1 2023-09-09 benjamin priour <vultkayn@gcc.gnu.org>
5 (region_model::add_constraints_from_binop): binop_svalues around
6 LT_EXPR, LE_EXPR, GT_EXPR, GE_EXPR are now unwrapped.
8 2023-09-07 David Malcolm <dmalcolm@redhat.com>
11 * program-point.cc (program_point::on_edge): Don't reject
12 EDGE_ABNORMAL for computed gotos.
13 * region-model.cc (region_model::maybe_update_for_edge): Handle
14 computed goto statements.
15 (region_model::apply_constraints_for_ggoto): New.
16 * region-model.h (region_model::apply_constraints_for_ggoto): New decl.
17 * supergraph.cc (supernode::get_label): New.
18 * supergraph.h (supernode::get_label): New decl.
20 2023-09-07 benjamin priour <vultkayn@gcc.gnu.org>
21 David Malcolm <dmalcolm@redhat.com>
24 * diagnostic-manager.cc
25 (compatible_epaths_p): New function.
26 (saved_diagnostic::supercedes_p): Now calls the above
27 to determine if the diagnostics do overlap and the superseding
30 2023-09-07 David Malcolm <dmalcolm@redhat.com>
32 * region-model.h: fix -Wunused-parameter warnings
34 2023-09-06 David Malcolm <dmalcolm@redhat.com>
37 * kf.cc (class kf_strstr): New.
38 (kf_strstr::impl_call_post): New.
39 (register_known_functions): Register it.
41 2023-09-06 David Malcolm <dmalcolm@redhat.com>
44 * kf.cc (class kf_strncpy): New.
45 (kf_strncpy::impl_call_post): New.
46 (register_known_functions): Register it.
47 * region-model.cc (region_model::read_bytes): Handle unknown
50 2023-09-06 David Malcolm <dmalcolm@redhat.com>
52 * kf.cc (kf_calloc::impl_call_pre): Pass ctxt to zero_fill_region.
53 (kf_memset::impl_call_pre): Move responsibility for calling
54 check_region_for_write to fill_region.
55 * region-model.cc (region_model::on_assignment): Pass ctxt to
57 (region_model::fill_region): Add "ctxt" param, using it to call
58 check_region_for_write.
59 (region_model::zero_fill_region): Likewise.
60 * region-model.h (region_model::fill_region): Add "ctxt" param.
61 (region_model::zero_fill_region): Likewise.
63 2023-09-01 benjamin priour <priour.be@gmail.com>
67 * analyzer.h (is_placement_new_p): New declaration.
69 (call_details::deref_ptr_arg): New function.
70 Dereference the argument at given index if possible.
71 * call-details.h: Declaration of the above function.
72 * kf-lang-cp.cc (is_placement_new_p): Returns true if the gcall
73 is recognized as a placement new.
74 (kf_operator_delete::impl_call_post): Unbinding a region and its
75 descendents now poisons with POISON_KIND_DELETED.
76 (register_known_functions_lang_cp): Known function "operator
77 delete" is now registered only once independently of its number of
79 * region-model.cc (region_model::eval_condition): Now
80 recursively calls itself if any of the operand is wrapped in a
82 * sm-malloc.cc (malloc_state_machine::on_stmt):
83 Add placement new recognition.
84 * svalue.cc (poison_kind_to_str): Wording for the new PK.
85 * svalue.h (enum poison_kind): Add value POISON_KIND_DELETED.
87 2023-08-31 Francois-Xavier Coudert <fxcoudert@gcc.gnu.org>
89 * kf.cc: Change spelling to macOS.
91 2023-08-30 Eric Feng <ef2648@columbia.edu>
94 * engine.cc (impl_region_model_context::warn): New optional
96 * exploded-graph.h (class impl_region_model_context): Likewise.
97 * region-model.cc (region_model::pop_frame): New callback
98 feature for region_model::pop_frame.
99 * region-model.h (struct append_regions_cb_data): Likewise.
100 (class region_model): Likewise.
101 (class region_model_context): New optional parameter.
102 (class region_model_context_decorator): Likewise.
104 2023-08-30 Francois-Xavier Coudert <fxcoudert@gcc.gnu.org>
106 * region-model.cc: Define INCLUDE_ALGORITHM.
108 2023-08-29 David Malcolm <dmalcolm@redhat.com>
111 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
112 selftest::analyzer_ranges_cc_tests.
113 * analyzer-selftests.h (selftest::run_analyzer_selftests): New
115 * analyzer.opt (Wanalyzer-overlapping-buffers): New option.
116 * call-details.cc: Include "analyzer/ranges.h" and "make-unique.h".
117 (class overlapping_buffers): New.
118 (call_details::complain_about_overlap): New.
119 * call-details.h (call_details::complain_about_overlap): New decl.
120 * kf.cc (kf_memcpy_memmove::impl_call_pre): Call
121 cd.complain_about_overlap for memcpy and memcpy_chk.
122 (kf_strcat::impl_call_pre): Call cd.complain_about_overlap.
123 (kf_strcpy::impl_call_pre): Likewise.
124 * ranges.cc: New file.
125 * ranges.h: New file.
127 2023-08-29 David Malcolm <dmalcolm@redhat.com>
130 * kf.cc (kf_strdup::impl_call_pre): Set size of
131 dynamically-allocated buffer. Simulate copying the string from
132 the source region to the new buffer.
134 2023-08-27 benjamin priour <vultkayn@gcc.gnu.org>
137 * analyzer.h (class known_function): Add virtual casts
138 to builtin_known_function.
139 (class builtin_known_function): New subclass of known_function
141 * kf.cc (class kf_alloca): Now derived from
142 builtin_known_function.
143 (class kf_calloc): Likewise.
144 (class kf_free): Likewise.
145 (class kf_malloc): Likewise.
146 (class kf_memcpy_memmove): Likewise.
147 (class kf_memset): Likewise.
148 (class kf_realloc): Likewise.
149 (class kf_strchr): Likewise.
150 (class kf_sprintf): Likewise.
151 (class kf_strcat): Likewise.
152 (class kf_strcpy): Likewise.
153 (class kf_strdup): Likewise.
154 (class kf_strlen): Likewise.
155 (class kf_strndup): Likewise.
156 (register_known_functions): Builtins are now registered as
157 known_functions by name rather than by their BUILTIN_CODE.
158 * known-function-manager.cc (get_normal_builtin): New overload.
159 * known-function-manager.h: New overload declaration.
160 * region-model.cc (region_model::get_builtin_kf): New function.
161 * region-model.h (class region_model): Add declaration of
163 * sm-fd.cc: For called recognized as builtins, use the
164 attributes of that builtin as defined in gcc/builtins.def
165 rather than the user's.
166 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
168 2023-08-25 David Malcolm <dmalcolm@redhat.com>
170 * access-diagram.cc (class string_region_spatial_item): Remove
171 assumption that the string is written to the start of the cluster.
173 2023-08-24 David Malcolm <dmalcolm@redhat.com>
177 (call_details::check_for_null_terminated_string_arg): Split into
178 overloads, one taking just an arg_idx, the other a new
179 "include_terminator" param.
180 * call-details.h: Likewise.
181 * kf.cc (class kf_strcat): New.
182 (kf_strcpy::impl_call_pre): Update for change to
183 check_for_null_terminated_string_arg.
184 (register_known_functions): Register kf_strcat.
186 (region_model::check_for_null_terminated_string_arg): Split into
187 overloads, one taking just an arg_idx, the other a new
188 "include_terminator" param. When returning an svalue, handle
189 "include_terminator" being false by subtracting one.
191 (region_model::check_for_null_terminated_string_arg): Split into
192 overloads, one taking just an arg_idx, the other a new
193 "include_terminator" param.
195 2023-08-24 David Malcolm <dmalcolm@redhat.com>
198 * region-model.cc (fragment::has_null_terminator): Handle
201 2023-08-24 David Malcolm <dmalcolm@redhat.com>
204 * region-model-manager.cc
205 (region_model_manager::get_or_create_initial_value): Simplify
206 INIT_VAL(ELEMENT_REG(STRING_REG), CONSTANT_SVAL) to
207 CONSTANT_SVAL(STRING[N]).
209 2023-08-24 David Malcolm <dmalcolm@redhat.com>
212 * region-model.cc (fragment::has_null_terminator): Move STRING_CST
213 handling to fragment::string_cst_has_null_terminator; also use it to
214 handle INIT_VAL(STRING_REG).
215 (fragment::string_cst_has_null_terminator): New, from above.
217 2023-08-24 David Malcolm <dmalcolm@redhat.com>
219 * kf.cc (kf_memcpy_memmove::impl_call_pre): Reimplement using
220 region_model::copy_bytes.
221 * region-model.cc (region_model::read_bytes): New.
222 (region_model::copy_bytes): New.
223 * region-model.h (region_model::read_bytes): New decl.
224 (region_model::copy_bytes): New decl.
226 2023-08-24 David Malcolm <dmalcolm@redhat.com>
229 * region-model.cc (region_model::get_string_size): Delete both.
230 * region-model.h (region_model::get_string_size): Delete both
233 2023-08-24 David Malcolm <dmalcolm@redhat.com>
236 * kf.cc (kf_strcpy::impl_call_pre): Reimplement using
237 check_for_null_terminated_string_arg.
238 * region-model.cc (region_model::get_store_bytes): Shortcut
239 reading all of a string_region.
240 (region_model::scan_for_null_terminator): Use get_store_value for
241 the bytes rather than "unknown" when returning an unknown length.
242 (region_model::write_bytes): New.
243 * region-model.h (region_model::write_bytes): New decl.
245 2023-08-24 David Malcolm <dmalcolm@redhat.com>
248 * region-model.cc (iterable_cluster::iterable_cluster): Add
249 symbolic binding keys to m_symbolic_bindings.
250 (iterable_cluster::has_symbolic_bindings_p): New.
251 (iterable_cluster::m_symbolic_bindings): New field.
252 (region_model::scan_for_null_terminator): Treat clusters with
253 symbolic bindings as having unknown strlen.
255 2023-08-24 David Malcolm <dmalcolm@redhat.com>
257 * engine.cc (impl_path_context::impl_path_context): Add logger
259 (impl_path_context::bifurcate): Add log message.
260 (impl_path_context::terminate_path): Likewise.
261 (impl_path_context::m_logger): New field.
262 (exploded_graph::process_node): Pass logger to path_ctxt ctor.
264 2023-08-22 David Malcolm <dmalcolm@redhat.com>
267 * kf-analyzer.cc (class kf_analyzer_get_strlen): Move to kf.cc.
268 (register_known_analyzer_functions): Use make_kf_strlen.
269 * kf.cc (class kf_strlen::impl_call_pre): Replace with
270 implementation of kf_analyzer_get_strlen from kf-analyzer.cc.
271 Handle "UNKNOWN" return from check_for_null_terminated_string_arg
272 by falling back to a conjured svalue.
273 (make_kf_strlen): New.
274 (register_known_functions): Use make_kf_strlen.
275 * known-function-manager.h (make_kf_strlen): New decl.
277 2023-08-22 David Malcolm <dmalcolm@redhat.com>
280 * call-details.cc (call_details::call_details): New ctor.
281 * call-details.h (call_details::call_details): New ctor decl.
282 (struct call_arg_details): Move here from region-model.cc.
283 * region-model.cc (region_model::check_call_format_attr): New.
284 (region_model::check_call_args): Call it.
285 (struct call_arg_details): Move it to call-details.h.
286 * region-model.h (region_model::check_call_format_attr): New decl.
288 2023-08-22 David Malcolm <dmalcolm@redhat.com>
290 * kf.cc (class kf_fopen): New.
291 (register_known_functions): Register it.
293 2023-08-22 David Malcolm <dmalcolm@redhat.com>
296 * analyzer.opt (Wanalyzer-unterminated-string): Delete.
298 (call_details::check_for_null_terminated_string_arg): Convert
299 return type from void to const svalue *. Add param "out_sval".
301 (call_details::check_for_null_terminated_string_arg): Likewise.
302 * kf-analyzer.cc (kf_analyzer_get_strlen::impl_call_pre): Wire up
303 to result of check_for_null_terminated_string_arg.
304 * region-model.cc (get_strlen): Delete.
305 (class unterminated_string_arg): Delete.
306 (struct fragment): New.
307 (class iterable_cluster): New.
308 (region_model::get_store_bytes): New.
309 (get_tree_for_byte_offset): New.
310 (region_model::scan_for_null_terminator): New.
311 (region_model::check_for_null_terminated_string_arg): Convert
312 return type from void to const svalue *. Add param "out_sval".
313 Reimplement in terms of scan_for_null_terminator, dropping the
314 special-case for -Wanalyzer-unterminated-string.
315 * region-model.h (region_model::get_store_bytes): New decl.
316 (region_model::scan_for_null_terminator): New decl.
317 (region_model::check_for_null_terminated_string_arg): Convert
318 return type from void to const svalue *. Add param "out_sval".
319 * store.cc (concrete_binding::get_byte_range): New.
320 * store.h (concrete_binding::get_byte_range): New decl.
321 (store_manager::get_concrete_binding): New overload.
323 2023-08-22 David Malcolm <dmalcolm@redhat.com>
325 * region-model.cc (region_model_context_decorator::add_event):
326 Handle m_inner being NULL.
327 * region-model.h (class region_model_context_decorator): Likewise.
328 (annotating_context::warn): Likewise.
330 2023-08-22 David Malcolm <dmalcolm@redhat.com>
332 * diagnostic-manager.cc (saved_diagnostic::add_event): New.
333 (saved_diagnostic::add_any_saved_events): New.
334 (diagnostic_manager::add_event): New.
335 (dedupe_winners::emit_best): New.
336 (diagnostic_manager::emit_saved_diagnostic): Make "sd" param
337 non-const. Call saved_diagnostic::add_any_saved_events.
338 * diagnostic-manager.h (saved_diagnostic::add_event): New decl.
339 (saved_diagnostic::add_any_saved_events): New decl.
340 (saved_diagnostic::m_saved_events): New field.
341 (diagnostic_manager::add_event): New decl.
342 (diagnostic_manager::emit_saved_diagnostic): Make "sd" param
344 * engine.cc (impl_region_model_context::add_event): New.
345 * exploded-graph.h (impl_region_model_context::add_event): New decl.
347 (noop_region_model_context::add_event): New.
348 (region_model_context_decorator::add_event): New.
349 * region-model.h (region_model_context::add_event): New vfunc.
350 (noop_region_model_context::add_event): New decl.
351 (region_model_context_decorator::add_event): New decl.
353 2023-08-22 David Malcolm <dmalcolm@redhat.com>
356 (class check_external_function_for_access_attr::annotating_ctxt):
357 Convert to an annotating_context.
358 * region-model.h (class note_adding_context): Rename to...
359 (class annotating_context): ...this, updating the "warn" method.
360 (note_adding_context::make_note): Replace with...
361 (annotating_context::add_annotations): ...this.
363 2023-08-14 benjamin priour <vultkayn@gcc.gnu.org>
366 * analyzer.opt: Add new option.
367 * diagnostic-manager.cc
368 (diagnostic_manager::prune_path): Call prune_system_headers.
369 (prune_frame): New function that deletes all events in a frame.
370 (diagnostic_manager::prune_system_headers): New function.
371 * diagnostic-manager.h: Add prune_system_headers declaration.
373 2023-08-11 David Malcolm <dmalcolm@redhat.com>
376 * analyzer.opt (Wanalyzer-unterminated-string): New.
378 (call_details::check_for_null_terminated_string_arg): New.
380 (call_details::check_for_null_terminated_string_arg): New decl.
381 * kf-analyzer.cc (class kf_analyzer_get_strlen): New.
382 (register_known_analyzer_functions): Register it.
383 * kf.cc (kf_error::impl_call_pre): Check that format arg is a
384 valid null-terminated string.
385 (kf_putenv::impl_call_pre): Likewise for the sole param.
386 (kf_strchr::impl_call_pre): Likewise for the first param.
387 (kf_strcpy::impl_call_pre): Likewise for the second param.
388 (kf_strdup::impl_call_pre): Likewise for the sole param.
389 * region-model.cc (get_strlen): New.
390 (struct call_arg_details): New.
391 (inform_about_expected_null_terminated_string_arg): New.
392 (class unterminated_string_arg): New.
393 (region_model::check_for_null_terminated_string_arg): New.
395 (region_model::check_for_null_terminated_string_arg): New decl.
397 2023-08-11 Eric Feng <ef2648@columbia.edu>
400 * call-details.h: New function.
401 * region-model.cc (region_model::get_or_create_region_for_heap_alloc):
402 New optional parameters.
403 * region-model.h (class region_model): New optional parameters.
404 * sm-malloc.cc (on_realloc_with_move): New function.
405 (region_model::transition_ptr_sval_non_null): New function.
407 2023-08-09 David Malcolm <dmalcolm@redhat.com>
409 * analyzer.h (class pure_known_function_with_default_return): New
411 * call-details.cc (const_fn_p): Move here from region-model.cc.
412 (maybe_get_const_fn_result): Likewise.
413 (get_result_size_in_bytes): Likewise.
414 (call_details::set_any_lhs_with_defaults): New function, based on
415 code in region_model::on_call_pre.
416 * call-details.h (call_details::set_any_lhs_with_defaults): New
418 * diagnostic-manager.cc
419 (diagnostic_manager::emit_saved_diagnostic): Log the index of the
421 * kf.cc (pure_known_function_with_default_return::impl_call_pre):
423 (kf_memset::impl_call_pre): Set the LHS to the first param.
424 (kf_putenv::impl_call_pre): Call cd.set_any_lhs_with_defaults.
425 (kf_sprintf::impl_call_pre): Call cd.set_any_lhs_with_defaults.
426 (class kf_stack_restore): Derive from
427 pure_known_function_with_default_return.
428 (class kf_stack_save): Likewise.
429 (kf_strlen::impl_call_pre): Call cd.set_any_lhs_with_defaults.
430 * region-model-reachability.cc (reachable_regions::handle_sval):
431 Remove logic for symbolic regions for pointers.
432 * region-model.cc (region_model::canonicalize): Remove purging of
433 dynamic extents workaround for surplus values from
434 region_model::on_call_pre's default LHS code.
435 (const_fn_p): Move to call-details.cc.
436 (maybe_get_const_fn_result): Likewise.
437 (get_result_size_in_bytes): Likewise.
438 (region_model::update_for_nonzero_return): Call
439 cd.set_any_lhs_with_defaults.
440 (region_model::on_call_pre): Remove the assignment to the LHS of a
441 default return value, instead requiring all known_function
442 implementations to write to any LHS of the call. Use
443 cd.set_any_lhs_with_defaults on the non-kf paths.
444 * sm-fd.cc (kf_socket::outcome_of_socket::update_model): Use
445 cd.set_any_lhs_with_defaults when failing to get at fd state.
446 (kf_bind::outcome_of_bind::update_model): Likewise.
447 (kf_listen::outcome_of_listen::update_model): Likewise.
448 (kf_accept::outcome_of_accept::update_model): Likewise.
449 (kf_connect::outcome_of_connect::update_model): Likewise.
450 (kf_read::impl_call_pre): Use cd.set_any_lhs_with_defaults.
451 * sm-file.cc (class kf_stdio_output_fn): Derive from
452 pure_known_function_with_default_return.
453 (class kf_ferror): Likewise.
454 (class kf_fileno): Likewise.
455 (kf_fgets::impl_call_pre): Use cd.set_any_lhs_with_defaults.
456 (kf_read::impl_call_pre): Likewise.
457 (class kf_getc): Derive from
458 pure_known_function_with_default_return.
459 (class kf_getchar): Likewise.
460 * varargs.cc (kf_va_arg::impl_call_pre): Use
461 cd.set_any_lhs_with_defaults.
463 2023-08-04 David Malcolm <dmalcolm@redhat.com>
466 * bounds-checking.cc (region_model::check_region_bounds): Handle
467 symbolic base regions.
468 * call-details.cc: Include "stringpool.h" and "attribs.h".
469 (call_details::lookup_function_attribute): New function.
470 * call-details.h (call_details::lookup_function_attribute): New
472 * region-model-manager.cc
473 (region_model_manager::maybe_fold_binop): Add reference to
475 * region-model-reachability.cc (reachable_regions::handle_sval):
476 Add symbolic regions for pointers that are conjured svalues for
478 * region-model.cc (region_model::canonicalize): Purge dynamic
479 extents for regions that aren't referenced.
480 (get_result_size_in_bytes): New function.
481 (region_model::on_call_pre): Use get_result_size_in_bytes and
482 potentially set the dynamic extents of the region pointed to by
484 (region_model::deref_rvalue): Add param "add_nonnull_constraint"
485 and use it to conditionalize adding the constraint.
486 (pending_diagnostic_subclass::dubious_allocation_size): Add "stmt"
487 param to both ctors and use it to initialize new "m_stmt" field.
488 (pending_diagnostic_subclass::operator==): Use m_stmt; don't use
490 (pending_diagnostic_subclass::m_stmt): New field.
491 (region_model::check_region_size): Generalize to any kind of
492 pointer svalue by using deref_rvalue rather than checking for
493 region_svalue. Pass stmt to dubious_allocation_size ctor.
494 * region-model.h (region_model::deref_rvalue): Add param
495 "add_nonnull_constraint".
496 * svalue.cc (conjured_svalue::lhs_value_p): New function.
497 * svalue.h (conjured_svalue::lhs_value_p): New decl.
499 2023-08-04 David Malcolm <dmalcolm@redhat.com>
501 * svalue.cc (region_svalue::dump_to_pp): Support NULL type.
502 (constant_svalue::dump_to_pp): Likewise.
503 (initial_svalue::dump_to_pp): Likewise.
504 (conjured_svalue::dump_to_pp): Likewise. Fix missing print of the
507 2023-08-03 David Malcolm <dmalcolm@redhat.com>
510 * region.cc (int_size_in_bits): Fail on zero-sized types.
512 2023-08-02 Eric Feng <ef2648@columbia.edu>
515 * analyzer-language.cc (run_callbacks): New function.
516 (on_finish_translation_unit): New function.
517 * analyzer-language.h (GCC_ANALYZER_LANGUAGE_H): New include.
518 (class translation_unit): New vfuncs.
520 2023-07-26 David Malcolm <dmalcolm@redhat.com>
523 * region-model-manager.cc
524 (region_model_manager::region_model_manager): Update for
525 generalizing region ids to also cover svalues.
526 (region_model_manager::get_or_create_constant_svalue): Likewise.
527 (region_model_manager::get_or_create_unknown_svalue): Likewise.
528 (region_model_manager::create_unique_svalue): Likewise.
529 (region_model_manager::get_or_create_initial_value): Likewise.
530 (region_model_manager::get_or_create_setjmp_svalue): Likewise.
531 (region_model_manager::get_or_create_poisoned_svalue): Likewise.
532 (region_model_manager::get_ptr_svalue): Likewise.
533 (region_model_manager::get_or_create_unaryop): Likewise.
534 (region_model_manager::get_or_create_binop): Likewise.
535 (region_model_manager::get_or_create_sub_svalue): Likewise.
536 (region_model_manager::get_or_create_repeated_svalue): Likewise.
537 (region_model_manager::get_or_create_bits_within): Likewise.
538 (region_model_manager::get_or_create_unmergeable): Likewise.
539 (region_model_manager::get_or_create_widening_svalue): Likewise.
540 (region_model_manager::get_or_create_compound_svalue): Likewise.
541 (region_model_manager::get_or_create_conjured_svalue): Likewise.
542 (region_model_manager::get_or_create_asm_output_svalue): Likewise.
543 (region_model_manager::get_or_create_const_fn_result_svalue):
545 (region_model_manager::get_region_for_fndecl): Likewise.
546 (region_model_manager::get_region_for_label): Likewise.
547 (region_model_manager::get_region_for_global): Likewise.
548 (region_model_manager::get_field_region): Likewise.
549 (region_model_manager::get_element_region): Likewise.
550 (region_model_manager::get_offset_region): Likewise.
551 (region_model_manager::get_sized_region): Likewise.
552 (region_model_manager::get_cast_region): Likewise.
553 (region_model_manager::get_frame_region): Likewise.
554 (region_model_manager::get_symbolic_region): Likewise.
555 (region_model_manager::get_region_for_string): Likewise.
556 (region_model_manager::get_bit_range): Likewise.
557 (region_model_manager::get_var_arg_region): Likewise.
558 (region_model_manager::get_region_for_unexpected_tree_code):
560 (region_model_manager::get_or_create_region_for_heap_alloc):
562 (region_model_manager::create_region_for_alloca): Likewise.
563 (region_model_manager::log_stats): Likewise.
564 * region-model-manager.h (region_model_manager::get_num_regions):
566 (region_model_manager::get_num_symbols): ...this.
567 (region_model_manager::alloc_region_id): Replace with...
568 (region_model_manager::alloc_symbol_id): ...this.
569 (region_model_manager::m_next_region_id): Replace with...
570 (region_model_manager::m_next_symbol_id): ...this.
571 * region-model.cc (selftest::test_get_representative_tree): Update
572 for generalizing region ids to also cover svalues.
573 (selftest::test_binop_svalue_folding): Likewise.
574 (selftest::test_state_merging): Likewise.
575 * region.cc (region::cmp_ids): Delete, in favor of
577 (region::region): Update for introduction of symbol base class.
578 (frame_region::get_region_for_local): Likewise.
579 (root_region::root_region): Likewise.
580 (symbolic_region::symbolic_region): Likewise.
581 * region.h: Replace include of "analyzer/complexity.h" with
583 (class region): Make a subclass of symbol.
584 (region::get_id): Delete in favor of symbol::get_id.
585 (region::cmp_ids): Delete in favor of symbol::cmp_ids.
586 (region::get_complexity): Delete in favor of
587 symbol::get_complexity.
588 (region::region): Use symbol::id_t for "id" param.
589 (region::m_complexity): Move field to symbol base class.
590 (region::m_id): Likewise.
591 (space_region::space_region): Use symbol::id_t for "id" param.
592 (frame_region::frame_region): Likewise.
593 (globals_region::globals_region): Likewise.
594 (code_region::code_region): Likewise.
595 (function_region::function_region): Likewise.
596 (label_region::label_region): Likewise.
597 (stack_region::stack_region): Likewise.
598 (heap_region::heap_region): Likewise.
599 (thread_local_region::thread_local_region): Likewise.
600 (root_region::root_region): Likewise.
601 (symbolic_region::symbolic_region): Likewise.
602 (decl_region::decl_region): Likewise.
603 (field_region::field_region): Likewise.
604 (element_region::element_region): Likewise.
605 (offset_region::offset_region): Likewise.
606 (sized_region::sized_region): Likewise.
607 (cast_region::cast_region): Likewise.
608 (heap_allocated_region::heap_allocated_region): Likewise.
609 (alloca_region::alloca_region): Likewise.
610 (string_region::string_region): Likewise.
611 (bit_range_region::bit_range_region): Likewise.
612 (var_arg_region::var_arg_region): Likewise.
613 (errno_region::errno_region): Likewise.
614 (unknown_region::unknown_region): Likewise.
615 * svalue.cc (sub_svalue::sub_svalue): Add symbol::id_t param.
616 (repeated_svalue::repeated_svalue): Likewise.
617 (bits_within_svalue::bits_within_svalue): Likewise.
618 (compound_svalue::compound_svalue): Likewise.
619 * svalue.h: Replace include of "analyzer/complexity.h" with
621 (class svalue): Make a subclass of symbol.
622 (svalue::get_complexity): Delete in favor of
623 symbol::get_complexity.
624 (svalue::svalue): Add symbol::id_t param. Update for new base
626 (svalue::m_complexity): Delete in favor of
627 symbol::m_complexity.
628 (region_svalue::region_svalue): Add symbol::id_t param
629 (constant_svalue::constant_svalue): Likewise.
630 (unknown_svalue::unknown_svalue): Likewise.
631 (poisoned_svalue::poisoned_svalue): Likewise.
632 (setjmp_svalue::setjmp_svalue): Likewise.
633 (initial_svalue::initial_svalue): Likewise.
634 (unaryop_svalue::unaryop_svalue): Likewise.
635 (binop_svalue::binop_svalue): Likewise.
636 (sub_svalue::sub_svalue): Likewise.
637 (repeated_svalue::repeated_svalue): Likewise.
638 (bits_within_svalue::bits_within_svalue): Likewise.
639 (unmergeable_svalue::unmergeable_svalue): Likewise.
640 (placeholder_svalue::placeholder_svalue): Likewise.
641 (widening_svalue::widening_svalue): Likewise.
642 (compound_svalue::compound_svalue): Likewise.
643 (conjured_svalue::conjured_svalue): Likewise.
644 (asm_output_svalue::asm_output_svalue): Likewise.
645 (const_fn_result_svalue::const_fn_result_svalue): Likewise.
646 * symbol.cc: New file.
647 * symbol.h: New file.
649 2023-07-21 David Malcolm <dmalcolm@redhat.com>
652 * region-model.cc (region_model::get_gassign_result): Only check
653 for bad shift counts when dealing with an integral type.
655 2023-07-21 David Malcolm <dmalcolm@redhat.com>
659 * access-diagram.cc (class spatial_item): Add virtual dtor.
661 2023-07-21 David Malcolm <dmalcolm@redhat.com>
664 * region.h (struct cast_region::key_t): Support "m_type" being
665 null by using "m_original_region" for empty/deleted slots.
667 2023-07-19 David Malcolm <dmalcolm@redhat.com>
670 * region-model-manager.cc
671 (region_model_manager::get_or_create_int_cst): Assert that we have
672 an integral or pointer type.
673 * sm-taint.cc (taint_state_machine::check_for_tainted_divisor):
674 Don't check non-integral types.
676 2023-06-29 benjamin priour <priour.be@gmail.com>
679 * region-model-manager.cc
680 (region_model_manager::get_or_create_initial_value): Take an
681 optional boolean value to bypass poisoning checks
682 * region-model-manager.h: Update declaration of the above function.
683 * region-model.cc (region_model::get_store_value): No longer returns
684 on OOB, but rather gives a boolean to get_or_create_initial_value.
685 (region_model::check_region_access): Update docstring.
686 (region_model::check_region_for_write): Update docstring.
688 2023-06-24 David Malcolm <dmalcolm@redhat.com>
690 * access-diagram.cc: Add #define INCLUDE_VECTOR.
691 * bounds-checking.cc: Likewise.
693 2023-06-22 David Malcolm <dmalcolm@redhat.com>
696 * access-diagram.cc: New file.
697 * access-diagram.h: New file.
698 * analyzer.h (class region_offset): Add default ctor.
699 (region_offset::make_byte_offset): New decl.
700 (region_offset::concrete_p): New.
701 (region_offset::get_concrete_byte_offset): New.
702 (region_offset::calc_symbolic_bit_offset): New decl.
703 (region_offset::calc_symbolic_byte_offset): New decl.
704 (region_offset::dump_to_pp): New decl.
705 (region_offset::dump): New decl.
706 (operator<, operator<=, operator>, operator>=): New decls for
709 (-param=analyzer-text-art-string-ellipsis-threshold=): New.
710 (-param=analyzer-text-art-string-ellipsis-head-len=): New.
711 (-param=analyzer-text-art-string-ellipsis-tail-len=): New.
712 (-param=analyzer-text-art-ideal-canvas-width=): New.
713 (fanalyzer-debug-text-art): New.
714 * bounds-checking.cc: Include "intl.h", "diagnostic-diagram.h",
715 and "analyzer/access-diagram.h".
716 (class out_of_bounds::oob_region_creation_event_capacity): New.
717 (out_of_bounds::out_of_bounds): Add "model" and "sval_hint"
719 (out_of_bounds::mark_interesting_stuff): Use the base region.
720 (out_of_bounds::add_region_creation_events): Use
721 oob_region_creation_event_capacity.
722 (out_of_bounds::get_dir): New pure vfunc.
723 (out_of_bounds::maybe_show_notes): New.
724 (out_of_bounds::maybe_show_diagram): New.
725 (out_of_bounds::make_access_diagram): New.
726 (out_of_bounds::m_model): New field.
727 (out_of_bounds::m_sval_hint): New field.
728 (out_of_bounds::m_region_creation_event_id): New field.
729 (concrete_out_of_bounds::concrete_out_of_bounds): Update for new
731 (concrete_past_the_end::concrete_past_the_end): Likewise.
732 (concrete_past_the_end::add_region_creation_events): Use
733 oob_region_creation_event_capacity.
734 (concrete_buffer_overflow::concrete_buffer_overflow): Update for
736 (concrete_buffer_overflow::emit): Replace call to
737 maybe_describe_array_bounds with maybe_show_notes.
738 (concrete_buffer_overflow::get_dir): New.
739 (concrete_buffer_over_read::concrete_buffer_over_read): Update for
741 (concrete_buffer_over_read::emit): Replace call to
742 maybe_describe_array_bounds with maybe_show_notes.
743 (concrete_buffer_overflow::get_dir): New.
744 (concrete_buffer_underwrite::concrete_buffer_underwrite): Update
746 (concrete_buffer_underwrite::emit): Replace call to
747 maybe_describe_array_bounds with maybe_show_notes.
748 (concrete_buffer_underwrite::get_dir): New.
749 (concrete_buffer_under_read::concrete_buffer_under_read): Update
751 (concrete_buffer_under_read::emit): Replace call to
752 maybe_describe_array_bounds with maybe_show_notes.
753 (concrete_buffer_under_read::get_dir): New.
754 (symbolic_past_the_end::symbolic_past_the_end): Update for new
756 (symbolic_buffer_overflow::symbolic_buffer_overflow): Likewise.
757 (symbolic_buffer_overflow::emit): Call maybe_show_notes.
758 (symbolic_buffer_overflow::get_dir): New.
759 (symbolic_buffer_over_read::symbolic_buffer_over_read): Update for
761 (symbolic_buffer_over_read::emit): Call maybe_show_notes.
762 (symbolic_buffer_over_read::get_dir): New.
763 (region_model::check_symbolic_bounds): Add "sval_hint" param. Pass
764 it and sized_offset_reg to diagnostics.
765 (region_model::check_region_bounds): Add "sval_hint" param, passing
767 * diagnostic-manager.cc
768 (diagnostic_manager::emit_saved_diagnostic): Pass logger to
769 pending_diagnostic::emit.
770 * engine.cc: Add logger param to pending_diagnostic::emit
772 * infinite-recursion.cc: Likewise.
773 * kf-analyzer.cc: Likewise.
