pp): Delete.
10102 (region_model::dump_dot_to_file): Delete.
10103 (region_model::dump_dot): Delete.
10104 (region_model::dump_to_pp): Drop summarize param in favor of
10105 simple and multiline.
10106 (region_model::dump): Likewise.
10107 (region_model::summarize_to_pp): Delete.
10108 (region_model::summarize): Delete.
10109 (region_model::void canonicalize): Drop ctxt param.
10110 (region_model::void check_for_poison): Delete.
10111 (region_model::get_gassign_result): New.
10112 (region_model::impl_call_alloca): New.
10113 (region_model::impl_call_analyzer_describe): New.
10114 (region_model::impl_call_analyzer_eval): New.
10115 (region_model::impl_call_builtin_expect): New.
10116 (region_model::impl_call_calloc): New.
10117 (region_model::impl_call_free): New.
10118 (region_model::impl_call_malloc): New.
10119 (region_model::impl_call_memset): New.
10120 (region_model::impl_call_strlen): New.
10121 (region_model::get_reachable_svalues): New.
10122 (region_model::handle_phi): Drop is_back_edge param.
10123 (region_model::region_id get_root_rid): Delete.
10124 (region_model::root_region *get_root_region): Delete.
10125 (region_model::region_id get_stack_region_id): Delete.
10126 (region_model::push_frame): Convert from region_id and svalue_id
10127 to const region * and const svalue *.
10128 (region_model::get_current_frame_id): Replace with...
10129 (region_model::get_current_frame): ...this.
10130 (region_model::pop_frame): Convert from region_id to
10131 const region *. Drop purge and stats param. Add out_result.
10132 (region_model::function *get_function_at_depth): Delete.
10133 (region_model::get_globals_region_id): Delete.
10134 (region_model::add_svalue): Delete.
10135 (region_model::replace_svalue): Delete.
10136 (region_model::add_region): Delete.
10137 (region_model::add_region_for_type): Delete.
10138 (region_model::get_svalue): Delete.
10139 (region_model::get_region): Delete.
10140 (region_model::get_lvalue): Convert from region_id to
10141 const region *.
10142 (region_model::get_rvalue): Convert from svalue_id to
10143 const svalue *.
10144 (region_model::get_or_create_ptr_svalue): Delete.
10145 (region_model::get_or_create_constant_svalue): Delete.
10146 (region_model::get_svalue_for_fndecl): Delete.
10147 (region_model::get_svalue_for_label): Delete.
10148 (region_model::get_region_for_fndecl): Delete.
10149 (region_model::get_region_for_label): Delete.
10150 (region_model::get_frame_at_index (int index) const;): New.
10151 (region_model::maybe_cast): Delete.
10152 (region_model::maybe_cast_1): Delete.
10153 (region_model::get_field_region): Delete.
10154 (region_model::id deref_rvalue): Convert from region_id and
10155 svalue_id to const region * and const svalue *. Drop overload,
10156 passing in both a tree and an svalue.
10157 (region_model::set_value): Convert from region_id and svalue_id to
10158 const region * and const svalue *.
10159 (region_model::set_to_new_unknown_value): Delete.
10160 (region_model::clobber_region (const region *reg);): New.
10161 (region_model::purge_region (const region *reg);): New.
10162 (region_model::zero_fill_region (const region *reg);): New.
10163 (region_model::mark_region_as_unknown (const region *reg);): New.
10164 (region_model::copy_region): Convert from region_id to
10165 const region *.
10166 (region_model::eval_condition): Convert from svalue_id to
10167 const svalue *.
10168 (region_model::eval_condition_without_cm): Likewise.
10169 (region_model::compare_initial_and_pointer): New.
10170 (region_model:maybe_get_constant): Delete.
10171 (region_model::add_new_malloc_region): Delete.
10172 (region_model::get_representative_tree): Convert from svalue_id to
10173 const svalue *.
10174 (region_model::get_representative_path_var): Delete decl taking a
10175 region_id in favor of two decls, for svalue vs region, with an
10176 svalue_set to ensure termination.
10177 (region_model::get_path_vars_for_svalue): Delete.
10178 (region_model::create_region_for_heap_alloc): New.
10179 (region_model::create_region_for_alloca): New.
10180 (region_model::purge_unused_svalues): Delete.
10181 (region_model::remap_svalue_ids): Delete.
10182 (region_model::remap_region_ids): Delete.
10183 (region_model::purge_regions): Delete.
10184 (region_model::get_num_svalues): Delete.
10185 (region_model::get_num_regions): Delete.
10186 (region_model::get_descendents): Delete.
10187 (region_model::get_store): New.
10188 (region_model::delete_region_and_descendents): Delete.
10189 (region_model::get_manager): New.
10190 (region_model::unbind_region_and_descendents): New.
10191 (region_model::can_merge_with_p): Add point param. Drop
10192 svalue_id_merger_mapping.
10193 (region_model::get_value_by_name): Delete.
10194 (region_model::convert_byte_offset_to_array_index): Delete.
10195 (region_model::get_or_create_mem_ref): Delete.
10196 (region_model::get_or_create_pointer_plus_expr): Delete.
10197 (region_model::get_or_create_view): Delete.
10198 (region_model::get_lvalue_1): Convert from region_id to
10199 const region *.
10200 (region_model::get_rvalue_1): Convert from svalue_id to
10201 const svalue *.
10202 (region_model::get_ssa_name_regions_for_current_frame): New.
10203 (region_model::append_ssa_names_cb): New.
10204 (region_model::get_store_value): New.
10205 (region_model::copy_struct_region): Delete.
10206 (region_model::copy_union_region): Delete.
10207 (region_model::copy_array_region): Delete.
10208 (region_model::region_exists_p): New.
10209 (region_model::make_region_for_unexpected_tree_code): Delete.
10210 (region_model::loop_replay_fixup): New.
10211 (region_model::poison_any_pointers_to_bad_regions): Delete.
10212 (region_model::poison_any_pointers_to_descendents): New.
10213 (region_model::dump_summary_of_rep_path_vars): Delete.
10214 (region_model::on_top_level_param): New.
10215 (region_model::record_dynamic_extents): New.
10216 (region_model::m_mgr;): New.
10217 (region_model::m_store;): New.
10218 (region_model::m_svalues;): Delete.
10219 (region_model::m_regions;): Delete.
10220 (region_model::m_root_rid;): Delete.
10221 (region_model::m_current_frame;): New.
10222 (region_model_context::remap_svalue_ids): Delete.
10223 (region_model_context::can_purge_p): Delete.
10224 (region_model_context::on_svalue_leak): New.
10225 (region_model_context::on_svalue_purge): Delete.
10226 (region_model_context::on_liveness_change): New.
10227 (region_model_context::on_inherited_svalue): Delete.
10228 (region_model_context::on_cast): Delete.
10229 (region_model_context::on_unknown_change): Convert from svalue_id to
10230 const svalue * and add is_mutable.
10231 (class noop_region_model_context): Update for region_model_context
10232 changes.
10233 (model_merger::model_merger): Add program_point. Drop
10234 svalue_id_merger_mapping.
10235 (model_merger::dump_to_pp): Add "simple" param.
10236 (model_merger::dump): Likewise.
10237 (model_merger::get_region_a): Delete.
10238 (model_merger::get_region_b): Delete.
10239 (model_merger::can_merge_values_p): Delete.
10240 (model_merger::record_regions): Delete.
10241 (model_merger::record_svalues): Delete.
10242 (model_merger::m_point): New field.
10243 (model_merger::m_map_regions_from_a_to_m): Delete.
10244 (model_merger::m_map_regions_from_b_to_m): Delete.
10245 (model_merger::m_sid_mapping): Delete.
10246 (struct svalue_id_merger_mapping): Delete.
10247 (class engine): New.
10248 (struct canonicalization): Delete.
10249 (inchash::add): Delete decls for hashing svalue_id and region_id.
10250 (test_region_model_context::on_unexpected_tree_code): Require t to
10251 be non-NULL.
10252 (selftest::assert_condition): Add overload comparing a pair of
10253 const svalue *.
10254 * sm-file.cc: Include "tristate.h", "selftest.h",
10255 "analyzer/call-string.h", "analyzer/program-point.h",
10256 "analyzer/store.h", and "analyzer/region-model.h".
10257 (fileptr_state_machine::get_default_state): New.
10258 (fileptr_state_machine::on_stmt): Remove calls to
10259 get_readable_tree in favor of get_diagnostic_tree.
10260 * sm-malloc.cc: Include "tristate.h", "selftest.h",
10261 "analyzer/call-string.h", "analyzer/program-point.h",
10262 "analyzer/store.h", and "analyzer/region-model.h".
10263 (malloc_state_machine::get_default_state): New.
10264 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New.
10265 (malloc_diagnostic::describe_state_change): Handle change.m_expr
10266 being NULL.
10267 (null_arg::emit): Avoid printing "NULL '0'".
10268 (null_arg::describe_final_event): Avoid printing "(0) NULL".
10269 (malloc_leak::emit): Handle m_arg being NULL.
10270 (malloc_leak::describe_final_event): Handle ev.m_expr being NULL.
10271 (malloc_state_machine::on_stmt): Don't call get_readable_tree.
10272 Call get_diagnostic_tree when creating pending diagnostics.
10273 Update for is_zero_assignment becoming a member function of
10274 sm_ctxt.
10275 Don't transition to m_non_heap for ADDR_EXPR(MEM_REF()).
10276 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New
10277 vfunc implementation.