774 * kf.cc: Likewise. Add nullptr for new param of
775 check_region_for_write.
776 * pending-diagnostic.h: Likewise in decl.
777 * region-model-manager.cc
778 (region_model_manager::get_or_create_int_cst): Convert param from
779 poly_int64 to const poly_wide_int_ref &.
780 (region_model_manager::maybe_fold_binop): Support type being NULL
781 when checking for floating-point types.
782 Check for (X + Y) - X => Y. Be less strict about types when folding
783 associative ops. Check for (X + Y) * CST => (X * CST) + (Y * CST).
784 * region-model-manager.h
785 (region_model_manager::get_or_create_int_cst): Convert param from
786 poly_int64 to const poly_wide_int_ref &.
787 * region-model.cc: Add logger param to pending_diagnostic::emit
789 (region_model::check_external_function_for_access_attr): Update
790 for new param of check_region_for_write.
791 (region_model::deref_rvalue): Use nullptr rather than NULL.
792 (region_model::get_capacity): Handle RK_STRING.
793 (region_model::check_region_access): Add "sval_hint" param; pass it to
795 (region_model::check_region_for_write): Add "sval_hint" param;
796 pass it to check_region_access.
797 (region_model::check_region_for_read): Add NULL for new param to
799 (region_model::set_value): Pass rhs_sval to
800 check_region_for_write.
801 (region_model::get_representative_path_var_1): Handle SK_CONSTANT
802 in the check for infinite recursion.
803 * region-model.h (region_model::check_region_for_write): Add
805 (region_model::check_region_access): Likewise.
806 (region_model::check_symbolic_bounds): Likewise.
807 (region_model::check_region_bounds): Likewise.
808 * region.cc (region_offset::make_byte_offset): New.
809 (region_offset::calc_symbolic_bit_offset): New.
810 (region_offset::calc_symbolic_byte_offset): New.
811 (region_offset::dump_to_pp): New.
812 (region_offset::dump): New.
813 (struct linear_op): New.
814 (operator<, operator<=, operator>, operator>=): New, for
816 (region::get_next_offset): New.
817 (region::get_relative_symbolic_offset): Use ptrdiff_type_node.
818 (field_region::get_relative_symbolic_offset): Likewise.
819 (element_region::get_relative_symbolic_offset): Likewise.
820 (bit_range_region::get_relative_symbolic_offset): Likewise.
821 * region.h (region::get_next_offset): New decl.
822 * sm-fd.cc: Add logger param to pending_diagnostic::emit
824 * sm-file.cc: Likewise.
825 * sm-malloc.cc: Likewise.
826 * sm-pattern-test.cc: Likewise.
827 * sm-sensitive.cc: Likewise.
828 * sm-signal.cc: Likewise.
829 * sm-taint.cc: Likewise.
830 * store.cc (bit_range::contains_p): Allow "out" to be null.
831 * store.h (byte_range::get_start_bit_offset): New.
832 (byte_range::get_next_bit_offset): New.
833 * varargs.cc: Add logger param to pending_diagnostic::emit
836 2023-06-10 Tim Lange <mail@tim-lange.me>
839 * constraint-manager.cc (class sval_finder): Visitor to find
840 childs in svalue trees.
841 (constraint_manager::sval_constrained_p): Add new function to
842 check whether a sval might be part of an constraint.
843 * constraint-manager.h: Add sval_constrained_p function.
844 * region-model.cc (class size_visitor): Reverse behavior to not
845 emit a warning on not explicitly considered cases.
846 (region_model::check_region_size):
847 Adapt to size_visitor changes.
849 2023-06-09 David Malcolm <dmalcolm@redhat.com>
852 * region-model.cc (region_model::get_initial_value_for_global):
853 Move code to region::calc_initial_value_at_main.
854 * region.cc (region::get_initial_value_at_main): New function.
855 (region::calc_initial_value_at_main): New function, based on code
856 in region_model::get_initial_value_for_global.
857 (region::region): Initialize m_cached_init_sval_at_main.
858 (decl_region::get_svalue_for_constructor): Add a cache, splitting
860 (decl_region::calc_svalue_for_constructor): ...this new function.
861 * region.h (region::get_initial_value_at_main): New decl.
862 (region::calc_initial_value_at_main): New decl.
863 (region::m_cached_init_sval_at_main): New field.
864 (decl_region::decl_region): Initialize m_ctor_svalue.
865 (decl_region::calc_svalue_for_constructor): New decl.
866 (decl_region::m_ctor_svalue): New field.
868 2023-06-08 Benjamin Priour <vultkayn@gcc.gnu.org>
870 * bounds-checking.cc (region_model::check_symbolic_bounds): Returns whether the BASE_REG
871 region access was OOB.
872 (region_model::check_region_bounds): Likewise.
873 * region-model.cc (region_model::get_store_value): Creates an
874 unknown svalue on OOB-read access to REG.
875 (region_model::check_region_access): Returns whether an unknown svalue needs be created.
876 (region_model::check_region_for_read): Passes check_region_access return value.
877 * region-model.h: Update prior function definitions.
879 2023-06-02 David Malcolm <dmalcolm@redhat.com>
882 * kf.cc (class kf_atomic_exchange): New.
883 (class kf_atomic_exchange_n): New.
884 (class kf_atomic_fetch_op): New.
885 (class kf_atomic_op_fetch): New.
886 (class kf_atomic_load): New.
887 (class kf_atomic_load_n): New.
888 (class kf_atomic_store_n): New.
889 (register_atomic_builtins): New function.
890 (register_known_functions): Call register_atomic_builtins.
892 2023-06-02 David Malcolm <dmalcolm@redhat.com>
894 * store.cc (store::eval_alias_1): Regions in different memory
897 2023-05-18 Bernhard Reutner-Fischer <aldot@gcc.gnu.org>
899 * region-model-manager.cc (get_code_for_cast): Use _P defines from
901 (region_model_manager::get_or_create_cast): Ditto.
902 (region_model_manager::get_region_for_global): Ditto.
903 * region-model.cc (region_model::get_lvalue_1): Ditto.
904 * region.cc (decl_region::maybe_get_constant_value): Ditto.
906 2023-03-22 David Malcolm <dmalcolm@redhat.com>
909 * program-point.cc: Include "analyzer/inlining-iterator.h".
910 (program_point::effectively_intraprocedural_p): New function.
911 * program-point.h (program_point::effectively_intraprocedural_p):
913 * sm-malloc.cc (deref_before_check::emit): Use it when rejecting
914 interprocedural cases, so that we reject interprocedural cases
915 that have become intraprocedural due to inlining.
917 2023-03-18 David Malcolm <dmalcolm@redhat.com>
920 * region-model.cc (region_model::on_longjmp): Pass false for
921 new "eval_return_svalue" param of pop_frame.
922 (region_model::pop_frame): Add new "eval_return_svalue" param and
923 use it to suppress the call to get_rvalue on the result when
924 needed by on_longjmp.
925 * region-model.h (region_model::pop_frame): Add new
926 "eval_return_svalue" param.
928 2023-03-10 David Malcolm <dmalcolm@redhat.com>
931 * region-model.cc (region_model::mark_region_as_unknown): Gather a
932 set of maybe-live svalues and call on_maybe_live_values with it.
933 * store.cc (binding_map::remove_overlapping_bindings): Add new
934 "maybe_live_values" param; add any removed svalues to it.
935 (binding_cluster::clobber_region): Add NULL as new param of
936 remove_overlapping_bindings.
937 (binding_cluster::mark_region_as_unknown): Add "maybe_live_values"
938 param and pass it to remove_overlapping_bindings.
939 (binding_cluster::maybe_get_compound_binding): Add NULL for new
940 param of binding_map::remove_overlapping_bindings.
941 (binding_cluster::remove_overlapping_bindings): Add
942 "maybe_live_values" param and pass to
943 binding_map::remove_overlapping_bindings.
944 (store::set_value): Capture a set of maybe-live svalues, and call
945 on_maybe_live_values with it.
946 (store::on_maybe_live_values): New.
947 (store::mark_region_as_unknown): Add "maybe_live_values" param
948 and pass it to binding_cluster::mark_region_as_unknown.
949 (store::remove_overlapping_bindings): Pass NULL for new param of
950 binding_cluster::remove_overlapping_bindings.
951 * store.h (binding_map::remove_overlapping_bindings): Add
952 "maybe_live_values" param.
953 (binding_cluster::mark_region_as_unknown): Likewise.
954 (binding_cluster::remove_overlapping_bindings): Likewise.
955 (store::mark_region_as_unknown): Likewise.
956 (store::on_maybe_live_values): New decl.
958 2023-03-10 David Malcolm <dmalcolm@redhat.com>
962 * sm-malloc.cc (deref_before_check::deref_before_check):
963 Initialize new field m_deref_expr. Assert that arg is non-NULL.
964 (deref_before_check::emit): Reject cases where the spelling of the
965 thing that was dereferenced differs from that of what is checked,
966 or if the dereference expression was not found. Remove code to
968 (deref_before_check::describe_state_change): Remove code to handle
970 (deref_before_check::describe_final_event): Likewise.
971 (deref_before_check::sufficiently_similar_p): New.
972 (deref_before_check::m_deref_expr): New field.
973 (malloc_state_machine::maybe_complain_about_deref_before_check):
974 Don't warn if the diag_ptr is NULL.
976 2023-03-03 David Malcolm <dmalcolm@redhat.com>
978 * kf.cc (class kf_sprintf): New.
979 (register_known_functions): Register it.
981 2023-03-02 David Malcolm <dmalcolm@redhat.com>
984 * region-model.cc (region_model::get_rvalue_1): Handle VAR_DECLs
985 with a DECL_HARD_REGISTER by returning UNKNOWN.
987 2023-03-02 Hans-Peter Nilsson <hp@axis.com>
989 * kf.cc (register_known_functions): Add __errno function for newlib.
991 2023-03-01 David Malcolm <dmalcolm@redhat.com>
994 * region-model.cc (region_model::on_call_pre): Flatten logic by
995 returning early. Consolidate logic for detecting const and pure
996 functions. When considering whether an unhandled built-in
997 function has side-effects, consider all kinds of builtin, rather
998 than just BUILT_IN_NORMAL, and don't require
999 gimple_builtin_call_types_compatible_p.
1001 2023-03-01 David Malcolm <dmalcolm@redhat.com>
1004 * infinite-recursion.cc (contains_unknown_p): New.
1005 (sufficiently_different_region_binding_p): New function, splitting
1006 out inner loop from...
1007 (sufficiently_different_p): ...here. Extend detection of unknown
1008 svalues to also include svalues that contain unknown. Treat
1009 changes in frames below the entry to the recursion as being
1010 sufficiently different to reject being an infinite recursion.
1012 2023-02-21 David Malcolm <dmalcolm@redhat.com>
1015 * analyzer.opt (fanalyzer-suppress-followups): New option.
1016 * engine.cc (impl_region_model_context::warn): Terminate the path
1017 if the diagnostic's terminate_path_p vfunc returns true and
1018 -fanalyzer-suppress-followups is true (the default).
1019 (impl_sm_context::warn): Likewise, for both overloads.
1020 * pending-diagnostic.h (pending_diagnostic::terminate_path_p): New
1022 * program-state.cc (program_state::on_edge): Terminate the path if
1023 the ctxt requests it during updating the edge.
1024 * region-model.cc (poisoned_value_diagnostic::terminate_path_p):
1026 * sm-malloc.cc (null_deref::terminate_path_p): New vfunc.
1027 (null_arg::terminate_path_p): New vfunc.
1029 2023-02-16 David Malcolm <dmalcolm@redhat.com>
1032 * constraint-manager.cc (bounded_range::dump_to_pp): Use
1033 bounded_range::singleton_p.
1034 (constraint_manager::add_bounded_ranges): Handle singleton ranges
1035 by adding an EQ_EXPR constraint.
1036 (constraint_manager::impossible_derived_conditions_p): New.
1037 (constraint_manager::eval_condition): Reject EQ_EXPR when it would
1038 imply impossible derived conditions.
1039 (selftest::test_bits): New.
1040 (selftest::run_constraint_manager_tests): Run it.
1041 * constraint-manager.h (bounded_range::singleton_p): New.
1042 (constraint_manager::impossible_derived_conditions_p): New decl.
1043 * region-model.cc (region_model::get_rvalue_1): Handle
1044 BIT_AND_EXPR, BIT_IOR_EXPR, and BIT_XOR_EXPR.
1046 2023-02-15 David Malcolm <dmalcolm@redhat.com>
1051 * diagnostic-manager.cc (epath_finder::get_best_epath): Add
1052 "target_stmt" param.
1053 (epath_finder::explore_feasible_paths): Likewise.
1054 (epath_finder::process_worklist_item): Likewise.
1055 (saved_diagnostic::calc_best_epath): Pass m_stmt to
1056 epath_finder::get_best_epath.
1057 * engine.cc (feasibility_state::maybe_update_for_edge): Move
1058 per-stmt logic to...
1059 (feasibility_state::update_for_stmt): ...this new function.
1060 * exploded-graph.h (feasibility_state::update_for_stmt): New decl.
1061 * feasible-graph.cc (feasible_node::get_state_at_stmt): New.
1062 * feasible-graph.h: Include "analyzer/exploded-graph.h".
1063 (feasible_node::get_state_at_stmt): New decl.
1064 * infinite-recursion.cc
1065 (infinite_recursion_diagnostic::check_valid_fpath_p): Update for
1066 vfunc signature change.
1067 * pending-diagnostic.h (pending_diagnostic::check_valid_fpath_p):
1068 Convert first param to a reference. Add stmt param.
1069 * region-model.cc: Include "analyzer/feasible-graph.h".
1070 (poisoned_value_diagnostic::poisoned_value_diagnostic): Add
1072 (poisoned_value_diagnostic::check_valid_fpath_p): New.
1073 (poisoned_value_diagnostic::m_check_expr): New field.
1074 (region_model::check_for_poison): Attempt to supply a check_expr
1076 (region_model::deref_rvalue): Add NULL for new check_expr param
1077 of poisoned_value_diagnostic.
1078 (region_model::get_or_create_region_for_heap_alloc): Don't reuse
1079 regions that are marked as TOUCHED.
1081 2023-02-10 David Malcolm <dmalcolm@redhat.com>
1084 * sm-malloc.cc (deref_before_check::emit): Reject the warning if
1085 the check occurs within a macro defintion.
1087 2023-02-09 David Malcolm <dmalcolm@redhat.com>
1090 * state-purge.cc (get_candidate_for_purging): Add ADDR_EXPR
1093 2023-02-08 David Malcolm <dmalcolm@redhat.com>
1096 * state-purge.cc (state_purge_per_decl::process_point_backwards):
1097 Don't stop processing the decl if it's fully overwritten by
1098 this stmt if it's also used by this stmt.
1100 2023-02-07 David Malcolm <dmalcolm@redhat.com>
1103 * sm-fd.cc (class kf_read): New.
1104 (register_known_fd_functions): Register "read".
1105 * sm-file.cc (class kf_fread): Update comment.
1107 2023-02-02 David Malcolm <dmalcolm@redhat.com>
1110 * sm-fd.cc (fd_state_machine::check_for_fd_attrs): Add missing
1112 (fd_state_machine::on_listen): Don't issue phase-mismatch or
1113 type-mismatch warnings for the "invalid" state.
1115 2023-02-01 David Malcolm <dmalcolm@redhat.com>
1118 * pending-diagnostic.cc (fixup_location_in_macro_p): Add "alloca"
1119 to macros that we shouldn't unwind inside.
1121 2023-01-26 David Malcolm <dmalcolm@redhat.com>
1124 * analyzer.h (class feasible_node): New forward decl.
1125 * diagnostic-manager.cc (epath_finder::get_best_epath): Add "pd"
1127 (epath_finder::explore_feasible_paths): Likewise.
1128 (epath_finder::process_worklist_item): Likewise. Use it to call
1129 pending_diagnostic::check_valid_fpath_p on the final fpath to
1130 give pending_diagnostic a way to add additional restrictions on
1132 (saved_diagnostic::calc_best_epath): Pass pending_diagnostic to
1133 epath_finder::get_best_epath.
1134 * infinite-recursion.cc: Include "analyzer/feasible-graph.h".
1135 (infinite_recursion_diagnostic::check_valid_fpath_p): New.
1136 (infinite_recursion_diagnostic::fedge_uses_conjured_svalue_p): New.
1137 (infinite_recursion_diagnostic::expr_uses_conjured_svalue_p): New.
1138 * pending-diagnostic.h (pending_diagnostic::check_valid_fpath_p):
1141 2023-01-19 David Malcolm <dmalcolm@redhat.com>
1144 * analyzer.h (class checker_event): New forward decl.
1145 (class state_change_event): Indent.
1146 (class warning_event): New forward decl.
1147 * checker-event.cc (state_change_event::state_change_event): Add
1149 (warning_event::get_desc): Update for new param of
1150 evdesc::final_event ctor.
1151 * checker-event.h (state_change_event::state_change_event): Add
1153 (state_change_event::get_exploded_node): New accessor.
1154 (state_change_event::m_enode): New field.
1155 (warning_event::warning_event): New "enode" param.
1156 (warning_event::get_exploded_node): New accessor.
1157 (warning_event::m_enode): New field.
1158 * diagnostic-manager.cc
1159 (state_change_event_creator::on_global_state_change): Pass
1160 src_node to state_change_event ctor.
1161 (state_change_event_creator::on_state_change): Likewise.
1162 (null_assignment_sm_context::set_next_state): Pass NULL for
1163 new param of state_change_event ctor.
1164 * infinite-recursion.cc
1165 (infinite_recursion_diagnostic::add_final_event): Update for new
1166 param of warning_event ctor.
1167 * pending-diagnostic.cc (pending_diagnostic::add_final_event):
1168 Pass enode to warning_event ctor.
1169 * pending-diagnostic.h (evdesc::final_event): Add reference to
1171 * sm-malloc.cc: Include "analyzer/checker-event.h" and
1172 "analyzer/exploded-graph.h".
1173 (deref_before_check::deref_before_check): Initialize new fields.
1174 (deref_before_check::emit): Reject warnings in which we were
1175 unable to determine the enodes of the dereference and the check.
1176 Reject warnings interprocedural warnings. Reject warnings in which
1177 the dereference doesn't dominate the check.
1178 (deref_before_check::describe_state_change): Set m_deref_enode.
1179 (deref_before_check::describe_final_event): Set m_check_enode.
1180 (deref_before_check::m_deref_enode): New field.
1181 (deref_before_check::m_check_enode): New field.
1183 2023-01-13 David Malcolm <dmalcolm@redhat.com>
1186 * region-model.cc (has_nondefault_case_for_value_p): New.
1187 (has_nondefault_cases_for_all_enum_values_p): New.
1188 (region_model::apply_constraints_for_gswitch): Skip
1189 implicitly-created "default" when switching on an enum
1190 and all enum values have non-default cases.
1191 (rejected_default_case::dump_to_pp): New.
1192 * region-model.h (region_model_context::possibly_tainted_p): New
1194 (class rejected_default_case): New.
1195 * sm-taint.cc (region_model_context::possibly_tainted_p): New.
1196 * supergraph.cc (switch_cfg_superedge::dump_label_to_pp): Dump
1197 when implicitly_created_default_p.
1198 (switch_cfg_superedge::implicitly_created_default_p): New.
1200 (switch_cfg_superedge::implicitly_created_default_p): New decl.
1202 2023-01-11 David Malcolm <dmalcolm@redhat.com>
1205 * kf.cc (class kf_strdup): New.
1206 (class kf_strndup): New.
1207 (register_known_functions): Register them.
1208 * region-model.cc (region_model::on_call_pre): Use
1209 &HEAP_ALLOCATED_REGION for the default result of an external
1210 function with the "malloc" attribute, rather than CONJURED_SVALUE.
1211 (region_model::get_or_create_region_for_heap_alloc): Allow
1212 "size_in_bytes" to be NULL.
1213 * store.cc (store::set_value): When handling *UNKNOWN = VAL,
1214 mark VAL as "maybe bound".
1216 2022-12-16 David Malcolm <dmalcolm@redhat.com>
1219 * kf.cc (kf_memcpy_memmove::impl_call_pre): Pass in source region
1220 to region_model::check_for_poison.
1221 * region-model-asm.cc (region_model::on_asm_stmt): Pass NULL
1222 region to region_model::check_for_poison.
1223 * region-model.cc (region_model::check_for_poison): Add
1224 "src_region" param, and pass it to poisoned_value_diagnostic.
1225 (region_model::on_assignment): Pass NULL region to
1226 region_model::check_for_poison.
1227 (region_model::get_rvalue): Likewise.
1228 * region-model.h (region_model::check_for_poison): Add
1230 * sm-fd.cc (fd_state_machine::on_accept): Pass in source region
1231 to region_model::check_for_poison.
1232 * varargs.cc (kf_va_copy::impl_call_pre): Pass NULL region to
1233 region_model::check_for_poison.
1234 (kf_va_arg::impl_call_pre): Pass in source region to
1235 region_model::check_for_poison.
1237 2022-12-14 David Malcolm <dmalcolm@redhat.com>
1240 * region.cc (decl_region::get_svalue_for_initializer): Bail out to
1241 avoid calling binding_key::make with an empty region.
1242 * store.cc (binding_map::apply_ctor_val_to_range): Likewise.
1243 (binding_map::apply_ctor_pair_to_child_region): Likewise.
1244 (binding_cluster::bind): Likewise.
1245 (binding_cluster::purge_region): Likewise.
1246 (binding_cluster::maybe_get_compound_binding): Likewise.
1247 (binding_cluster::maybe_get_simple_value): Likewise.
1249 2022-12-09 David Malcolm <dmalcolm@redhat.com>
1251 * analyzer.h (class known_function): Expand comment.
1252 * region-model-impl-calls.cc: Rename to...
1254 * known-function-manager.h (class known_function_manager): Add
1257 2022-12-09 David Malcolm <dmalcolm@redhat.com>
1261 (call_summary_replay::convert_region_from_summary_1): Convert
1262 heap_regs_in_use from auto_sbitmap to auto_bitmap.
1263 * region-model-manager.cc
1264 (region_model_manager::get_or_create_region_for_heap_alloc):
1265 Convert from sbitmap to bitmap.
1266 * region-model-manager.h: Likewise.
1268 (region_model::get_or_create_region_for_heap_alloc): Convert from
1269 auto_sbitmap to auto_bitmap.
1270 (region_model::get_referenced_base_regions): Likewise.
1271 * region-model.h: Include "bitmap.h" rather than "sbitmap.h".
1272 (region_model::get_referenced_base_regions): Convert from
1273 auto_sbitmap to auto_bitmap.
1275 2022-12-09 David Malcolm <dmalcolm@redhat.com>
1277 * region-model-impl-calls.cc (class kf_memcpy): Rename to...
1278 (class kf_memcpy_memmove): ...this.
1279 (kf_memcpy::impl_call_pre): Rename to...
1280 (kf_memcpy_memmove::impl_call_pre): ...this, and check the src for
1282 (register_known_functions): Update for above renaming, and
1283 register BUILT_IN_MEMMOVE and BUILT_IN_MEMMOVE_CHK.
1285 2022-12-06 David Malcolm <dmalcolm@redhat.com>
1288 * region-model.cc (region_model::get_store_value): Return an
1289 unknown value for empty regions.
1290 (region_model::set_value): Bail on empty regions.
1291 * region.cc (region::empty_p): New.
1292 * region.h (region::empty_p): New decl.
1293 * state-purge.cc (same_binding_p): Bail if either region is empty.
1294 * store.cc (binding_key::make): Assert that a concrete binding's
1295 bit_size must be > 0.
1296 (binding_cluster::mark_region_as_unknown): Bail on empty regions.
1297 (binding_cluster::get_binding): Likewise.
1298 (binding_cluster::remove_overlapping_bindings): Likewise.
1299 (binding_cluster::on_unknown_fncall): Don't conjure values for
1301 (store::fill_region): Bail on empty regions.
1302 * store.h (class concrete_binding): Update comment to reflect that
1303 the range of bits must be non-empty.
1304 (concrete_binding::concrete_binding): Assert that bit range is
1307 2022-12-06 David Malcolm <dmalcolm@redhat.com>
1310 * region-model-manager.cc
1311 (region_model_manager::get_or_create_null_ptr): New.
1312 * region-model-manager.h
1313 (region_model_manager::get_or_create_null_ptr): New decl.
1314 * region-model.cc (region_model::on_top_level_param): Add
1315 "nonnull" param and make use of it.
1316 (region_model::push_frame): When handling a top-level entrypoint
1317 to the analysis, determine which params __attribute__((nonnull))
1318 applies to, and pass to on_top_level_param.
1319 * region-model.h (region_model::on_top_level_param): Add "nonnull"
1322 2022-12-06 David Malcolm <dmalcolm@redhat.com>
1324 * analyzer.h (register_known_analyzer_functions): New decl.
1325 (register_known_functions_lang_cp): New decl.
1326 * call-details.cc: New file, split out from
1327 region-model-impl-calls.cc.
1328 * call-details.h: New file, split out from region-model.h.
1329 * call-info.cc: Include "analyzer/call-details.h".
1330 * call-summary.h: Likewise.
1331 * kf-analyzer.cc: New file, split out from
1332 region-model-impl-calls.cc.
1333 * kf-lang-cp.cc: Likewise.
1334 * known-function-manager.cc: Include "analyzer/call-details.h".
1335 * region-model-impl-calls.cc: Move definitions of call_details's
1336 member functions to call-details.cc. Move class kf_analyzer_* to
1337 kf-analyzer.cc. Move kf_operator_new and kf_operator_delete to
1338 kf-lang-cp.cc. Refresh #includes accordingly.
1339 (register_known_functions): Replace registration of __analyzer_*
1340 functions with a call to register_known_analyzer_functions.
1341 Replace registration of C++ support functions with a call to
1342 register_known_functions_lang_cp.
1343 * region-model.h (class call_details): Move to new call-details.h.
1344 * sm-fd.cc: Include "analyzer/call-details.h".
1345 * sm-file.cc: Likewise.
1346 * sm-malloc.cc: Likewise.
1347 * varargs.cc: Likewise.
1349 2022-12-02 David Malcolm <dmalcolm@redhat.com>
1351 * analyzer.h (struct event_loc_info): New forward decl.
1352 * bounds-checking.cc: Use event_loc_info throughout to bundle the
1353 loc, fndecl, depth triples.
1354 * call-info.cc: Likewise.
1355 * checker-event.cc: Likewise.
1356 * checker-event.h (struct event_loc_info): New decl. Use it
1357 throughout to bundle the loc, fndecl, depth triples.
1358 * checker-path.cc: Likewise.
1359 * checker-path.h: Likewise.
1360 * diagnostic-manager.cc: Likewise.
1361 * engine.cc: Likewise.
1362 * infinite-recursion.cc: Likewise.
1363 * pending-diagnostic.cc: Likewise.
1364 * pending-diagnostic.h: Likewise.
1365 * region-model.cc: Likewise.
1366 * sm-signal.cc: Likewise.
1367 * varargs.cc: Likewise.
1369 2022-12-02 David Malcolm <dmalcolm@redhat.com>
1372 * analyzer.cc (make_label_text_n): Convert param "n" from int to
1373 unsigned HOST_WIDE_INT.
1374 * analyzer.h (make_label_text_n): Likewise for decl.
1375 * bounds-checking.cc: Include "analyzer/checker-event.h" and
1376 "analyzer/checker-path.h".
1377 (out_of_bounds::add_region_creation_events): New.
1378 (concrete_past_the_end::describe_region_creation_event): Replace
1380 (concrete_past_the_end::add_region_creation_events): ...this.
1381 (symbolic_past_the_end::describe_region_creation_event): Delete.
1382 * checker-event.cc (region_creation_event::region_creation_event):
1383 Update for dropping all member data.
1384 (region_creation_event::get_desc): Delete, splitting out into
1385 region_creation_event_memory_space::get_desc,
1386 region_creation_event_capacity::get_desc, and
1387 region_creation_event_debug::get_desc.
1388 (region_creation_event_memory_space::get_desc): New.
1389 (region_creation_event_capacity::get_desc): New.
1390 (region_creation_event_allocation_size::get_desc): New.
1391 (region_creation_event_debug::get_desc): New.
1392 * checker-event.h: Include "analyzer/program-state.h".
1393 (enum rce_kind): Delete.
1394 (class region_creation_event): Drop all member data.
1395 (region_creation_event::region_creation_event): Make protected.
1396 (region_creation_event::get_desc): Delete.
1397 (class region_creation_event_memory_space): New.
1398 (class region_creation_event_capacity): New.
1399 (class region_creation_event_allocation_size): New.
1400 (class region_creation_event_debug): New.
1401 * checker-path.cc (checker_path::add_region_creation_events): Add
1402 "pd" param. Call pending_diangnostic::add_region_creation_events.
1403 Update for conversion of RCE_DEBUG to region_creation_event_debug.
1404 * checker-path.h (checker_path::add_region_creation_events): Add
1406 * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
1407 Pass pending_diagnostic to
1408 emission_path::add_region_creation_events.
1409 (diagnostic_manager::build_emission_path): Pass path_builder to
1410 add_event_on_final_node.
1411 (diagnostic_manager::add_event_on_final_node): Add "pb" param.
1412 Pass pending_diagnostic to
1413 emission_path::add_region_creation_events.
1414 (diagnostic_manager::add_events_for_eedge): Pass
1415 pending_diagnostic to emission_path::add_region_creation_events.
1416 * diagnostic-manager.h
1417 (diagnostic_manager::add_event_on_final_node): Add "pb" param.
1418 * pending-diagnostic.cc
1419 (pending_diagnostic::add_region_creation_events): New.
1420 * pending-diagnostic.h (struct region_creation): Delete.
1421 (pending_diagnostic::describe_region_creation_event): Delete.
1422 (pending_diagnostic::add_region_creation_events): New vfunc.
1423 * region-model.cc: Include "analyzer/checker-event.h" and
1424 "analyzer/checker-path.h".
1425 (dubious_allocation_size::dubious_allocation_size): Initialize
1426 m_has_allocation_event.
1427 (dubious_allocation_size::describe_region_creation_event): Delete.
1428 (dubious_allocation_size::describe_final_event): Update for
1429 replacement of m_allocation_event with m_has_allocation_event.
1430 (dubious_allocation_size::add_region_creation_events): New.
1431 (dubious_allocation_size::m_allocation_event): Replace with...
1432 (dubious_allocation_size::m_has_allocation_event): ...this.
1434 2022-12-02 David Malcolm <dmalcolm@redhat.com>
1437 * region-model-manager.cc
1438 (region_model_manager::maybe_fold_binop): Fold (0 - VAL) to -VAL.
1439 * region-model.cc (region_model::eval_condition): Handle e.g.
1440 "-X <= 0" as equivalent to X >= 0".
1442 2022-12-01 David Malcolm <dmalcolm@redhat.com>
1445 * bounds-checking.cc
1446 (symbolic_past_the_end::describe_final_event): Delete, moving to
1447 symbolic_buffer_overflow::describe_final_event and
1448 symbolic_buffer_over_read::describe_final_event, eliminating
1449 composition of text strings via "byte_str" and "m_dir_str".
1450 (symbolic_past_the_end::m_dir_str): Delete field.
1451 (symbolic_buffer_overflow::symbolic_buffer_overflow): Drop
1453 (symbolic_buffer_overflow::describe_final_event): New, as noted
1455 (symbolic_buffer_over_read::symbolic_buffer_overflow): Drop
1457 (symbolic_buffer_over_read::describe_final_event): New, as noted
1460 2022-12-01 David Malcolm <dmalcolm@redhat.com>
1462 * bounds-checking.cc (class out_of_bounds): Split out from...
1463 (class concrete_out_of_bounds): New abstract subclass.
1464 (class past_the_end): Rename to...
1465 (class concrete_past_the_end): ...this, and make a subclass of
1466 concrete_out_of_bounds.
1467 (class buffer_overflow): Rename to...
1468 (class concrete_buffer_overflow): ...this, and make a subclass of
1469 concrete_past_the_end.
1470 (class buffer_over_read): Rename to...
1471 (class concrete_buffer_over_read): ...this, and make a subclass of
1472 concrete_past_the_end.
1473 (class buffer_underwrite): Rename to...
1474 (class concrete_buffer_underwrite): ...this, and make a subclass
1475 of concrete_out_of_bounds.
1476 (class buffer_under_read): Rename to...
1477 (class concrete_buffer_under_read): ...this, and make a subclass
1478 of concrete_out_of_bounds.
1479 (class symbolic_past_the_end): Convert to a subclass of
1481 (symbolic_buffer_overflow::get_kind): New.
1482 (symbolic_buffer_over_read::get_kind): New.
1483 (region_model::check_region_bounds): Update for renamings.
1484 * engine.cc (impl_sm_context::set_next_state): Eliminate
1485 "new_ctxt", passing NULL to get_rvalue instead.
1486 (impl_sm_context::warn): Likewise.
1488 2022-12-01 David Malcolm <dmalcolm@redhat.com>
1491 * bounds-checking.cc (out_of_bounds::get_memory_space): New.
1492 (buffer_overflow::emit): Use it.
1493 (class buffer_overread): Rename to...
1494 (class buffer_over_read): ...this.
1495 (buffer_over_read::emit): Specify which memory space the read is
1496 from, where known. Change "overread" to "over-read".
1497 (class buffer_underflow): Rename to...
1498 (class buffer_underwrite): ...this.
1499 (buffer_underwrite::emit): Specify which memory space the write is
1500 to, where known. Change "underflow" to "underwrite".
1501 (class buffer_underread): Rename to...
1502 (class buffer_under_read): Rename to...
1503 (buffer_under_read::emit): Specify which memory space the read is
1504 from, where known. Change "underread" to "under-read".
1505 (symbolic_past_the_end::get_memory_space): New.
1506 (symbolic_buffer_overflow::emit): Use it.
1507 (class symbolic_buffer_overread): Rename to...
1508 (class symbolic_buffer_over_read): ...this.
1509 (symbolic_buffer_over_read::emit): Specify which memory space the
1510 read is from, where known. Change "overread" to "over-read".
1511 (region_model::check_symbolic_bounds): Update for class renaming.
1512 (region_model::check_region_bounds): Likewise.
1514 2022-12-01 David Malcolm <dmalcolm@redhat.com>
1517 * bounds-checking.cc (out_of_bounds::maybe_describe_array_bounds):
1519 (buffer_overflow::emit): Call maybe_describe_array_bounds.
1520 (buffer_overread::emit): Likewise.
1521 (buffer_underflow::emit): Likewise.
1522 (buffer_underread::emit): Likewise.
1524 2022-12-01 David Malcolm <dmalcolm@redhat.com>
1527 * bounds-checking.cc (buffer_overflow::emit): Use inform_n.
1528 Update wording to clarify that we're talking about the size of
1529 the bad access, rather than its position.
1530 (buffer_overread::emit): Likewise.
1532 2022-12-01 David Malcolm <dmalcolm@redhat.com>
1534 * bounds-checking.cc: New file, taken from region-model.cc.
1535 * region-model.cc (class out_of_bounds): Move to
1537 (class past_the_end): Likewise.
1538 (class buffer_overflow): Likewise.
1539 (class buffer_overread): Likewise.
1540 (class buffer_underflow): Likewise.
1541 (class buffer_underread): Likewise.
1542 (class symbolic_past_the_end): Likewise.
1543 (class symbolic_buffer_overflow): Likewise.
1544 (class symbolic_buffer_overread): Likewise.
1545 (region_model::check_symbolic_bounds): Likewise.
1546 (maybe_get_integer_cst_tree): Likewise.
1547 (region_model::check_region_bounds): Likewise.
1548 * region-model.h: Add comment.
1550 2022-12-01 David Malcolm <dmalcolm@redhat.com>
1553 * sm-fd.cc (fd_state_machine::on_bind): Handle m_constant_fd in
1554 the "success" outcome.
1555 (fd_state_machine::on_connect): Likewise.
1556 * sm-fd.dot: Add "constant_fd" state and its transitions.
1558 2022-11-30 David Malcolm <dmalcolm@redhat.com>
1560 * region-model-impl-calls.cc (class kf_fgets): Move to sm-file.cc.
1561 (kf_fgets::impl_call_pre): Likewise.
1562 (class kf_fread): Likewise.
1563 (kf_fread::impl_call_pre): Likewise.
1564 (class kf_getchar): Likewise.
1565 (class kf_stdio_output_fn): Likewise.
1566 (register_known_functions): Move registration of
1567 BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
1568 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
1569 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
1570 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
1571 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
1572 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF,
1573 "getchar", "fgets", "fgets_unlocked", and "fread" to
1574 register_known_file_functions.
1575 * sm-file.cc (class kf_stdio_output_fn): Move here from
1576 region-model-impl-calls.cc.
1577 (class kf_fgets): Likewise.
1578 (class kf_fread): Likewise.
1579 (class kf_getchar): Likewise.
1580 (register_known_file_functions): Move registration of
1581 BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
1582 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
1583 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
1584 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
1585 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
1586 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF,
1587 "fgets", "fgets_unlocked", "fread", and "getchar" to here from
1588 register_known_functions.
1590 2022-11-30 David Malcolm <dmalcolm@redhat.com>
1593 * analyzer.h (register_known_file_functions): New decl.
1594 * program-state.cc (sm_state_map::replay_call_summary): Rejct
1595 attempts to store sm-state for caller_sval that can't have
1597 * region-model-impl-calls.cc (register_known_functions): Call
1598 register_known_file_functions.
1599 * sm-fd.cc (class kf_isatty): New.
1600 (register_known_fd_functions): Register it.
1601 * sm-file.cc (class kf_ferror): New.
1602 (class kf_fileno): New.
1603 (class kf_getc): New.
1604 (register_known_file_functions): New.
1606 2022-11-30 David Malcolm <dmalcolm@redhat.com>
1609 * region-model-manager.cc
1610 (region_model_manager::maybe_fold_binop): For POINTER_PLUS_EXPR,
1611 PLUS_EXPR and MINUS_EXPR, eliminate requirement that the final
1612 type matches that of arg0 in favor of a cast.
1614 2022-11-24 Martin Liska <mliska@suse.cz>
1616 * varargs.cc: Fix Clang warnings.
1618 2022-11-24 David Malcolm <dmalcolm@redhat.com>
1622 (call_summary_replay::convert_region_from_summary_1): Update for
1623 change to creation of heap-allocated regions.
1624 * program-state.cc (test_program_state_1): Likewise.
1625 (test_program_state_merging): Likewise.
1626 * region-model-impl-calls.cc (kf_calloc::impl_call_pre): Likewise.
1627 (kf_malloc::impl_call_pre): Likewise.
1628 (kf_operator_new::impl_call_pre): Likewise.
1629 (kf_realloc::impl_call_postsuccess_with_move::update_model): Likewise.
1630 * region-model-manager.cc
1631 (region_model_manager::create_region_for_heap_alloc): Convert
1633 (region_model_manager::get_or_create_region_for_heap_alloc):
1634 ...this, reusing an existing region if it's unreferenced in the
1636 * region-model-manager.h (region_model_manager::get_num_regions): New.
1637 (region_model_manager::create_region_for_heap_alloc): Convert to...
1638 (region_model_manager::get_or_create_region_for_heap_alloc): ...this.
1639 * region-model.cc (region_to_value_map::can_merge_with_p): Reject
1640 merger when the values are different.
1641 (region_model::create_region_for_heap_alloc): Convert to...
1642 (region_model::get_or_create_region_for_heap_alloc): ...this.
1643 (region_model::get_referenced_base_regions): New.
1644 (selftest::test_state_merging): Update for change to creation of
1645 heap-allocated regions.
1646 (selftest::test_malloc_constraints): Likewise.
1647 (selftest::test_malloc): Likewise.
1648 * region-model.h: Include "sbitmap.h".
1649 (region_model::create_region_for_heap_alloc): Convert to...
1650 (region_model::get_or_create_region_for_heap_alloc): ...this.
1651 (region_model::get_referenced_base_regions): New decl.
1652 * store.cc (store::canonicalize): Don't purge a heap-allocated region
1653 that's been marked as escaping.
1655 2022-11-24 David Malcolm <dmalcolm@redhat.com>
1657 * checker-path.cc (checker_path::inject_any_inlined_call_events):
1658 Don't dump the address of the block when -fdump-noaddr.
1660 2022-11-24 David Malcolm <dmalcolm@redhat.com>
1662 * region-model.h (region_model::on_socket): Delete decl.
1663 (region_model::on_bind): Likewise.
1664 (region_model::on_listen): Likewise.
1665 (region_model::on_accept): Likewise.
1666 (region_model::on_connect): Likewise.
1667 * sm-fd.cc (kf_socket::outcome_of_socket::update_model): Move body
1668 of region_model::on_socket into here, ...
1669 (region_model::on_socket): ...eliminating this function.
1670 (kf_bind::outcome_of_bind::update_model): Likewise for on_bind...
1671 (region_model::on_bind): ...eliminating this function.
1672 (kf_listen::outcome_of_listen::update_model): Likewise fo
1674 (region_model::on_listen): ...eliminating this function.
1675 (kf_accept::outcome_of_accept::update_model): Likewise fo
1677 (region_model::on_accept): ...eliminating this function.
1678 (kf_connect::outcome_of_connect::update_model): Likewise fo
1680 (region_model::on_connect): ...eliminating this function.
1682 2022-11-24 David Malcolm <dmalcolm@redhat.com>
1684 * analyzer.h (register_known_fd_functions): New decl.
1685 * region-model-impl-calls.cc (class kf_accept): Move to sm-fd.cc.
1686 (class kf_bind): Likewise.
1687 (class kf_connect): Likewise.
1688 (class kf_listen): Likewise.
1689 (class kf_pipe): Likewise.
1690 (class kf_socket): Likewise.
1691 (register_known_functions): Remove registration of the above
1692 functions, instead calling register_known_fd_functions.
1693 * sm-fd.cc: Include "analyzer/call-info.h".
1694 (class kf_socket): Move here from region-model-impl-calls.cc.
1695 (class kf_bind): Likewise.
1696 (class kf_listen): Likewise.
1697 (class kf_accept): Likewise.
1698 (class kf_connect): Likewise.
1699 (class kf_pipe): Likewise.
1700 (register_known_fd_functions): New.
1702 2022-11-22 David Malcolm <dmalcolm@redhat.com>
1705 * known-function-manager.cc (known_function_manager::get_match):
1706 Don't look up fndecls by name when they're not in the root
1709 2022-11-22 David Malcolm <dmalcolm@redhat.com>
1712 * sm-fd.cc (fd_state_machine::check_for_new_socket_fd): Don't
1713 complain when old state is "fd-constant".
1714 (fd_state_machine::on_listen): Likewise.
1715 (fd_state_machine::on_accept): Likewise.
1717 2022-11-22 David Malcolm <dmalcolm@redhat.com>
1720 * region-model-impl-calls.cc (register_known_functions): Register
1721 "___errno" and "__error" as synonyms for "__errno_location".
1723 2022-11-22 David Malcolm <dmalcolm@redhat.com>
1725 * analyzer.h (class internal_known_function): New.
1726 (register_varargs_builtins): New decl.
1727 * engine.cc (exploded_node::on_stmt_pre): Remove
1728 "out_terminate_path" param from call to region_model::on_stmt_pre.
1729 (feasibility_state::maybe_update_for_edge): Likewise.
1730 * known-function-manager.cc: Include "basic-block.h", "gimple.h",
1731 and "analyzer/region-model.h".
1732 (known_function_manager::known_function_manager): Initialize
1734 (known_function_manager::~known_function_manager): Clean up
1736 (known_function_manager::get_by_identifier): Make const.
1737 (known_function_manager::add): New overloaded definitions for
1738 enum built_in_function and enum internal_fn.
1739 (known_function_manager::get_by_fndecl): Delete.
1740 (known_function_manager::get_match): New.
1741 (known_function_manager::get_internal_fn): New.
1742 (known_function_manager::get_normal_builtin): New.
1743 * known-function-manager.h
1744 (known_function_manager::get_by_identifier): Make private and
1745 add const qualifier.
1746 (known_function_manager::get_by_fndecl): Delete.
1747 (known_function_manager::add): Add overloaded decls for
1748 enum built_in_function name and enum internal_fn.
1749 (known_function_manager::get_match): New decl.
1750 (known_function_manager::get_internal_fn): New decl.
1751 (known_function_manager::get_normal_builtin): New decl.
1752 (known_function_manager::m_combined_fns_arr): New field.
1753 * region-model-impl-calls.cc (call_details::arg_is_size_p): New.
1754 (class kf_alloca): New.
1755 (region_model::impl_call_alloca): Convert to...
1756 (kf_alloca::impl_call_pre): ...this.
1757 (kf_analyzer_dump_capacity::matches_call_types_p): Rewrite check
1758 to use call_details::arg_is_pointer_p.
1759 (region_model::impl_call_builtin_expect): Convert to...
1760 (class kf_expect): ...this.
1761 (class kf_calloc): New, adding check that both arguments are
1763 (region_model::impl_call_calloc): Convert to...
1764 (kf_calloc::impl_call_pre): ...this.
1765 (kf_connect::matches_call_types_p): Rewrite check to use
1766 call_details::arg_is_pointer_p.
1767 (region_model::impl_call_error): Convert to...
1768 (class kf_error): ...this, and...
1769 (kf_error::impl_call_pre): ...this.
1770 (class kf_fgets): New, adding checks that args 0 and 2 are
1772 (region_model::impl_call_fgets): Convert to...
1773 (kf_fgets::impl_call_pre): ...this.
1774 (class kf_fread): New, adding checks on the argument types.
1775 (region_model::impl_call_fread): Convert to...
1776 (kf_fread::impl_call_pre): ...this.
1777 (class kf_free): New, adding check that the argument is a pointer.
1778 (region_model::impl_call_free): Convert to...
1779 (kf_free::impl_call_post): ...this.
1780 (class kf_getchar): New.
1781 (class kf_malloc): New, adding check that the argument is a
1783 (region_model::impl_call_malloc): Convert to...
1784 (kf_malloc::impl_call_pre): ...this.
1785 (class kf_memcpy): New, adding checks on arguments.
1786 (region_model::impl_call_memcpy): Convert to...
1787 (kf_memcpy::impl_call_pre): ...this.
1788 (class kf_memset): New.
1789 (region_model::impl_call_memset): Convert to...
1790 (kf_memset::impl_call_pre): ...this.
1791 (kf_pipe::matches_call_types_p): Rewrite check to use
1792 call_details::arg_is_pointer_p.
1793 (kf_putenv::matches_call_types_p): Likewise.
1794 (class kf_realloc): New, adding checks on the argument types.
1795 (region_model::impl_call_realloc): Convert to...
1796 (kf_realloc::impl_call_post): ...this.
1797 (class kf_strchr): New.
1798 (region_model::impl_call_strchr): Convert to...
1799 (kf_strchr::impl_call_post): ...this.
1800 (class kf_stack_restore): New.
1801 (class kf_stack_save): New.
1802 (class kf_stdio_output_fn): New.
1803 (class kf_strcpy): New,
1804 (region_model::impl_call_strcpy): Convert to...
1805 (kf_strcpy::impl_call_pre): ...this.
1806 (class kf_strlen): New.
1807 (region_model::impl_call_strlen): Convert to...
1808 (kf_strlen::impl_call_pre): ...this.
1809 (class kf_ubsan_bounds): New.
1810 (region_model::impl_deallocation_call): Reimplement to avoid call
1812 (register_known_functions): Add handlers for IFN_BUILTIN_EXPECT
1813 and IFN_UBSAN_BOUNDS. Add handlers for BUILT_IN_ALLOCA,
1814 BUILT_IN_ALLOCA_WITH_ALIGN, BUILT_IN_CALLOC, BUILT_IN_EXPECT,
1815 BUILT_IN_EXPECT_WITH_PROBABILITY, BUILT_IN_FPRINTF,
1816 BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
1817 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
1818 BUILT_IN_FREE, BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED,
1819 BUILT_IN_MALLOC, BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK,
1820 BUILT_IN_MEMSET, BUILT_IN_MEMSET_CHK, BUILT_IN_PRINTF,
1821 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
1822 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
1823 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_REALLOC, BUILT_IN_STACK_RESTORE,
1824 BUILT_IN_STACK_SAVE, BUILT_IN_STRCHR, BUILT_IN_STRCPY,
1825 BUILT_IN_STRCPY_CHK, BUILT_IN_STRLEN, BUILT_IN_VFPRINTF, and
1826 BUILT_IN_VPRINTF. Call register_varargs_builtins. Add handlers
1827 for "getchar", "memset", "fgets", "fgets_unlocked", "fread",
1828 "error", and "error_at_line".
1829 * region-model.cc (region_model::on_stmt_pre): Drop
1830 "out_terminate_path" param.
1831 (region_model::get_known_function): Reimplement by calling
1832 known_function_manager::get_match, passing new "cd" param.
1833 Add overload taking enum internal_fn.
1834 (region_model::on_call_pre): Drop "out_terminate_path" param.
1835 Remove special-case handling of internal fns IFN_BUILTIN_EXPECT,
1836 IFN_UBSAN_BOUNDS, and IFN_VA_ARG, of built-in fns BUILT_IN_ALLOCA,
1837 BUILT_IN_ALLOCA_WITH_ALIGN, BUILT_IN_CALLOC, BUILT_IN_EXPECT,
1838 BUILT_IN_EXPECT_WITH_PROBABILITY, BUILT_IN_FREE, BUILT_IN_MALLOC,
1839 BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_MEMSET,
1840 BUILT_IN_MEMSET_CHK, BUILT_IN_REALLOC, BUILT_IN_STRCHR,
1841 BUILT_IN_STRCPY, BUILT_IN_STRCPY_CHK, BUILT_IN_STRLEN,
1842 BUILT_IN_STACK_SAVE, BUILT_IN_STACK_RESTORE, BUILT_IN_FPRINTF,
1843 BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED,
1844 BUILT_IN_FPUTC, BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS,
1845 BUILT_IN_FPUTS_UNLOCKED, BUILT_IN_FWRITE,
1846 BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
1847 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR,
1848 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED,
1849 BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF, BUILT_IN_VA_START, and
1850 BUILT_IN_VA_COPY, and of named functions "malloc", "calloc",
1851 "alloca", "realloc", "error", "error_at_line", "fgets",
1852 "fgets_unlocked", "fread", "getchar", "memset", "strchr", and
1853 "strlen". Replace all this special-casing with calls to
1854 get_known_function for internal fns and for fn decls.
1855 (region_model::on_call_post): Remove special-casing handling for
1856 "free" and "strchr", and for BUILT_IN_REALLOC, BUILT_IN_STRCHR,
1857 and BUILT_IN_VA_END. Replace by consolidating on usage of
1859 * region-model.h (call_details::arg_is_size_p): New.
1860 (region_model::on_stmt_pre): Drop "out_terminate_path" param.
1861 (region_model::on_call_pre): Likewise.
1862 (region_model::impl_call_alloca): Delete.
1863 (region_model::impl_call_builtin_expect): Delete.
1864 (region_model::impl_call_calloc): Delete.
1865 (region_model::impl_call_error): Delete.
1866 (region_model::impl_call_fgets): Delete.
1867 (region_model::impl_call_fread): Delete.
1868 (region_model::impl_call_free): Delete.
1869 (region_model::impl_call_malloc): Delete.
1870 (region_model::impl_call_memcpy): Delete.
1871 (region_model::impl_call_memset): Delete.
1872 (region_model::impl_call_realloc): Delete.
1873 (region_model::impl_call_strchr): Delete.
1874 (region_model::impl_call_strcpy): Delete.
1875 (region_model::impl_call_strlen): Delete.
1876 (region_model::impl_call_va_start): Delete.
1877 (region_model::impl_call_va_copy): Delete.
1878 (region_model::impl_call_va_arg): Delete.
1879 (region_model::impl_call_va_end): Delete.
1880 (region_model::check_region_for_write): Public.
1881 (region_model::get_known_function): Add "cd" param. Add
1882 overloaded decl taking enum internal_fn.
1883 * sm-malloc.cc: Update comments.
1884 * varargs.cc (class kf_va_start): New.
1885 (region_model::impl_call_va_start): Convert to...
1886 (kf_va_start::impl_call_pre): ...this.
1887 (class kf_va_copy): New.
1888 (region_model::impl_call_va_copy): Convert to...
1889 (kf_va_copy::impl_call_pre): ...this.
1890 (class kf_va_arg): New.
1891 (region_model::impl_call_va_arg): Convert to...
1892 (kf_va_arg::impl_call_pre): ...this.
1893 (class kf_va_end): New.
1894 (region_model::impl_call_va_end): Delete.
1895 (register_varargs_builtins): New.
1897 2022-11-22 David Malcolm <dmalcolm@redhat.com>
1900 * region-model.cc (region_model::update_for_int_cst_return):
1901 Require that the return type be an integer type.
1902 (region_model::update_for_nonzero_return): Likewise.
1904 2022-11-22 David Malcolm <dmalcolm@redhat.com>
1907 * region-model-impl-calls.cc (kf_accept::matches_call_types_p):
1908 Require that args 1 and 2 be pointers.
1909 (kf_bind::matches_call_types_p): Require that arg 1 be a pointer.
1910 * region-model.h (call_details::arg_is_pointer_p): New
1912 2022-11-22 David Malcolm <dmalcolm@redhat.com>
1916 (call_summary_replay::convert_region_from_summary_1): Handle
1917 RK_THREAD_LOCAL and RK_ERRNO in switch.
1918 * region-model.cc (region_model::get_representative_path_var_1):
1921 2022-11-19 David Malcolm <dmalcolm@redhat.com>
1924 * engine.cc (dynamic_call_info_t::update_model): Update the model
1925 by pushing or pop a frame, rather than by clobbering it with the
1926 model from the exploded_node's state.
1928 2022-11-18 David Malcolm <dmalcolm@redhat.com>
1930 * analyzer.cc (is_pipe_call_p): Delete.
1931 * analyzer.h (is_pipe_call_p): Delete.
1932 * region-model-impl-calls.cc (call_details::get_location): New.
1933 (class kf_analyzer_break): New, adapted from
1934 region_model::on_stmt_pre.
1935 (region_model::impl_call_analyzer_describe): Convert to...
1936 (class kf_analyzer_describe): ...this.
1937 (region_model::impl_call_analyzer_dump_capacity): Convert to...
1938 (class kf_analyzer_dump_capacity): ...this.
1939 (region_model::impl_call_analyzer_dump_escaped): Convert to...
1940 (class kf_analyzer_dump_escaped): ...this.
1941 (class kf_analyzer_dump_exploded_nodes): New.
1942 (region_model::impl_call_analyzer_dump_named_constant): Convert
1944 (class kf_analyzer_dump_named_constant): ...this.
1945 (class dump_path_diagnostic): Move here from region-model.cc.
1946 (class kf_analyzer_dump_path) New, adapted from
1947 region_model::on_stmt_pre.
1948 (class kf_analyzer_dump_region_model): Likewise.
1949 (region_model::impl_call_analyzer_eval): Convert to...
1950 (class kf_analyzer_eval): ...this.
1951 (region_model::impl_call_analyzer_get_unknown_ptr): Convert to...
1952 (class kf_analyzer_get_unknown_ptr): ...this.
1953 (class known_function_accept): Rename to...
1954 (class kf_accept): ...this.
1955 (class known_function_bind): Rename to...
1956 (class kf_bind): ...this.
1957 (class known_function_connect): Rename to...
1958 (class kf_connect): ...this.
1959 (region_model::impl_call_errno_location): Convert to...
1960 (class kf_errno_location): ...this.
1961 (class known_function_listen): Rename to...
1962 (class kf_listen): ...this.
1963 (region_model::impl_call_pipe): Convert to...
1964 (class kf_pipe): ...this.
1965 (region_model::impl_call_putenv): Convert to...
1966 (class kf_putenv): ...this.
1967 (region_model::impl_call_operator_new): Convert to...
1968 (class kf_operator_new): ...this.
1969 (region_model::impl_call_operator_delete): Convert to...
1970 (class kf_operator_delete): ...this.
1971 (class known_function_socket): Rename to...
1972 (class kf_socket): ...this.
1973 (register_known_functions): Rename param to KFM. Break out
1974 existing known functions into a "POSIX" section, and add "pipe",
1975 "pipe2", and "putenv". Add debugging functions
1976 "__analyzer_break", "__analyzer_describe",
1977 "__analyzer_dump_capacity", "__analyzer_dump_escaped",
1978 "__analyzer_dump_exploded_nodes",
1979 "__analyzer_dump_named_constant", "__analyzer_dump_path",
1980 "__analyzer_dump_region_model", "__analyzer_eval",
1981 "__analyzer_get_unknown_ptr". Add C++ support functions
1982 "operator new", "operator new []", "operator delete", and
1983 "operator delete []".
1984 * region-model.cc (class dump_path_diagnostic): Move to
1985 region-model-impl-calls.cc.
1986 (region_model::on_stmt_pre): Eliminate special-casing of
1987 "__analyzer_describe", "__analyzer_dump_capacity",
1988 "__analyzer_dump_escaped", "__analyzer_dump_named_constant",
1989 "__analyzer_dump_path", "__analyzer_dump_region_model",
1990 "__analyzer_eval", "__analyzer_break",
1991 "__analyzer_dump_exploded_nodes", "__analyzer_get_unknown_ptr",
1992 "__errno_location", "pipe", "pipe2", "putenv", "operator new",
1993 "operator new []", "operator delete", "operator delete []"
1994 "pipe" and "pipe2", handling them instead via the known_functions
1996 * region-model.h (call_details::get_location): New decl.
1997 (region_model::impl_call_analyzer_describe): Delete decl.
1998 (region_model::impl_call_analyzer_dump_capacity): Delete decl.
1999 (region_model::impl_call_analyzer_dump_escaped): Delete decl.
2000 (region_model::impl_call_analyzer_dump_named_constant): Delete decl.
2001 (region_model::impl_call_analyzer_eval): Delete decl.
2002 (region_model::impl_call_analyzer_get_unknown_ptr): Delete decl.
2003 (region_model::impl_call_errno_location): Delete decl.
2004 (region_model::impl_call_pipe): Delete decl.
2005 (region_model::impl_call_putenv): Delete decl.
2006 (region_model::impl_call_operator_new): Delete decl.
2007 (region_model::impl_call_operator_delete): Delete decl.
2008 * sm-fd.cc: Update comments.
2010 2022-11-16 David Malcolm <dmalcolm@redhat.com>
2013 * analyzer-language.cc: Include "diagnostic.h".
2014 (maybe_stash_named_constant): Add logger param and use it to log
2015 the name being looked up, and the result.
2016 (stash_named_constants): New, splitting out from...
2017 (on_finish_translation_unit): ...this function. Call
2018 get_or_create_logfile and use the result to create a logger
2019 instance, passing it to stash_named_constants.
2020 * analyzer.h (get_or_create_any_logfile): New decl.
2021 * engine.cc (dump_fout, owns_dump_fout): New globals, split out
2023 (get_or_create_any_logfile): New function, split out from...
2024 (run_checkers): ...here, so that the logfile can be opened by
2025 on_finish_translation_unit. Clear the globals when closing the
2028 2022-11-16 David Malcolm <dmalcolm@redhat.com>
2030 * analyzer.h (known_function::matches_call_types_p): New vfunc.
2031 (known_function::impl_call_pre): Provide base implementation.
2032 (known_function::impl_call_post): New vfunc.
2033 (register_known_functions): New.
2034 * engine.cc (impl_run_checkers): Call register_known_functions.
2035 * region-model-impl-calls.cc (region_model::impl_call_accept):
2037 (class known_function_accept): ...this.
2038 (region_model::impl_call_bind): Convert to...
2039 (class known_function_bind): ...this.
2040 (region_model::impl_call_connect): Convert to...
2041 (class known_function_connect): ...this.
2042 (region_model::impl_call_listen): Convert to...
2043 (class known_function_listen): ...this.
2044 (region_model::impl_call_socket): Convert to...
2045 (class known_function_socket): ...this.
2046 (register_known_functions): New.
2047 * region-model.cc (region_model::on_call_pre): Remove special
2048 case for "bind" in favor of the known_function-handling dispatch.
2049 Add call to known_function::matches_call_types_p to latter.
2050 (region_model::on_call_post): Remove special cases for "accept",
2051 "bind", "connect", "listen", and "socket" in favor of dispatch
2052 to known_function::impl_call_post.
2053 * region-model.h (region_model::impl_call_accept): Delete decl.
2054 (region_model::impl_call_bind): Delete decl.
2055 (region_model::impl_call_connect): Delete decl.
2056 (region_model::impl_call_listen): Delete decl.
2057 (region_model::impl_call_socket): Delete decl.
2058 * sm-fd.cc: Update comments.
2060 2022-11-16 David Malcolm <dmalcolm@redhat.com>
2062 * checker-event.cc: New file, split out from...
2063 * checker-path.cc: ...this file.
2065 2022-11-15 David Malcolm <dmalcolm@redhat.com>
2068 * analyzer-language.cc (on_finish_translation_unit): Stash named
2069 constants "SOCK_STREAM" and "SOCK_DGRAM".
2070 * analyzer.opt (Wanalyzer-fd-phase-mismatch): New.
2071 (Wanalyzer-fd-type-mismatch): New.
2072 * engine.cc (impl_region_model_context::get_state_map_by_name):
2073 Add "out_sm_context" param. Allow out_sm_idx to be NULL.
2075 (impl_region_model_context::get_state_map_by_name):
2076 Add "out_sm_context" param.
2077 * region-model-impl-calls.cc (region_model::impl_call_accept): New.
2078 (region_model::impl_call_bind): New.
2079 (region_model::impl_call_connect): New.
2080 (region_model::impl_call_listen): New.
2081 (region_model::impl_call_socket): New.
2082 * region-model.cc (region_model::on_call_pre): Special-case
2084 (region_model::on_call_post): Special-case "accept", "bind",
2085 "connect", "listen", and "socket".
2086 * region-model.h (region_model::impl_call_accept): New decl.
2087 (region_model::impl_call_bind): New decl.
2088 (region_model::impl_call_connect): New decl.
2089 (region_model::impl_call_listen): New decl.
2090 (region_model::impl_call_socket): New decl.
2091 (region_model::on_socket): New decl.
2092 (region_model::on_bind): New decl.
2093 (region_model::on_listen): New decl.
2094 (region_model::on_accept): New decl.
2095 (region_model::on_connect): New decl.
2096 (region_model::add_constraint): Make public.
2097 (region_model::check_for_poison): Make public.
2098 (region_model_context::get_state_map_by_name): Add out_sm_context param.
2099 (region_model_context::get_fd_map): Likewise.
2100 (region_model_context::get_malloc_map): Likewise.
2101 (region_model_context::get_taint_map): Likewise.
2102 (noop_region_model_context::get_state_map_by_name): Likewise.
2103 (region_model_context_decorator::get_state_map_by_name): Likewise.
2104 * sm-fd.cc: Include "analyzer/supergraph.h" and
2105 "analyzer/analyzer-language.h".
2106 (enum expected_phase): New enum.
2107 (fd_state_machine::m_new_datagram_socket): New.
2108 (fd_state_machine::m_new_stream_socket): New.
2109 (fd_state_machine::m_new_unknown_socket): New.
2110 (fd_state_machine::m_bound_datagram_socket): New.
2111 (fd_state_machine::m_bound_stream_socket): New.
2112 (fd_state_machine::m_bound_unknown_socket): New.
2113 (fd_state_machine::m_listening_stream_socket): New.
2114 (fd_state_machine::m_m_connected_stream_socket): New.
2115 (fd_state_machine::m_SOCK_STREAM): New.
2116 (fd_state_machine::m_SOCK_DGRAM): New.
2117 (fd_diagnostic::describe_state_change): Handle socket states.
2118 (fd_diagnostic::get_meaning_for_state_change): Likewise.
2119 (class fd_phase_mismatch): New.
2120 (enum expected_type): New enum.
2121 (class fd_type_mismatch): New.
2122 (fd_state_machine::fd_state_machine): Initialize new states and
2123 stashed named constants.
2124 (fd_state_machine::is_socket_fd_p): New.
2125 (fd_state_machine::is_datagram_socket_fd_p): New.
2126 (fd_state_machine::is_stream_socket_fd_p): New.
2127 (fd_state_machine::on_close): Handle the socket states.
2128 (fd_state_machine::check_for_open_fd): Complain about fncalls on
2129 sockets in the wrong phase. Support socket FDs.
2130 (add_constraint_ge_zero): New.
2131 (fd_state_machine::get_state_for_socket_type): New.
2132 (fd_state_machine::on_socket): New.
2133 (fd_state_machine::check_for_socket_fd): New.
2134 (fd_state_machine::check_for_new_socket_fd): New.
2135 (fd_state_machine::on_bind): New.
2136 (fd_state_machine::on_listen): New.
2137 (fd_state_machine::on_accept): New.
2138 (fd_state_machine::on_connect): New.
2139 (fd_state_machine::can_purge_p): Don't purge socket values.
2140 (get_fd_state): New.
2141 (region_model::mark_as_valid_fd): Use get_fd_state.
2142 (region_model::on_socket): New.
2143 (region_model::on_bind): New.
2144 (region_model::on_listen): New.
2145 (region_model::on_accept): New.
2146 (region_model::on_connect): New.
2147 * sm-fd.dot: Update to reflect sm-fd.cc changes.
2149 2022-11-15 David Malcolm <dmalcolm@redhat.com>
2152 * analyzer-language.cc: New file.
2153 * analyzer-language.h: New file.
2154 * analyzer.h (get_stashed_constant_by_name): New decl.
2155 (log_stashed_constants): New decl.
2156 * engine.cc (impl_run_checkers): Call log_stashed_constants.
2157 * region-model-impl-calls.cc
2158 (region_model::impl_call_analyzer_dump_named_constant): New.
2159 * region-model.cc (region_model::on_stmt_pre): Handle
2160 __analyzer_dump_named_constant.
2162 (region_model::impl_call_analyzer_dump_named_constant): New decl.
2163 * sm-fd.cc (fd_state_machine::m_O_ACCMODE): New.
2164 (fd_state_machine::m_O_RDONLY): New.
2165 (fd_state_machine::m_O_WRONLY): New.
2166 (fd_state_machine::fd_state_machine): Initialize the new fields.
2167 (fd_state_machine::get_access_mode_from_flag): Use the new fields,
2168 rather than using the host values.
2170 2022-11-13 David Malcolm <dmalcolm@redhat.com>
2173 * analyzer.opt (Wanalyzer-tainted-assertion): New.
2174 * checker-path.cc (checker_path::fixup_locations): Pass false to
2175 pending_diagnostic::fixup_location.
2176 * diagnostic-manager.cc (get_emission_location): Pass true to
2177 pending_diagnostic::fixup_location.
2178 * pending-diagnostic.cc (pending_diagnostic::fixup_location): Add
2180 * pending-diagnostic.h (pending_diagnostic::fixup_location): Add
2182 * sm-taint.cc (taint_state_machine::m_tainted_control_flow): New.
2183 (taint_diagnostic::describe_state_change): Drop "final".
2184 (class tainted_assertion): New.
2185 (taint_state_machine::taint_state_machine): Initialize
2186 m_tainted_control_flow.
2187 (taint_state_machine::alt_get_inherited_state): Support
2188 comparisons being tainted, based on their arguments.
2189 (is_assertion_failure_handler_p): New.
2190 (taint_state_machine::on_stmt): Complain about calls to assertion
2191 failure handlers guarded by an attacker-controller conditional.
2192 Detect attacker-controlled gcond conditionals and gswitch index
2194 (taint_state_machine::check_control_flow_arg_for_taint): New.
2196 2022-11-11 David Malcolm <dmalcolm@redhat.com>
2198 * sm-fd.dot: Fix typo in comment.
2199 * sm-file.dot: New file.
2200 * varargs.cc: Fix typo in comment.
2201 * varargs.dot: New file.
2203 2022-11-11 David Malcolm <dmalcolm@redhat.com>
2205 * checker-path.h: Split out checker_event and its subclasses to...
2206 * checker-event.h: ...this new header.
2208 2022-11-11 David Malcolm <dmalcolm@redhat.com>
2211 * analyzer.opt (Wanalyzer-infinite-recursion): New.
2212 * call-string.cc (call_string::count_occurrences_of_function):
2214 * call-string.h (call_string::count_occurrences_of_function): New
2216 * checker-path.cc (function_entry_event::function_entry_event):
2218 (checker_path::add_final_event): Delete.
2219 * checker-path.h (function_entry_event::function_entry_event): New
2221 (function_entry_event::get_desc): Drop "final".