10278 * sm-sensitive.cc (sensitive_state_machine::warn_for_any_exposure): Call
10279 get_diagnostic_tree and pass the result to warn_for_state.
10280 * sm-signal.cc: Move includes of "analyzer/call-string.h" and
10281 "analyzer/program-point.h" to before "analyzer/region-model.h",
10282 and also include "analyzer/store.h" before it.
10283 (signal_unsafe_call::describe_state_change): Use
10284 get_dest_function to get handler.
10285 (update_model_for_signal_handler): Pass manager to region_model
10286 ctor.
10287 (register_signal_handler::impl_transition): Update for changes to
10288 get_or_create_node and add_edge.
10289 * sm-taint.cc (taint_state_machine::on_stmt): Remove calls to
10290 get_readable_tree, replacing them when calling warn_for_state with
10291 calls to get_diagnostic_tree.
10292 * sm.cc (is_zero_assignment): Delete.
10293 (any_pointer_p): Move to within namespace ana.
10294 * sm.h (is_zero_assignment): Remove decl.
10295 (any_pointer_p): Move decl to within namespace ana.
10296 (state_machine::get_default_state): New vfunc.
10297 (state_machine::reset_when_passed_to_unknown_fn_p): New vfunc.
10298 (sm_context::get_readable_tree): Rename to...
10299 (sm_context::get_diagnostic_tree): ...this.
10300 (sm_context::is_zero_assignment): New vfunc.
10301 * store.cc: New file.
10302 * store.h: New file.
10303 * svalue.cc: New file.
10305 2020-05-22 Mark Wielaard <mark@klomp.org>
10307 * sm-signal.cc(signal_unsafe_call::emit): Possibly add
10308 gcc_rich_location note for replacement.
10309 (signal_unsafe_call::get_replacement_fn): New private function.
10310 (get_async_signal_unsafe_fns): Add "exit".
10312 2020-04-28 David Malcolm <dmalcolm@redhat.com>
10314 PR analyzer/94816
10315 * engine.cc (impl_region_model_context::on_unexpected_tree_code):
10316 Handle NULL tree.
10317 * region-model.cc (region_model::add_region_for_type): Handle
10318 NULL type.
10319 * region-model.h
10320 (test_region_model_context::on_unexpected_tree_code): Handle NULL
10321 tree.
10323 2020-04-28 David Malcolm <dmalcolm@redhat.com>
10325 PR analyzer/94447
10326 PR analyzer/94639
10327 PR analyzer/94732
10328 PR analyzer/94754
10329 * analyzer.opt (Wanalyzer-use-of-uninitialized-value): Delete.
10330 * program-state.cc (selftest::test_program_state_dumping): Update
10331 expected dump result for removal of "uninit".
10332 * region-model.cc (poison_kind_to_str): Delete POISON_KIND_UNINIT
10333 case.
10334 (root_region::ensure_stack_region): Initialize stack with null
10335 svalue_id rather than with a typeless POISON_KIND_UNINIT value.
10336 (root_region::ensure_heap_region): Likewise for the heap.
10337 (region_model::dump_summary_of_rep_path_vars): Remove
10338 summarization of uninit values.
10339 (region_model::validate): Remove check that the stack has a
10340 POISON_KIND_UNINIT value.
10341 (poisoned_value_diagnostic::emit): Remove POISON_KIND_UNINIT
10342 case.
10343 (poisoned_value_diagnostic::describe_final_event): Likewise.
10344 (selftest::test_dump): Update expected dump result for removal of
10345 "uninit".
10346 (selftest::test_svalue_equality): Remove "uninit" and "freed".
10347 * region-model.h (enum poison_kind): Remove POISON_KIND_UNINIT.
10349 2020-04-01 David Malcolm <dmalcolm@redhat.com>
10351 PR analyzer/94378
10352 * checker-path.cc: Include "bitmap.h".
10353 * constraint-manager.cc: Likewise.
10354 * diagnostic-manager.cc: Likewise.
10355 * engine.cc: Likewise.
10356 (exploded_node::detect_leaks): Pass null region_id to pop_frame.
10357 * program-point.cc: Include "bitmap.h".
10358 * program-state.cc: Likewise.
10359 * region-model.cc (id_set<region_id>::id_set): Convert to...
10360 (region_id_set::region_id_set): ...this.
10361 (svalue_id_set::svalue_id_set): New ctor.
10362 (region_model::copy_region): New function.
10363 (region_model::copy_struct_region): New function.
10364 (region_model::copy_union_region): New function.
10365 (region_model::copy_array_region): New function.
10366 (stack_region::pop_frame): Drop return value. Add
10367 "result_dst_rid" param; if it is non-null, use copy_region to copy
10368 the result to it. Rather than capture and pass a single "known
10369 used" return value to be used by purge_unused_values, instead
10370 gather and pass a set of known used return values.
10371 (root_region::pop_frame): Drop return value. Add "result_dst_rid"
10372 param.
10373 (region_model::on_assignment): Use copy_region.
10374 (region_model::on_return): Likewise for the result.
10375 (region_model::on_longjmp): Pass null for pop_frame's
10376 result_dst_rid.
10377 (region_model::update_for_return_superedge): Pass the region for the
10378 return value of the call, if any, to pop_frame, rather than setting
10379 the lvalue for the lhs of the result.
10380 (region_model::pop_frame): Drop return value. Add
10381 "result_dst_rid" param.
10382 (region_model::purge_unused_svalues): Convert third param from an
10383 svalue_id * to an svalue_id_set *, updating the initial populating
10384 of the "used" bitmap accordingly. Don't remap it when done.
10385 (struct selftest::coord_test): New selftest fixture, extracted from...
10386 (selftest::test_dump_2): ...here.
10387 (selftest::test_compound_assignment): New selftest.
10388 (selftest::test_stack_frames): Pass null to new param of pop_frame.
10389 (selftest::analyzer_region_model_cc_tests): Call the new selftest.
10390 * region-model.h (class id_set): Delete template.
10391 (class region_id_set): Reimplement, using old id_set implementation.
10392 (class svalue_id_set): Likewise. Convert from auto_sbitmap to
10393 auto_bitmap.
10394 (region::get_active_view): New accessor.
10395 (stack_region::pop_frame): Drop return value. Add
10396 "result_dst_rid" param.
10397 (root_region::pop_frame): Likewise.
10398 (region_model::pop_frame): Likewise.
10399 (region_model::copy_region): New decl.
10400 (region_model::purge_unused_svalues): Convert third param from an
10401 svalue_id * to an svalue_id_set *.
10402 (region_model::copy_struct_region): New decl.
10403 (region_model::copy_union_region): New decl.
10404 (region_model::copy_array_region): New decl.
10406 2020-03-27 David Malcolm <dmalcolm@redhat.com>
10408 * program-state.cc (selftest::test_program_state_dumping): Update
10409 expected dump to include symbolic_region's possibly_null field.
10410 * region-model.cc (symbolic_region::print_fields): New vfunc
10411 implementation.
10412 (region_model::add_constraint): Clear m_possibly_null from
10413 symbolic_regions now known to be non-NULL.
10414 (selftest::test_malloc_constraints): New selftest.
10415 (selftest::analyzer_region_model_cc_tests): Call it.
10416 * region-model.h (region::dyn_cast_symbolic_region): Add non-const
10417 overload.
10418 (symbolic_region::dyn_cast_symbolic_region): Implement it.
10419 (symbolic_region::print_fields): New vfunc override decl.
10421 2020-03-27 David Malcolm <dmalcolm@redhat.com>
10423 * analyzer.h (class feasibility_problem): New forward decl.
10424 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
10425 Initialize new fields m_status, m_epath_length, and m_problem.
10426 (saved_diagnostic::~saved_diagnostic): Delete m_problem.
10427 (dedupe_candidate::dedupe_candidate): Convert "sd" param from a
10428 const ref to a mutable ptr.
10429 (dedupe_winners::add): Convert "sd" param from a const ref to a
10430 mutable ptr. Record the length of the exploded_path. Record the
10431 feasibility/infeasibility of sd into sd, capturing a
10432 feasibility_problem when feasible_p fails, and storing it in sd.
10433 (diagnostic_manager::emit_saved_diagnostics): Update for pass by
10434 ptr rather than by const ref.
10435 * diagnostic-manager.h (class saved_diagnostic): Add new enum
10436 status. Add fields m_status, m_epath_length and m_problem.
10437 (saved_diagnostic::set_feasible): New member function.
10438 (saved_diagnostic::set_infeasible): New member function.
10439 (saved_diagnostic::get_feasibility_problem): New accessor.
10440 (saved_diagnostic::get_status): New accessor.
10441 (saved_diagnostic::set_epath_length): New member function.
10442 (saved_diagnostic::get_epath_length): New accessor.
10443 * engine.cc: Include "gimple-pretty-print.h".
10444 (exploded_path::feasible_p): Add OUT param and, if non-NULL, write
10445 a new feasibility_problem to it on failure.
10446 (viz_callgraph_node::dump_dot): Convert begin_tr calls to
10447 begin_trtd. Convert end_tr calls to end_tdtr.
10448 (class exploded_graph_annotator): New subclass of dot_annotator.
10449 (impl_run_checkers): Add a second -fdump-analyzer-supergraph dump
10450 after the analysis runs, using exploded_graph_annotator. dumping
10451 to DUMP_BASE_NAME.supergraph-eg.dot.
10452 * exploded-graph.h (exploded_node::get_dot_fillcolor): Make
10453 public.
10454 (exploded_path::feasible_p): Add OUT param.
10455 (class feasibility_problem): New class.