2222 (checker_path::add_final_event): Delete.
2223 * diagnostic-manager.cc
2224 (diagnostic_manager::emit_saved_diagnostic): Create the final
2225 event via a new pending_diagnostic::add_final_event vfunc, rather
2226 than checker_path::add_final_event.
2227 (diagnostic_manager::add_events_for_eedge): Create function entry
2228 events via a new pending_diagnostic::add_function_entry_event
2230 * engine.cc (exploded_graph::process_node): When creating a new
2231 PK_BEFORE_SUPERNODE node, call
2232 exploded_graph::detect_infinite_recursion on it after adding the
2234 * exploded-graph.h (exploded_graph::detect_infinite_recursion):
2236 (exploded_graph::find_previous_entry_to): New decl.
2237 * infinite-recursion.cc: New file.
2238 * pending-diagnostic.cc
2239 (pending_diagnostic::add_function_entry_event): New.
2240 (pending_diagnostic::add_final_event): New.
2241 * pending-diagnostic.h
2242 (pending_diagnostic::add_function_entry_event): New vfunc.
2243 (pending_diagnostic::add_final_event): New vfunc.
2245 2022-11-10 David Malcolm <dmalcolm@redhat.com>
2248 * analyzer.opt (Wanalyzer-deref-before-check): New warning.
2249 * diagnostic-manager.cc
2250 (null_assignment_sm_context::set_next_state): Only add state
2251 change events for transition to "null" state.
2252 (null_assignment_sm_context::is_transition_to_null): New.
2253 * engine.cc (impl_region_model_context::on_pop_frame): New.
2254 * exploded-graph.h (impl_region_model_context::on_pop_frame): New
2256 * program-state.cc (sm_state_map::clear_any_state): New.
2257 (sm_state_map::can_merge_with_p): New.
2258 (program_state::can_merge_with_p): Replace requirement that
2259 sm-states be equal in favor of an attempt to merge them.
2260 * program-state.h (sm_state_map::clear_any_state): New decl.
2261 (sm_state_map::can_merge_with_p): New decl.
2262 * region-model.cc (region_model::eval_condition): Make const.
2263 (region_model::pop_frame): Call ctxt->on_pop_frame.
2264 * region-model.h (region_model::eval_condition): Make const.
2265 (region_model_context::on_pop_frame): New vfunc.
2266 (noop_region_model_context::on_pop_frame): New.
2267 (region_model_context_decorator::on_pop_frame): New.
2268 * sm-malloc.cc (enum resource_state): Add RS_ASSUMED_NON_NULL.
2269 (allocation_state::dump_to_pp): Drop "final".
2270 (struct assumed_non_null_state): New subclass.
2271 (malloc_state_machine::m_assumed_non_null): New.
2272 (assumed_non_null_p): New.
2273 (class deref_before_check): New.
2274 (assumed_non_null_state::dump_to_pp): New.
2275 (malloc_state_machine::get_or_create_assumed_non_null_state_for_frame):
2277 (malloc_state_machine::maybe_assume_non_null): New.
2278 (malloc_state_machine::on_stmt): Transition from start state to
2279 "assumed-non-null" state for pointers passed to
2280 __attribute__((nonnull)) arguments, and for pointers explicitly
2281 dereferenced. Call maybe_complain_about_deref_before_check for
2282 pointers explicitly compared against NULL.
2283 (malloc_state_machine::maybe_complain_about_deref_before_check):
2285 (malloc_state_machine::on_deallocator_call): Also transition
2286 "assumed-non-null" states to "freed".
2287 (malloc_state_machine::on_pop_frame): New.
2288 (malloc_state_machine::maybe_get_merged_states_nonequal): New.
2289 * sm-malloc.dot: Update for changes to sm-malloc.cc.
2290 * sm.h (state_machine::on_pop_frame): New.
2291 (state_machine::maybe_get_merged_state): New.
2292 (state_machine::maybe_get_merged_states_nonequal): New.
2294 2022-11-09 David Malcolm <dmalcolm@redhat.com>
2296 * checker-path.cc (checker_event::debug): New.
2297 (checker_path::add_event): Move here from checker-path.h. Add
2299 * checker-path.h (checker_event::debug): New decl.
2300 (checker_path::checker_path): Add logger param.
2301 (checker_path::add_event): Move definition from here to
2303 (checker_path::m_logger): New field.
2304 * diagnostic-manager.cc
2305 (diagnostic_manager::emit_saved_diagnostic): Pass logger to
2307 (diagnostic_manager::add_events_for_eedge): Log scope when
2308 processing a run of stmts.
2310 2022-11-08 David Malcolm <dmalcolm@redhat.com>
2313 * region-model-impl-calls.cc: Update comment.
2314 * region-model.cc (region_model::check_symbolic_bounds): Fix
2315 layout of "void" return. Replace usage of
2316 eval_condition_without_cm with eval_condition.
2317 (region_model::eval_condition): Take over body of...
2318 (region_model::eval_condition_without_cm): ...this subroutine,
2319 dropping the latter. Eliminating this distinction avoids issues
2320 where constraints were not considered when recursing.
2321 (region_model::compare_initial_and_pointer): Update comment.
2322 (region_model::symbolic_greater_than): Replace usage of
2323 eval_condition_without_cm with eval_condition.
2325 (region_model::eval_condition_without_cm): Delete decl.
2327 2022-11-08 David Malcolm <dmalcolm@redhat.com>
2329 * region-model-impl-calls.cc
2330 (region_model::impl_call_errno_location): New.
2331 * region-model-manager.cc
2332 (region_model_manager::region_model_manager): Initialize
2333 m_thread_local_region and m_errno_region.
2334 * region-model-manager.h (region_model_manager::get_errno_region):
2336 (region_model_manager::m_thread_local_region): New.
2337 (region_model_manager::m_errno_region): New.
2338 * region-model.cc (region_model::on_call_pre): Special-case
2340 (region_model::set_errno): New.
2341 * region-model.h (impl_call_errno_location): New decl.
2342 (region_model::set_errno): New decl.
2343 * region.cc (thread_local_region::dump_to_pp): New.
2344 (errno_region::dump_to_pp): New.
2345 * region.h (enum memory_space): Add MEMSPACE_THREAD_LOCAL.
2346 (enum region_kind): Add RK_THREAD_LOCAL and RK_ERRNO.
2347 (class thread_local_region): New.
2348 (is_a_helper <const thread_local_region *>::test): New.
2349 (class errno_region): New.
2350 (is_a_helper <const errno_region *>::test): New.
2351 * store.cc (binding_cluster::escaped_p): New.
2352 (store::escaped_p): Treat errno as always having escaped.
2353 (store::replay_call_summary_cluster): Handle RK_THREAD_LOCAL and
2355 * store.h (binding_cluster::escaped_p): Remove definition.
2357 2022-11-08 David Malcolm <dmalcolm@redhat.com>
2359 * call-info.cc (success_call_info::get_desc): Delete.
2360 (failed_call_info::get_desc): Likewise.
2361 (succeed_or_fail_call_info::get_desc): New.
2362 * call-info.h (class succeed_or_fail_call_info): New.
2363 (class success_call_info): Convert to a subclass of
2364 succeed_or_fail_call_info.
2365 (class failed_call_info): Likewise.
2367 2022-11-08 David Malcolm <dmalcolm@redhat.com>
2369 * region-model-impl-calls.cc (region_model::impl_call_strchr):
2370 Move to on_call_post. Handle both outcomes using bifurcation,
2371 rather than just the "not found" case.
2372 * region-model.cc (region_model::on_call_pre): Move
2373 BUILT_IN_STRCHR and "strchr" to...
2374 (region_model::on_call_post): ...here.
2376 2022-11-03 David Malcolm <dmalcolm@redhat.com>
2378 * analyzer.h: Use std::unique_ptr for state machines from plugins.
2379 * engine.cc: Likewise.
2381 2022-11-03 David Malcolm <dmalcolm@redhat.com>
2383 * analyzer.h: Use std::unique_ptr for known functions.
2384 * engine.cc: Likewise.
2385 * known-function-manager.cc: Likewise.
2386 * known-function-manager.h: Likewise.
2388 2022-11-03 David Malcolm <dmalcolm@redhat.com>
2390 * analysis-plan.cc: Define INCLUDE_MEMORY before including
2392 * analyzer-pass.cc: Likewise.
2393 * analyzer-selftests.cc: Likewise.
2394 * analyzer.cc: Likewise.
2395 * analyzer.h: Use std::unique_ptr in bifurcation code.
2396 * call-string.cc: Define INCLUDE_MEMORY before including system.h.
2397 * complexity.cc: Likewise.
2398 * engine.cc: Use std::unique_ptr in bifurcation code.
2399 * exploded-graph.h: Likewise.
2400 * known-function-manager.cc: Define INCLUDE_MEMORY before
2402 * region-model-impl-calls.cc: Use std::unique_ptr in bifurcation
2404 * region-model.cc: Likewise.
2405 * region-model.h: Likewise.
2406 * supergraph.cc: Define INCLUDE_MEMORY before including system.h.
2408 2022-11-03 David Malcolm <dmalcolm@redhat.com>
2410 * call-info.cc: Use std::unique_ptr for checker_event.
2411 * checker-path.cc: Likewise.
2412 * checker-path.h: Likewise.
2413 * diagnostic-manager.cc: Likewise.
2414 * engine.cc: Likewise.
2415 * pending-diagnostic.cc: Likewise.
2416 * sm-signal.cc: Likewise.
2417 * varargs.cc: Likewise.
2419 2022-11-03 David Malcolm <dmalcolm@redhat.com>
2421 * diagnostic-manager.cc: Include "make-unique.h".
2422 Use std::unique_ptr for feasibility_problems and exploded_path.
2423 Delete explicit saved_diagnostic dtor.
2424 * diagnostic-manager.h: Likewise.
2425 * engine.cc: Likewise.
2426 * exploded-graph.h: Likewise.
2427 * feasible-graph.cc: Likewise.
2428 * feasible-graph.h: Likewise.
2430 2022-11-03 David Malcolm <dmalcolm@redhat.com>
2432 * checker-path.cc (rewind_event::rewind_event): Update for usage of
2433 std::unique_ptr on custom_edge_info.
2434 * engine.cc (exploded_node::on_longjmp): Likewise.
2435 (exploded_edge::exploded_edge): Likewise.
2436 (exploded_edge::~exploded_edge): Delete.
2437 (exploded_graph::add_function_entry): Update for usage of
2438 std::unique_ptr on custom_edge_info.
2439 (exploded_graph::add_edge): Likewise.
2440 (add_tainted_args_callback): Likewise.
2441 (exploded_graph::maybe_create_dynamic_call): Likewise.
2442 (exploded_graph::process_node): Likewise.
2443 * exploded-graph.h (exploded_edge::~exploded_edge): Delete.
2444 (exploded_edge::m_custom_info): Use std::unique_ptr.
2445 (exploded_edge::add_edge): Likewise.
2446 * sm-signal.cc (register_signal_handler::impl_transition): Use
2449 2022-11-03 David Malcolm <dmalcolm@redhat.com>
2451 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic): Make
2453 (saved_diagnostic::~saved_diagnostic): Remove explicit delete of
2455 (diagnostic_manager::add_diagnostic): Make stmt_finder const.
2456 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic):
2458 (saved_diagnostic::m_stmt_finder): Convert to std::unique_ptr.
2459 (diagnostic_manager::add_diagnostic): Make stmt_finder const.
2460 * engine.cc (impl_sm_context::impl_sm_context): Likewise.
2461 (impl_sm_context::m_stmt_finder): Likewise.
2462 (leak_stmt_finder::clone): Convert return type to std::unique_ptr.
2463 * exploded-graph.h (stmt_finder::clone): Likewise.
2465 2022-11-03 David Malcolm <dmalcolm@redhat.com>
2467 * call-info.cc: Add define of INCLUDE_MEMORY.
2468 * call-summary.cc: Likewise.
2469 * checker-path.cc: Likewise.
2470 * constraint-manager.cc: Likewise.
2471 * diagnostic-manager.cc: Likewise.
2472 (saved_diagnostic::saved_diagnostic): Use std::unique_ptr for
2473 param d and field m_d.
2474 (saved_diagnostic::~saved_diagnostic): Remove explicit delete of m_d.
2475 (saved_diagnostic::add_note): Use std::unique_ptr for
2477 (saved_diagnostic::get_pending_diagnostic): Update for conversion
2478 of m_sd.m_d to unique_ptr.
2479 (diagnostic_manager::add_diagnostic): Use std::unique_ptr for
2480 param d. Remove explicit deletion.
2481 (diagnostic_manager::add_note): Use std::unique_ptr for param pn.
2482 (diagnostic_manager::emit_saved_diagnostic): Update for conversion
2483 of m_sd.m_d to unique_ptr.
2484 (null_assignment_sm_context::warn): Use std::unique_ptr for
2485 param d. Remove explicit deletion.
2486 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Use
2487 std::unique_ptr for param d.
2488 (saved_diagnostic::add_note): Likewise for param pn.
2489 (saved_diagnostic::m_d): Likewise.
2490 (diagnostic_manager::add_diagnostic): Use std::unique_ptr for
2492 (diagnostic_manager::add_note): Use std::unique_ptr for param pn.
2493 * engine.cc: Include "make-unique.h".
2494 (impl_region_model_context::warn): Update to use std::unique_ptr
2495 for param, removing explicit deletion.
2496 (impl_region_model_context::add_note): Likewise.
2497 (impl_sm_context::warn): Update to use std::unique_ptr
2499 (impl_region_model_context::on_state_leak): Likewise for result of
2501 (exploded_node::on_longjmp): Use make_unique when creating
2503 (exploded_graph::process_node): Likewise.
2504 * exploded-graph.h (impl_region_model_context::warn): Update to
2505 use std::unique_ptr for param.
2506 (impl_region_model_context::add_note): Likewise.
2507 * feasible-graph.cc: Add define of INCLUDE_MEMORY.
2508 * pending-diagnostic.cc: Likewise.
2509 * pending-diagnostic.h: Include analyzer.sm.h"
2510 * program-point.cc: Add define of INCLUDE_MEMORY.
2511 * program-state.cc: Likewise.
2512 * region-model-asm.cc: Likewise.
2513 * region-model-impl-calls.cc: Likewise. Include "make-unique.h".
2514 (region_model::impl_call_putenv): Use make_unique when creating
2516 * region-model-manager.cc: Add define of INCLUDE_MEMORY.
2517 * region-model-reachability.cc: Likewise.
2518 * region-model.cc: Likewise. Include "make-unique.h".
2519 (region_model::get_gassign_result): Use make_unique when creating
2521 (region_model::check_for_poison): Likewise.
2522 (region_model::on_stmt_pre): Likewise.
2523 (region_model::check_symbolic_bounds): Likewise.
2524 (region_model::check_region_bounds): Likewise.
2525 (annotating_ctxt: make_note): Use std::unique_ptr for result.
2526 (region_model::deref_rvalue): Use make_unique when creating
2528 (region_model::check_for_writable_region): Likewise.
2529 (region_model::check_region_size): Likewise.
2530 (region_model::check_dynamic_size_for_floats): Likewise.
2531 (region_model::maybe_complain_about_infoleak): Likewise.
2532 (noop_region_model_context::add_note): Use std::unique_ptr for
2533 param. Remove explicit deletion.
2534 * region-model.h: Include "analyzer/pending-diagnostic.h".
2535 (region_model_context::warn): Convert param to std::unique_ptr.
2536 (region_model_context::add_note): Likewise.
2537 (noop_region_model_context::warn): Likewise.
2538 (noop_region_model_context::add_note): Likewise.
2539 (region_model_context_decorator::warn): Likewise.
2540 (region_model_context_decorator::add_note): Likewise.
2541 (note_adding_context::warn): Likewise.
2542 (note_adding_context::make_note): Likewise for return type.
2543 (test_region_model_context::warn): Convert param to
2545 * region.cc: Add define of INCLUDE_MEMORY.
2546 * sm-fd.cc: Likewise. Include "make-unique.h".
2547 (fd_state_machine::check_for_fd_attrs): Use make_unique when
2548 creating pending_diagnostics.
2549 (fd_state_machine::on_open): Likewise.
2550 (fd_state_machine::on_creat): Likewise.
2551 (fd_state_machine::check_for_dup): Likewise.
2552 (fd_state_machine::on_close): Likewise.
2553 (fd_state_machine::check_for_open_fd): Likewise.
2554 (fd_state_machine::on_leak): Likewise, converting return type to
2556 * sm-file.cc: Add define of INCLUDE_MEMORY. Include
2558 (fileptr_state_machine::on_stmt): Use make_unique when creating
2560 (fileptr_state_machine::on_leak): Likewise, converting return type
2562 * sm-malloc.cc: Add define of INCLUDE_MEMORY. Include
2564 (malloc_state_machine::on_stmt): Use make_unique when creating
2566 (malloc_state_machine::handle_free_of_non_heap): Likewise.
2567 (malloc_state_machine::on_deallocator_call): Likewise.
2568 (malloc_state_machine::on_realloc_call): Likewise.
2569 (malloc_state_machine::on_leak): Likewise, converting return type
2571 * sm-pattern-test.cc: Add define of INCLUDE_MEMORY. Include
2573 (pattern_test_state_machine::on_condition): Use make_unique when
2574 creating pending_diagnostic.
2575 * sm-sensitive.cc: Add define of INCLUDE_MEMORY. Include
2577 (sensitive_state_machine::warn_for_any_exposure): Use make_unique
2578 when creating pending_diagnostic.
2579 * sm-signal.cc: Add define of INCLUDE_MEMORY. Include
2581 (signal_state_machine::on_stmt): Use make_unique when creating
2583 * sm-taint.cc: Add define of INCLUDE_MEMORY. Include
2585 (taint_state_machine::check_for_tainted_size_arg): Use make_unique
2586 when creating pending_diagnostic.
2587 (taint_state_machine::check_for_tainted_divisor): Likewise.
2588 (region_model::check_region_for_taint): Likewise.
2589 (region_model::check_dynamic_size_for_taint): Likewise.
2590 * sm.cc: Add define of INCLUDE_MEMORY. Include
2591 "analyzer/pending-diagnostic.h".
2592 (state_machine::on_leak): Move here from sm.h, changing return
2593 type to std::unique_ptr.
2594 * sm.h (state_machine::on_leak): Change return type to
2595 std::unique_ptr. Move defn of base impl to sm.cc
2596 (sm_context::warn): Convert param d to std_unique_ptr.
2597 * state-purge.cc: Add define of INCLUDE_MEMORY.
2598 * store.cc: Likewise.
2599 * svalue.cc: Likewise.
2600 * trimmed-graph.cc: Likewise.
2601 * varargs.cc: Likewise. Include "make-unique.h".
2602 (va_list_state_machine::check_for_ended_va_list): Use make_unique
2603 when creating pending_diagnostic.
2604 (va_list_state_machine::on_leak): Likewise, converting return type
2606 (region_model::impl_call_va_arg): Use make_unique when creating
2609 2022-11-03 David Malcolm <dmalcolm@redhat.com>
2612 * analyzer.cc (is_pipe_call_p): New.
2613 * analyzer.h (is_pipe_call_p): New decl.
2614 * region-model.cc (region_model::on_call_pre): Use it.
2615 (region_model::on_call_post): Likewise.
2617 2022-10-26 David Malcolm <dmalcolm@redhat.com>
2619 * sm-fd.cc (fd_state_machine::on_open): Transition to "unchecked"
2620 when the mode is symbolic, rather than just on integer constants.
2621 (fd_state_machine::check_for_open_fd): Don't complain about
2622 unchecked values in the start state.
2624 2022-10-26 David Malcolm <dmalcolm@redhat.com>
2626 * sm-fd.dot: New file.
2628 2022-10-24 David Malcolm <dmalcolm@redhat.com>
2631 * varargs.cc (get_va_copy_arg): Fix the non-pointer case.
2633 2022-10-24 David Malcolm <dmalcolm@redhat.com>
2636 * region-model.cc (region_model::eval_condition_without_cm):
2637 Ensure that constants are on the right-hand side before checking
2640 2022-10-24 David Malcolm <dmalcolm@redhat.com>
2642 * engine.cc (impl_region_model_context::get_malloc_map): Replace
2644 (impl_region_model_context::get_state_map_by_name): ...this.
2645 (impl_region_model_context::get_fd_map): Delete.
2646 (impl_region_model_context::get_taint_map): Delete.
2647 * exploded-graph.h (impl_region_model_context::get_fd_map):
2649 (impl_region_model_context::get_malloc_map): Delete.
2650 (impl_region_model_context::get_taint_map): Delete.
2651 (impl_region_model_context::get_state_map_by_name): New.
2652 * region-model.h (region_model_context::get_state_map_by_name):
2654 (region_model_context::get_fd_map): Convert from vfunc to
2656 (region_model_context::get_malloc_map): Likewise.
2657 (region_model_context::get_taint_map): Likewise.
2658 (noop_region_model_context::get_state_map_by_name): New.
2659 (noop_region_model_context::get_fd_map): Delete.
2660 (noop_region_model_context::get_malloc_map): Delete.
2661 (noop_region_model_context::get_taint_map): Delete.
2662 (region_model_context_decorator::get_state_map_by_name): New.
2663 (region_model_context_decorator::get_fd_map): Delete.
2664 (region_model_context_decorator::get_malloc_map): Delete.
2665 (region_model_context_decorator::get_taint_map): Delete.
2667 2022-10-24 David Malcolm <dmalcolm@redhat.com>
2670 * engine.cc (impl_region_model_context::get_fd_map): New.
2671 * exploded-graph.h (impl_region_model_context::get_fd_map): New
2673 * region-model-impl-calls.cc (region_model::impl_call_pipe): New.
2674 * region-model.cc (region_model::update_for_int_cst_return): New,
2676 (region_model::update_for_zero_return): ...this. Reimplement in
2677 terms of the former.
2678 (region_model::on_call_pre): Handle "pipe" and "pipe2".
2679 (region_model::on_call_post): Likewise.
2680 * region-model.h (region_model::impl_call_pipe): New decl.
2681 (region_model::update_for_int_cst_return): New decl.
2682 (region_model::mark_as_valid_fd): New decl.
2683 (region_model_context::get_fd_map): New pure virtual fn.
2684 (noop_region_model_context::get_fd_map): New.
2685 (region_model_context_decorator::get_fd_map): New.
2686 * sm-fd.cc: Include "analyzer/program-state.h".
2687 (fd_state_machine::describe_state_change): Handle transitions from
2688 start state to valid states.
2689 (fd_state_machine::mark_as_valid_fd): New.
2690 (fd_state_machine::on_stmt): Add missing return for "creat".
2691 (region_model::mark_as_valid_fd): New.
2693 2022-10-19 David Malcolm <dmalcolm@redhat.com>
2696 * varargs.cc (get_BT_VALIST_ARG): Rename to...
2697 (get_va_copy_arg): ...this, and update logic for determining level
2698 of indirection of va_copy's argument to use type of argument,
2699 rather than looking at va_list_type_node, to correctly handle
2700 __builtin_ms_va_copy.
2701 (get_stateful_BT_VALIST_ARG): Rename to...
2702 (get_stateful_va_copy_arg): ...this.
2703 (va_list_state_machine::on_va_copy): Update for renaming.
2704 (region_model::impl_call_va_copy): Likewise.
2706 2022-10-13 David Malcolm <dmalcolm@redhat.com>
2709 * svalue.cc (constant_svalue::maybe_fold_bits_within): Only
2710 attempt to extract individual bits when tree_fits_uhwi_p.
2712 2022-10-07 David Malcolm <dmalcolm@redhat.com>
2715 * region-model.cc (selftest::get_bit): New function.
2716 (selftest::test_bits_within_svalue_folding): New.
2717 (selfftest::analyzer_region_model_cc_tests): Call it.
2718 * svalue.cc (constant_svalue::maybe_fold_bits_within): Handle the
2719 case of extracting a single bit.
2721 2022-10-06 David Malcolm <dmalcolm@redhat.com>
2724 * store.cc (store::replay_call_summary_cluster): Eliminate
2725 special-casing of RK_HEAP_ALLOCATED in favor of sharing code with
2726 RK_DECL, avoiding an ICE due to attempting to bind a
2727 compound_svalue into a binding_cluster when an svalue in the
2728 summary cluster converts to a compound_svalue in the caller.
2730 2022-10-06 David Malcolm <dmalcolm@redhat.com>
2732 * call-summary.cc (call_summary_replay::dump_to_pp): Bulletproof
2733 against NULL caller regions/svalues.
2735 2022-10-05 David Malcolm <dmalcolm@redhat.com>
2737 * analysis-plan.cc: Simplify includes.
2738 * analyzer-pass.cc: Likewise.
2739 * analyzer-selftests.cc: Likewise.
2740 * analyzer.cc: Likewise.
2741 * analyzer.h: Add includes of "json.h" and "tristate.h".
2742 * call-info.cc: Simplify includes.
2743 * call-string.cc: Likewise.
2744 * call-summary.cc: Likewise.
2745 * checker-path.cc: Likewise.
2746 * complexity.cc: Likewise.
2747 * constraint-manager.cc: Likewise.
2748 * diagnostic-manager.cc: Likewise.
2749 * engine.cc: Likewise.
2750 * feasible-graph.cc: Likewise.
2751 * known-function-manager.cc: Likewise.
2752 * pending-diagnostic.cc: Likewise.
2753 * program-point.cc: Likewise.
2754 * program-state.cc: Likewise.
2755 * region-model-asm.cc: Likewise.
2756 * region-model-impl-calls.cc: Likewise.
2757 * region-model-manager.cc: Likewise.
2758 * region-model-reachability.cc: Likewise.
2759 * region-model.cc: Likewise.
2760 * region-model.h: Include "selftest.h".
2761 * region.cc: Simplify includes.
2762 * sm-fd.cc: Likewise.
2763 * sm-file.cc: Likewise.
2764 * sm-malloc.cc: Likewise.
2765 * sm-pattern-test.cc: Likewise.
2766 * sm-sensitive.cc: Likewise.
2767 * sm-signal.cc: Likewise.
2768 * sm-taint.cc: Likewise.
2770 * state-purge.cc: Likewise.
2771 * store.cc: Likewise.
2772 * store.h: Likewise.
2773 * supergraph.cc: Likewise.
2774 * svalue.cc: Likewise.
2775 * svalue.h: Likewise.
2776 * trimmed-graph.cc: Likewise.
2777 * varargs.cc: Likewise.
2779 2022-10-05 David Malcolm <dmalcolm@redhat.com>
2783 (call_summary_replay::convert_svalue_from_summary_1): Handle NULL
2784 results from convert_svalue_from_summary in SK_UNARY_OP and
2786 * engine.cc (impl_region_model_context::on_unknown_change): Bail
2787 out on svalues that can't have associated state.
2788 * region-model-impl-calls.cc
2789 (region_model::impl_call_analyzer_get_unknown_ptr): New.
2790 * region-model.cc (region_model::on_stmt_pre): Handle
2791 "__analyzer_get_unknown_ptr".
2793 (region_model::impl_call_analyzer_get_unknown_ptr): New decl.
2794 * store.cc (store::replay_call_summary_cluster): Avoid trying to
2795 create binding clusters for base regions that shouldn't have them.
2797 2022-10-05 Martin Liska <mliska@suse.cz>
2799 * call-summary.cc (call_summary_replay::call_summary_replay):
2800 Remove unused variable and arguments.
2801 * call-summary.h: Likewise.
2802 * engine.cc (exploded_node::on_stmt): Likewise.
2803 (exploded_node::replay_call_summaries): Likewise.
2804 (exploded_node::replay_call_summary): Likewise.
2805 * exploded-graph.h (class exploded_node): Likewise.
2807 2022-10-05 David Malcolm <dmalcolm@redhat.com>
2810 * analyzer-logging.h: Include "diagnostic-core.h".
2811 * analyzer.h: Include "function.h".
2812 (class call_summary): New forward decl.
2813 (class call_summary_replay): New forward decl.
2814 (struct per_function_data): New forward decl.
2815 (struct interesting_t): New forward decl.
2816 (custom_edge_info::update_state): New vfunc.
2817 * call-info.cc (custom_edge_info::update_state): New.
2818 * call-summary.cc: New file.
2819 * call-summary.h: New file.
2820 * constraint-manager.cc: Include "analyzer/call-summary.h".
2821 (class replay_fact_visitor): New.
2822 (constraint_manager::replay_call_summary): New.
2823 * constraint-manager.h (constraint_manager::replay_call_summary):
2825 * engine.cc: Include "analyzer/call-summary.h".
2826 (exploded_node::on_stmt): Handle call summaries.
2827 (class call_summary_edge_info): New.
2828 (exploded_node::replay_call_summaries): New.
2829 (exploded_node::replay_call_summary): New.
2830 (per_function_data::~per_function_data): New.
2831 (per_function_data::add_call_summary): Move here from header and
2833 (exploded_graph::process_node): Call update_state rather than
2834 update_model when handling bifurcation
2835 (viz_callgraph_node::dump_dot): Use a regular label rather
2836 than an HTML table; add summaries to dump.
2837 * exploded-graph.h: Include "alloc-pool.h", "fibonacci_heap.h",
2838 "supergraph.h", "sbitmap.h", "shortest-paths.h", "analyzer/sm.h",
2839 "analyzer/program-state.h", and "analyzer/diagnostic-manager.h".
2840 (exploded_node::replay_call_summaries): New decl.
2841 (exploded_node::replay_call_summary): New decl.
2842 (per_function_data::~per_function_data): New decl.
2843 (per_function_data::add_call_summary): Move implemention from
2845 (per_function_data::m_summaries): Update type of element.
2846 * known-function-manager.h: Include "analyzer/analyzer-logging.h".
2847 * program-point.h: Include "pretty-print.h" and
2848 "analyzer/call-string.h".
2849 * program-state.cc: Include "analyzer/call-summary.h".
2850 (sm_state_map::replay_call_summary): New.
2851 (program_state::replay_call_summary): New.
2852 * program-state.h (sm_state_map::replay_call_summary): New decl.
2853 (program_state::replay_call_summary): New decl.
2854 * region-model-manager.cc
2855 (region_model_manager::get_or_create_asm_output_svalue): New
2857 * region-model-manager.h
2858 (region_model_manager::get_or_create_asm_output_svalue): New
2860 * region-model.cc: Include "analyzer/call-summary.h".
2861 (region_model::maybe_update_for_edge): Remove call to
2862 region_model::update_for_call_summary on
2863 SUPEREDGE_INTRAPROCEDURAL_CALL.
2864 (region_model::update_for_call_summary): Delete.
2865 (region_model::replay_call_summary): New.
2866 * region-model.h (region_model::replay_call_summary): New decl.
2867 (region_model::update_for_call_summary): Delete decl.
2868 * store.cc: Include "analyzer/call-summary.h".
2869 (store::replay_call_summary): New.
2870 (store::replay_call_summary_cluster): New.
2871 * store.h: Include "tristate.h".
2872 (is_a_helper <const ana::concrete_binding *>::test): New.
2873 (store::replay_call_summary): New decl.
2874 (store::replay_call_summary_cluster): New decl.
2875 * supergraph.cc (get_ultimate_function_for_cgraph_edge): Remove
2877 (supergraph_call_edge): Make stmt param const.
2878 * supergraph.h: Include "ordered-hash-map.h", "cfg.h",
2879 "basic-block.h", "gimple.h", "gimple-iterator.h", and "digraph.h".
2880 (supergraph_call_edge): Make stmt param const.
2881 (get_ultimate_function_for_cgraph_edge): New decl.
2882 * svalue.cc (compound_svalue::compound_svalue): Assert that we're
2883 not nesting compound_svalues.
2884 * svalue.h: Include "json.h", "analyzer/store.h", and
2885 "analyzer/program-point.h".
2886 (asm_output_svalue::get_num_outputs): New accessor.
2888 2022-10-05 David Malcolm <dmalcolm@redhat.com>
2890 * region-model.h: Include "analyzer/region-model-manager.h"
2891 (class region_model_manager): Move decl to...
2892 * region-model-manager.h: ...this new file.
2894 2022-10-05 David Malcolm <dmalcolm@redhat.com>
2896 * region-model-manager.cc
2897 (region_model_manager::maybe_fold_unaryop): Fold -(-(VAL)) to VAL.
2899 2022-10-05 David Malcolm <dmalcolm@redhat.com>
2901 * region-model-manager.cc
2902 (region_model_manager::get_or_create_widening_svalue): Use a
2903 function_point rather than a program_point.
2904 * region-model.cc (selftest::test_widening_constraints): Likewise.
2906 (region_model_manager::get_or_create_widening_svalue): Likewise.
2907 (model_merger::get_function_point): New.
2908 * svalue.cc (svalue::can_merge_p): Use a function_point rather
2909 than a program_point.
2910 (svalue::can_merge_p): Likewise.
2911 * svalue.h (widening_svalue::key_t): Likewise.
2912 (widening_svalue::widening_svalue): Likewise.
2914 2022-09-12 Martin Liska <mliska@suse.cz>
2916 * region-model.cc (region_model::maybe_complain_about_infoleak):
2917 Remove unused fields.
2919 2022-09-11 Tim Lange <mail@tim-lange.me>
2922 * region-model.cc (region_model::check_region_bounds):
2923 Bail out if 0 bytes were accessed.
2924 * store.cc (byte_range::dump_to_pp):
2925 Add special case for empty ranges.
2926 (byte_range::exceeds_p): Restrict to non-empty ranges.
2927 (byte_range::falls_short_of_p): Restrict to non-empty ranges.
2928 * store.h (bit_range::empty_p): New function.
2929 (bit_range::get_last_byte_offset): Restrict to non-empty ranges.
2930 (byte_range::empty_p): New function.
2931 (byte_range::get_last_byte_offset): Restrict to non-empty ranges.
2933 2022-09-09 David Malcolm <dmalcolm@redhat.com>
2935 * analyzer.opt (Wanalyzer-exposure-through-uninit-copy): New.
2936 * checker-path.cc (region_creation_event::region_creation_event):
2937 Add "capacity" and "kind" params.
2938 (region_creation_event::get_desc): Generalize to different kinds
2940 (checker_path::add_region_creation_event): Convert to...
2941 (checker_path::add_region_creation_events): ...this.
2942 * checker-path.h (enum rce_kind): New.
2943 (region_creation_event::region_creation_event): Add "capacity" and
2945 (region_creation_event::m_capacity): New field.
2946 (region_creation_event::m_rce_kind): New field.
2947 (checker_path::add_region_creation_event): Convert to...
2948 (checker_path::add_region_creation_events): ...this.
2949 * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
2950 Update for multiple region creation events.
2951 (diagnostic_manager::add_event_on_final_node): Likewise.
2952 (diagnostic_manager::add_events_for_eedge): Likewise.
2953 * region-model-impl-calls.cc (call_details::get_logger): New.
2954 * region-model.cc: Define INCLUDE_MEMORY before including
2955 "system.h". Include "gcc-rich-location.h".
2956 (class record_layout): New.
2957 (class exposure_through_uninit_copy): New.
2958 (contains_uninit_p): New.
2959 (region_model::maybe_complain_about_infoleak): New.
2960 * region-model.h (call_details::get_logger): New decl.
2961 (region_model::maybe_complain_about_infoleak): New decl.
2962 (region_model::mark_as_tainted): New decl.
2963 * sm-taint.cc (region_model::mark_as_tainted): New.
2965 2022-09-09 David Malcolm <dmalcolm@redhat.com>
2967 * analyzer.h (class known_function_manager): New forward decl.
2968 (class known_function): New.
2969 (plugin_analyzer_init_iface::register_known_function): New.
2970 * engine.cc: Include "analyzer/known-function-manager.h".
2971 (plugin_analyzer_init_impl::plugin_analyzer_init_impl): Add
2973 (plugin_analyzer_init_impl::register_state_machine): Add
2975 (plugin_analyzer_init_impl::register_known_function): New.
2976 (plugin_analyzer_init_impl::m_known_fn_mgr): New.
2977 (impl_run_checkers): Update plugin callback invocation to use
2978 eng's known_function_manager.
2979 * known-function-manager.cc: New file.
2980 * known-function-manager.h: New file.
2981 * region-model-manager.cc
2982 (region_model_manager::region_model_manager): Pass logger to
2983 m_known_fn_mgr's ctor.
2984 * region-model.cc (region_model::update_for_zero_return): New.
2985 (region_model::update_for_nonzero_return): New.
2986 (maybe_simplify_upper_bound): New.
2987 (region_model::maybe_get_copy_bounds): New.
2988 (region_model::get_known_function): New.
2989 (region_model::on_call_pre): Handle plugin-supplied known
2991 * region-model.h: Include "analyzer/known-function-manager.h".
2992 (region_model_manager::get_known_function_manager): New.
2993 (region_model_manager::m_known_fn_mgr): New.
2994 (call_details::get_model): New accessor.
2995 (region_model::maybe_get_copy_bounds): New decl.
2996 (region_model::update_for_zero_return): New decl.
2997 (region_model::update_for_nonzero_return): New decl.
2998 (region_model::get_known_function): New decl.
2999 (region_model::get_known_function_manager): New.
3001 2022-09-08 Tim Lange <mail@tim-lange.me>
3004 * analyzer.h (region_offset): Eliminate m_is_symbolic member.
3005 * region-model-impl-calls.cc (region_model::impl_call_realloc):
3006 Refine implementation to be more precise.
3007 * region-model.cc (class symbolic_past_the_end):
3008 Abstract diagnostic class to complain about accesses past the end
3009 with symbolic values.
3010 (class symbolic_buffer_overflow):
3011 Concrete diagnostic class to complain about buffer overflows with
3013 (class symbolic_buffer_overread):
3014 Concrete diagnostic class to complain about buffer overreads with
3016 (region_model::check_symbolic_bounds): New function.
3017 (maybe_get_integer_cst_tree): New helper function.
3018 (region_model::check_region_bounds):
3019 Add call to check_symbolic_bounds if offset is not concrete.
3020 (region_model::eval_condition_without_cm):
3021 Add support for EQ_EXPR and GT_EXPR with binaryop_svalues.
3022 (is_positive_svalue): New hleper function.
3023 (region_model::symbolic_greater_than):
3024 New function to handle GT_EXPR comparisons with symbolic values.
3025 (region_model::structural_equality): New function to compare
3026 whether two svalues are structured the same, i.e. evaluate to
3028 (test_struct): Reflect changes to region::calc_offset.
3029 (test_var): Likewise.
3030 (test_array_2): Likewise and add selftest with symbolic i.
3031 * region-model.h (class region_model): Add check_symbolic_bounds,
3032 symbolic_greater_than and structural_equality.
3033 * region.cc (region::get_offset):
3034 Reflect changes to region::calc_offset.
3035 (region::calc_offset):
3036 Compute the symbolic offset if the offset is not concrete.
3037 (region::get_relative_symbolic_offset): New function to return the
3038 symbolic offset in bytes relative to its parent.
3039 (field_region::get_relative_symbolic_offset): Likewise.
3040 (element_region::get_relative_symbolic_offset): Likewise.
3041 (offset_region::get_relative_symbolic_offset): Likewise.
3042 (bit_range_region::get_relative_symbolic_offset): Likewise.
3043 * region.h: Add get_relative_symbolic_offset.
3044 * store.cc (binding_key::make):
3045 Reflect changes to region::calc_offset.
3046 (binding_map::apply_ctor_val_to_range): Likewise.
3047 (binding_map::apply_ctor_pair_to_child_region): Likewise.
3048 (binding_cluster::bind_compound_sval): Likewise.
3049 (binding_cluster::get_any_binding): Likewise.
3050 (binding_cluster::maybe_get_compound_binding): Likewise.
3052 2022-09-05 Tim Lange <mail@tim-lange.me>
3054 * region-model-impl-calls.cc (region_model::impl_call_strcpy):
3055 Handle the constant string case.
3056 * region-model.cc (region_model::get_string_size):
3057 New function to get the string size from a region or svalue.
3058 * region-model.h (class region_model): Add get_string_size.
3060 2022-09-05 Tim Lange <mail@tim-lange.me>
3062 * region.cc (cast_region::get_relative_concrete_offset):
3063 New overloaded method.
3064 * region.h: Add cast_region::get_relative_concrete_offset.
3066 2022-08-22 Martin Liska <mliska@suse.cz>
3068 * region-model.cc: Add missing final keyword.
3070 2022-08-18 Tim Lange <mail@tim-lange.me>
3073 * analyzer.opt: Add Wanalyzer-imprecise-floating-point-arithmetic.
3074 * region-model.cc (is_any_cast_p): Formatting.
3075 (region_model::check_region_size): Ensure precondition.
3076 (class imprecise_floating_point_arithmetic): New abstract
3077 diagnostic class for all floating-point related warnings.
3078 (class float_as_size_arg): Concrete diagnostic class to complain
3079 about floating-point operands inside the size argument.
3080 (class contains_floating_point_visitor):
3081 New visitor to find floating-point operands inside svalues.
3082 (region_model::check_dynamic_size_for_floats): New function.
3083 (region_model::set_dynamic_extents):
3084 Call to check_dynamic_size_for_floats.
3085 * region-model.h (class region_model):
3086 Add region_model::check_dynamic_size_for_floats.
3088 2022-08-16 Martin Liska <mliska@suse.cz>
3090 * region-model.cc: Fix -Winconsistent-missing-override clang
3092 * region.h: Likewise.
3094 2022-08-15 David Malcolm <dmalcolm@redhat.com>
3097 * region-model.cc (buffer_overread::emit): Fix copy&paste error in
3098 direction of the access in the note.
3100 2022-08-15 David Malcolm <dmalcolm@redhat.com>
3103 * region-model.cc (region_model::on_call_pre): Use check_call_args
3104 when ensuring that we call get_arg_svalue on all args. Remove
3105 redundant call from handling for stdio builtins.
3107 2022-08-15 Immad Mir <mirimmad@outlook.com>
3110 * sm-fd.cc (check_for_dup): exit early if first
3111 argument is invalid for all dup functions.
3113 2022-08-12 Tim Lange <mail@tim-lange.me>
3116 * analyzer.opt: Add Wanalyzer-out-of-bounds.
3117 * region-model.cc (class out_of_bounds): Diagnostics base class
3118 for all out-of-bounds diagnostics.
3119 (class past_the_end): Base class derived from out_of_bounds for
3120 the buffer_overflow and buffer_overread diagnostics.
3121 (class buffer_overflow): Buffer overflow diagnostics.
3122 (class buffer_overread): Buffer overread diagnostics.
3123 (class buffer_underflow): Buffer underflow diagnostics.
3124 (class buffer_underread): Buffer overread diagnostics.
3125 (region_model::check_region_bounds): New function to check region
3126 bounds for out-of-bounds accesses.
3127 (region_model::check_region_access):
3128 Add call to check_region_bounds.
3129 (region_model::get_representative_tree): New function that accepts
3130 a region instead of an svalue.
3131 * region-model.h (class region_model):
3132 Add region_model::check_region_bounds.
3133 * region.cc (region::symbolic_p): New predicate.
3134 (offset_region::get_byte_size_sval): Only return the remaining
3135 byte size on offset_regions.
3136 * region.h: Add region::symbolic_p.
3137 * store.cc (byte_range::intersects_p):
3138 Add new function equivalent to bit_range::intersects_p.
3139 (byte_range::exceeds_p): New function.
3140 (byte_range::falls_short_of_p): New function.
3141 * store.h (struct byte_range): Add byte_range::intersects_p,
3142 byte_range::exceeds_p and byte_range::falls_short_of_p.
3144 2022-08-12 Tim Lange <mail@tim-lange.me>
3147 * region-model-impl-calls.cc (region_model::impl_call_realloc):
3148 Use the result of get_copied_size as the size for the
3149 sized_regions in realloc.
3150 (success_with_move::get_copied_size): New function.
3152 2022-08-11 Immad Mir <mirimmad@outlook.com>
3155 * sm-fd.cc (check_for_dup): handle the m_start
3156 state when transitioning the state of LHS
3157 of dup, dup2 and dup3 call.
3159 2022-08-09 David Malcolm <dmalcolm@redhat.com>
3162 * region-model.cc (region_model::on_call_pre): Ensure that we call
3163 get_arg_svalue on all arguments.
3165 2022-08-05 David Malcolm <dmalcolm@redhat.com>
3168 * analyzer.opt (Wanalyzer-jump-through-null): New option.
3169 * engine.cc (class jump_through_null): New.
3170 (exploded_graph::process_node): Complain about jumps through NULL
3173 2022-08-02 Immad Mir <mirimmad@outlook.com>
3176 * sm-fd.cc (fd_state_machine::on_open): Add
3177 creat, dup, dup2 and dup3 functions.
3179 (fd_state_machine::valid_to_unchecked_state): New.
3180 (fd_state_machine::on_creat): New.
3181 (fd_state_machine::on_dup): New.
3183 2022-07-28 David Malcolm <dmalcolm@redhat.com>
3186 * analyzer.opt (Wanalyzer-putenv-of-auto-var): New.
3187 * region-model-impl-calls.cc (class putenv_of_auto_var): New.
3188 (region_model::impl_call_putenv): New.
3189 * region-model.cc (region_model::on_call_pre): Handle putenv.
3190 * region-model.h (region_model::impl_call_putenv): New decl.
3192 2022-07-28 David Malcolm <dmalcolm@redhat.com>
3194 * sm-malloc.cc (free_of_non_heap::emit): Add comment about CWE.
3195 * sm-taint.cc (tainted_size::emit): Likewise.
3197 2022-07-28 David Malcolm <dmalcolm@redhat.com>
3199 * region.h: Add notes to the comment describing the region
3202 2022-07-27 Immad Mir <mirimmad@outlook.com>
3206 (fd_diagnostic::get_meaning_for_state_change): New.
3208 2022-07-26 David Malcolm <dmalcolm@redhat.com>
3211 * store.cc (store::set_value): Don't strip away casts if the
3212 region has NULL type.
3214 2022-07-26 David Malcolm <dmalcolm@redhat.com>
3216 * region.h (code_region::get_element): Remove stray decl.
3217 (function_region::get_element): Likewise.
3219 2022-07-25 Martin Liska <mliska@suse.cz>
3221 * sm-fd.cc: Run dos2unix and fix coding style issues.
3223 2022-07-23 Immad Mir <mirimmad@outlook.com>
3225 * sm-fd.cc (fd_param_diagnostic): New diagnostic class.
3226 (fd_access_mode_mismatch): Change inheritance from fd_diagnostic
3227 to fd_param_diagnostic. Add new overloaded constructor.
3228 (fd_use_after_close): Likewise.
3229 (unchecked_use_of_fd): Likewise and also change name to fd_use_without_check.
3230 (double_close): Change name to fd_double_close.
3231 (enum access_directions): New.
3232 (fd_state_machine::on_stmt): Handle calls to function with the
3233 new three function attributes.
3234 (fd_state_machine::check_for_fd_attrs): New.
3235 (fd_state_machine::on_open): Use the new overloaded constructors
3236 of diagnostic classes.
3238 2022-07-22 David Malcolm <dmalcolm@redhat.com>
3241 * varargs.cc (region_model::impl_call_va_start): Avoid iterating
3242 through non-existant variadic arguments by initializing the
3243 impl_region to "UNKNOWN" if the va_start occurs in the top-level
3244 function to the analysis.
3246 2022-07-22 David Malcolm <dmalcolm@redhat.com>
3249 * store.cc (binding_cluster::binding_cluster): Remove overzealous
3250 assertion; we're checking for tracked_p in
3251 store::get_or_create_cluster.
3253 2022-07-22 Tim Lange <mail@tim-lange.me>
3256 * region-model.cc (capacity_compatible_with_type): Always return true
3257 if alloc_size is zero.
3259 2022-07-21 David Malcolm <dmalcolm@redhat.com>
3262 * varargs.cc (region_model::impl_call_va_arg): When determining if
3263 we're doing interprocedural analysis, use the stack depth of the
3264 frame in which va_start was called, rather than the current stack
3267 2022-07-21 David Malcolm <dmalcolm@redhat.com>
3269 * sm-taint.cc (tainted_array_index::emit): Bulletproof against
3271 (tainted_array_index::describe_final_event): Likewise.
3272 (tainted_size::emit): Likewise.
3273 (tainted_size::describe_final_event): Likewise.
3275 2022-07-21 David Malcolm <dmalcolm@redhat.com>
3278 * region.cc (decl_region::get_svalue_for_initializer): Bail out on
3281 2022-07-20 David Malcolm <dmalcolm@redhat.com>
3284 * sm-taint.cc (taint_state_machine::on_condition): Potentially
3285 update the state of the RHS as well as the LHS.
3287 2022-07-20 David Malcolm <dmalcolm@redhat.com>
3290 * region.h (string_region::tracked_p): New.
3291 * store.cc (binding_cluster::binding_cluster): Move here from
3292 store.h. Add assertion that base_region is tracked_p.
3293 * store.h (binding_cluster::binding_cluster): Move to store.cc.
3295 2022-07-19 David Malcolm <dmalcolm@redhat.com>
3298 * constraint-manager.h (bounded_ranges::get_count): New.
3299 (bounded_ranges::get_range): New.
3300 * engine.cc (impl_region_model_context::on_bounded_ranges): New.
3301 * exploded-graph.h (impl_region_model_context::on_bounded_ranges):
3303 * region-model.cc (region_model::apply_constraints_for_gswitch):
3304 Potentially call ctxt->on_bounded_ranges.
3305 * region-model.h (region_model_context::on_bounded_ranges): New
3307 (noop_region_model_context::on_bounded_ranges): New.
3308 (region_model_context_decorator::on_bounded_ranges): New.
3309 * sm-taint.cc: Include "analyzer/constraint-manager.h".
3310 (taint_state_machine::on_bounded_ranges): New.
3311 * sm.h (state_machine::on_bounded_ranges): New.
3313 2022-07-19 David Malcolm <dmalcolm@redhat.com>
3315 * engine.cc (exploded_graph::process_node): Show any description
3316 of the out-edge when logging it for consideration.
3318 2022-07-15 David Malcolm <dmalcolm@redhat.com>
3321 * sm-taint.cc (taint_state_machine::on_condition): Handle range
3322 checks optimized by build_range_check.
3324 2022-07-15 Jonathan Wakely <jwakely@redhat.com>
3326 * call-info.cc (call_info::print): Adjust to new label_text API.
3327 * checker-path.cc (checker_event::dump): Likewise.
3328 (region_creation_event::get_desc): Likewise.
3329 (state_change_event::get_desc): Likewise.
3330 (superedge_event::should_filter_p): Likewise.
3331 (start_cfg_edge_event::get_desc): Likewise.
3332 (call_event::get_desc): Likewise.
3333 (return_event::get_desc): Likewise.
3334 (warning_event::get_desc): Likewise.
3335 (checker_path::dump): Likewise.
3336 (checker_path::debug): Likewise.
3337 * diagnostic-manager.cc (diagnostic_manager::prune_for_sm_diagnostic):
3339 (diagnostic_manager::prune_interproc_events): Likewise.
3340 * engine.cc (feasibility_state::maybe_update_for_edge):
3342 * program-state.cc (sm_state_map::to_json): Likewise.
3343 * region-model-impl-calls.cc (region_model::impl_call_analyzer_describe): Likewise.
3344 (region_model::impl_call_analyzer_dump_capacity): Likewise.
3345 * region.cc (region::to_json): Likewise.
3346 * sm-malloc.cc (inform_nonnull_attribute): Likewise.
3347 * store.cc (binding_map::to_json): Likewise.
3348 (store::to_json): Likewise.
3349 * supergraph.cc (superedge::dump): Likewise.
3350 * svalue.cc (svalue::to_json): Likewise.
3352 2022-07-07 David Malcolm <dmalcolm@redhat.com>
3354 * checker-path.cc (start_cfg_edge_event::get_desc): Update for
3355 superedge::get_description returning a label_text.
3356 * engine.cc (feasibility_state::maybe_update_for_edge): Likewise.
3357 * supergraph.cc (superedge::dump): Likewise.
3358 (superedge::get_description): Convert return type from char * to
3360 * supergraph.h (superedge::get_description): Likewise.
3362 2022-07-07 David Malcolm <dmalcolm@redhat.com>
3364 * call-info.cc (call_info::print): Update for removal of
3365 label_text::maybe_free in favor of automatic memory management.
3366 * checker-path.cc (checker_event::dump): Likewise.
3367 (checker_event::prepare_for_emission): Likewise.
3368 (state_change_event::get_desc): Likewise.
3369 (superedge_event::should_filter_p): Likewise.
3370 (start_cfg_edge_event::get_desc): Likewise.
3371 (warning_event::get_desc): Likewise.
3372 (checker_path::dump): Likewise.
3373 (checker_path::debug): Likewise.
3374 * diagnostic-manager.cc
3375 (diagnostic_manager::prune_for_sm_diagnostic): Likewise.
3376 (diagnostic_manager::prune_interproc_events): Likewise.
3377 * program-state.cc (sm_state_map::to_json): Likewise.
3378 * region.cc (region::to_json): Likewise.
3379 * sm-malloc.cc (inform_nonnull_attribute): Likewise.
3380 * store.cc (binding_map::to_json): Likewise.
3381 (store::to_json): Likewise.
3382 * svalue.cc (svalue::to_json): Likewise.
3384 2022-07-07 David Malcolm <dmalcolm@redhat.com>
3387 * sm-taint.cc (taint_state_machine::on_stmt): Move handling of
3388 assignments from division to...
3389 (taint_state_machine::check_for_tainted_divisor): ...this new
3390 function. Reject warning when the divisor is known to be non-zero.
3391 * sm.cc: Include "analyzer/program-state.h".
3392 (sm_context::get_old_region_model): New.
3393 * sm.h (sm_context::get_old_region_model): New decl.
3395 2022-07-06 Immad Mir <mirimmad@outlook.com>
3398 * sm-fd.cc (fd_state_machine): Change ordering of initialization
3399 of state m_invalid so that the order of initializers is same as
3400 the ordering of the fields in the class decl.
3402 2022-07-06 Immad Mir <mirimmad@outlook.com>
3404 * sm-fd.cc (use_after_close): save the "close" event and
3405 show it where possible.
3407 2022-07-06 David Malcolm <dmalcolm@redhat.com>
3410 * region-model.cc (within_short_circuited_stmt_p): Move extraction
3411 of assign_stmt to caller.
3412 (due_to_ifn_deferred_init_p): New.
3413 (region_model::check_for_poison): Move extraction of assign_stmt
3414 from within_short_circuited_stmt_p to here. Share logic with
3415 call to due_to_ifn_deferred_init_p.
3417 2022-07-02 Tim Lange <mail@tim-lange.me>
3420 * analyzer.opt: Added Wanalyzer-allocation-size.
3421 * checker-path.cc (region_creation_event::get_desc): Added call to new
3422 virtual function pending_diagnostic::describe_region_creation_event.
3423 * checker-path.h: Added region_creation_event::get_desc.
3424 * diagnostic-manager.cc (diagnostic_manager::add_event_on_final_node):
3426 * diagnostic-manager.h:
3427 Added diagnostic_manager::add_event_on_final_node.
3428 * pending-diagnostic.h (struct region_creation): New event_desc struct.
3429 (pending_diagnostic::describe_region_creation_event): Added virtual
3430 function to overwrite description of a region creation.
3431 * region-model.cc (class dubious_allocation_size): New class.
3432 (capacity_compatible_with_type): New helper function.
3433 (class size_visitor): New class.
3434 (struct_or_union_with_inheritance_p): New helper function.
3435 (is_any_cast_p): New helper function.
3436 (region_model::check_region_size): New function.
3437 (region_model::set_value): Added call to
3438 region_model::check_region_size.
3439 * region-model.h (class region_model): New function check_region_size.
3440 * svalue.cc (region_svalue::accept): Changed to post-order traversal.
3441 (initial_svalue::accept): Likewise.
3442 (unaryop_svalue::accept): Likewise.
3443 (binop_svalue::accept): Likewise.
3444 (sub_svalue::accept): Likewise.
3445 (repeated_svalue::accept): Likewise.
3446 (bits_within_svalue::accept): Likewise.
3447 (widening_svalue::accept): Likewise.
3448 (unmergeable_svalue::accept): Likewise.
3449 (compound_svalue::accept): Likewise.
3450 (conjured_svalue::accept): Likewise.
3451 (asm_output_svalue::accept): Likewise.
3452 (const_fn_result_svalue::accept): Likewise.
3454 2022-07-02 Immad Mir <mirimmad17@gmail.com>
3457 * analyzer.opt (Wanalyzer-fd-leak): New option.
3458 (Wanalyzer-fd-access-mode-mismatch): New option.
3459 (Wanalyzer-fd-use-without-check): New option.
3460 (Wanalyzer-fd-double-close): New option.
3461 (Wanalyzer-fd-use-after-close): New option.
3462 * sm.h (make_fd_state_machine): New decl.
3463 * sm.cc (make_checkers): Call make_fd_state_machine.
3464 * sm-fd.cc: New file.
3466 2022-06-24 David Malcolm <dmalcolm@redhat.com>
3468 * call-string.cc: Add includes of "analyzer/analyzer.h"
3469 and "analyzer/analyzer-logging.h".
3470 (call_string::call_string): Delete copy ctor.
3471 (call_string::operator=): Delete.
3472 (call_string::operator==): Delete.
3473 (call_string::hash): Delete.
3474 (call_string::push_call): Make const, returning the resulting
3476 (call_string::pop): Delete.
3477 (call_string::cmp_ptr_ptr): New.
3478 (call_string::validate): Assert that m_parent is non-NULL, or
3479 m_elements is empty.
3480 (call_string::call_string): Move default ctor here from
3481 call-string.h and reimplement. Add ctor taking a parent
3483 (call_string::~call_string): New.
3484 (call_string::recursive_log): New.
3485 * call-string.h (call_string::call_string): Move default ctor's
3486 defn to call-string.cc. Delete copy ctor. Add ctor taking a
3487 parent and an element.
3488 (call_string::operator=): Delete.
3489 (call_string::operator==): Delete.
3490 (call_string::hash): Delete.
3491 (call_string::push_call): Make const, returning the resulting
3493 (call_string::pop): Delete decl.
3494 (call_string::get_parent): New.
3495 (call_string::cmp_ptr_ptr): New decl.
3496 (call_string::get_top_of_stack): New.
3497 (struct call_string::hashmap_traits_t): New.
3498 (class call_string): Add friend class region_model_manager. Add
3499 DISABLE_COPY_AND_ASSIGN.
3500 (call_string::~call_string): New decl.
3501 (call_string::recursive_log): New decl.
3502 (call_string::m_parent): New field.
3503 (call_string::m_children): New field.
3504 * constraint-manager.cc (selftest::test_many_constants): Pass
3505 model manager to program_point::origin.
3506 * engine.cc (exploded_graph::exploded_graph): Likewise.
3507 (exploded_graph::add_function_entry): Likewise for
3508 program_point::from_function_entry.
3509 (add_tainted_args_callback): Likewise.
3510 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
3511 Update for change to program_point.get_call_string.
3512 (exploded_graph::process_node): Likewise.
3513 (class function_call_string_cluster): Convert m_cs from a
3514 call_string to a const call_string &.
3515 (struct function_call_string): Likewise.
3516 (pod_hash_traits<function_call_string>::hash): Use pointer_hash
3518 (pod_hash_traits<function_call_string>::equal): Update for change
3520 (root_cluster::add_node): Update for change to
3521 function_call_string.
3522 (viz_callgraph_node::dump_dot): Update for change to call_string.
3523 * exploded-graph.h (per_call_string_data::m_key): Convert to a
3525 (struct eg_call_string_hash_map_traits): Delete.
3526 (exploded_graph::call_string_data_map_t): Remove traits class.
3527 * program-point.cc: Move include of "analyzer/call-string.h" to
3528 after "analyzer/analyzer-logging.h".
3529 (program_point::print): Update for conversion of m_call_string to
3531 (program_point::to_json): Likewise.
3532 (program_point::push_to_call_stack): Update for immutability of
3534 (program_point::pop_from_call_stack): Likewise.
3535 (program_point::hash): Use pointer hashing for m_call_string.
3536 (program_point::get_function_at_depth): Update for change to
3538 (program_point::validate): Update for changes to call_string.
3539 (program_point::on_edge): Likewise.
3540 (program_point::origin): Move here from call-string.h. Add
3541 region_model_manager param and use it to get empty call string.
3542 (program_point::from_function_entry): Likewise.
3543 (selftest::test_function_point_ordering): Likewise.
3544 (selftest::test_function_point_ordering): Likewise.
3545 * program-point.h (program_point::program_point): Update for
3546 change to m_call_string.
3547 (program_point::get_call_string): Likewise.
3548 (program_point::get_stack_depth): Likewise.
3549 (program_point::origin): Add region_model_manager param, and move
3550 defn to call-string.cc.
3551 (program_point::from_function_entry): Likewise.
3552 (program_point::empty): Drop call_string.
3553 (program_point::deleted): Likewise.
3554 (program_point::program_point): New private ctor.
3555 (program_point::m_call_string): Convert from call_string to const
3557 * program-state.cc (selftest::test_program_state_merging): Update
3558 for call_string changes.
3559 (selftest::test_program_state_merging_2): Likewise.
3560 * region-model-manager.cc
3561 (region_model_manager::region_model_manager): Construct
3562 m_empty_call_string.
3563 (region_model_manager::log_stats): Log the call strings.
3564 * region-model.cc (assert_region_models_merge): Pass the
3565 region_model_manager when creating program_point instances.
3566 (selftest::test_state_merging): Likewise.
3567 (selftest::test_constraint_merging): Likewise.
3568 (selftest::test_widening_constraints): Likewise.
3569 (selftest::test_iteration_1): Likewise.
3570 * region-model.h (region_model_manager::get_empty_call_string):
3572 (region_model_manager::m_empty_call_string): New.
3573 * sm-signal.cc (register_signal_handler::impl_transition): Update
3574 for changes to call_string.
3576 2022-06-24 David Malcolm <dmalcolm@redhat.com>
3578 * call-string.cc (call_string::calc_recursion_depth): Whitespace
3580 (call_string::cmp): Likewise.
3581 (call_string::get_caller_node): Likewise.
3582 (call_string::validate): Likewise.
3583 * engine.cc (dynamic_call_info_t::add_events_to_path): Likewise.
3584 (exploded_graph::get_per_function_data): Likewise.
3585 (exploded_graph::maybe_create_dynamic_call): Likewise.
3586 (exploded_graph::maybe_create_dynamic_call): Likewise.
3587 (exploded_graph::process_node): Likewise.
3589 2022-06-16 David Malcolm <dmalcolm@redhat.com>
3591 * varargs.cc (va_arg_type_mismatch::emit): Associate the warning
3592 with CWE-686 ("Function Call With Incorrect Argument Type").
3594 2022-06-16 David Malcolm <dmalcolm@redhat.com>
3596 * varargs.cc: Include "diagnostic-metadata.h".
3597 (va_list_exhausted::emit): Associate the warning with
3598 CWE-685 ("Function Call With Incorrect Number of Arguments").
3600 2022-06-16 David Malcolm <dmalcolm@redhat.com>
3602 * sm-file.cc (double_fclose::emit): Associate the warning with
3603 CWE-1341 ("Multiple Releases of Same Resource or Handle").
3605 2022-06-15 David Malcolm <dmalcolm@redhat.com>
3608 * analyzer.opt (fanalyzer-undo-inlining): New option.
3609 * checker-path.cc: Include "diagnostic-core.h" and
3610 "inlining-iterator.h".
3611 (event_kind_to_string): Handle EK_INLINED_CALL.
3612 (class inlining_info): New class.
3613 (checker_event::checker_event): Move here from checker-path.h.
3614 Store original fndecl and depth, and calculate effective fndecl
3615 and depth based on inlining information.
3616 (checker_event::dump): Emit original depth as well as effective
3617 depth when they differ; likewise for fndecl.
3618 (region_creation_event::get_desc): Use m_effective_fndecl.
3619 (inlined_call_event::get_desc): New.
3620 (inlined_call_event::get_meaning): New.
3621 (checker_path::inject_any_inlined_call_events): New.
3622 * checker-path.h (enum event_kind): Add EK_INLINED_CALL.
3623 (checker_event::checker_event): Make protected, and move
3624 definition to checker-path.cc.
3625 (checker_event::get_fndecl): Use effective fndecl.
3626 (checker_event::get_stack_depth): Use effective stack depth.
3627 (checker_event::get_logical_location): Use effective stack depth.
3628 (checker_event::get_original_stack_depth): New.
3629 (checker_event::m_fndecl): Rename to...
3630 (checker_event::m_original_fndecl): ...this.
3631 (checker_event::m_depth): Rename to...
3632 (checker_event::m_original_depth): ...this.
3633 (checker_event::m_effective_fndecl): New field.
3634 (checker_event::m_effective_depth): New field.
3635 (class inlined_call_event): New checker_event subclass.
3636 (checker_path::inject_any_inlined_call_events): New decl.
3637 * diagnostic-manager.cc: Include "inlining-iterator.h".
3638 (diagnostic_manager::emit_saved_diagnostic): Call
3639 checker_path::inject_any_inlined_call_events.
3640 (diagnostic_manager::prune_for_sm_diagnostic): Handle
3642 * engine.cc (tainted_args_function_custom_event::get_desc): Use
3644 * inlining-iterator.h: New file.
3646 2022-06-15 David Malcolm <dmalcolm@redhat.com>
3648 * diagnostic-manager.cc (saved_diagnostic::dump_dot_id): New.
3649 (saved_diagnostic::dump_as_dot_node): New.
3650 * diagnostic-manager.h (saved_diagnostic::dump_dot_id): New decl.
3651 (saved_diagnostic::dump_as_dot_node): New decl.
3652 * engine.cc (exploded_node::dump_dot): Add nodes for saved
3655 2022-06-02 David Malcolm <dmalcolm@redhat.com>
3657 * checker-path.cc (checker_event::get_meaning): New.
3658 (function_entry_event::get_meaning): New.
3659 (state_change_event::get_desc): Add dump of meaning of the event
3660 to the -fanalyzer-verbose-state-changes output.
3661 (state_change_event::get_meaning): New.
3662 (cfg_edge_event::get_meaning): New.
3663 (call_event::get_meaning): New.
3664 (return_event::get_meaning): New.
3665 (start_consolidated_cfg_edges_event::get_meaning): New.
3666 (warning_event::get_meaning): New.
3667 * checker-path.h: Include "tree-logical-location.h".
3668 (checker_event::checker_event): Construct m_logical_loc.
3669 (checker_event::get_logical_location): New.
3670 (checker_event::get_meaning): New decl.
3671 (checker_event::m_logical_loc): New.
3672 (function_entry_event::get_meaning): New decl.
3673 (state_change_event::get_meaning): New decl.
3674 (cfg_edge_event::get_meaning): New decl.
3675 (call_event::get_meaning): New decl.
3676 (return_event::get_meaning): New decl.
3677 (start_consolidated_cfg_edges_event::get_meaning): New.
3678 (warning_event::get_meaning): New decl.
3679 * pending-diagnostic.h: Include "diagnostic-path.h".
3680 (pending_diagnostic::get_meaning_for_state_change): New vfunc.
3681 * sm-file.cc (file_diagnostic::get_meaning_for_state_change): New
3683 * sm-malloc.cc (malloc_diagnostic::get_meaning_for_state_change):
3686 (exposure_through_output_file::get_meaning_for_state_change):
3688 * sm-taint.cc (taint_diagnostic::get_meaning_for_state_change):
3691 (va_list_sm_diagnostic::get_meaning_for_state_change): Likewise.
3693 2022-05-23 David Malcolm <dmalcolm@redhat.com>
3695 * call-info.cc: Add "final" and "override" to all vfunc
3696 implementations that were missing them, as appropriate.
3697 * engine.cc: Likewise.
3698 * region-model.cc: Likewise.
3699 * sm-malloc.cc: Likewise.
3700 * supergraph.h: Likewise.
3701 * svalue.cc: Likewise.
3702 * varargs.cc: Likewise.
3704 2022-05-20 David Malcolm <dmalcolm@redhat.com>
3706 * analyzer-pass.cc: Replace uses of "FINAL" and "OVERRIDE" with
3707 "final" and "override".
3708 * call-info.h: Likewise.
3709 * checker-path.h: Likewise.
3710 * constraint-manager.cc: Likewise.
3711 * diagnostic-manager.cc: Likewise.
3712 * engine.cc: Likewise.
3713 * exploded-graph.h: Likewise.
3714 * feasible-graph.h: Likewise.