10456 * state-purge.cc (state_purge_annotator::add_node_annotations):
10457 Return a bool, add a "within_table" param.
10458 (print_vec_of_names): Convert begin_tr calls to begin_trtd.
10459 Convert end_tr calls to end_tdtr.
10460 (state_purge_annotator::add_stmt_annotations): Add "within_row"
10461 param.
10462 * state-purge.h ((state_purge_annotator::add_node_annotations):
10463 Return a bool, add a "within_table" param.
10464 (state_purge_annotator::add_stmt_annotations): Add "within_row"
10465 param.
10466 * supergraph.cc (supernode::dump_dot): Call add_node_annotations
10467 twice: as before, passing false for "within_table", then again
10468 with true when within the TABLE element. Convert some begin_tr
10469 calls to begin_trtd, and some end_tr calls to end_tdtr.
10470 Repeat each add_stmt_annotations call, distinguishing between
10471 calls that add TRs and those that add TDs to an existing TR.
10472 Add a call to add_after_node_annotations.
10473 * supergraph.h (dot_annotator::add_node_annotations): Add a
10474 "within_table" param.
10475 (dot_annotator::add_stmt_annotations): Add a "within_row" param.
10476 (dot_annotator::add_after_node_annotations): New vfunc.
10478 2020-03-27 David Malcolm <dmalcolm@redhat.com>
10480 * diagnostic-manager.cc (dedupe_winners::add): Show the
10481 exploded_node index in the log messages.
10482 (diagnostic_manager::emit_saved_diagnostics): Log a summary of
10483 m_saved_diagnostics at entry.
10485 2020-03-27 David Malcolm <dmalcolm@redhat.com>
10487 * supergraph.cc (superedge::dump): Add space before description;
10488 move newline to non-pretty_printer overload.
10490 2020-03-18 David Malcolm <dmalcolm@redhat.com>
10492 * region-model.cc: Include "stor-layout.h".
10493 (region_model::dump_to_pp): Rather than calling
10494 dump_summary_of_map on each of the current frame and the globals,
10495 instead get a vec of representative path_vars for all regions,
10496 and then dump a summary of all of them.
10497 (region_model::dump_summary_of_map): Delete, rewriting into...
10498 (region_model::dump_summary_of_rep_path_vars): ...this new
10499 function, working on a vec of path_vars.
10500 (region_model::set_value): New overload.
10501 (region_model::get_representative_path_var): Rename
10502 "parent_region" local to "parent_reg" and consolidate with other
10503 local. Guard test for grandparent being stack on parent_reg being
10504 non-NULL. Move handling for parent being an array_region to
10505 within guard for parent_reg being non-NULL.
10506 (selftest::make_test_compound_type): New function.
10507 (selftest::test_dump_2): New selftest.
10508 (selftest::test_dump_3): New selftest.
10509 (selftest::test_stack_frames): Update expected output from
10510 simplified dump to show "a" and "b" from parent frame and "y" in
10511 child frame.
10512 (selftest::analyzer_region_model_cc_tests): Call test_dump_2 and
10513 test_dump_3.
10514 * region-model.h (region_model::set_value): New overload decl.
10515 (region_model::dump_summary_of_map): Delete.
10516 (region_model::dump_summary_of_rep_path_vars): New.
10518 2020-03-18 David Malcolm <dmalcolm@redhat.com>
10520 * region-model.h (class noop_region_model_context): New subclass
10521 of region_model_context.
10522 (class tentative_region_model_context): Inherit from
10523 noop_region_model_context rather than from region_model_context;
10524 drop redundant vfunc implementations.
10525 (class test_region_model_context): Likewise.
10527 2020-03-18 David Malcolm <dmalcolm@redhat.com>
10529 * engine.cc (exploded_node::exploded_node): Move implementation
10530 here from header; accept point_and_state by const reference rather
10531 than by value.
10532 * exploded-graph.h (exploded_node::exploded_node): Pass
10533 point_and_state by const reference rather than by value. Move
10534 body to engine.cc.
10536 2020-03-18 Jakub Jelinek <jakub@redhat.com>
10538 * sm-malloc.cc (malloc_state_machine::on_stmt): Fix up duplicated word
10539 issue in a comment.
10540 * region-model.cc (region_model::make_region_for_unexpected_tree_code,
10541 region_model::delete_region_and_descendents): Likewise.
10542 * engine.cc (class exploded_cluster): Likewise.
10543 * diagnostic-manager.cc (class path_builder): Likewise.
10545 2020-03-13 David Malcolm <dmalcolm@redhat.com>
10547 PR analyzer/94099
10548 PR analyzer/94105
10549 * diagnostic-manager.cc (for_each_state_change): Bulletproof
10550 against errors in get_rvalue by passing a
10551 tentative_region_model_context and rejecting if there's an error.
10552 * region-model.cc (region_model::get_lvalue_1): When handling
10553 ARRAY_REF, handle results of error-handling. Handle NOP_EXPR.
10555 2020-03-06 David Malcolm <dmalcolm@redhat.com>
10557 * analyzer.h (class array_region): New forward decl.
10558 * program-state.cc (selftest::test_program_state_dumping_2): New.
10559 (selftest::analyzer_program_state_cc_tests): Call it.
10560 * region-model.cc (array_region::constant_from_key): New.
10561 (region_model::get_representative_tree): Handle region_svalue by
10562 generating an ADDR_EXPR.
10563 (region_model::get_representative_path_var): In view handling,
10564 remove erroneous TREE_TYPE when determining the type of the tree.
10565 Handle array regions and STRING_CST.
10566 (selftest::assert_dump_tree_eq): New.
10567 (ASSERT_DUMP_TREE_EQ): New macro.
10568 (selftest::test_get_representative_tree): New selftest.
10569 (selftest::analyzer_region_model_cc_tests): Call it.
10570 * region-model.h (region::dyn_cast_array_region): New vfunc.
10571 (array_region::dyn_cast_array_region): New vfunc implementation.
10572 (array_region::constant_from_key): New decl.
10574 2020-03-06 David Malcolm <dmalcolm@redhat.com>
10576 * analyzer.h (dump_quoted_tree): New decl.
10577 * engine.cc (exploded_node::dump_dot): Pass region model to
10578 sm_state_map::print.
10579 * program-state.cc: Include diagnostic-core.h.
10580 (sm_state_map::print): Add "model" param and use it to print
10581 representative trees. Only print origin information if non-null.
10582 (sm_state_map::dump): Pass NULL for model to print call.
10583 (program_state::print): Pass region model to sm_state_map::print.
10584 (program_state::dump_to_pp): Use spaces rather than newlines when
10585 summarizing. Pass region_model to sm_state_map::print.
10586 (ana::selftest::assert_dump_eq): New function.
10587 (ASSERT_DUMP_EQ): New macro.
10588 (ana::selftest::test_program_state_dumping): New function.
10589 (ana::selftest::analyzer_program_state_cc_tests): Call it.
10590 * program-state.h (program_state::print): Add model param.
10591 * region-model.cc (dump_quoted_tree): New function.
10592 (map_region::print_fields): Use dump_quoted_tree rather than
10593 %qE to avoid lang-dependent output.
10594 (map_region::dump_child_label): Likewise.
10595 (region_model::dump_summary_of_map): For SK_REGION, when
10596 get_representative_path_var fails, print the region id rather than
10597 erroneously printing NULL.
10598 * sm.cc (state_machine::get_state_by_name): New function.
10599 * sm.h (state_machine::get_state_by_name): New decl.
10601 2020-03-04 David Malcolm <dmalcolm@redhat.com>
10603 * region-model.cc (region::validate): Convert model param from ptr
10604 to reference. Update comment to reflect that it's now a vfunc.
10605 (map_region::validate): New vfunc implementation.
10606 (array_region::validate): New vfunc implementation.
10607 (stack_region::validate): New vfunc implementation.
10608 (root_region::validate): New vfunc implementation.
10609 (region_model::validate): Pass a reference rather than a pointer
10610 to the region::validate vfunc.
10611 * region-model.h (region::validate): Make virtual. Convert model
10612 param from ptr to reference.
10613 (map_region::validate): New vfunc decl.
10614 (array_region::validate): New vfunc decl.
10615 (stack_region::validate): New vfunc decl.
10616 (root_region::validate): New vfunc decl.
10618 2020-03-04 David Malcolm <dmalcolm@redhat.com>
10620 PR analyzer/93993
10621 * region-model.cc (region_model::on_call_pre): Handle
10622 BUILT_IN_EXPECT and its variants.
10623 (region_model::add_any_constraints_from_ssa_def_stmt): Split out
10624 gassign handling into add_any_constraints_from_gassign; add gcall
10625 handling.
10626 (region_model::add_any_constraints_from_gassign): New function,
10627 based on the above. Add handling for NOP_EXPR.
10628 (region_model::add_any_constraints_from_gcall): New function.
10629 (region_model::get_representative_path_var): Handle views.
10630 * region-model.h
10631 (region_model::add_any_constraints_from_ssa_def_stmt): New decl.
10632 (region_model::add_any_constraints_from_gassign): New decl.
10634 2020-03-04 David Malcolm <dmalcolm@redhat.com>
10636 PR analyzer/93993
10637 * checker-path.h (state_change_event::get_lvalue): Add ctxt param
10638 and pass it to region_model::get_value call.
10639 * diagnostic-manager.cc (get_any_origin): Pass a
10640 tentative_region_model_context to the calls to get_lvalue and reject
10641 the comparison if errors occur.
10642 (can_be_expr_of_interest_p): New function.
10643 (diagnostic_manager::prune_for_sm_diagnostic): Replace checks for
10644 CONSTANT_CLASS_P with calls to update_for_unsuitable_sm_exprs.
10645 Pass a tentative_region_model_context to the calls to
10646 state_change_event::get_lvalue and reject the comparison if errors
10647 occur.
10648 (diagnostic_manager::update_for_unsuitable_sm_exprs): New.
10649 * diagnostic-manager.h
10650 (diagnostic_manager::update_for_unsuitable_sm_exprs): New decl.
10651 * region-model.h (class tentative_region_model_context): New class.
10653 2020-03-04 David Malcolm <dmalcolm@redhat.com>
10655 * engine.cc (worklist::worklist): Remove unused field m_eg.
10656 (class viz_callgraph_edge): Remove unused field m_call_sedge.
10657 (class viz_callgraph): Remove unused field m_sg.
10658 * exploded-graph.h (worklist::::m_eg): Remove unused field.
10660 2020-03-02 David Malcolm <dmalcolm@redhat.com>
10662 * analyzer.opt (fanalyzer-show-duplicate-count): New option.
10663 * diagnostic-manager.cc
10664 (diagnostic_manager::emit_saved_diagnostic): Use the above to
10665 guard the printing of the duplicate count.
10667 2020-03-02 David Malcolm <dmalcolm@redhat.com>
10669 PR analyzer/93959
10670 * analyzer.cc (is_std_function_p): New function.
10671 (is_std_named_call_p): New functions.
10672 * analyzer.h (is_std_named_call_p): New decl.
10673 * sm-malloc.cc (malloc_state_machine::on_stmt): Check for "std::"
10674 variants when checking for malloc, calloc and free.
10676 2020-02-26 David Malcolm <dmalcolm@redhat.com>
10678 PR analyzer/93950
10679 * diagnostic-manager.cc
10680 (diagnostic_manager::prune_for_sm_diagnostic): Assert that var is
10681 either NULL or not a constant. When updating var, bulletproof
10682 against constant values.
10684 2020-02-26 David Malcolm <dmalcolm@redhat.com>
10686 PR analyzer/93947
10687 * region-model.cc (region_model::get_fndecl_for_call): Gracefully
10688 fail for fn_decls that don't have a cgraph_node.
10690 2020-02-26 David Malcolm <dmalcolm@redhat.com>
10692 * bar-chart.cc: New file.
10693 * bar-chart.h: New file.
10694 * engine.cc: Include "analyzer/bar-chart.h".
10695 (stats::log): Only log the m_num_nodes kinds that are non-zero.
10696 (stats::dump): Likewise when dumping.
10697 (stats::get_total_enodes): New.
10698 (exploded_graph::get_or_create_node): Increment the per-point-data
10699 m_excess_enodes when hitting the per-program-point limit on
10700 enodes.
10701 (exploded_graph::print_bar_charts): New.
10702 (exploded_graph::log_stats): Log the number of unprocessed enodes
10703 in the worklist. Call print_bar_charts.
10704 (exploded_graph::dump_stats): Print the number of unprocessed
10705 enodes in the worklist.
10706 * exploded-graph.h (stats::get_total_enodes): New decl.
10707 (struct per_program_point_data): Add field m_excess_enodes.
10708 (exploded_graph::print_bar_charts): New decl.
10709 * supergraph.cc (superedge::dump): New.
10710 (superedge::dump): New.
10711 * supergraph.h (supernode::get_function): New.
10712 (superedge::dump): New decl.
10713 (superedge::dump): New decl.
10715 2020-02-24 David Malcolm <dmalcolm@redhat.com>
10717 * engine.cc (exploded_graph::get_or_create_node): Dump the
10718 program_state to the pp, rather than to stderr.
10720 2020-02-24 David Malcolm <dmalcolm@redhat.com>
10722 PR analyzer/93032
10723 * sm.cc (make_checkers): Require the "taint" checker to be
10724 explicitly enabled.
10726 2020-02-24 David Malcolm <dmalcolm@redhat.com>
10728 PR analyzer/93899
10729 * engine.cc
10730 (impl_region_model_context::impl_region_model_context): Add logger
10731 param.
10732 * engine.cc (exploded_graph::add_function_entry): Create an
10733 impl_region_model_context and pass it to the push_frame call.
10734 Bail if the resulting state is invalid.
10735 (exploded_graph::build_initial_worklist): Likewise.
10736 (exploded_graph::build_initial_worklist): Handle the case where
10737 add_function_entry fails.
10738 * exploded-graph.h
10739 (impl_region_model_context::impl_region_model_context): Add logger
10740 param.
10741 * region-model.cc (map_region::get_or_create): Add ctxt param and
10742 pass it to add_region_for_type.
10743 (map_region::can_merge_p): Pass NULL as a ctxt to call to
10744 get_or_create.
10745 (array_region::get_element): Pass ctxt to call to get_or_create.
10746 (array_region::get_or_create): Add ctxt param and pass it to
10747 add_region_for_type.
10748 (root_region::push_frame): Pass ctxt to get_or_create calls.
10749 (region_model::get_lvalue_1): Likewise.
10750 (region_model::make_region_for_unexpected_tree_code): Assert that
10751 ctxt is non-NULL.
10752 (region_model::get_rvalue_1): Pass ctxt to get_svalue_for_fndecl
10753 and get_svalue_for_label calls.
10754 (region_model::get_svalue_for_fndecl): Add ctxt param and pass it
10755 to get_region_for_fndecl.
10756 (region_model::get_region_for_fndecl): Add ctxt param and pass it
10757 to get_or_create.
10758 (region_model::get_svalue_for_label): Add ctxt param and pass it
10759 to get_region_for_label.
10760 (region_model::get_region_for_label): Add ctxt param and pass it
10761 to get_region_for_fndecl and get_or_create.
10762 (region_model::get_field_region): Add ctxt param and pass it to
10763 get_or_create_view and get_or_create.
10764 (make_region_for_type): Replace gcc_unreachable with return NULL.
10765 (region_model::add_region_for_type): Add ctxt param. Handle a
10766 return of NULL from make_region_for_type by calling
10767 make_region_for_unexpected_tree_code.
10768 (region_model::get_or_create_mem_ref): Pass ctxt to calls to
10769 get_or_create_view.
10770 (region_model::get_or_create_view): Add ctxt param and pass it to
10771 add_region_for_type.
10772 (selftest::test_state_merging): Pass ctxt to get_or_create_view.
10773 * region-model.h (region_model::get_or_create): Add ctxt param.
10774 (region_model::add_region_for_type): Likewise.
10775 (region_model::get_svalue_for_fndecl): Likewise.
10776 (region_model::get_svalue_for_label): Likewise.
10777 (region_model::get_region_for_fndecl): Likewise.
10778 (region_model::get_region_for_label): Likewise.
10779 (region_model::get_field_region): Likewise.
10780 (region_model::get_or_create_view): Likewise.
10782 2020-02-24 David Malcolm <dmalcolm@redhat.com>
10784 * checker-path.cc (superedge_event::should_filter_p): Update
10785 filter for empty descriptions to cover verbosity level 3 as well
10786 as 2.
10787 * diagnostic-manager.cc: Include "analyzer/reachability.h".
10788 (class path_builder): New class.
10789 (diagnostic_manager::emit_saved_diagnostic): Create a path_builder
10790 and pass it to build_emission_path, rather passing eg; similarly
10791 for add_events_for_eedge and ext_state.
10792 (diagnostic_manager::build_emission_path): Replace "eg" param
10793 with a path_builder, pass it to add_events_for_eedge.
10794 (diagnostic_manager::add_events_for_eedge): Replace ext_state
10795 param with path_builder; pass it to add_events_for_superedge.
10796 (diagnostic_manager::significant_edge_p): New.
10797 (diagnostic_manager::add_events_for_superedge): Add path_builder
10798 param. Reject insignificant edges at verbosity levels below 3.
10799 (diagnostic_manager::prune_for_sm_diagnostic): Update highest
10800 verbosity level to 4.
10801 * diagnostic-manager.h (class path_builder): New forward decl.
10802 (diagnostic_manager::build_emission_path): Replace "eg" param
10803 with a path_builder.
10804 (diagnostic_manager::add_events_for_eedge): Replace ext_state
10805 param with path_builder.
10806 (diagnostic_manager::significant_edge_p): New.
10807 (diagnostic_manager::add_events_for_superedge): Add path_builder
10808 param.
10809 * reachability.h: New file.
10811 2020-02-18 David Malcolm <dmalcolm@redhat.com>
10813 PR analyzer/93692
10814 * analyzer.opt (fdump-analyzer-callgraph): Rewrite description.
10816 2020-02-18 David Malcolm <dmalcolm@redhat.com>
10818 PR analyzer/93777
10819 * region-model.cc (region_model::maybe_cast_1): Replace assertion
10820 that build_cast returns non-NULL with a conditional, falling
10821 through to the logic which returns a new unknown value of the
10822 desired type if it fails.
10824 2020-02-18 David Malcolm <dmalcolm@redhat.com>
10826 PR analyzer/93778
10827 * engine.cc (impl_region_model_context::on_unknown_tree_code):
10828 Rename to...
10829 (impl_region_model_context::on_unexpected_tree_code): ...this and
10830 convert first argument from path_var to tree.
10831 (exploded_node::on_stmt): Pass ctxt to purge_for_unknown_fncall.
10832 * exploded-graph.h (region_model_context::on_unknown_tree_code):
10833 Rename to...
10834 (region_model_context::on_unexpected_tree_code): ...this and
10835 convert first argument from path_var to tree.