3715 * pending-diagnostic.h: Likewise.
3716 * region-model-impl-calls.cc: Likewise.
3717 * region-model.cc: Likewise.
3718 * region-model.h: Likewise.
3719 * region.h: Likewise.
3720 * sm-file.cc: Likewise.
3721 * sm-malloc.cc: Likewise.
3722 * sm-pattern-test.cc: Likewise.
3723 * sm-sensitive.cc: Likewise.
3724 * sm-signal.cc: Likewise.
3725 * sm-taint.cc: Likewise.
3726 * state-purge.h: Likewise.
3727 * store.cc: Likewise.
3728 * store.h: Likewise.
3729 * supergraph.h: Likewise.
3730 * svalue.h: Likewise.
3731 * trimmed-graph.h: Likewise.
3732 * varargs.cc: Likewise.
3734 2022-05-16 David Malcolm <dmalcolm@redhat.com>
3737 * analyzer.cc (make_label_text_n): New.
3738 * analyzer.h (class var_arg_region): New forward decl.
3739 (make_label_text_n): New decl.
3740 * analyzer.opt (Wanalyzer-va-arg-type-mismatch): New option.
3741 (Wanalyzer-va-list-exhausted): New option.
3742 (Wanalyzer-va-list-leak): New option.
3743 (Wanalyzer-va-list-use-after-va-end): New option.
3744 * checker-path.cc (call_event::get_desc): Split out decl access
3746 (call_event::get_caller_fndecl): ...this new function and...
3747 (call_event::get_callee_fndecl): ...this new function.
3748 * checker-path.h (call_event::get_desc): Drop "FINAL".
3749 (call_event::get_caller_fndecl): New decl.
3750 (call_event::get_callee_fndecl): New decl.
3751 (class call_event): Make fields protected.
3752 * diagnostic-manager.cc (null_assignment_sm_context::warn): New
3754 (null_assignment_sm_context::get_new_program_state): New.
3755 (diagnostic_manager::add_events_for_superedge): Move case
3756 SUPEREDGE_CALL to a new pending_diagnostic::add_call_event vfunc.
3757 * engine.cc (impl_sm_context::warn): Implement new override.
3758 (impl_sm_context::get_new_program_state): New.
3759 * pending-diagnostic.cc: Include "analyzer/diagnostic-manager.h",
3760 "cpplib.h", "digraph.h", "ordered-hash-map.h", "cfg.h",
3761 "basic-block.h", "gimple.h", "gimple-iterator.h", "cgraph.h"
3762 "analyzer/supergraph.h", "analyzer/program-state.h",
3763 "alloc-pool.h", "fibonacci_heap.h", "shortest-paths.h",
3764 "sbitmap.h", "analyzer/exploded-graph.h", "diagnostic-path.h",
3765 and "analyzer/checker-path.h".
3767 (fixup_location_in_macro_p): New.
3768 (pending_diagnostic::fixup_location): New.
3769 (pending_diagnostic::add_call_event): New.
3770 * pending-diagnostic.h (pending_diagnostic::fixup_location): Drop
3771 no-op inline implementation in favor of the more complex
3772 implementation above.
3773 (pending_diagnostic::add_call_event): New vfunc.
3774 * region-model-impl-calls.cc: Include "analyzer/sm.h",
3775 "diagnostic-path.h", and "analyzer/pending-diagnostic.h".
3776 * region-model-manager.cc
3777 (region_model_manager::get_var_arg_region): New.
3778 (region_model_manager::log_stats): Log m_var_arg_regions.
3779 * region-model.cc (region_model::on_call_pre): Handle IFN_VA_ARG,
3780 BUILT_IN_VA_START, and BUILT_IN_VA_COPY.
3781 (region_model::on_call_post): Handle BUILT_IN_VA_END.
3782 (region_model::get_representative_path_var_1): Handle RK_VAR_ARG.
3783 (region_model::push_frame): Push variadic arguments.
3784 * region-model.h (region_model_manager::get_var_arg_region): New
3786 (region_model_manager::m_var_arg_regions): New field.
3787 (region_model::impl_call_va_start): New decl.
3788 (region_model::impl_call_va_copy): New decl.
3789 (region_model::impl_call_va_arg): New decl.
3790 (region_model::impl_call_va_end): New decl.
3791 * region.cc (alloca_region::dump_to_pp): Dump the id.
3792 (var_arg_region::dump_to_pp): New.
3793 (var_arg_region::get_frame_region): New.
3794 * region.h (enum region_kind): Add RK_VAR_ARG.
3795 (region::dyn_cast_var_arg_region): New.
3796 (class var_arg_region): New.
3797 (is_a_helper <const var_arg_region *>::test): New.
3798 (struct default_hash_traits<var_arg_region::key_t>): New.
3799 * sm.cc (make_checkers): Call make_va_list_state_machine.
3800 * sm.h (sm_context::warn): New vfunc.
3801 (sm_context::get_old_svalue): Drop unused decl.
3802 (sm_context::get_new_program_state): New vfunc.
3803 (make_va_list_state_machine): New decl.
3804 * varargs.cc: New file.
3806 2022-05-16 Martin Liska <mliska@suse.cz>
3808 * engine.cc (exploded_node::get_dot_fillcolor): Use ARRAY_SIZE.
3809 * function-set.cc (test_stdio_example): Likewise.
3810 * sm-file.cc (get_file_using_fns): Likewise.
3811 * sm-malloc.cc (malloc_state_machine::unaffected_by_call_p): Likewise.
3812 * sm-signal.cc (get_async_signal_unsafe_fns): Likewise.
3814 2022-05-13 Richard Biener <rguenther@suse.de>
3816 * supergraph.cc: Re-order gimple-fold.h include.
3818 2022-05-11 David Malcolm <dmalcolm@redhat.com>
3820 * checker-path.cc (state_change_event::get_desc): Call maybe_free
3821 on label_text temporaries.
3822 * diagnostic-manager.cc
3823 (diagnostic_manager::prune_for_sm_diagnostic): Likewise.
3824 * engine.cc (exploded_graph::~exploded_graph): Fix leak of
3825 m_per_point_data and m_per_call_string_data values. Simplify
3826 cleanup of m_per_function_stats and m_per_point_data values.
3827 (feasibility_state::maybe_update_for_edge): Fix leak of result of
3828 superedge::get_description.
3829 * region-model-manager.cc
3830 (region_model_manager::~region_model_manager): Move cleanup of
3831 m_setjmp_values to match the ordering of the fields within
3832 region_model_manager. Fix leak of values within
3833 m_repeated_values_map, m_bits_within_values_map,
3834 m_asm_output_values_map, and m_const_fn_result_values_map.
3836 2022-04-28 David Malcolm <dmalcolm@redhat.com>
3839 * store.cc (binding_cluster::get_any_binding): Handle accessing
3840 sub_svalues of clusters where the base region has a symbolic
3843 2022-04-28 David Malcolm <dmalcolm@redhat.com>
3845 * diagnostic-manager.cc (epath_finder::process_worklist_item):
3846 Call dump_feasible_path when a path that reaches the the target
3848 (epath_finder::dump_feasible_path): New.
3849 * engine.cc (feasibility_state::dump_to_pp): New.
3850 * exploded-graph.h (feasibility_state::dump_to_pp): New decl.
3851 * feasible-graph.cc (feasible_graph::dump_feasible_path): New.
3852 * feasible-graph.h (feasible_graph::dump_feasible_path): New
3854 * program-point.cc (function_point::print): Fix missing trailing
3856 * program-point.h (program_point::print_source_line): Remove
3859 2022-04-25 David Malcolm <dmalcolm@redhat.com>
3864 (cmp_cst): Rename to...
3865 (cmp_csts_same_type): ...this. Convert all recursive calls to
3867 (cmp_csts_and_types): ....this new function.
3868 (svalue::cmp_ptr): Update for renaming of cmp_cst
3870 2022-04-14 David Malcolm <dmalcolm@redhat.com>
3873 * region-model-reachability.cc (reachable_regions::handle_parm):
3874 Use maybe_get_deref_base_region rather than just region_svalue, to
3875 handle pointer arithmetic also.
3876 * svalue.cc (svalue::maybe_get_deref_base_region): New.
3877 * svalue.h (svalue::maybe_get_deref_base_region): New decl.
3879 2022-04-14 David Malcolm <dmalcolm@redhat.com>
3882 * svalue.cc (cmp_cst): When comparing VECTOR_CSTs, compare the
3883 types of the encoded elements before calling cmp_cst on them.
3885 2022-04-09 David Malcolm <dmalcolm@redhat.com>
3888 * region-model-manager.cc
3889 (region_model_manager::get_unknown_symbolic_region): New,
3891 (region_model_manager::get_field_region): ...here.
3892 (region_model_manager::get_element_region): Use it here.
3893 (region_model_manager::get_offset_region): Likewise.
3894 (region_model_manager::get_sized_region): Likewise.
3895 (region_model_manager::get_cast_region): Likewise.
3896 (region_model_manager::get_bit_range): Likewise.
3898 (region_model_manager::get_unknown_symbolic_region): New decl.
3899 * region.cc (symbolic_region::symbolic_region): Handle sval_ptr
3901 (symbolic_region::dump_to_pp): Handle having NULL type.
3903 2022-04-07 David Malcolm <dmalcolm@redhat.com>
3906 * store.cc (binding_map::remove_overlapping_bindings): Add
3907 "always_overlap" param, using it to generalize to the case where
3908 we want to remove all bindings. Update "uncertainty" logic to
3909 only record maybe-bound values for cases where there is a symbolic
3911 (binding_cluster::mark_region_as_unknown): Split param "reg" into
3912 "reg_to_bind" and "reg_for_overlap".
3913 (binding_cluster::maybe_get_compound_binding): Pass "false" to
3914 binding_map::remove_overlapping_bindings new "always_overlap" param.
3915 (binding_cluster::remove_overlapping_bindings): Determine
3916 "always_overlap" and pass it to
3917 binding_map::remove_overlapping_bindings.
3918 (store::set_value): Pass uncertainty to remove_overlapping_bindings
3919 call. Update for new param of
3920 binding_cluster::mark_region_as_unknown, passing both the base
3921 region of the iter_cluster, and the lhs_reg.
3922 (store::mark_region_as_unknown): Update for new param of
3923 binding_cluster::mark_region_as_unknown, passing "reg" for both.
3924 (store::remove_overlapping_bindings): Add param "uncertainty", and
3925 pass it on to call to
3926 binding_cluster::remove_overlapping_bindings.
3927 * store.h (binding_map::remove_overlapping_bindings): Add
3928 "always_overlap" param.
3929 (binding_cluster::mark_region_as_unknown): Split param "reg" into
3930 "reg_to_bind" and "reg_for_overlap".
3931 (store::remove_overlapping_bindings): Add param "uncertainty".
3933 2022-03-29 David Malcolm <dmalcolm@redhat.com>
3936 * region-model-manager.cc (dump_untracked_region): Skip decls in
3939 2022-03-29 David Malcolm <dmalcolm@redhat.com>
3942 * analyzer.h (class conjured_purge): New forward decl.
3943 * region-model-asm.cc (region_model::on_asm_stmt): Add
3944 conjured_purge param to calls binding_cluster::on_asm and
3945 region_model_manager::get_or_create_conjured_svalue.
3946 * region-model-impl-calls.cc
3947 (call_details::get_or_create_conjured_svalue): Likewise for call
3948 to region_model_manager::get_or_create_conjured_svalue.
3949 (region_model::impl_call_fgets): Remove call to
3950 region_model::purge_state_involving, as this is now done
3951 implicitly by call_details::get_or_create_conjured_svalue.
3952 (region_model::impl_call_fread): Likewise.
3953 (region_model::impl_call_strchr): Pass conjured_purge param to
3954 call to region_model_manager::get_or_create_conjured_svalue.
3955 * region-model-manager.cc (conjured_purge::purge): New.
3956 (region_model_manager::get_or_create_conjured_svalue): Add
3957 param "p". Use it to purge state when reusing an existing
3959 * region-model.cc (region_model::on_call_pre): Replace call to
3960 region_model::purge_state_involving with passing conjured_purge
3961 to region_model_manager::get_or_create_conjured_svalue.
3962 (region_model::handle_unrecognized_call): Pass conjured_purge to
3963 store::on_unknown_fncall.
3965 (region_model_manager::get_or_create_conjured_svalue): Add param
3967 * store.cc (binding_cluster::on_unknown_fncall): Likewise. Pass
3968 it on to region_model_manager::get_or_create_conjured_svalue.
3969 (binding_cluster::on_asm): Likewise.
3970 (store::on_unknown_fncall): Add param "p" and pass it on to
3971 binding_cluster::on_unknown_fncall.
3972 * store.h (binding_cluster::on_unknown_fncall): Add param p.
3973 (binding_cluster::on_asm): Likewise.
3974 (store::on_unknown_fncall): Likewise.
3975 * svalue.h (class conjured_purge): New.
3977 2022-03-29 David Malcolm <dmalcolm@redhat.com>
3980 * region.cc (ipa_ref_requires_tracking): Drop "context_fndecl",
3981 instead using the ref->referring to get the cgraph node of the
3983 (symnode_requires_tracking_p): Likewise.
3985 2022-03-26 David Malcolm <dmalcolm@redhat.com>
3988 * store.cc (binding_cluster::make_unknown_relative_to): Reject
3989 attempts to create a cluster for untracked base regions.
3990 (store::set_value): Likewise.
3991 (store::fill_region): Likewise.
3992 (store::mark_region_as_unknown): Likewise.
3994 2022-03-25 David Malcolm <dmalcolm@redhat.com>
3997 * analyzer.opt (-fdump-analyzer-untracked): New option.
3998 * engine.cc (impl_run_checkers): Handle it.
3999 * region-model-asm.cc (region_model::on_asm_stmt): Don't attempt
4000 to clobber regions with !tracked_p ().
4001 * region-model-manager.cc (dump_untracked_region): New.
4002 (region_model_manager::dump_untracked_regions): New.
4003 (frame_region::dump_untracked_regions): New.
4004 * region-model.h (region_model_manager::dump_untracked_regions):
4006 * region.cc (ipa_ref_requires_tracking): New.
4007 (symnode_requires_tracking_p): New.
4008 (decl_region::calc_tracked_p): New.
4009 * region.h (region::tracked_p): New vfunc.
4010 (frame_region::dump_untracked_regions): New decl.
4011 (class decl_region): Note that this is also used fo SSA names.
4012 (decl_region::decl_region): Initialize m_tracked.
4013 (decl_region::tracked_p): New.
4014 (decl_region::calc_tracked_p): New decl.
4015 (decl_region::m_tracked): New.
4016 * store.cc (store::get_or_create_cluster): Assert that we
4017 don't try to create clusters for base regions that aren't
4019 (store::mark_as_escaped): Don't mark base regions that we're not
4022 2022-03-23 David Malcolm <dmalcolm@redhat.com>
4025 * engine.cc (impl_run_checkers): Create the engine after the
4026 supergraph, and pass the supergraph to the engine.
4027 * region-model.cc (region_model::get_lvalue_1): Pass ctxt to
4028 frame_region::get_region_for_local.
4029 (region_model::update_for_return_gcall): Pass the lvalue for the
4030 result to pop_frame as a tree, rather than as a region.
4031 (region_model::pop_frame): Update for above change, determining
4032 the destination region after the frame is popped and thus with
4033 respect to the caller frame rather than the called frame.
4034 Likewise, set the value of the region to the return value after
4035 the frame is popped.
4036 (engine::engine): Add supergraph pointer.
4037 (selftest::test_stack_frames): Set the DECL_CONTECT of PARM_DECLs.
4038 (selftest::test_get_representative_path_var): Likewise.
4039 (selftest::test_state_merging): Likewise.
4040 * region-model.h (region_model::pop_frame): Convert first param
4041 from a const region * to a tree.
4042 (engine::engine): Add param "sg".
4043 (engine::m_sg): New field.
4044 * region.cc: Include "analyzer/sm.h" and
4045 "analyzer/program-state.h".
4046 (frame_region::get_region_for_local): Add "ctxt" param.
4047 Add assertions that VAR_DECLs are locals, and that expr is for the
4049 * region.h (frame_region::get_region_for_local): Add "ctxt" param.
4051 2022-03-23 David Malcolm <dmalcolm@redhat.com>
4054 * sm-taint.cc (taint_diagnostic::subclass_equal_p): Check
4055 m_has_bounds as well as m_arg.
4056 (tainted_allocation_size::subclass_equal_p): Chain up to base
4057 class implementation. Also check m_mem_space.
4058 (tainted_allocation_size::emit): Add note showing stack-based vs
4059 heap-based allocations.
4061 2022-03-23 David Malcolm <dmalcolm@redhat.com>
4064 * diagnostic-manager.cc (diagnostic_manager::add_diagnostic):
4065 Convert return type from "void" to "bool", reporting success vs
4066 failure to caller, for both overloads.
4067 * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
4069 * engine.cc (impl_region_model_context::warn): Propagate return
4070 value from diagnostic_manager::add_diagnostic.
4072 2022-03-18 David Malcolm <dmalcolm@redhat.com>
4077 * analyzer.h (class state_purge_per_decl): New forward decl.
4078 * engine.cc (impl_run_checkers): Pass region_model_manager to
4079 state_purge_map ctor.
4080 * program-point.cc (function_point::final_stmt_p): New.
4081 (function_point::get_next): New.
4082 * program-point.h (function_point::final_stmt_p): New decl.
4083 (function_point::get_next): New decl.
4084 * program-state.cc (program_state::prune_for_point): Generalize to
4085 purge local decls as well as SSA names.
4086 (program_state::can_purge_base_region_p): New.
4087 * program-state.h (program_state::can_purge_base_region_p): New
4089 * region-model.cc (struct append_ssa_names_cb_data): Rename to...
4090 (struct append_regions_cb_data): ...this.
4091 (region_model::get_ssa_name_regions_for_current_frame): Rename
4093 (region_model::get_regions_for_current_frame): ...this, updating
4094 for other renamings.
4095 (region_model::append_ssa_names_cb): Rename to...
4096 (region_model::append_regions_cb): ...this, and drop the requirement
4097 that the subregion be a SSA name.
4098 * region-model.h (struct append_ssa_names_cb_data): Rename decl
4100 (struct append_regions_cb_data): ...this.
4101 (region_model::get_ssa_name_regions_for_current_frame): Rename
4103 (region_model::get_regions_for_current_frame): ...this.
4104 (region_model::append_ssa_names_cb): Rename decl to...
4105 (region_model::append_regions_cb): ...this.
4106 * state-purge.cc: Include "tristate.h", "selftest.h",
4107 "analyzer/store.h", "analyzer/region-model.h", and
4109 (get_candidate_for_purging): New.
4110 (class gimple_op_visitor): New.
4114 (state_purge_map::state_purge_map): Add "mgr" param. Update for
4115 renamings. Find uses of local variables.
4116 (state_purge_map::~state_purge_map): Update for renaming of m_map
4117 to m_ssa_map. Clean up m_decl_map.
4118 (state_purge_map::get_or_create_data_for_decl): New.
4119 (state_purge_per_ssa_name::state_purge_per_ssa_name): Update for
4120 inheriting from state_purge_per_tree.
4121 (state_purge_per_ssa_name::add_to_worklist): Likewise.
4122 (state_purge_per_decl::state_purge_per_decl): New.
4123 (state_purge_per_decl::add_needed_at): New.
4124 (state_purge_per_decl::add_pointed_to_at): New.
4125 (state_purge_per_decl::process_worklists): New.
4126 (state_purge_per_decl::add_to_worklist): New.
4127 (same_binding_p): New.
4128 (fully_overwrites_p): New.
4129 (state_purge_per_decl::process_point_backwards): New.
4130 (state_purge_per_decl::process_point_forwards): New.
4131 (state_purge_per_decl::needed_at_point_p): New.
4132 (state_purge_annotator::print_needed): Generalize to print local
4133 decls as well as SSA names.
4134 * state-purge.h (class state_purge_map): Update leading comment.
4135 (state_purge_map::map_t): Rename to...
4136 (state_purge_map::ssa_map_t): ...this.
4137 (state_purge_map::iterator): Rename to...
4138 (state_purge_map::ssa_iterator): ...this.
4139 (state_purge_map::decl_map_t): New typedef.
4140 (state_purge_map::decl_iterator): New typedef.
4141 (state_purge_map::state_purge_map): Add "mgr" param.
4142 (state_purge_map::get_data_for_ssa_name): Update for renaming.
4143 (state_purge_map::get_any_data_for_decl): New.
4144 (state_purge_map::get_or_create_data_for_decl): New decl.
4145 (state_purge_map::begin): Rename to...
4146 (state_purge_map::begin_ssas): ...this.
4147 (state_purge_map::end): Rename to...
4148 (state_purge_map::end_ssa): ...this.
4149 (state_purge_map::begin_decls): New.
4150 (state_purge_map::end_decls): New.
4151 (state_purge_map::m_map): Rename to...
4152 (state_purge_map::m_ssa_map): ...this.
4153 (state_purge_map::m_decl_map): New field.
4154 (class state_purge_per_tree): New class.
4155 (class state_purge_per_ssa_name): Inherit from state_purge_per_tree.
4156 (state_purge_per_ssa_name::get_function): Move to base class.
4157 (state_purge_per_ssa_name::point_set_t): Likewise.
4158 (state_purge_per_ssa_name::m_fun): Likewise.
4159 (class state_purge_per_decl): New.
4161 2022-03-17 David Malcolm <dmalcolm@redhat.com>
4163 * state-purge.cc (state_purge_annotator::add_node_annotations):
4164 Avoid duplicate before-supernode annotations when returning from
4165 an interprocedural call. Show after-supernode annotations.
4167 2022-03-17 David Malcolm <dmalcolm@redhat.com>
4169 * program-point.cc (program_point::get_next): Fix missing
4172 2022-03-16 David Malcolm <dmalcolm@redhat.com>
4175 * diagnostic-manager.cc (get_emission_location): New.
4176 (diagnostic_manager::diagnostic_manager): Initialize
4177 m_num_disabled_diagnostics.
4178 (diagnostic_manager::add_diagnostic): Reject diagnostics that
4179 will eventually be rejected due to being disabled.
4180 (diagnostic_manager::emit_saved_diagnostics): Log the number
4181 of disabled diagnostics.
4182 (diagnostic_manager::emit_saved_diagnostic): Split out logic for
4183 determining emission location to get_emission_location.
4184 * diagnostic-manager.h
4185 (diagnostic_manager::m_num_disabled_diagnostics): New field.
4186 * engine.cc (stale_jmp_buf::get_controlling_option): New.
4187 (stale_jmp_buf::emit): Use it.
4188 * pending-diagnostic.h
4189 (pending_diagnostic::get_controlling_option): New vfunc.
4191 (poisoned_value_diagnostic::get_controlling_option): New.
4192 (poisoned_value_diagnostic::emit): Use it.
4193 (shift_count_negative_diagnostic::get_controlling_option): New.
4194 (shift_count_negative_diagnostic::emit): Use it.
4195 (shift_count_overflow_diagnostic::get_controlling_option): New.
4196 (shift_count_overflow_diagnostic::emit): Use it.
4197 (dump_path_diagnostic::get_controlling_option): New.
4198 (dump_path_diagnostic::emit): Use it.
4199 (write_to_const_diagnostic::get_controlling_option): New.
4200 (write_to_const_diagnostic::emit): Use it.
4201 (write_to_string_literal_diagnostic::get_controlling_option): New.
4202 (write_to_string_literal_diagnostic::emit): Use it.
4203 * sm-file.cc (double_fclose::get_controlling_option): New.
4204 (double_fclose::emit): Use it.
4205 (file_leak::get_controlling_option): New.
4206 (file_leak::emit): Use it.
4207 * sm-malloc.cc (mismatching_deallocation::get_controlling_option):
4209 (mismatching_deallocation::emit): Use it.
4210 (double_free::get_controlling_option): New.
4211 (double_free::emit): Use it.
4212 (possible_null_deref::get_controlling_option): New.
4213 (possible_null_deref::emit): Use it.
4214 (possible_null_arg::get_controlling_option): New.
4215 (possible_null_arg::emit): Use it.
4216 (null_deref::get_controlling_option): New.
4217 (null_deref::emit): Use it.
4218 (null_arg::get_controlling_option): New.
4219 (null_arg::emit): Use it.
4220 (use_after_free::get_controlling_option): New.
4221 (use_after_free::emit): Use it.
4222 (malloc_leak::get_controlling_option): New.
4223 (malloc_leak::emit): Use it.
4224 (free_of_non_heap::get_controlling_option): New.
4225 (free_of_non_heap::emit): Use it.
4226 * sm-pattern-test.cc (pattern_match::get_controlling_option): New.
4227 (pattern_match::emit): Use it.
4229 (exposure_through_output_file::get_controlling_option): New.
4230 (exposure_through_output_file::emit): Use it.
4231 * sm-signal.cc (signal_unsafe_call::get_controlling_option): New.
4232 (signal_unsafe_call::emit): Use it.
4233 * sm-taint.cc (tainted_array_index::get_controlling_option): New.
4234 (tainted_array_index::emit): Use it.
4235 (tainted_offset::get_controlling_option): New.
4236 (tainted_offset::emit): Use it.
4237 (tainted_size::get_controlling_option): New.
4238 (tainted_size::emit): Use it.
4239 (tainted_divisor::get_controlling_option): New.
4240 (tainted_divisor::emit): Use it.
4241 (tainted_allocation_size::get_controlling_option): New.
4242 (tainted_allocation_size::emit): Use it.
4244 2022-03-15 David Malcolm <dmalcolm@redhat.com>
4246 * store.cc (store::store): Presize m_cluster_map.
4248 2022-03-10 David Malcolm <dmalcolm@redhat.com>
4251 * constraint-manager.cc (constraint_manager::add_constraint):
4252 Refresh the EC IDs when adding constraints implied by offsets.
4254 2022-03-10 David Malcolm <dmalcolm@redhat.com>
4257 * analyzer.h (class pending_note): New forward decl.
4258 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
4260 (saved_diagnostic::operator==): Compare m_notes.
4261 (saved_diagnostic::add_note): New.
4262 (saved_diagnostic::emit_any_notes): New.
4263 (diagnostic_manager::add_note): New.
4264 (diagnostic_manager::emit_saved_diagnostic): Call emit_any_notes
4265 after emitting the warning.
4266 * diagnostic-manager.h (saved_diagnostic::add_note): New decl.
4267 (saved_diagnostic::emit_any_notes): New decl.
4268 (saved_diagnostic::m_notes): New field.
4269 (diagnostic_manager::add_note): New decl.
4270 * engine.cc (impl_region_model_context::add_note): New.
4271 * exploded-graph.h (impl_region_model_context::add_note): New
4273 * pending-diagnostic.h (class pending_note): New.
4274 (class pending_note_subclass): New template.
4275 * region-model.cc (class reason_attr_access): New.
4276 (check_external_function_for_access_attr): Add class
4277 annotating_ctxt and use it when checking region.
4278 (noop_region_model_context::add_note): New.
4279 * region-model.h (region_model_context::add_note): New vfunc.
4280 (noop_region_model_context::add_note): New decl.
4281 (class region_model_context_decorator): New.
4282 (class note_adding_context): New.
4284 2022-03-10 David Malcolm <dmalcolm@redhat.com>
4288 (region_model::check_external_function_for_access_attr): New.
4289 (region_model::handle_unrecognized_call): Call it.
4291 (region_model::check_external_function_for_access_attr): New decl.
4292 (region_model::handle_unrecognized_call): New decl.
4294 2022-03-10 David Malcolm <dmalcolm@redhat.com>
4296 * sm-taint.cc (taint_state_machine::check_for_tainted_size_arg):
4297 Avoid generating duplicate saved_diagnostics by only handling the
4298 rdwr_map entry for the ptrarg, not the duplicate entry for the
4301 2022-03-07 David Malcolm <dmalcolm@redhat.com>
4304 * engine.cc (returning_from_function_p): New.
4305 (impl_region_model_context::on_state_leak): Use it when rejecting
4306 leaks at the return from "main".
4308 2022-03-07 Jakub Jelinek <jakub@redhat.com>
4310 * store.cc: Fix up duplicated word issue in a comment.
4311 * analyzer.cc: Likewise.
4312 * engine.cc: Likewise.
4313 * sm-taint.cc: Likewise.
4315 2022-03-04 David Malcolm <dmalcolm@redhat.com>
4318 * analyzer.opt (-param=analyzer-max-svalue-depth=): Reduce from 13
4321 2022-02-23 David Malcolm <dmalcolm@redhat.com>
4324 * analyzer.h (class const_fn_result_svalue): New decl.
4325 * region-model-impl-calls.cc (call_details::get_manager): New.
4326 * region-model-manager.cc
4327 (region_model_manager::get_or_create_const_fn_result_svalue): New.
4328 (region_model_manager::log_stats): Log
4329 m_const_fn_result_values_map.
4330 * region-model.cc (const_fn_p): New.
4331 (maybe_get_const_fn_result): New.
4332 (region_model::on_call_pre): Handle fndecls with
4333 __attribute__((const)) by calling the above rather than making
4335 * region-model.h (visitor::visit_const_fn_result_svalue): New.
4336 (region_model_manager::get_or_create_const_fn_result_svalue): New
4338 (region_model_manager::const_fn_result_values_map_t): New typedef.
4339 (region_model_manager::m_const_fn_result_values_map): New field.
4340 (call_details::get_manager): New decl.
4341 * svalue.cc (svalue::cmp_ptr): Handle SK_CONST_FN_RESULT.
4342 (const_fn_result_svalue::dump_to_pp): New.
4343 (const_fn_result_svalue::dump_input): New.
4344 (const_fn_result_svalue::accept): New.
4345 * svalue.h (enum svalue_kind): Add SK_CONST_FN_RESULT.
4346 (svalue::dyn_cast_const_fn_result_svalue): New.
4347 (class const_fn_result_svalue): New.
4348 (is_a_helper <const const_fn_result_svalue *>::test): New.
4349 (template <> struct default_hash_traits<const_fn_result_svalue::key_t>):
4352 2022-02-17 David Malcolm <dmalcolm@redhat.com>
4355 * region-model.cc: Include "calls.h".
4356 (region_model::on_call_pre): Use flags_from_decl_or_type to
4357 generalize check for DECL_PURE_P to also check for ECF_CONST.
4359 2022-02-16 David Malcolm <dmalcolm@redhat.com>
4362 * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
4363 Add region creation events for globals of interest.
4364 (null_assignment_sm_context::get_old_program_state): New.
4365 (diagnostic_manager::add_events_for_eedge): Move check for
4366 changing dynamic extents from PK_BEFORE_STMT case to after the
4367 switch on the dst_point's kind so that we can emit them for the
4368 final stmt in a basic block.
4369 * engine.cc (impl_sm_context::get_old_program_state): New.
4370 * sm-malloc.cc (malloc_state_machine::get_default_state): Rewrite
4371 detection of m_non_heap to use get_memory_space.
4372 (free_of_non_heap::free_of_non_heap): Add freed_reg param.
4373 (free_of_non_heap::subclass_equal_p): Update for changes to
4375 (free_of_non_heap::emit): Drop m_kind in favor of
4377 (free_of_non_heap::describe_state_change): Remove logic for
4379 (free_of_non_heap::mark_interesting_stuff): Add region-creation of
4381 (free_of_non_heap::get_memory_space): New.
4382 (free_of_non_heap::kind): Drop enum.
4383 (free_of_non_heap::m_freed_reg): New field.
4384 (free_of_non_heap::m_kind): Drop field.
4385 (malloc_state_machine::on_stmt): Drop transition to m_non_heap.
4386 (malloc_state_machine::handle_free_of_non_heap): New function,
4387 split out from on_deallocator_call and on_realloc_call, adding
4388 detection of the freed region.
4389 (malloc_state_machine::on_deallocator_call): Use it.
4390 (malloc_state_machine::on_realloc_call): Likewise.
4391 * sm.h (sm_context::get_old_program_state): New vfunc.
4393 2022-02-15 David Malcolm <dmalcolm@redhat.com>
4396 * region-model-manager.cc
4397 (region_model_manager::maybe_fold_sub_svalue): Only call
4398 get_or_create_cast if type is non-NULL.
4400 2022-02-15 David Malcolm <dmalcolm@redhat.com>
4403 * exploded-graph.h (impl_region_model_context::get_stmt): New.
4404 * region-model.cc: Include "gimple-ssa.h", "tree-phinodes.h",
4405 "tree-ssa-operands.h", and "ssa-iterators.h".
4406 (within_short_circuited_stmt_p): New.
4407 (region_model::check_for_poison): Don't warn about uninit values
4408 if within_short_circuited_stmt_p.
4409 * region-model.h (region_model_context::get_stmt): New vfunc.
4410 (noop_region_model_context::get_stmt): New.
4412 2022-02-11 David Malcolm <dmalcolm@redhat.com>
4415 * region-model.cc (region_model::check_for_poison): Ignore
4416 uninitialized uses of empty types.
4418 2022-02-10 David Malcolm <dmalcolm@redhat.com>
4421 * region-model-manager.cc
4422 (region_model_manager::maybe_fold_sub_svalue): Generalize getting
4423 individual chars of a STRING_CST from element_region to any
4424 subregion which is a concrete access of a single byte from its
4426 * region.cc (region::get_relative_concrete_byte_range): New.
4427 * region.h (region::get_relative_concrete_byte_range): New decl.
4429 2022-02-09 David Malcolm <dmalcolm@redhat.com>
4432 * region-model.cc (selftest::test_bit_range_regions): New.
4433 (selftest::analyzer_region_model_cc_tests): Call it.
4434 * region.h (bit_range_region::key_t::hash): Fix hashing of m_bits
4435 to avoid using uninitialized data.
4437 2022-02-07 David Malcolm <dmalcolm@redhat.com>
4440 * sm-taint.cc (tainted_allocation_size::tainted_allocation_size):
4441 Remove overzealous assertion.
4442 (tainted_allocation_size::emit): Likewise.
4443 (region_model::check_dynamic_size_for_taint): Likewise.
4445 2022-02-07 David Malcolm <dmalcolm@redhat.com>
4448 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
4449 Reimplement in terms of a get_store_value followed by a set_value.
4451 2022-02-03 David Malcolm <dmalcolm@redhat.com>
4454 * engine.cc (exploded_graph::process_node): Use the node for any
4455 diagnostics, avoiding ICE if a bifurcation update adds a
4456 saved_diagnostic, such as for a tainted realloc size.