10836 * program-state.cc (sm_state_map::purge_for_unknown_fncall): Add
10837 ctxt param and pass on to calls to get_rvalue.
10838 * program-state.h (sm_state_map::purge_for_unknown_fncall): Add
10839 ctxt param.
10840 * region-model.cc (region_model::handle_unrecognized_call): Pass
10841 ctxt on to call to get_rvalue.
10842 (region_model::get_lvalue_1): Move body of default case to
10843 region_model::make_region_for_unexpected_tree_code and call it.
10844 Within COMPONENT_REF case, reject attempts to handle types other
10845 than RECORD_TYPE and UNION_TYPE.
10846 (region_model::make_region_for_unexpected_tree_code): New
10847 function, based on default case of region_model::get_lvalue_1.
10848 * region-model.h
10849 (region_model::make_region_for_unexpected_tree_code): New decl.
10850 (region_model::on_unknown_tree_code): Rename to...
10851 (region_model::on_unexpected_tree_code): ...this and convert first
10852 argument from path_var to tree.
10853 (class test_region_model_context): Update vfunc implementation for
10854 above change.
10856 2020-02-18 David Malcolm <dmalcolm@redhat.com>
10858 PR analyzer/93774
10859 * region-model.cc
10860 (region_model::convert_byte_offset_to_array_index): Use
10861 int_size_in_bytes before calling size_in_bytes, to gracefully fail
10862 on incomplete types.
10864 2020-02-17 David Malcolm <dmalcolm@redhat.com>
10866 PR analyzer/93775
10867 * region-model.cc (region_model::get_fndecl_for_call): Handle the
10868 case where the code_region's get_tree_for_child_region returns
10869 NULL.
10871 2020-02-17 David Malcolm <dmalcolm@redhat.com>
10873 PR analyzer/93388
10874 * engine.cc (impl_region_model_context::on_unknown_tree_code):
10875 New.
10876 (exploded_graph::get_or_create_node): Reject invalid states.
10877 * exploded-graph.h
10878 (impl_region_model_context::on_unknown_tree_code): New decl.
10879 (point_and_state::point_and_state): Assert that the state is
10880 valid.
10881 * program-state.cc (program_state::program_state): Initialize
10882 m_valid to true.
10883 (program_state::operator=): Copy m_valid.
10884 (program_state::program_state): Likewise for move constructor.
10885 (program_state::print): Print m_valid.
10886 (program_state::dump_to_pp): Likewise.
10887 * program-state.h (program_state::m_valid): New field.
10888 * region-model.cc (region_model::get_lvalue_1): Implement the
10889 default case by returning a new symbolic region and calling
10890 the context's on_unknown_tree_code, rather than issuing an
10891 internal_error. Implement VIEW_CONVERT_EXPR.
10892 * region-model.h (region_model_context::on_unknown_tree_code): New
10893 vfunc.
10894 (test_region_model_context::on_unknown_tree_code): New.
10896 2020-02-17 David Malcolm <dmalcolm@redhat.com>
10898 * sm-malloc.cc (malloc_diagnostic::describe_state_change): For
10899 transition to the "null" state, only say "assuming" when
10900 transitioning from the "unchecked" state.
10902 2020-02-17 David Malcolm <dmalcolm@redhat.com>
10904 * diagnostic-manager.h (diagnostic_manager::get_saved_diagnostic):
10905 Add const overload.
10906 * engine.cc (exploded_node::dump_dot): Dump saved_diagnostics.
10907 * exploded-graph.h (exploded_graph::get_diagnostic_manager): Add
10908 const overload.
10910 2020-02-11 David Malcolm <dmalcolm@redhat.com>
10912 PR analyzer/93288
10913 * analysis-plan.cc (analysis_plan::use_summary_p): Look through
10914 the ultimate_alias_target when getting the called function.
10915 * engine.cc (exploded_node::on_stmt): Rename second "ctxt" to
10916 "sm_ctxt". Use the region_model's get_fndecl_for_call rather than
10917 gimple_call_fndecl.
10918 * region-model.cc (region_model::get_fndecl_for_call): Use
10919 ultimate_alias_target on fndecl.
10920 * supergraph.cc (get_ultimate_function_for_cgraph_edge): New
10921 function.
10922 (supergraph_call_edge): Use it when rejecting edges without
10923 functions.
10924 (supergraph::supergraph): Use it to get the function for the
10925 cgraph_edge when building interprocedural superedges.
10926 (callgraph_superedge::get_callee_function): Use it.
10927 * supergraph.h (supergraph::get_num_snodes): Make param const.
10928 (supergraph::function_to_num_snodes_t): Make first type param
10929 const.
10931 2020-02-11 David Malcolm <dmalcolm@redhat.com>
10933 PR analyzer/93374
10934 * engine.cc (exploded_edge::exploded_edge): Add ext_state param
10935 and pass it to change.validate.
10936 (exploded_graph::get_or_create_node): Move purging of change
10937 svalues to also cover the case of reusing an existing enode.
10938 (exploded_graph::add_edge): Pass m_ext_state to exploded_edge's
10939 ctor.
10940 * exploded-graph.h (exploded_edge::exploded_edge): Add ext_state
10941 param.
10942 * program-state.cc (state_change::sm_change::validate): Likewise.
10943 Assert that m_sm_idx is sane. Use ext_state to validate
10944 m_old_state and m_new_state.
10945 (state_change::validate): Add ext_state param and pass it to
10946 the sm_change validate calls.
10947 * program-state.h (state_change::sm_change::validate): Add
10948 ext_state param.
10949 (state_change::validate): Likewise.
10951 2020-02-11 David Malcolm <dmalcolm@redhat.com>
10953 PR analyzer/93669
10954 * engine.cc (exploded_graph::dump_exploded_nodes): Handle missing
10955 case of STATUS_WORKLIST in implementation of
10956 "__analyzer_dump_exploded_nodes".
10958 2020-02-11 David Malcolm <dmalcolm@redhat.com>
10960 PR analyzer/93649
10961 * constraint-manager.cc (constraint_manager::add_constraint): When
10962 merging equivalence classes and updating m_constant, also update
10963 m_cst_sid.
10964 (constraint_manager::validate): If m_constant is non-NULL assert
10965 that m_cst_sid is non-null and is valid.
10967 2020-02-11 David Malcolm <dmalcolm@redhat.com>
10969 PR analyzer/93657
10970 * analyzer.opt (fdump-analyzer): Reword description.
10971 (fdump-analyzer-stderr): Likewise.
10973 2020-02-11 David Malcolm <dmalcolm@redhat.com>
10975 * region-model.cc (print_quoted_type): New function.
10976 (svalue::print): Use it to replace %qT.
10977 (region::dump_to_pp): Likewise.
10978 (region::dump_child_label): Likewise.
10979 (region::print_fields): Likewise.
10981 2020-02-10 David Malcolm <dmalcolm@redhat.com>
10983 PR analyzer/93659
10984 * analyzer.opt (-param=analyzer-max-recursion-depth=): Fix "tha"
10985 -> "that" typo.
10986 (Wanalyzer-use-of-uninitialized-value): Fix "initialized" ->
10987 "uninitialized" typo.
10989 2020-02-10 David Malcolm <dmalcolm@redhat.com>
10991 PR analyzer/93350
10992 * region-model.cc (region_model::get_lvalue_1):
10993 Handle BIT_FIELD_REF.
10994 (make_region_for_type): Handle VECTOR_TYPE.
10996 2020-02-10 David Malcolm <dmalcolm@redhat.com>
10998 PR analyzer/93647
10999 * diagnostic-manager.cc
11000 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof against
11001 VAR being constant.
11002 * region-model.cc (region_model::get_lvalue_1): Provide a better
11003 error message when encountering an unhandled tree code.
11005 2020-02-10 David Malcolm <dmalcolm@redhat.com>
11007 PR analyzer/93405
11008 * region-model.cc (region_model::get_lvalue_1): Implement
11009 CONST_DECL.
11011 2020-02-06 David Malcolm <dmalcolm@redhat.com>
11013 * region-model.cc (region_model::maybe_cast_1): Attempt to provide
11014 a region_svalue if either type is a pointer, rather than if both
11015 types are pointers.
11017 2020-02-05 David Malcolm <dmalcolm@redhat.com>
11019 * engine.cc (exploded_node::dump_dot): Show merger enodes.
11020 (worklist::add_node): Assert that the node's m_status is
11021 STATUS_WORKLIST.
11022 (exploded_graph::process_worklist): Likewise for nodes from the
11023 worklist. Set status of merged nodes to STATUS_MERGER.
11024 (exploded_graph::process_node): Set status of node to
11025 STATUS_PROCESSED.
11026 (exploded_graph::dump_exploded_nodes): Rework handling of
11027 "__analyzer_dump_exploded_nodes", splitting enodes by status into
11028 "processed" and "merger", showing the count of just the processed
11029 enodes at the call, rather than the count of all enodes.
11030 * exploded-graph.h (exploded_node::status): New enum.
11031 (exploded_node::exploded_node): Initialize m_status to
11032 STATUS_WORKLIST.
11033 (exploded_node::get_status): New getter.
11034 (exploded_node::set_status): New setter.
11036 2020-02-04 David Malcolm <dmalcolm@redhat.com>
11038 PR analyzer/93543
11039 * engine.cc (pod_hash_traits<function_call_string>::mark_empty):
11040 Eliminate reinterpret_cast.
11041 (pod_hash_traits<function_call_string>::is_empty): Likewise.
11043 2020-02-03 David Malcolm <dmalcolm@redhat.com>
11045 * constraint-manager.cc (range::constrained_to_single_element):
11046 Replace fold_build2 with fold_binary. Remove unnecessary newline.
11047 (constraint_manager::get_or_add_equiv_class): Replace fold_build2
11048 with fold_binary in two places, and remove out-of-date comment.
11049 (constraint_manager::eval_condition): Replace fold_build2 with
11050 fold_binary.
11051 * region-model.cc (constant_svalue::eval_condition): Likewise.
11052 (region_model::on_assignment): Likewise.
11054 2020-02-03 David Malcolm <dmalcolm@redhat.com>
11056 PR analyzer/93544
11057 * diagnostic-manager.cc
11058 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof
11059 against bad choices due to bad paths.
11060 * engine.cc (impl_region_model_context::on_phi): New.
11061 * exploded-graph.h (impl_region_model_context::on_phi): New decl.
11062 * region-model.cc (region_model::on_longjmp): Likewise.
11063 (region_model::handle_phi): Add phi param. Call the ctxt's on_phi
11064 vfunc.
11065 (region_model::update_for_phis): Pass phi to handle_phi.
11066 * region-model.h (region_model::handle_phi): Add phi param.
11067 (region_model_context::on_phi): New vfunc.
11068 (test_region_model_context::on_phi): New.
11069 * sm-malloc.cc (malloc_state_machine::on_phi): New.
11070 (malloc_state_machine::on_zero_assignment): New.
11071 * sm.h (state_machine::on_phi): New vfunc.
11073 2020-02-03 David Malcolm <dmalcolm@redhat.com>
11075 * engine.cc (supernode_cluster::dump_dot): Show BB index as
11076 well as SN index.
11077 * supergraph.cc (supernode::dump_dot): Likewise.
11079 2020-02-03 David Malcolm <dmalcolm@redhat.com>
11081 PR analyzer/93546
11082 * region-model.cc (region_model::on_call_pre): Update for new
11083 param of symbolic_region ctor.
11084 (region_model::deref_rvalue): Likewise.
11085 (region_model::add_new_malloc_region): Likewise.
11086 (make_region_for_type): Likewise, preserving type.
11087 * region-model.h (symbolic_region::symbolic_region): Add "type"
11088 param and pass it to base class ctor.
11090 2020-02-03 David Malcolm <dmalcolm@redhat.com>
11092 PR analyzer/93547
11093 * constraint-manager.cc
11094 (constraint_manager::get_or_add_equiv_class): Ensure types are
11095 compatible before comparing constants.
11097 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11099 PR analyzer/93457
11100 * region-model.cc (make_region_for_type): Use VOID_TYPE_P rather
11101 than checking against void_type_node.
11103 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11105 PR analyzer/93373
11106 * region-model.cc (ASSERT_COMPAT_TYPES): Convert to...
11107 (assert_compat_types): ...this, and bail when either type is NULL,
11108 or when VOID_TYPE_P (dst_type).
11109 (region_model::get_lvalue): Update for above conversion.
11110 (region_model::get_rvalue): Likewise.
11112 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11114 PR analyzer/93379
11115 * region-model.cc (region_model::update_for_return_superedge):
11116 Move check for null result so that it also guards setting the
11117 lhs.
11119 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11121 PR analyzer/93438
11122 * region-model.cc (stack_region::can_merge_p): Split into a two
11123 pass approach, creating all stack regions first, then populating
11124 them.
11125 (selftest::test_state_merging): Add test coverage for (a) the case
11126 of self-merging a model in which a local in an older stack frame
11127 points to a local in a more recent stack frame (which previously
11128 would ICE), and (b) the case of self-merging a model in which a
11129 local points to a global (which previously worked OK).
11131 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11133 * analyzer.cc (is_named_call_p): Replace tests for fndecl being
11134 extern at file scope and having a non-NULL DECL_NAME with a call
11135 to maybe_special_function_p.
11136 * function-set.cc (function_set::contains_decl_p): Add call to
11137 maybe_special_function_p.
11139 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11141 PR analyzer/93450
11142 * constraint-manager.cc
11143 (constraint_manager::get_or_add_equiv_class): Only compare constants
11144 if their types are compatible.
11145 * region-model.cc (constant_svalue::eval_condition): Replace check
11146 for identical types with call to types_compatible_p.
11148 2020-01-30 David Malcolm <dmalcolm@redhat.com>
11150 * program-state.cc (extrinsic_state::dump_to_pp): New.
11151 (extrinsic_state::dump_to_file): New.
11152 (extrinsic_state::dump): New.
11153 * program-state.h (extrinsic_state::dump_to_pp): New decl.
11154 (extrinsic_state::dump_to_file): New decl.
11155 (extrinsic_state::dump): New decl.
11156 * sm.cc: Include "pretty-print.h".
11157 (state_machine::dump_to_pp): New.
11158 * sm.h (state_machine::dump_to_pp): New decl.
11160 2020-01-30 David Malcolm <dmalcolm@redhat.com>
11162 * diagnostic-manager.cc (for_each_state_change): Use
11163 extrinsic_state::get_num_checkers rather than accessing m_checkers
11164 directly.
11165 * program-state.cc (program_state::program_state): Likewise.
11166 * program-state.h (extrinsic_state::m_checkers): Make private.
11168 2020-01-30 David Malcolm <dmalcolm@redhat.com>
11170 PR analyzer/93356
11171 * region-model.cc (region_model::eval_condition): In both
11172 overloads, bail out immediately on floating-point types.
11173 (region_model::eval_condition_without_cm): Likewise.
11174 (region_model::add_constraint): Likewise.
11176 2020-01-30 David Malcolm <dmalcolm@redhat.com>
11178 PR analyzer/93450
11179 * program-state.cc (sm_state_map::set_state): For the overload
11180 taking an svalue_id, bail out if the set_state on the ec does
11181 nothing. Convert the latter's return type from void to bool,
11182 returning true if anything changed.
11183 (sm_state_map::impl_set_state): Convert the return type from void
11184 to bool, returning true if the state changed.
11185 * program-state.h (sm_state_map::set_state): Convert return type
11186 from void to bool.
11187 (sm_state_map::impl_set_state): Likewise.
11188 * region-model.cc (constant_svalue::eval_condition): Only call
11189 fold_build2 if the types are the same.
11191 2020-01-29 Jakub Jelinek <jakub@redhat.com>
11193 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Remove.
11194 * constraint-manager.cc: Include diagnostic-core.h before graphviz.h.
11195 (range::dump, equiv_class::print): Don't use PUSH_IGNORE_WFORMAT or
11196 POP_IGNORE_WFORMAT.
11197 * state-purge.cc: Include diagnostic-core.h before
11198 gimple-pretty-print.h.
11199 (state_purge_annotator::add_node_annotations, print_vec_of_names):
11200 Don't use PUSH_IGNORE_WFORMAT or POP_IGNORE_WFORMAT.
11201 * region-model.cc: Move diagnostic-core.h include before graphviz.h.
11202 (path_var::dump, svalue::print, constant_svalue::print_details,
11203 region::dump_to_pp, region::dump_child_label, region::print_fields,
11204 map_region::print_fields, map_region::dump_dot_to_pp,
11205 map_region::dump_child_label, array_region::print_fields,
11206 array_region::dump_dot_to_pp): Don't use PUSH_IGNORE_WFORMAT or
11207 POP_IGNORE_WFORMAT.
11209 2020-01-28 David Malcolm <dmalcolm@redhat.com>
11211 PR analyzer/93316
11212 * engine.cc (rewind_info_t::update_model): Get the longjmp call
11213 stmt via get_longjmp_call () rather than assuming it is the last
11214 stmt in the longjmp's supernode.
11215 (rewind_info_t::add_events_to_path): Get the location_t for the
11216 rewind_from_longjmp_event via get_longjmp_call () rather than from
11217 the supernode's get_end_location ().
11219 2020-01-28 David Malcolm <dmalcolm@redhat.com>
11221 * region-model.cc (poisoned_value_diagnostic::emit): Update for
11222 renaming of warning_at overload to warning_meta.
11223 * sm-file.cc (file_leak::emit): Likewise.
11224 * sm-malloc.cc (double_free::emit): Likewise.
11225 (possible_null_deref::emit): Likewise.
11226 (possible_null_arg::emit): Likewise.
11227 (null_deref::emit): Likewise.
11228 (null_arg::emit): Likewise.
11229 (use_after_free::emit): Likewise.
11230 (malloc_leak::emit): Likewise.
11231 (free_of_non_heap::emit): Likewise.
11232 * sm-sensitive.cc (exposure_through_output_file::emit): Likewise.
11233 * sm-signal.cc (signal_unsafe_call::emit): Likewise.
11234 * sm-taint.cc (tainted_array_index::emit): Likewise.
11236 2020-01-27 David Malcolm <dmalcolm@redhat.com>
11238 PR analyzer/93451
11239 * region-model.cc (tree_cmp): For the REAL_CST case, impose an
11240 arbitrary order on NaNs relative to other NaNs and to non-NaNs;
11241 const-correctness tweak.
11242 (ana::selftests::build_real_cst_from_string): New function.
11243 (ana::selftests::append_interesting_constants): New function.
11244 (ana::selftests::test_tree_cmp_on_constants): New test.
11245 (ana::selftests::test_canonicalization_4): New test.
11246 (ana::selftests::analyzer_region_model_cc_tests): Call the new
11247 tests.
11249 2020-01-27 David Malcolm <dmalcolm@redhat.com>
11251 PR analyzer/93349
11252 * engine.cc (run_checkers): Save and restore input_location.