4457 * region-model-impl-calls.cc
4458 (region_model::impl_call_realloc::success_no_move::update_model):
4459 Require the old pointer to be non-NULL to be able successfully
4460 grow in place. Use model->deref_rvalue rather than maybe_get_region
4461 to support the old pointer being symbolic.
4462 (region_model::impl_call_realloc::success_with_move::update_model):
4463 Likewise. Add a constraint that the new pointer != the old pointer.
4464 Use a sized_region when setting the value of the new region.
4465 Handle the case where we don't know the dynamic size of the old
4466 region by marking the new region as unknown.
4467 * sm-taint.cc (tainted_allocation_size::tainted_allocation_size):
4468 Update assertion to also allow for MEMSPACE_UNKNOWN.
4469 (tainted_allocation_size::emit): Likewise.
4470 (region_model::check_dynamic_size_for_taint): Likewise.
4472 2022-02-03 David Malcolm <dmalcolm@redhat.com>
4474 * region-model-impl-calls.cc (region_model::impl_call_calloc): Use
4475 a sized_region when calling zero_fill_region.
4477 2022-02-02 David Malcolm <dmalcolm@redhat.com>
4479 * region-model.cc (region_model::on_return): Replace usage of
4480 copy_region with get_rvalue/set_value pair.
4481 (region_model::pop_frame): Likewise.
4482 (selftest::test_compound_assignment): Likewise.
4483 * region-model.h (region_model::copy_region): Delete decl.
4484 * region.cc (region_model::copy_region): Delete.
4486 2022-02-02 David Malcolm <dmalcolm@redhat.com>
4488 * region.cc (region::calc_offset): Consolidate effectively
4491 2022-02-02 David Malcolm <dmalcolm@redhat.com>
4493 * analyzer.h (class bit_range_region): New forward decl.
4494 * region-model-manager.cc (region_model_manager::get_bit_range):
4496 (region_model_manager::log_stats): Handle m_bit_range_regions.
4497 * region-model.cc (region_model::get_lvalue_1): Handle
4499 * region-model.h (region_model_manager::get_bit_range): New decl.
4500 (region_model_manager::m_bit_range_regions): New field.
4501 * region.cc (region::get_base_region): Handle RK_BIT_RANGE.
4502 (region::base_region_p): Likewise.
4503 (region::calc_offset): Likewise.
4504 (bit_range_region::dump_to_pp): New.
4505 (bit_range_region::get_byte_size): New.
4506 (bit_range_region::get_bit_size): New.
4507 (bit_range_region::get_byte_size_sval): New.
4508 (bit_range_region::get_relative_concrete_offset): New.
4509 * region.h (enum region_kind): Add RK_BIT_RANGE.
4510 (region::dyn_cast_bit_range_region): New vfunc.
4511 (class bit_range_region): New.
4512 (is_a_helper <const bit_range_region *>::test): New.
4513 (default_hash_traits<bit_range_region::key_t>): New.
4515 2022-02-02 David Malcolm <dmalcolm@redhat.com>
4518 * region-model.cc (region_model::on_call_pre): Handle
4521 2022-01-27 David Malcolm <dmalcolm@redhat.com>
4523 * checker-path.cc (event_kind_to_string): Handle
4525 (region_creation_event::region_creation_event): New.
4526 (region_creation_event::get_desc): New.
4527 (checker_path::add_region_creation_event): New.
4528 * checker-path.h (enum event_kind): Add EK_REGION_CREATION.
4529 (class region_creation_event): New subclass.
4530 (checker_path::add_region_creation_event): New decl.
4531 * diagnostic-manager.cc
4532 (diagnostic_manager::emit_saved_diagnostic): Pass NULL for new
4533 param to add_events_for_eedge when handling trailing eedge.
4534 (diagnostic_manager::build_emission_path): Create an interesting_t
4535 instance, allow the pending diagnostic to populate it, and pass it
4536 to the calls to add_events_for_eedge.
4537 (diagnostic_manager::add_events_for_eedge): Add "interest" param.
4538 Use it to add region_creation_events for on-stack regions created
4539 within at function entry, and when pertinent dynamically-sized
4540 regions are created.
4541 (diagnostic_manager::prune_for_sm_diagnostic): Add case for
4543 * diagnostic-manager.h (diagnostic_manager::add_events_for_eedge):
4544 Add "interest" param.
4545 * pending-diagnostic.cc: Include "selftest.h", "tristate.h",
4546 "analyzer/call-string.h", "analyzer/program-point.h",
4547 "analyzer/store.h", and "analyzer/region-model.h".
4548 (interesting_t::add_region_creation): New.
4549 (interesting_t::dump_to_pp): New.
4550 * pending-diagnostic.h (struct interesting_t): New.
4551 (pending_diagnostic::mark_interesting_stuff): New vfunc.
4553 (poisoned_value_diagnostic::poisoned_value_diagnostic): Add
4554 (poisoned_value_diagnostic::operator==): Compare m_pkind and
4555 m_src_region fields.
4556 (poisoned_value_diagnostic::mark_interesting_stuff): New.
4557 (poisoned_value_diagnostic::m_src_region): New.
4558 (region_model::check_for_poison): Call
4559 get_region_for_poisoned_expr for uninit values and pass the resul
4561 (region_model::get_region_for_poisoned_expr): New.
4562 (region_model::deref_rvalue): Pass NULL for
4563 poisoned_value_diagnostic's src_region.
4564 * region-model.h (region_model::get_region_for_poisoned_expr): New
4566 * region.h (frame_region::get_fndecl): New.
4568 2022-01-27 Martin Liska <mliska@suse.cz>
4571 * constraint-manager.cc (bounded_ranges_manager::log_stats):
4572 Cast to long for format purpose.
4573 * region-model-manager.cc (log_uniq_map): Likewise.
4575 2022-01-26 David Malcolm <dmalcolm@redhat.com>
4578 * region-model.cc (region_model::check_call_args): New.
4579 (region_model::on_call_pre): Call it when ignoring stdio builtins.
4580 * region-model.h (region_model::check_call_args): New decl
4582 2022-01-26 David Malcolm <dmalcolm@redhat.com>
4585 * constraint-manager.cc (range::add_bound): Fix tests for
4586 discarding redundant constraints. Perform test for rejecting
4587 unsatisfiable constraints earlier so that they don't update
4588 the object on failure.
4589 (selftest::test_range): New.
4590 (selftest::test_constant_comparisons): Add test coverage for
4591 existing constraints becoming narrower until they are
4593 (selftest::run_constraint_manager_tests): Call test_range.
4595 2022-01-22 David Malcolm <dmalcolm@redhat.com>
4598 * region-model-manager.cc
4599 (region_model_manager::get_or_create_cast): Bail out if the types
4600 are the same. Don't attempt to handle casts involving vector
4603 2022-01-20 David Malcolm <dmalcolm@redhat.com>
4606 * constraint-manager.cc (bound::ensure_closed): Convert param to
4608 (range::constrained_to_single_element): Likewise.
4609 (range::add_bound): New.
4610 (constraint_manager::add_constraint): Handle SVAL + OFFSET
4611 compared to a constant.
4612 (constraint_manager::get_ec_bounds): Rewrite in terms of
4614 (constraint_manager::eval_condition): Reject if range::add_bound
4616 (selftest::test_constant_comparisons): Add test coverage for
4617 various impossible combinations of integer comparisons.
4618 * constraint-manager.h (enum bound_kind): New.
4619 (struct bound): Likewise.
4620 (bound::ensure_closed): Convert to param to enum bound_kind.
4621 (struct range): Convert to...
4622 (class range): ...this, making fields private.
4623 (range::add_bound): New decls.
4624 * region-model.cc (region_model::add_constraint): Fail if
4625 constraint_manager::add_constraint fails.
4627 2022-01-18 David Malcolm <dmalcolm@redhat.com>
4630 * region-model-manager.cc
4631 (region_model_manager::get_or_create_constant_svalue): Assert that
4632 we have a CONSTANT_CLASS_P.
4633 (region_model_manager::maybe_fold_unaryop): Only fold a constant
4634 when fold_unary's result is a constant or a cast of a constant.
4636 2022-01-18 David Malcolm <dmalcolm@redhat.com>
4639 * region-model-manager.cc
4640 (region_model_manager::maybe_fold_sub_svalue): Avoid casting to
4641 NULL type when folding access to repeated svalue.
4643 2022-01-17 Martin Liska <mliska@suse.cz>
4645 * analyzer.cc (is_special_named_call_p): Rename .c names to .cc.
4646 (is_named_call_p): Likewise.
4647 * region-model-asm.cc (deterministic_p): Likewise.
4648 * region.cc (field_region::get_relative_concrete_offset): Likewise.
4649 * sm-malloc.cc (method_p): Likewise.
4650 * supergraph.cc (superedge::dump_dot): Likewise.
4652 2022-01-14 David Malcolm <dmalcolm@redhat.com>
4654 * sm-taint.cc (taint_state_machine::combine_states): Handle combination
4655 of has_ub and has_lb.
4657 2022-01-14 David Malcolm <dmalcolm@redhat.com>
4660 * sm-taint.cc (taint_state_machine::alt_get_inherited_state):
4661 Remove gcc_unreachable from default case for unary ops.
4663 2022-01-14 David Malcolm <dmalcolm@redhat.com>
4665 * engine.cc: Include "stringpool.h", "attribs.h", and
4667 (mark_params_as_tainted): New.
4668 (class tainted_args_function_custom_event): New.
4669 (class tainted_args_function_info): New.
4670 (exploded_graph::add_function_entry): Handle functions with
4671 "tainted_args" attribute.
4672 (class tainted_args_field_custom_event): New.
4673 (class tainted_args_callback_custom_event): New.
4674 (class tainted_args_call_info): New.
4675 (add_tainted_args_callback): New.
4676 (add_any_callbacks): New.
4677 (exploded_graph::build_initial_worklist): Likewise.
4678 (exploded_graph::build_initial_worklist): Find callbacks that are
4679 reachable from global initializers, calling add_any_callbacks on
4682 2022-01-12 David Malcolm <dmalcolm@redhat.com>
4685 * engine.cc (impl_sm_context::impl_sm_context): Add
4686 "unknown_side_effects" param and use it to initialize
4687 new m_unknown_side_effects field.
4688 (impl_sm_context::unknown_side_effects_p): New.
4689 (impl_sm_context::m_unknown_side_effects): New.
4690 (exploded_node::on_stmt): Pass unknown_side_effects to sm_ctxt
4692 * sm-taint.cc: Include "stringpool.h" and "attribs.h".
4693 (tainted_size::tainted_size): Drop "dir" param.
4694 (tainted_size::get_kind): Drop "FINAL".
4695 (tainted_size::emit): Likewise.
4696 (tainted_size::m_dir): Drop unused field.
4697 (class tainted_access_attrib_size): New subclass.
4698 (taint_state_machine::on_stmt): Call check_for_tainted_size_arg on
4699 external functions with unknown side effects.
4700 (taint_state_machine::check_for_tainted_size_arg): New.
4701 (region_model::check_region_for_taint): Drop "dir" param from
4703 * sm.h (sm_context::unknown_side_effects_p): New.
4705 2022-01-11 David Malcolm <dmalcolm@redhat.com>
4708 * diagnostic-manager.cc
4709 (class auto_disable_complexity_checks): Rename to...
4710 (class auto_checking_feasibility): ...this, updating
4711 the calls accordingly.
4712 (epath_finder::explore_feasible_paths): Update for renaming.
4713 * region-model-manager.cc
4714 (region_model_manager::region_model_manager): Update for change from
4715 m_check_complexity to m_checking_feasibility.
4716 (region_model_manager::reject_if_too_complex): Likewise.
4717 (region_model_manager::get_or_create_unknown_svalue): Handle
4718 m_checking_feasibility.
4719 (region_model_manager::create_unique_svalue): New.
4720 (region_model_manager::maybe_fold_binop): Handle BIT_AND_EXPR and
4721 BIT_IOR_EXPRs on booleans where we know the result.
4722 * region-model.cc (test_binop_svalue_folding): Add test coverage
4724 * region-model.h (region_model_manager::create_unique_svalue): New
4726 (region_model_manager::enable_complexity_check): Replace with...
4727 (region_model_manager::begin_checking_feasibility): ...this.
4728 (region_model_manager::disable_complexity_check): Replace with...
4729 (region_model_manager::end_checking_feasibility): ...this.
4730 (region_model_manager::m_check_complexity): Replace with...
4731 (region_model_manager::m_checking_feasibility): ...this.
4732 (region_model_manager::m_managed_dynamic_svalues): New field.
4734 2022-01-08 David Malcolm <dmalcolm@redhat.com>
4736 * engine.cc (impl_run_checkers): Pass logger to engine ctor.
4737 * region-model-manager.cc
4738 (region_model_manager::region_model_manager): Add logger param and
4739 use it to initialize m_logger.
4740 * region-model.cc (engine::engine): New.
4741 * region-model.h (region_model_manager::region_model_manager):
4743 (region_model_manager::get_logger): New.
4744 (region_model_manager::m_logger): New field.
4745 (engine::engine): New.
4746 * store.cc (store_manager::get_logger): New.
4747 (store::set_value): Log scope. Log when marking a cluster as
4748 unknown due to possible aliasing.
4749 * store.h (store_manager::get_logger): New decl.
4751 2022-01-08 David Malcolm <dmalcolm@redhat.com>
4753 * region-model-impl-calls.cc (cmp_decls): New.
4754 (cmp_decls_ptr_ptr): New.
4755 (region_model::impl_call_analyzer_dump_escaped): New.
4756 * region-model.cc (region_model::on_stmt_pre): Handle
4757 __analyzer_dump_escaped.
4758 * region-model.h (region_model::impl_call_analyzer_dump_escaped):
4760 * store.h (binding_cluster::get_base_region): New accessor.
4762 2022-01-08 David Malcolm <dmalcolm@redhat.com>
4764 * region.cc (region::is_named_decl_p): New.
4765 * region.h (region::is_named_decl_p): New decl.
4767 2022-01-06 David Malcolm <dmalcolm@redhat.com>
4770 * store.cc (store::eval_alias_1): Refactor handling of decl
4771 regions, adding a test for may_be_aliased, rejecting those for
4772 which it returns false.
4774 2021-12-12 Jonathan Wakely <jwakely@redhat.com>
4776 * engine.cc: Define INCLUDE_MEMORY instead of INCLUDE_UNIQUE_PTR.
4778 2021-12-06 David Malcolm <dmalcolm@redhat.com>
4781 * constraint-manager.cc (equiv_class::contains_non_constant_p):
4783 (constraint_manager::canonicalize): Call it when determining
4785 (selftest::test_purging): New selftest.
4786 (selftest::run_constraint_manager_tests): Likewise.
4787 * constraint-manager.h (equiv_class::contains_non_constant_p):
4790 2021-12-01 David Malcolm <dmalcolm@redhat.com>
4793 * region-model-reachability.cc (reachable_regions::handle_parm):
4794 Treat all svalues within a compound parm has reachable, and those
4797 2021-11-29 David Malcolm <dmalcolm@redhat.com>
4800 * store.cc (binding_cluster::can_merge_p): For the "key is bound"
4801 vs "key is not bound" merger case, check that the bound svalue
4802 is mergeable before merging it to "unknown", rejecting the merger
4805 2021-11-19 David Malcolm <dmalcolm@redhat.com>
4808 * engine.cc (exploded_graph::get_or_create_node): Pass in
4809 m_ext_state to program_state::can_merge_with_p.
4810 (exploded_graph::process_worklist): Likewise.
4811 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
4813 (exploded_graph::process_node): Add missing call to detect_leaks
4814 when handling phi nodes.
4815 * program-state.cc (program_state::can_merge_with_p): Add
4816 "ext_state" param. Pass it and state ptrs to
4817 region_model::can_merge_with_p.
4818 (selftest::test_program_state_merging): Update for new ext_state
4819 param of program_state::can_merge_with_p.
4820 (selftest::test_program_state_merging_2): Likewise.
4821 * program-state.h (program_state::can_purge_p): Make const.
4822 (program_state::can_merge_with_p): Add "ext_state" param.
4823 * region-model.cc: Include "analyzer/program-state.h".
4824 (region_model::can_merge_with_p): Add params "ext_state",
4825 "state_a", and "state_b", use them when creating model_merger
4827 (model_merger::mergeable_svalue_p): New.
4828 * region-model.h (region_model::can_merge_with_p): Add params
4829 "ext_state", "state_a", and "state_b".
4830 (model_merger::model_merger) Likewise, initializing new fields.
4831 (model_merger::mergeable_svalue_p): New decl.
4832 (model_merger::m_ext_state): New field.
4833 (model_merger::m_state_a): New field.
4834 (model_merger::m_state_b): New field.
4835 * svalue.cc (svalue::can_merge_p): Call
4836 model_merger::mergeable_svalue_p on both states and reject the
4839 2021-11-17 David Malcolm <dmalcolm@redhat.com>
4842 * region-model-impl-calls.cc (region_model::impl_call_strchr): New.
4843 * region-model-manager.cc
4844 (region_model_manager::maybe_fold_unaryop): Simplify cast to
4845 pointer type of an existing pointer to a region.
4846 * region-model.cc (region_model::on_call_pre): Handle
4847 BUILT_IN_STRCHR and "strchr".
4848 (write_to_const_diagnostic::emit): Add auto_diagnostic_group. Add
4849 alternate wordings for functions and labels.
4850 (write_to_const_diagnostic::describe_final_event): Add alternate
4851 wordings for functions and labels.
4852 (region_model::check_for_writable_region): Handle RK_FUNCTION and
4854 * region-model.h (region_model::impl_call_strchr): New decl.
4856 2021-11-16 David Malcolm <dmalcolm@redhat.com>
4859 * constraint-manager.cc (bounded_range::operator==): Require the
4860 types to be the same for equality.
4862 2021-11-13 David Malcolm <dmalcolm@redhat.com>
4864 * analyzer.opt (Wanalyzer-tainted-allocation-size): New.
4865 (Wanalyzer-tainted-divisor): New.
4866 (Wanalyzer-tainted-offset): New.
4867 (Wanalyzer-tainted-size): New.
4868 * engine.cc (impl_region_model_context::get_taint_map): New.
4869 * exploded-graph.h (impl_region_model_context::get_taint_map):
4871 * program-state.cc (sm_state_map::get_state): Call
4872 alt_get_inherited_state.
4873 (sm_state_map::impl_set_state): Modify states within
4875 (program_state::impl_call_analyzer_dump_state): Undo casts.
4876 (selftest::test_program_state_1): Update for new context param of
4877 create_region_for_heap_alloc.
4878 (selftest::test_program_state_merging): Likewise.
4879 * region-model-impl-calls.cc (region_model::impl_call_alloca):
4881 (region_model::impl_call_calloc): Likewise.
4882 (region_model::impl_call_malloc): Likewise.
4883 (region_model::impl_call_operator_new): Likewise.
4884 (region_model::impl_call_realloc): Likewise.
4885 * region-model.cc (region_model::check_region_access): Call
4886 check_region_for_taint.
4887 (region_model::get_representative_path_var_1): Handle binops.
4888 (region_model::create_region_for_heap_alloc): Add "ctxt" param and
4889 pass it to set_dynamic_extents.
4890 (region_model::create_region_for_alloca): Likewise.
4891 (region_model::set_dynamic_extents): Add "ctxt" param and use it
4892 to call check_dynamic_size_for_taint.
4893 (selftest::test_state_merging): Update for new context param of
4894 create_region_for_heap_alloc.
4895 (selftest::test_malloc_constraints): Likewise.
4896 (selftest::test_malloc): Likewise.
4897 (selftest::test_alloca): Likewise for create_region_for_alloca.
4898 * region-model.h (region_model::create_region_for_heap_alloc): Add
4900 (region_model::create_region_for_alloca): Likewise.
4901 (region_model::set_dynamic_extents): Likewise.
4902 (region_model::check_dynamic_size_for_taint): New decl.
4903 (region_model::check_region_for_taint): New decl.
4904 (region_model_context::get_taint_map): New vfunc.
4905 (noop_region_model_context::get_taint_map): New.
4906 * sm-taint.cc: Remove include of "diagnostic-event-id.h"; add
4907 includes of "gimple-iterator.h", "tristate.h", "selftest.h",
4908 "ordered-hash-map.h", "cgraph.h", "cfg.h", "digraph.h",
4909 "analyzer/supergraph.h", "analyzer/call-string.h",
4910 "analyzer/program-point.h", "analyzer/store.h",
4911 "analyzer/region-model.h", and "analyzer/program-state.h".
4912 (enum bounds): Move to top of file.
4913 (class taint_diagnostic): New.
4914 (class tainted_array_index): Convert to subclass of taint_diagnostic.
4915 (tainted_array_index::emit): Add CWE-129. Reword warning to use
4916 "attacker-controlled" rather than "tainted".
4917 (tainted_array_index::describe_state_change): Move to
4918 taint_diagnostic::describe_state_change.
4919 (tainted_array_index::describe_final_event): Reword to use
4920 "attacker-controlled" rather than "tainted".
4921 (class tainted_offset): New.
4922 (class tainted_size): New.
4923 (class tainted_divisor): New.
4924 (class tainted_allocation_size): New.
4925 (taint_state_machine::alt_get_inherited_state): New.
4926 (taint_state_machine::on_stmt): In assignment handling, remove
4927 ARRAY_REF handling in favor of check_region_for_taint. Add
4928 detection of tainted divisors.
4929 (taint_state_machine::get_taint): New.
4930 (taint_state_machine::combine_states): New.
4931 (region_model::check_region_for_taint): New.
4932 (region_model::check_dynamic_size_for_taint): New.
4933 * sm.h (state_machine::alt_get_inherited_state): New.
4935 2021-11-12 David Malcolm <dmalcolm@redhat.com>
4937 * engine.cc (exploded_node::on_stmt_pre): Return when handling
4938 "__analyzer_dump_state".
4940 2021-11-11 Richard Biener <rguenther@suse.de>
4942 * supergraph.cc: Include bitmap.h.
4944 2021-11-04 David Malcolm <dmalcolm@redhat.com>
4946 * program-state.cc (sm_state_map::dump): Use default_tree_printer
4949 2021-09-16 Maxim Blinov <maxim.blinov@embecosm.com>
4952 * engine.cc (INCLUDE_UNIQUE_PTR): Define.
4954 2021-09-08 David Malcolm <dmalcolm@redhat.com>
4957 * analyzer.h (compat_types_p): New decl.
4958 * constraint-manager.cc
4959 (constraint_manager::get_or_add_equiv_class): Guard against NULL
4960 type when checking for pointer types.
4961 * region-model-impl-calls.cc (region_model::impl_call_realloc):
4962 Guard against NULL lhs type/region. Guard against the size value
4963 not being of a compatible type for dynamic extents.
4964 * region-model.cc (compat_types_p): Make non-static.
4966 2021-08-30 David Malcolm <dmalcolm@redhat.com>
4969 * analyzer.h (class custom_edge_info): New class, adapted from
4970 exploded_edge::custom_info_t. Make member functions const.
4971 Make update_model return bool, converting edge param from
4972 reference to a pointer, and adding a ctxt param.
4973 (class path_context): New class.
4974 * call-info.cc: New file.
4975 * call-info.h: New file.
4976 * engine.cc: Include "analyzer/call-info.h" and <memory>.
4977 (impl_region_model_context::impl_region_model_context): Update for
4978 new m_path_ctxt field.
4979 (impl_region_model_context::bifurcate): New.
4980 (impl_region_model_context::terminate_path): New.
4981 (impl_region_model_context::get_malloc_map): New.
4982 (impl_sm_context::impl_sm_context): Update for new m_path_ctxt
4984 (impl_sm_context::get_fndecl_for_call): Likewise.
4985 (impl_sm_context::set_next_state): Likewise.
4986 (impl_sm_context::warn): Likewise.
4987 (impl_sm_context::is_zero_assignment): Likewise.
4988 (impl_sm_context::get_path_context): New.
4989 (impl_sm_context::m_path_ctxt): New.
4990 (impl_region_model_context::on_condition): Update for new
4991 path_ctxt param. Handle m_enode_for_diag being NULL.
4992 (impl_region_model_context::on_phi): Update for new path_ctxt
4994 (exploded_node::on_stmt): Add path_ctxt param, updating ctor calls
4995 to use it as necessary. Use it to bail out after sm-handling,
4997 (exploded_node::detect_leaks): Update for new path_ctxt param.
4998 (dynamic_call_info_t::update_model): Update for conversion of
4999 exploded_edge::custom_info_t to custom_edge_info.
5000 (dynamic_call_info_t::add_events_to_path): Likewise.
5001 (rewind_info_t::update_model): Likewise.
5002 (rewind_info_t::add_events_to_path): Likewise.
5003 (exploded_edge::exploded_edge): Likewise.
5004 (exploded_graph::add_edge): Likewise.
5005 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
5006 Update for new path_ctxt param.
5007 (class impl_path_context): New.
5008 (exploded_graph::process_node): Update for new path_ctxt param.
5009 Create an impl_path_context and pass it to exploded_node::on_stmt.
5010 Use it to terminate iterating stmts if terminate_path is called
5011 on it. After processing a run of stmts, query path_ctxt to
5012 potentially terminate the analysis path, and/or to "bifurcate" the
5013 analysis into multiple additional paths.
5014 (feasibility_state::maybe_update_for_edge): Update for new
5015 update_model ctxt param.
5017 (impl_region_model_context::impl_region_model_context): Add
5019 (impl_region_model_context::bifurcate): New.
5020 (impl_region_model_context::terminate_path): New
5021 (impl_region_model_context::get_ext_state): New.
5022 (impl_region_model_context::get_malloc_map): New.
5023 (impl_region_model_context::m_path_ctxt): New field.
5024 (exploded_node::on_stmt): Add path_ctxt param.
5025 (class exploded_edge::custom_info_t): Move to analyzer.h, renaming
5026 to custom_edge_info, and making the changes as noted in analyzer.h
5028 (exploded_edge::exploded_edge): Update for these changes to
5029 exploded_edge::custom_info_t.
5030 (exploded_edge::m_custom_info): Likewise.
5031 (class dynamic_call_info_t): Likewise.
5032 (class rewind_info_t): Likewise.
5033 (exploded_graph::add_edge): Likewise.
5034 * program-state.cc (program_state::on_edge): Update for new
5036 (program_state::push_call): Likewise.
5037 (program_state::returning_call): Likewise.
5038 (program_state::prune_for_point): Likewise.
5039 * region-model-impl-calls.cc: Include "analyzer/call-info.h".
5040 (call_details::get_fndecl_for_call): New.
5041 (region_model::impl_call_realloc): Reimplement.
5042 * region-model.cc (region_model::on_call_pre): Move call to
5043 impl_call_realloc to...
5044 (region_model::on_call_post): ...here. Consolidate creation
5045 of call_details instance.
5046 (noop_region_model_context::bifurcate): New.
5047 (noop_region_model_context::terminate_path): New.
5048 * region-model.h (call_details::get_call_stmt): New.
5049 (call_details::get_fndecl_for_call): New.
5050 (region_model::on_realloc_with_move): New.
5051 (region_model_context::bifurcate): New.
5052 (region_model_context::terminate_path): New.
5053 (region_model_context::get_ext_state): New.
5054 (region_model_context::get_malloc_map): New.
5055 (noop_region_model_context::bifurcate): New.
5056 (noop_region_model_context::terminate_path): New.
5057 (noop_region_model_context::get_ext_state): New.
5058 (noop_region_model_context::get_malloc_map): New.
5059 * sm-malloc.cc: Include "analyzer/program-state.h".
5060 (malloc_state_machine::on_realloc_call): Reimplement.
5061 (malloc_state_machine::on_realloc_with_move): New.
5062 (region_model::on_realloc_with_move): New.
5063 * sm-signal.cc (class signal_delivery_edge_info_t): Update for
5064 conversion from exploded_edge::custom_info_t to custom_edge_info.
5065 * sm.h (sm_context::get_path_context): New.
5066 * svalue.cc (svalue::maybe_get_constant): Call
5067 unwrap_any_unmergeable.
5069 2021-08-25 Ankur Saini <arsenic@sourceware.org>
5072 * engine.cc (exploded_graph::maybe_create_dynamic_call): Don't create
5073 calls if max recursion limit is reached.
5075 2021-08-23 David Malcolm <dmalcolm@redhat.com>
5077 * analyzer.h (struct rejected_constraint): Convert to...
5078 (class rejected_constraint): ...this.
5079 (class bounded_ranges): New forward decl.
5080 (class bounded_ranges_manager): New forward decl.
5081 * constraint-manager.cc: Include "analyzer/analyzer-logging.h" and
5082 "tree-pretty-print.h".
5083 (can_plus_one_p): New.
5085 (can_minus_one_p): New.
5087 (bounded_range::bounded_range): New.
5089 (bounded_range::dump_to_pp): New.
5090 (bounded_range::dump): New.
5091 (bounded_range::to_json): New.
5092 (bounded_range::set_json_attr): New.
5093 (bounded_range::contains_p): New.
5094 (bounded_range::intersects_p): New.
5095 (bounded_range::operator==): New.
5096 (bounded_range::cmp): New.
5097 (bounded_ranges::bounded_ranges): New.
5098 (bounded_ranges::bounded_ranges): New.
5099 (bounded_ranges::bounded_ranges): New.
5100 (bounded_ranges::canonicalize): New.
5101 (bounded_ranges::validate): New.
5102 (bounded_ranges::operator==): New.
5103 (bounded_ranges::dump_to_pp): New.
5104 (bounded_ranges::dump): New.
5105 (bounded_ranges::to_json): New.
5106 (bounded_ranges::eval_condition): New.
5107 (bounded_ranges::contain_p): New.
5108 (bounded_ranges::cmp): New.
5109 (bounded_ranges_manager::~bounded_ranges_manager): New.
5110 (bounded_ranges_manager::get_or_create_empty): New.
5111 (bounded_ranges_manager::get_or_create_point): New.
5112 (bounded_ranges_manager::get_or_create_range): New.
5113 (bounded_ranges_manager::get_or_create_union): New.
5114 (bounded_ranges_manager::get_or_create_intersection): New.
5115 (bounded_ranges_manager::get_or_create_inverse): New.
5116 (bounded_ranges_manager::consolidate): New.
5117 (bounded_ranges_manager::get_or_create_ranges_for_switch): New.
5118 (bounded_ranges_manager::create_ranges_for_switch): New.
5119 (bounded_ranges_manager::make_case_label_ranges): New.
5120 (bounded_ranges_manager::log_stats): New.
5121 (bounded_ranges_constraint::print): New.
5122 (bounded_ranges_constraint::to_json): New.
5123 (bounded_ranges_constraint::operator==): New.
5124 (bounded_ranges_constraint::add_to_hash): New.
5125 (constraint_manager::constraint_manager): Update for new field
5126 m_bounded_ranges_constraints.
5127 (constraint_manager::operator=): Likewise.
5128 (constraint_manager::hash): Likewise.
5129 (constraint_manager::operator==): Likewise.
5130 (constraint_manager::print): Likewise.
5131 (constraint_manager::dump_to_pp): Likewise.
5132 (constraint_manager::to_json): Likewise.
5133 (constraint_manager::add_unknown_constraint): Update the lhs_ec_id
5134 if necessary in existing constraints when combining equivalence
5135 classes. Add similar code for handling
5136 m_bounded_ranges_constraints.
5137 (constraint_manager::add_constraint_internal): Add comment.
5138 (constraint_manager::add_bounded_ranges): New.
5139 (constraint_manager::eval_condition): Use new field
5140 m_bounded_ranges_constraints.
5141 (constraint_manager::purge): Update bounded_ranges_constraint
5143 (constraint_manager::canonicalize): Update for new field.
5144 (merger_fact_visitor::on_ranges): New.
5145 (constraint_manager::for_each_fact): Use new field
5146 m_bounded_ranges_constraints.
5147 (constraint_manager::validate): Fix off-by-one error needed due
5148 to bug fixed above in add_unknown_constraint. Validate the EC IDs
5149 in m_bounded_ranges_constraints.
5150 (constraint_manager::get_range_manager): New.
5151 (selftest::assert_dump_bounded_range_eq): New.
5152 (ASSERT_DUMP_BOUNDED_RANGE_EQ): New.
5153 (selftest::test_bounded_range): New.
5154 (selftest::assert_dump_bounded_ranges_eq): New.
5155 (ASSERT_DUMP_BOUNDED_RANGES_EQ): New.
5156 (selftest::test_bounded_ranges): New.
5157 (selftest::run_constraint_manager_tests): Call the new selftests.
5158 * constraint-manager.h (struct bounded_range): New.
5159 (struct bounded_ranges): New.
5160 (template <> struct default_hash_traits<bounded_ranges::key_t>): New.
5161 (class bounded_ranges_manager): New.
5162 (fact_visitor::on_ranges): New pure virtual function.
5163 (class bounded_ranges_constraint): New.
5164 (constraint_manager::add_bounded_ranges): New decl.
5165 (constraint_manager::get_range_manager): New decl.
5166 (constraint_manager::m_bounded_ranges_constraints): New field.
5167 * diagnostic-manager.cc (epath_finder::process_worklist_item):
5168 Transfer ownership of rc to add_feasibility_problem.
5169 * engine.cc (feasibility_problem::dump_to_pp): Use get_model.
5170 * feasible-graph.cc (infeasible_node::dump_dot): Update for
5171 conversion of m_rc to a pointer.
5172 (feasible_graph::add_feasibility_problem): Pass RC by pointer and
5174 * feasible-graph.h (infeasible_node::infeasible_node): Pass RC by
5175 pointer and take ownership.
5176 (infeasible_node::~infeasible_node): New.
5177 (infeasible_node::m_rc): Convert to a pointer.
5178 (feasible_graph::add_feasibility_problem): Pass RC by pointer and
5180 * region-model-manager.cc: Include
5181 "analyzer/constraint-manager.h".
5182 (region_model_manager::region_model_manager): Initializer new
5184 (region_model_manager::~region_model_manager): Delete it.
5185 (region_model_manager::log_stats): Call log_stats on it.
5186 * region-model.cc (region_model::add_constraint): Use new subclass
5187 rejected_op_constraint.
5188 (region_model::apply_constraints_for_gswitch): Reimplement using
5189 bounded_ranges_manager.
5190 (rejected_constraint::dump_to_pp): Convert to...