11254 2020-01-27 David Malcolm <dmalcolm@redhat.com>
11256 * call-string.cc (call_string::cmp_1): Delete, moving body to...
11257 (call_string::cmp): ...here.
11258 * call-string.h (call_string::cmp_1): Delete decl.
11259 * engine.cc (worklist::key_t::cmp_1): Delete, moving body to...
11260 (worklist::key_t::cmp): ...here. Implement hash comparisons
11261 via comparison rather than subtraction to avoid overflow issues.
11262 * exploded-graph.h (worklist::key_t::cmp_1): Delete decl.
11263 * region-model.cc (tree_cmp): Eliminate buggy checking for
11264 symmetry.
11266 2020-01-27 David Malcolm <dmalcolm@redhat.com>
11268 * analyzer.cc (is_named_call_p): Check that fndecl is "extern"
11269 and at file scope. Potentially disregard prefix _ or __ in
11270 fndecl's name. Bail if the identifier is NULL.
11271 (is_setjmp_call_p): Expect a gcall rather than plain gimple.
11272 Remove special-case check for leading prefix, and also check for
11273 sigsetjmp.
11274 (is_longjmp_call_p): Also check for siglongjmp.
11275 (get_user_facing_name): New function.
11276 * analyzer.h (is_setjmp_call_p): Expect a gcall rather than plain
11277 gimple.
11278 (get_user_facing_name): New decl.
11279 * checker-path.cc (setjmp_event::get_desc): Use
11280 get_user_facing_name to avoid hardcoding the function name.
11281 (rewind_event::rewind_event): Add rewind_info param, using it to
11282 initialize new m_rewind_info field, and strengthen the assertion.
11283 (rewind_from_longjmp_event::get_desc): Use get_user_facing_name to
11284 avoid hardcoding the function name.
11285 (rewind_to_setjmp_event::get_desc): Likewise.
11286 * checker-path.h (setjmp_event::setjmp_event): Add setjmp_call
11287 param and use it to initialize...
11288 (setjmp_event::m_setjmp_call): New field.
11289 (rewind_event::rewind_event): Add rewind_info param.
11290 (rewind_event::m_rewind_info): New protected field.
11291 (rewind_from_longjmp_event::rewind_from_longjmp_event): Add
11292 rewind_info param.
11293 (class rewind_to_setjmp_event): Move rewind_info field to parent
11294 class.
11295 * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
11296 Update setjmp-handling for is_setjmp_call_p requiring a gcall;
11297 pass the call to the new setjmp_event.
11298 * engine.cc (exploded_node::on_stmt): Update for is_setjmp_call_p
11299 requiring a gcall.
11300 (stale_jmp_buf::emit): Use get_user_facing_name to avoid
11301 hardcoding the function names.
11302 (exploded_node::on_longjmp): Pass the longjmp_call when
11303 constructing rewind_info.
11304 (rewind_info_t::add_events_to_path): Pass the rewind_info_t to the
11305 rewind_from_longjmp_event's ctor.
11306 * exploded-graph.h (rewind_info_t::rewind_info_t): Add
11307 longjmp_call param.
11308 (rewind_info_t::get_longjmp_call): New.
11309 (rewind_info_t::m_longjmp_call): New.
11310 * region-model.cc (region_model::on_setjmp): Update comment to
11311 indicate this is also for sigsetjmp.
11312 * region-model.h (struct setjmp_record): Likewise.
11313 (class setjmp_svalue): Likewise.
11315 2020-01-27 David Malcolm <dmalcolm@redhat.com>
11317 PR analyzer/93276
11318 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Guard these
11319 macros with GCC_VERSION >= 4006, making them no-op otherwise.
11320 * engine.cc (exploded_edge::exploded_edge): Specify template for
11321 base class initializer.
11322 (exploded_graph::add_edge): Specify template when chaining up to
11323 base class add_edge implementation.
11324 (viz_callgraph_node::dump_dot): Drop redundant "typename".
11325 (viz_callgraph_edge::viz_callgraph_edge): Specify template for
11326 base class initializer.
11327 * program-state.cc (sm_state_map::clone_with_remapping): Drop
11328 redundant "typename".
11329 (sm_state_map::print): Likewise.
11330 (sm_state_map::hash): Likewise.
11331 (sm_state_map::operator==): Likewise.
11332 (sm_state_map::remap_svalue_ids): Likewise.
11333 (sm_state_map::on_svalue_purge): Likewise.
11334 (sm_state_map::validate): Likewise.
11335 * program-state.h (sm_state_map::iterator_t): Likewise.
11336 * supergraph.h (superedge::superedge): Specify template for base
11337 class initializer.
11339 2020-01-23 David Malcolm <dmalcolm@redhat.com>
11341 PR analyzer/93375
11342 * supergraph.cc (callgraph_superedge::get_arg_for_parm): Fail
11343 gracefully is the number of parameters at the callee exceeds the
11344 number of arguments at the call stmt.
11345 (callgraph_superedge::get_parm_for_arg): Likewise.
11347 2020-01-22 David Malcolm <dmalcolm@redhat.com>
11349 PR analyzer/93382
11350 * program-state.cc (sm_state_map::on_svalue_purge): If the
11351 entry survives, but the origin is being purged, then reset the
11352 origin to null.
11354 2020-01-22 David Malcolm <dmalcolm@redhat.com>
11356 * sm-signal.cc: Fix nesting of CHECKING_P and namespace ana.
11358 2020-01-22 David Malcolm <dmalcolm@redhat.com>
11360 PR analyzer/93378
11361 * engine.cc (setjmp_svalue::compare_fields): Update for
11362 replacement of m_enode with m_setjmp_record.
11363 (setjmp_svalue::add_to_hash): Likewise.
11364 (setjmp_svalue::get_index): Rename...
11365 (setjmp_svalue::get_enode_index): ...to this.
11366 (setjmp_svalue::print_details): Update for replacement of m_enode
11367 with m_setjmp_record.
11368 (exploded_node::on_longjmp): Likewise.
11369 * exploded-graph.h (rewind_info_t::m_enode_origin): Replace...
11370 (rewind_info_t::m_setjmp_record): ...with this.
11371 (rewind_info_t::rewind_info_t): Update for replacement of m_enode
11372 with m_setjmp_record.
11373 (rewind_info_t::get_setjmp_point): Likewise.
11374 (rewind_info_t::get_setjmp_call): Likewise.
11375 * region-model.cc (region_model::dump_summary_of_map): Likewise.
11376 (region_model::on_setjmp): Likewise.
11377 * region-model.h (struct setjmp_record): New struct.
11378 (setjmp_svalue::m_enode): Replace...
11379 (setjmp_svalue::m_setjmp_record): ...with this.
11380 (setjmp_svalue::setjmp_svalue): Update for replacement of m_enode
11381 with m_setjmp_record.
11382 (setjmp_svalue::clone): Likewise.
11383 (setjmp_svalue::get_index): Rename...
11384 (setjmp_svalue::get_enode_index): ...to this.
11385 (setjmp_svalue::get_exploded_node): Replace...
11386 (setjmp_svalue::get_setjmp_record): ...with this.
11388 2020-01-22 David Malcolm <dmalcolm@redhat.com>
11390 PR analyzer/93316
11391 * analyzer.cc (is_setjmp_call_p): Check for "setjmp" as well as
11392 "_setjmp".
11394 2020-01-22 David Malcolm <dmalcolm@redhat.com>
11396 PR analyzer/93307
11397 * analysis-plan.h: Wrap everything namespace "ana".
11398 * analyzer-logging.cc: Likewise.
11399 * analyzer-logging.h: Likewise.
11400 * analyzer-pass.cc (pass_analyzer::execute): Update for "ana"
11401 namespace.
11402 * analyzer-selftests.cc: Wrap everything namespace "ana".
11403 * analyzer-selftests.h: Likewise.
11404 * analyzer.h: Likewise for forward decls of types.
11405 * call-string.h: Likewise.
11406 * checker-path.cc: Likewise.
11407 * checker-path.h: Likewise.
11408 * constraint-manager.cc: Likewise.
11409 * constraint-manager.h: Likewise.
11410 * diagnostic-manager.cc: Likewise.
11411 * diagnostic-manager.h: Likewise.
11412 * engine.cc: Likewise.
11413 * engine.h: Likewise.
11414 * exploded-graph.h: Likewise.
11415 * function-set.cc: Likewise.
11416 * function-set.h: Likewise.
11417 * pending-diagnostic.cc: Likewise.
11418 * pending-diagnostic.h: Likewise.
11419 * program-point.cc: Likewise.
11420 * program-point.h: Likewise.
11421 * program-state.cc: Likewise.
11422 * program-state.h: Likewise.
11423 * region-model.cc: Likewise.
11424 * region-model.h: Likewise.
11425 * sm-file.cc: Likewise.
11426 * sm-malloc.cc: Likewise.
11427 * sm-pattern-test.cc: Likewise.
11428 * sm-sensitive.cc: Likewise.
11429 * sm-signal.cc: Likewise.
11430 * sm-taint.cc: Likewise.
11431 * sm.cc: Likewise.
11432 * sm.h: Likewise.
11433 * state-purge.h: Likewise.
11434 * supergraph.cc: Likewise.
11435 * supergraph.h: Likewise.
11437 2020-01-21 David Malcolm <dmalcolm@redhat.com>
11439 PR analyzer/93352
11440 * region-model.cc (int_cmp): Rename to...
11441 (array_region::key_cmp): ...this, using key_t rather than int.
11442 Rewrite in terms of comparisons rather than subtraction to
11443 ensure qsort is anti-symmetric when handling extreme values.
11444 (array_region::walk_for_canonicalization): Update for above
11445 renaming.
11446 * region-model.h (array_region::key_cmp): New decl.
11448 2020-01-17 David Malcolm <dmalcolm@redhat.com>
11450 PR analyzer/93290
11451 * region-model.cc (region_model::eval_condition_without_cm): Avoid
11452 gcc_unreachable for unexpected operations for the case where
11453 we're comparing an svalue against itself.
11455 2020-01-17 David Malcolm <dmalcolm@redhat.com>
11457 PR analyzer/93281
11458 * region-model.cc
11459 (region_model::convert_byte_offset_to_array_index): Convert to
11460 ssizetype before dividing by byte_size. Use fold_binary rather
11461 than fold_build2 to avoid needlessly constructing a tree for the
11462 non-const case.
11464 2020-01-15 David Malcolm <dmalcolm@redhat.com>
11466 * engine.cc (class impl_region_model_context): Fix comment.
11468 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11470 PR analyzer/93212
11471 * region-model.cc (make_region_for_type): Use
11472 FUNC_OR_METHOD_TYPE_P rather than comparing against FUNCTION_TYPE.
11473 * region-model.h (function_region::function_region): Likewise.
11475 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11477 * program-state.cc (sm_state_map::clone_with_remapping): Copy
11478 m_global_state.
11479 (selftest::test_program_state_merging_2): New selftest.
11480 (selftest::analyzer_program_state_cc_tests): Call it.
11482 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11484 * checker-path.h (checker_path::get_checker_event): New function.
11485 (checker_path): Add DISABLE_COPY_AND_ASSIGN; make fields private.
11486 * diagnostic-manager.cc
11487 (diagnostic_manager::prune_for_sm_diagnostic): Replace direct
11488 access to checker_path::m_events with accessor functions. Fix
11489 overlong line.
11490 (diagnostic_manager::prune_interproc_events): Replace direct
11491 access to checker_path::m_events with accessor functions.
11492 (diagnostic_manager::finish_pruning): Likewise.
11494 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11496 * checker-path.h (checker_event::clone): Delete vfunc decl.
11497 (debug_event::clone): Delete vfunc impl.
11498 (custom_event::clone): Delete vfunc impl.
11499 (statement_event::clone): Delete vfunc impl.
11500 (function_entry_event::clone): Delete vfunc impl.
11501 (state_change_event::clone): Delete vfunc impl.
11502 (start_cfg_edge_event::clone): Delete vfunc impl.
11503 (end_cfg_edge_event::clone): Delete vfunc impl.
11504 (call_event::clone): Delete vfunc impl.
11505 (return_event::clone): Delete vfunc impl.
11506 (setjmp_event::clone): Delete vfunc impl.
11507 (rewind_from_longjmp_event::clone): Delete vfunc impl.
11508 (rewind_to_setjmp_event::clone): Delete vfunc impl.
11509 (warning_event::clone): Delete vfunc impl.
11511 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11513 * supergraph.cc (supernode::dump_dot): Ensure that the TABLE
11514 element has at least one TR.
11516 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11518 PR analyzer/58237
11519 * engine.cc (leak_stmt_finder::find_stmt): Use get_pure_location
11520 when comparing against UNKNOWN_LOCATION.
11521 (stmt_requires_new_enode_p): Likewise.
11522 (exploded_graph::dump_exploded_nodes): Likewise.
11523 * supergraph.cc (supernode::get_start_location): Likewise.
11524 (supernode::get_end_location): Likewise.
11526 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11528 PR analyzer/58237
11529 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
11530 selftest::analyzer_sm_file_cc_tests.
11531 * analyzer-selftests.h (selftest::analyzer_sm_file_cc_tests): New
11532 decl.
11533 * sm-file.cc: Include "analyzer/function-set.h" and
11534 "analyzer/analyzer-selftests.h".
11535 (get_file_using_fns): New function.
11536 (is_file_using_fn_p): New function.
11537 (fileptr_state_machine::on_stmt): Return true for known functions.
11538 (selftest::analyzer_sm_file_cc_tests): New function.
11540 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11542 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
11543 selftest::analyzer_sm_signal_cc_tests.
11544 * analyzer-selftests.h (selftest::analyzer_sm_signal_cc_tests):
11545 New decl.
11546 * sm-signal.cc: Include "analyzer/function-set.h" and
11547 "analyzer/analyzer-selftests.h".
11548 (get_async_signal_unsafe_fns): New function.
11549 (signal_unsafe_p): Reimplement in terms of the above.
11550 (selftest::analyzer_sm_signal_cc_tests): New function.
11552 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11554 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
11555 selftest::analyzer_function_set_cc_tests.
11556 * analyzer-selftests.h (selftest::analyzer_function_set_cc_tests):
11557 New decl.
11558 * function-set.cc: New file.
11559 * function-set.h: New file.
11561 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11563 * analyzer.h (fndecl_has_gimple_body_p): New decl.
11564 * engine.cc (impl_region_model_context::on_unknown_change): New
11565 function.
11566 (fndecl_has_gimple_body_p): Make non-static.
11567 (exploded_node::on_stmt): Treat __analyzer_dump_exploded_nodes as
11568 known. Track whether we have a call with unknown side-effects and
11569 pass it to on_call_post.
11570 * exploded-graph.h (impl_region_model_context::on_unknown_change):
11571 New decl.
11572 * program-state.cc (sm_state_map::on_unknown_change): New function.
11573 * program-state.h (sm_state_map::on_unknown_change): New decl.
11574 * region-model.cc: Include "bitmap.h".
11575 (region_model::on_call_pre): Return a bool, capturing whether the
11576 call has unknown side effects.
11577 (region_model::on_call_post): Add arg "bool unknown_side_effects"
11578 and if true, call handle_unrecognized_call.
11579 (class reachable_regions): New class.
11580 (region_model::handle_unrecognized_call): New function.
11581 * region-model.h (region_model::on_call_pre): Return a bool.
11582 (region_model::on_call_post): Add arg "bool unknown_side_effects".
11583 (region_model::handle_unrecognized_call): New decl.
11584 (region_model_context::on_unknown_change): New vfunc.
11585 (test_region_model_context::on_unknown_change): New function.
11587 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11589 * diagnostic-manager.cc (saved_diagnostic::operator==): Move here
11590 from header. Replace pointer equality test on m_var with call to
11591 pending_diagnostic::same_tree_p.
11592 * diagnostic-manager.h (saved_diagnostic::operator==): Move to
11593 diagnostic-manager.cc.
11594 * pending-diagnostic.cc (pending_diagnostic::same_tree_p): New.
11595 * pending-diagnostic.h (pending_diagnostic::same_tree_p): New.
11596 * sm-file.cc (file_diagnostic::subclass_equal_p): Replace pointer
11597 equality on m_arg with call to pending_diagnostic::same_tree_p.
11598 * sm-malloc.cc (malloc_diagnostic::subclass_equal_p): Likewise.
11599 (possible_null_arg::subclass_equal_p): Likewise.
11600 (null_arg::subclass_equal_p): Likewise.
11601 (free_of_non_heap::subclass_equal_p): Likewise.
11602 * sm-pattern-test.cc (pattern_match::operator==): Likewise.
11603 * sm-sensitive.cc (exposure_through_output_file::operator==):
11604 Likewise.
11605 * sm-taint.cc (tainted_array_index::operator==): Likewise.
11607 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11609 * diagnostic-manager.cc (dedupe_winners::add): Add logging
11610 of deduplication decisions made.
11612 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11614 * ChangeLog: New file.
11615 * analyzer-selftests.cc: New file.
11616 * analyzer-selftests.h: New file.
11617 * analyzer.opt: New file.
11618 * analysis-plan.cc: New file.
11619 * analysis-plan.h: New file.
11620 * analyzer-logging.cc: New file.
11621 * analyzer-logging.h: New file.
11622 * analyzer-pass.cc: New file.
11623 * analyzer.cc: New file.
11624 * analyzer.h: New file.
11625 * call-string.cc: New file.
11626 * call-string.h: New file.
11627 * checker-path.cc: New file.
11628 * checker-path.h: New file.
11629 * constraint-manager.cc: New file.
11630 * constraint-manager.h: New file.
11631 * diagnostic-manager.cc: New file.
11632 * diagnostic-manager.h: New file.
11633 * engine.cc: New file.
11634 * engine.h: New file.
11635 * exploded-graph.h: New file.
11636 * pending-diagnostic.cc: New file.
11637 * pending-diagnostic.h: New file.
11638 * program-point.cc: New file.
11639 * program-point.h: New file.
11640 * program-state.cc: New file.
11641 * program-state.h: New file.
11642 * region-model.cc: New file.
11643 * region-model.h: New file.
11644 * sm-file.cc: New file.
11645 * sm-malloc.cc: New file.
11646 * sm-malloc.dot: New file.
11647 * sm-pattern-test.cc: New file.
11648 * sm-sensitive.cc: New file.
11649 * sm-signal.cc: New file.
11650 * sm-taint.cc: New file.
11651 * sm.cc: New file.
11652 * sm.h: New file.
11653 * state-purge.cc: New file.
11654 * state-purge.h: New file.
11655 * supergraph.cc: New file.
11656 * supergraph.h: New file.
11658 2019-12-13 David Malcolm <dmalcolm@redhat.com>
11660 * Initial creation
11662 \f
11663 Copyright (C) 2019-2024 Free Software Foundation, Inc.
11665 Copying and distribution of this file, with or without modification,
11666 are permitted in any medium without royalty provided the copyright
11667 notice and this notice are preserved.