5191 (rejected_op_constraint::dump_to_pp): ...this.
5192 (rejected_ranges_constraint::dump_to_pp): New.
5193 * region-model.h (struct purge_stats): Add field
5194 m_num_bounded_ranges_constraints.
5195 (region_model_manager::get_range_manager): New.
5196 (region_model_manager::m_range_mgr): New.
5197 (region_model::get_range_manager): New.
5198 (struct rejected_constraint): Split into...
5199 (class rejected_constraint):...this new abstract base class,
5201 (class rejected_op_constraint): ...this new concrete subclass.
5202 (class rejected_ranges_constraint): New.
5203 * supergraph.cc: Include "tree-cfg.h".
5204 (supergraph::supergraph): Drop idx param from add_cfg_edge.
5205 (supergraph::add_cfg_edge): Drop idx param.
5206 (switch_cfg_superedge::switch_cfg_superedge): Move here from
5207 header. Populate m_case_labels with all cases which go to DST.
5208 (switch_cfg_superedge::dump_label_to_pp): Reimplement to use
5210 (switch_cfg_superedge::get_case_label): Delete.
5211 * supergraph.h (supergraphadd_cfg_edge): Drop "idx" param.
5212 (switch_cfg_superedge::switch_cfg_superedge): Drop idx param and
5213 move implementation to supergraph.cc.
5214 (switch_cfg_superedge::get_case_label): Delete.
5215 (switch_cfg_superedge::get_case_labels): New.
5216 (switch_cfg_superedge::m_idx): Delete.
5217 (switch_cfg_superedge::m_case_labels): New field.
5219 2021-08-23 David Malcolm <dmalcolm@redhat.com>
5222 * sm-file.cc (file_diagnostic::describe_state_change): Handle
5223 change.m_expr being NULL.
5225 2021-08-23 David Malcolm <dmalcolm@redhat.com>
5228 * analyzer.cc (maybe_reconstruct_from_def_stmt): Bail if fn is
5229 NULL, and assert that it's non-NULL before passing it to
5230 build_call_array_loc.
5232 2021-08-23 David Malcolm <dmalcolm@redhat.com>
5235 * region-model.cc (region_model::eval_condition_without_cm):
5236 Refactor comparison against zero, adding a check for
5237 POINTER_PLUS_EXPR of non-NULL.
5239 2021-08-23 David Malcolm <dmalcolm@redhat.com>
5241 * store.cc (bit_range::intersects_p): New overload.
5242 (bit_range::operator-): New.
5243 (binding_cluster::maybe_get_compound_binding): Handle the partial
5245 (selftest::test_bit_range_intersects_p): Add test coverage for
5246 new overload of bit_range::intersects_p.
5247 * store.h (bit_range::intersects_p): New overload.
5248 (bit_range::operator-): New.
5250 2021-08-23 Ankur Saini <arsenic@sourceware.org>
5253 * diagnostic-manager.cc
5254 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Fix typo.
5256 2021-08-21 Ankur Saini <arsenic@sourceware.org>
5259 * diagnostic-manager.cc
5260 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Use
5261 caller_model only when the supergraph_edge doesn't exixt.
5262 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
5264 * engine.cc (exploded_graph::create_dynamic_call): Rename to...
5265 (exploded_graph::maybe_create_dynamic_call): ...this, return call
5267 (exploded_graph::process_node): Handle calls which were not dynamically
5269 * exploded-graph.h (exploded_graph::create_dynamic_call): Rename to...
5270 (exploded_graph::maybe_create_dynamic_call): ...this.
5271 * region-model.cc (region_model::update_for_gcall): New param, use it
5272 to push call to frame.
5273 (region_model::update_for_call_superedge): Pass callee function to
5275 * region-model.h (region_model::update_for_gcall): New param.
5277 2021-08-18 Ankur Saini <arsenic@sourceware.org>
5280 * region-model.cc (region_model::get_rvalue_1): Add case for
5283 2021-08-18 Ankur Saini <arsenic@sourceware.org>
5286 * analysis-plan.cc (analysis_plan::use_summary_p): Don't use call
5287 summaries if there is no callgraph edge
5288 * checker-path.cc (call_event::call_event): Handle calls events that
5289 are not represented by a supergraph call edge
5290 (return_event::return_event): Likewise.
5291 (call_event::get_desc): Work with new call_event structure.
5292 (return_event::get_desc): Likeise.
5293 * checker-path.h (call_event::m_src_snode): New field.
5294 (call_event::m_dest_snode): New field.
5295 (return_event::m_src_snode): New field.
5296 (return_event::m_dest_snode): New field.
5297 * diagnostic-manager.cc
5298 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>:
5299 Refactor to work with edges without callgraph edge.
5300 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
5302 * engine.cc (dynamic_call_info_t::update_model): New function.
5303 (dynamic_call_info_t::add_events_to_path): New function.
5304 (exploded_graph::create_dynamic_call): New function.
5305 (exploded_graph::process_node): Work with dynamically discovered calls.
5306 * exploded-graph.h (class dynamic_call_info_t): New class.
5307 (exploded_graph::create_dynamic_call): New decl.
5308 * program-point.cc (program_point::push_to_call_stack): New function.
5309 (program_point::pop_from_call_stack): New function.
5310 * program-point.h (program_point::push_to_call_stack): New decl.
5311 (program_point::pop_from_call_stack): New decl.
5312 * program-state.cc (program_state::push_call): New function.
5313 (program_state::returning_call): New function.
5314 * program-state.h (program_state::push_call): New decl.
5315 (program_state::returning_call): New decl.
5316 * region-model.cc (region_model::update_for_gcall) New function.
5317 (region_model::update_for_return_gcall): New function.
5318 (egion_model::update_for_call_superedge): Get the underlying gcall and
5320 (region_model::update_for_return_superedge): Likewise.
5321 * region-model.h (region_model::update_for_gcall): New decl.
5322 (region_model::update_for_return_gcall): New decl.
5323 * state-purge.cc (state_purge_per_ssa_name::process_point): Update to
5324 work with calls without underlying cgraph edge.
5325 * supergraph.cc (supergraph::supergraph) Split snodes at every callsite.
5326 * supergraph.h (supernode::get_returning_call) New accessor.
5328 2021-08-04 David Malcolm <dmalcolm@redhat.com>
5331 * analyzer.cc (maybe_reconstruct_from_def_stmt): Add GIMPLE_ASM
5333 * analyzer.h (class asm_output_svalue): New forward decl.
5334 (class reachable_regions): New forward decl.
5335 * complexity.cc (complexity::from_vec_svalue): New.
5336 * complexity.h (complexity::from_vec_svalue): New decl.
5337 * engine.cc (feasibility_state::maybe_update_for_edge): Handle
5338 asm stmts by calling on_asm_stmt.
5339 * region-model-asm.cc: New file.
5340 * region-model-manager.cc
5341 (region_model_manager::maybe_fold_asm_output_svalue): New.
5342 (region_model_manager::get_or_create_asm_output_svalue): New.
5343 (region_model_manager::log_stats): Log m_asm_output_values_map.
5344 * region-model.cc (region_model::on_stmt_pre): Handle GIMPLE_ASM.
5345 * region-model.h (visitor::visit_asm_output_svalue): New.
5346 (region_model_manager::get_or_create_asm_output_svalue): New decl.
5347 (region_model_manager::maybe_fold_asm_output_svalue): New decl.
5348 (region_model_manager::asm_output_values_map_t): New typedef.
5349 (region_model_manager::m_asm_output_values_map): New field.
5350 (region_model::on_asm_stmt): New.
5351 * store.cc (binding_cluster::on_asm): New.
5352 * store.h (binding_cluster::on_asm): New decl.
5353 * svalue.cc (svalue::cmp_ptr): Handle SK_ASM_OUTPUT.
5354 (asm_output_svalue::dump_to_pp): New.
5355 (asm_output_svalue::dump_input): New.
5356 (asm_output_svalue::input_idx_to_asm_idx): New.
5357 (asm_output_svalue::accept): New.
5358 * svalue.h (enum svalue_kind): Add SK_ASM_OUTPUT.
5359 (svalue::dyn_cast_asm_output_svalue): New.
5360 (class asm_output_svalue): New.
5361 (is_a_helper <const asm_output_svalue *>::test): New.
5362 (struct default_hash_traits<asm_output_svalue::key_t>): New.
5364 2021-08-03 Jakub Jelinek <jakub@redhat.com>
5367 * sm-malloc.cc (known_allocator_p): Only check DECL_FUNCTION_CODE on
5368 BUILT_IN_NORMAL builtins.
5370 2021-07-29 Ankur Saini <arsenic@sourceware.org>
5372 * call-string.cc (call_string::element_t::operator==): New operator.
5373 (call_String::element_t::operator!=): New operator.
5374 (call_string::element_t::get_caller_function): New function.
5375 (call_string::element_t::get_callee_function): New function.
5376 (call_string::call_string): Refactor to Initialise m_elements.
5377 (call_string::operator=): Refactor to work with m_elements.
5378 (call_string::operator==): Likewise.
5379 (call_string::to_json): Likewise.
5380 (call_string::hash): Refactor to hash e.m_caller.
5381 (call_string::push_call): Refactor to work with m_elements.
5382 (call_string::push_call): New overload to push call via supernodes.
5383 (call_string::pop): Refactor to work with m_elements.
5384 (call_string::calc_recursion_depth): Likewise.
5385 (call_string::cmp): Likewise.
5386 (call_string::validate): Likewise.
5387 (call_string::operator[]): Likewise.
5388 * call-string.h (class supernode): New forward decl.
5389 (struct call_string::element_t): New struct.
5390 (call_string::call_string): Refactor to initialise m_elements.
5391 (call_string::bool empty_p): Refactor to work with m_elements.
5392 (call_string::get_callee_node): New decl.
5393 (call_string::get_caller_node): New decl.
5394 (m_elements): Replaces m_return_edges.
5395 * program-point.cc (program_point::get_function_at_depth): Refactor to
5396 work with new call-string format.
5397 (program_point::validate): Likewise.
5398 (program_point::on_edge): Likewise.
5400 2021-07-28 David Malcolm <dmalcolm@redhat.com>
5402 * region-model.cc (region_model::on_call_pre): Treat
5403 IFN_UBSAN_BOUNDS, BUILT_IN_STACK_SAVE, and BUILT_IN_STACK_RESTORE
5404 as no-ops, rather than handling them as unknown functions.
5406 2021-07-28 David Malcolm <dmalcolm@redhat.com>
5408 * region-model-impl-calls.cc (region_model::impl_call_alloca):
5409 Drop redundant return value.
5410 (region_model::impl_call_builtin_expect): Likewise.
5411 (region_model::impl_call_calloc): Likewise.
5412 (region_model::impl_call_malloc): Likewise.
5413 (region_model::impl_call_memset): Likewise.
5414 (region_model::impl_call_operator_new): Likewise.
5415 (region_model::impl_call_operator_delete): Likewise.
5416 (region_model::impl_call_strlen): Likewise.
5417 * region-model.cc (region_model::on_call_pre): Fix return value of
5418 known functions that don't have unknown side-effects.
5419 * region-model.h (region_model::impl_call_alloca): Drop redundant
5421 (region_model::impl_call_builtin_expect): Likewise.
5422 (region_model::impl_call_calloc): Likewise.
5423 (region_model::impl_call_malloc): Likewise.
5424 (region_model::impl_call_memset): Likewise.
5425 (region_model::impl_call_strlen): Likewise.
5426 (region_model::impl_call_operator_new): Likewise.
5427 (region_model::impl_call_operator_delete): Likewise.
5429 2021-07-28 Siddhesh Poyarekar <siddhesh@gotplt.org>
5431 * analyzer.cc (is_named_call_p, is_std_named_call_p): Make
5432 first argument a const_tree.
5433 * analyzer.h (is_named_call_p, -s_std_named_call_p): Likewise.
5434 * sm-malloc.cc (known_allocator_p): New function.
5435 (malloc_state_machine::on_stmt): Use it.
5437 2021-07-28 Siddhesh Poyarekar <siddhesh@gotplt.org>
5440 (malloc_state_machine::get_or_create_deallocator): Recognize
5443 2021-07-26 David Malcolm <dmalcolm@redhat.com>
5445 * region-model.cc (region_model::on_call_pre): Always set conjured
5446 LHS, not just for SSA names.
5448 2021-07-23 David Malcolm <dmalcolm@redhat.com>
5450 * diagnostic-manager.cc
5451 (class auto_disable_complexity_checks): New.
5452 (epath_finder::explore_feasible_paths): Use it to disable
5453 complexity checks whilst processing the worklist.
5454 * region-model-manager.cc
5455 (region_model_manager::region_model_manager): Initialize
5457 (region_model_manager::reject_if_too_complex): Bail if
5458 m_check_complexity is false.
5460 (region_model_manager::enable_complexity_check): New.
5461 (region_model_manager::disable_complexity_check): New.
5462 (region_model_manager::m_check_complexity): New.
5464 2021-07-21 David Malcolm <dmalcolm@redhat.com>
5467 * sm-file.cc (file_leak::emit): Handle m_arg being NULL.
5468 (file_leak::describe_final_event): Handle ev.m_expr being NULL.
5470 2021-07-21 David Malcolm <dmalcolm@redhat.com>
5473 * store.cc (binding_cluster::purge_state_involving): Don't change
5474 m_map whilst iterating through it.
5476 2021-07-21 David Malcolm <dmalcolm@redhat.com>
5478 * region-model.cc (region_model::handle_phi): Add "old_state"
5480 (region_model::update_for_phis): Update so that all of the phi
5481 stmts are effectively handled simultaneously, rather than in
5483 * region-model.h (region_model::handle_phi): Add "old_state"
5485 * state-purge.cc (self_referential_phi_p): Replace with...
5486 (name_used_by_phis_p): ...this new function.
5487 (state_purge_per_ssa_name::process_point): Update to use the
5488 above, so that all phi stmts at a basic block are effectively
5489 considered simultaneously, and only consider the phi arguments for
5490 the pertinent in-edge.
5491 * supergraph.cc (cfg_superedge::get_phi_arg_idx): New.
5492 (cfg_superedge::get_phi_arg): Use the above.
5493 * supergraph.h (cfg_superedge::get_phi_arg_idx): New decl.
5495 2021-07-21 David Malcolm <dmalcolm@redhat.com>
5497 * state-purge.cc (state_purge_annotator::add_node_annotations):
5498 Rather than erroneously always using the NULL in-edge, determine
5499 each relevant in-edge, and print the appropriate data for each
5500 in-edge. Use print_needed to print the data as comma-separated
5502 (print_vec_of_names): Add "within_table" param and use it.
5503 (state_purge_annotator::add_stmt_annotations): Factor out
5504 collation and printing code into...
5505 (state_purge_annotator::print_needed): ...this new function.
5506 * state-purge.h (state_purge_annotator::print_needed): New decl.
5508 2021-07-21 David Malcolm <dmalcolm@redhat.com>
5510 * program-point.cc (function_point::print): Show src BB index at
5513 2021-07-21 David Malcolm <dmalcolm@redhat.com>
5515 * svalue.cc (infix_p): New.
5516 (binop_svalue::dump_to_pp): Use it to print MIN_EXPR and MAX_EXPR
5517 in prefix form, rather than infix.
5519 2021-07-19 David Malcolm <dmalcolm@redhat.com>
5522 * constraint-manager.cc (constraint_manager::add_constraint): Use
5523 can_have_associated_state_p rather than testing for unknown.
5524 (constraint_manager::get_or_add_equiv_class): Likewise.
5525 * program-state.cc (sm_state_map::set_state): Likewise.
5526 (sm_state_map::impl_set_state): Add assertion.
5527 * region-model-manager.cc
5528 (region_model_manager::maybe_fold_unaryop): Handle poisoned
5530 (region_model_manager::maybe_fold_binop): Move handling of unknown
5532 (region_model_manager::get_or_create_binop): ...to here, and
5533 generalize to use can_have_associated_state_p.
5534 (region_model_manager::maybe_fold_sub_svalue): Use
5535 can_have_associated_state_p rather than testing for unknown.
5536 (region_model_manager::maybe_fold_repeated_svalue): Use unknown
5537 when the size or repeated value is "unknown"/"poisoned".
5538 * region-model.cc (region_model::purge_state_involving): Reject
5539 attempts to purge unknown/poisoned svalues, as these svalues
5540 should not have state associated with them.
5541 * svalue.cc (sub_svalue::sub_svalue): Assert that we're building
5542 on top of an svalue with can_have_associated_state_p.
5543 (repeated_svalue::repeated_svalue): Likewise.
5544 (bits_within_svalue::bits_within_svalue): Likewise.
5545 * svalue.h (svalue::can_have_associated_state_p): New.
5546 (unknown_svalue::can_have_associated_state_p): New.
5547 (poisoned_svalue::can_have_associated_state_p): New.
5548 (unaryop_svalue::unaryop_svalue): Assert that we're building on
5549 top of an svalue with can_have_associated_state_p.
5550 (binop_svalue::binop_svalue): Likewise.
5551 (widening_svalue::widening_svalue): Likewise.
5553 2021-07-16 David Malcolm <dmalcolm@redhat.com>
5555 * analyzer.h (enum access_direction): New.
5556 * engine.cc (exploded_node::on_longjmp): Update for new param of
5558 * program-state.cc (program_state::prune_for_point): Likewise.
5559 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
5560 Replace call to check_for_writable_region with call to
5561 check_region_for_write.
5562 (region_model::impl_call_memset): Likewise.
5563 (region_model::impl_call_strcpy): Likewise.
5564 * region-model-reachability.cc (reachable_regions::add): Update
5565 for new param of get_store_value.
5566 * region-model.cc (region_model::get_rvalue_1): Likewise, also for
5567 get_rvalue_for_bits.
5568 (region_model::get_store_value): Add ctxt param and use it to call
5569 check_region_for_read.
5570 (region_model::get_rvalue_for_bits): Add ctxt param and use it to
5571 call get_store_value.
5572 (region_model::check_region_access): New.
5573 (region_model::check_region_for_write): New.
5574 (region_model::check_region_for_read): New.
5575 (region_model::set_value): Update comment. Replace call to
5576 check_for_writable_region with call to check_region_for_write.
5577 * region-model.h (region_model::get_rvalue_for_bits): Add ctxt
5579 (region_model::get_store_value): Add ctxt param.
5580 (region_model::check_region_access): New decl.
5581 (region_model::check_region_for_write): New decl.
5582 (region_model::check_region_for_read): New decl.
5583 * region.cc (region_model::copy_region): Update call to
5585 * svalue.cc (initial_svalue::implicitly_live_p): Likewise.
5587 2021-07-16 David Malcolm <dmalcolm@redhat.com>
5589 * engine.cc (exploded_node::on_stmt_pre): Handle
5590 __analyzer_dump_state.
5591 * program-state.cc (extrinsic_state::get_sm_idx_by_name): New.
5592 (program_state::impl_call_analyzer_dump_state): New.
5593 * program-state.h (extrinsic_state::get_sm_idx_by_name): New decl.
5594 (program_state::impl_call_analyzer_dump_state): New decl.
5595 * region-model-impl-calls.cc
5596 (call_details::get_arg_string_literal): New.
5597 * region-model.h (call_details::get_arg_string_literal): New decl.
5599 2021-07-16 David Malcolm <dmalcolm@redhat.com>
5601 * program-state.cc (program_state::detect_leaks): Simplify using
5602 svalue::maybe_get_region.
5603 * region-model-impl-calls.cc (region_model::impl_call_fgets): Likewise.
5604 (region_model::impl_call_fread): Likewise.
5605 (region_model::impl_call_free): Likewise.
5606 (region_model::impl_call_operator_delete): Likewise.
5607 * region-model.cc (selftest::test_stack_frames): Likewise.
5608 (selftest::test_state_merging): Likewise.
5609 * svalue.cc (svalue::maybe_get_region): New.
5610 * svalue.h (svalue::maybe_get_region): New decl.
5612 2021-07-15 David Malcolm <dmalcolm@redhat.com>
5614 * svalue.h (is_a_helper <placeholder_svalue *>::test): Make
5615 param and template param const.
5616 (is_a_helper <widening_svalue *>::test): Likewise.
5617 (is_a_helper <compound_svalue *>::test): Likewise.
5618 (is_a_helper <conjured_svalue *>::test): Likewise.
5620 2021-07-15 David Malcolm <dmalcolm@redhat.com>
5625 * analyzer.cc (maybe_reconstruct_from_def_stmt): Split out
5626 GIMPLE_ASSIGN case into...
5627 (get_diagnostic_tree_for_gassign_1): New.
5628 (get_diagnostic_tree_for_gassign): New.
5629 * analyzer.h (get_diagnostic_tree_for_gassign): New decl.
5630 * analyzer.opt (Wanalyzer-write-to-string-literal): New.
5631 * constraint-manager.cc (class svalue_purger): New.
5632 (constraint_manager::purge_state_involving): New.
5633 * constraint-manager.h
5634 (constraint_manager::purge_state_involving): New.
5635 * diagnostic-manager.cc (saved_diagnostic::supercedes_p): New.
5636 (dedupe_winners::handle_interactions): New.
5637 (diagnostic_manager::emit_saved_diagnostics): Call it.
5638 * diagnostic-manager.h (saved_diagnostic::supercedes_p): New decl.
5639 * engine.cc (impl_region_model_context::warn): Convert return type
5640 to bool. Return false if the diagnostic isn't saved.
5641 (impl_region_model_context::purge_state_involving): New.
5642 (impl_sm_context::get_state): Use NULL ctxt when querying old
5644 (impl_sm_context::set_next_state): Use new sval when querying old
5646 (class dump_path_diagnostic): Move to region-model.cc
5647 (exploded_node::on_stmt): Move to on_stmt_pre and on_stmt_post.
5648 Remove call to purge_state_involving.
5649 (exploded_node::on_stmt_pre): New, based on the above. Move most
5650 of it to region_model::on_stmt_pre.
5651 (exploded_node::on_stmt_post): Likewise, moving to
5652 region_model::on_stmt_post.
5653 (class stale_jmp_buf): Fix parent class to use curiously recurring
5655 (feasibility_state::maybe_update_for_edge): Call on_call_pre and
5656 on_call_post on gcalls.
5657 * exploded-graph.h (impl_region_model_context::warn): Return bool.
5658 (impl_region_model_context::purge_state_involving): New decl.
5659 (exploded_node::on_stmt_pre): New decl.
5660 (exploded_node::on_stmt_post): New decl.
5661 * pending-diagnostic.h (pending_diagnostic::use_of_uninit_p): New.
5662 (pending_diagnostic::supercedes_p): New.
5663 * program-state.cc (sm_state_map::get_state): Inherit state for
5664 conjured_svalue as well as initial_svalue.
5665 (sm_state_map::purge_state_involving): Also support SK_CONJURED.
5666 * region-model-impl-calls.cc (call_details::get_uncertainty):
5667 Handle m_ctxt being NULL.
5668 (call_details::get_or_create_conjured_svalue): New.
5669 (region_model::impl_call_fgets): New.
5670 (region_model::impl_call_fread): New.
5671 * region-model-manager.cc
5672 (region_model_manager::get_or_create_initial_value): Return an
5673 uninitialized poisoned value for regions that can't have initial
5675 * region-model-reachability.cc
5676 (reachable_regions::mark_escaped_clusters): Handle ctxt being
5678 * region-model.cc (region_to_value_map::purge_state_involving): New.
5679 (poisoned_value_diagnostic::use_of_uninit_p): New.
5680 (poisoned_value_diagnostic::emit): Handle POISON_KIND_UNINIT.
5681 (poisoned_value_diagnostic::describe_final_event): Likewise.
5682 (region_model::check_for_poison): New.
5683 (region_model::on_assignment): Call it.
5684 (class dump_path_diagnostic): Move here from engine.cc.
5685 (region_model::on_stmt_pre): New, based on exploded_node::on_stmt.
5686 (region_model::on_call_pre): Move the setting of the LHS to a
5687 conjured svalue to before the checks for specific functions.
5688 Handle "fgets", "fgets_unlocked", and "fread".
5689 (region_model::purge_state_involving): New.
5690 (region_model::handle_unrecognized_call): Handle ctxt being NULL.
5691 (region_model::get_rvalue): Call check_for_poison.
5692 (selftest::test_stack_frames): Use NULL for context when getting
5693 uninitialized rvalue.
5694 (selftest::test_alloca): Likewise.
5695 * region-model.h (region_to_value_map::purge_state_involving): New
5697 (call_details::get_or_create_conjured_svalue): New decl.
5698 (region_model::on_stmt_pre): New decl.
5699 (region_model::purge_state_involving): New decl.
5700 (region_model::impl_call_fgets): New decl.
5701 (region_model::impl_call_fread): New decl.
5702 (region_model::check_for_poison): New decl.
5703 (region_model_context::warn): Return bool.
5704 (region_model_context::purge_state_involving): New.
5705 (noop_region_model_context::warn): Return bool.
5706 (noop_region_model_context::purge_state_involving): New.
5707 (test_region_model_context:: warn): Return bool.
5708 * region.cc (region::get_memory_space): New.
5709 (region::can_have_initial_svalue_p): New.
5710 (region::involves_p): New.
5711 * region.h (enum memory_space): New.
5712 (region::get_memory_space): New decl.
5713 (region::can_have_initial_svalue_p): New decl.
5714 (region::involves_p): New decl.
5715 * sm-malloc.cc (use_after_free::supercedes_p): New.
5716 * store.cc (binding_cluster::purge_state_involving): New.
5717 (store::purge_state_involving): New.
5718 * store.h (class symbolic_binding): New forward decl.
5719 (binding_key::dyn_cast_symbolic_binding): New.
5720 (symbolic_binding::dyn_cast_symbolic_binding): New.
5721 (binding_cluster::purge_state_involving): New.
5722 (store::purge_state_involving): New.
5723 * svalue.cc (svalue::can_merge_p): Reject attempts to merge
5724 poisoned svalues with other svalues, so that we identify
5725 paths in which a variable is conditionally uninitialized.
5726 (involvement_visitor::visit_conjured_svalue): New.
5727 (svalue::involves_p): Also handle SK_CONJURED.
5728 (poison_kind_to_str): Handle POISON_KIND_UNINIT.
5729 (poisoned_svalue::maybe_fold_bits_within): New.
5730 * svalue.h (enum poison_kind): Add POISON_KIND_UNINIT.
5731 (poisoned_svalue::maybe_fold_bits_within): New decl.
5733 2021-07-15 David Malcolm <dmalcolm@redhat.com>
5735 * analyzer.opt (fdump-analyzer-exploded-paths): New.
5736 * diagnostic-manager.cc
5737 (diagnostic_manager::emit_saved_diagnostic): Implement it.
5738 * engine.cc (exploded_path::dump_to_pp): Add ext_state param and
5739 use it to dump states if non-NULL.
5740 (exploded_path::dump): Likewise.
5741 (exploded_path::dump_to_file): New.
5742 * exploded-graph.h (exploded_path::dump_to_pp): Add ext_state
5744 (exploded_path::dump): Likewise.
5745 (exploded_path::dump): Likewise.
5746 (exploded_path::dump_to_file): New.
5748 2021-07-15 David Malcolm <dmalcolm@redhat.com>
5750 * analyzer.cc (fixup_tree_for_diagnostic_1): Use DECL_DEBUG_EXPR
5752 * engine.cc (readability): Likewise.
5754 2021-07-15 David Malcolm <dmalcolm@redhat.com>
5756 * state-purge.cc (self_referential_phi_p): New.
5757 (state_purge_per_ssa_name::process_point): Don't purge an SSA name
5758 at its def-stmt if the def-stmt is self-referential.
5760 2021-07-07 David Malcolm <dmalcolm@redhat.com>
5762 * diagnostic-manager.cc (null_assignment_sm_context::get_state):
5764 (null_assignment_sm_context::set_next_state): New overload.
5765 (null_assignment_sm_context::get_diagnostic_tree): New.
5766 * engine.cc (impl_sm_context::get_state): New overload.
5767 (impl_sm_context::set_next_state): New overload.
5768 (impl_sm_context::get_diagnostic_tree): New overload.
5769 (impl_region_model_context::on_condition): Convert params from
5770 tree to const svalue *.
5771 * exploded-graph.h (impl_region_model_context::on_condition):
5773 * region-model.cc (region_model::on_call_pre): Move handling of
5774 internal calls to before checking for get_fndecl_for_call.
5775 (region_model::add_constraints_from_binop): New.
5776 (region_model::add_constraint): Split out into a new overload
5777 working on const svalue * rather than tree. Call
5778 add_constraints_from_binop. Drop call to
5779 add_any_constraints_from_ssa_def_stmt.
5780 (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
5781 (region_model::add_any_constraints_from_gassign): Delete.
5782 (region_model::add_any_constraints_from_gcall): Delete.
5784 (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
5785 (region_model::add_any_constraints_from_gassign): Delete.
5786 (region_model::add_any_constraints_from_gcall): Delete.
5787 (region_model::add_constraint): Add overload decl.
5788 (region_model::add_constraints_from_binop): New decl.
5789 (region_model_context::on_condition): Convert params from tree to
5791 (noop_region_model_context::on_condition): Likewise.
5792 * sm-file.cc (fileptr_state_machine::condition): Likewise.
5793 * sm-malloc.cc (malloc_state_machine::on_condition): Likewise.
5794 * sm-pattern-test.cc: Include tristate.h, selftest.h,
5795 analyzer/call-string.h, analyzer/program-point.h,
5796 analyzer/store.h, and analyzer/region-model.h.
5797 (pattern_test_state_machine::on_condition): Convert params from tree to
5799 * sm-sensitive.cc (sensitive_state_machine::on_condition): Delete.
5800 * sm-signal.cc (signal_state_machine::on_condition): Delete.
5801 * sm-taint.cc (taint_state_machine::on_condition): Convert params
5802 from tree to const svalue *.
5803 * sm.cc: Include tristate.h, selftest.h, analyzer/call-string.h,
5804 analyzer/program-point.h, analyzer/store.h, and
5805 analyzer/region-model.h.
5806 (any_pointer_p): Add overload taking const svalue *sval.
5807 * sm.h (any_pointer_p): Add overload taking const svalue *sval.
5808 (state_machine::on_condition): Convert params from tree to
5809 const svalue *. Provide no-op default implementation.
5810 (sm_context::get_state): Add overload taking const svalue *sval.
5811 (sm_context::set_next_state): Likewise.
5812 (sm_context::on_transition): Likewise.
5813 (sm_context::get_diagnostic_tree): Likewise.
5814 * svalue.cc (svalue::all_zeroes_p): New.
5815 (constant_svalue::all_zeroes_p): New.
5816 (repeated_svalue::all_zeroes_p): Convert to vfunc.
5817 * svalue.h (svalue::all_zeroes_p): New decl.
5818 (constant_svalue::all_zeroes_p): New decl.
5819 (repeated_svalue::all_zeroes_p): Convert decl to vfunc.
5821 2021-06-30 David Malcolm <dmalcolm@redhat.com>
5824 * analyzer.h (class repeated_svalue): New forward decl.
5825 (class bits_within_svalue): New forward decl.
5826 (class sized_region): New forward decl.
5827 (get_field_at_bit_offset): New forward decl.
5828 * engine.cc (exploded_graph::get_or_create_node): Validate the
5830 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
5831 Validate the states at each stage.
5832 * program-state.cc (program_state::validate): Validate
5834 * region-model-impl-calls.cc (region_model::impl_call_memset):
5835 Replace special-case logic for handling constant sizes with
5836 a call to fill_region of a sized_region with the given fill value.
5837 * region-model-manager.cc (maybe_undo_optimize_bit_field_compare):
5839 (region_model_manager::maybe_fold_sub_svalue): Fold element-based
5840 subregions of an initial value into initial values of an element.
5841 Fold subvalues of repeated svalues.
5842 (region_model_manager::maybe_fold_repeated_svalue): New.
5843 (region_model_manager::get_or_create_repeated_svalue): New.
5844 (get_bit_range_for_field): New.
5845 (get_byte_range_for_field): New.
5846 (get_field_at_byte_range): New.
5847 (region_model_manager::maybe_fold_bits_within_svalue): New.
5848 (region_model_manager::get_or_create_bits_within): New.
5849 (region_model_manager::get_sized_region): New.
5850 (region_model_manager::log_stats): Update for addition of
5851 m_repeated_values_map, m_bits_within_values_map, and
5853 * region-model.cc (region_model::validate): New.
5854 (region_model::on_assignment): Drop enum binding_kind.
5855 (region_model::get_initial_value_for_global): Likewise.
5856 (region_model::get_rvalue_for_bits): Replace body with call to
5857 get_or_create_bits_within.
5858 (region_model::get_capacity): Handle RK_SIZED.
5859 (region_model::set_value): Drop enum binding_kind.
5860 (region_model::fill_region): New.
5861 (region_model::get_representative_path_var_1): Handle RK_SIZED.
5862 * region-model.h (visitor::visit_repeated_svalue): New.
5863 (visitor::visit_bits_within_svalue): New.
5864 (region_model_manager::get_or_create_repeated_svalue): New decl.
5865 (region_model_manager::get_or_create_bits_within): New decl.
5866 (region_model_manager::get_sized_region): New decl.
5867 (region_model_manager::maybe_fold_repeated_svalue): New decl.
5868 (region_model_manager::maybe_fold_bits_within_svalue): New decl.
5869 (region_model_manager::repeated_values_map_t): New typedef.
5870 (region_model_manager::m_repeated_values_map): New field.
5871 (region_model_manager::bits_within_values_map_t): New typedef.
5872 (region_model_manager::m_bits_within_values_map): New field.
5873 (region_model_manager::m_sized_regions): New field.
5874 (region_model::fill_region): New decl.
5875 * region.cc (region::get_base_region): Handle RK_SIZED.
5876 (region::base_region_p): Likewise.
5877 (region::get_byte_size_sval): New.
5878 (get_field_at_bit_offset): Make non-static.
5879 (region::calc_offset): Move implementation of cases to
5880 get_relative_concrete_offset vfunc implementations. Handle
5882 (region::get_relative_concrete_offset): New.
5883 (decl_region::get_svalue_for_initializer): Drop enum binding_kind.
5884 (field_region::get_relative_concrete_offset): New, from
5885 region::calc_offset.
5886 (element_region::get_relative_concrete_offset): Likewise.
5887 (offset_region::get_relative_concrete_offset): Likewise.
5888 (sized_region::accept): New.
5889 (sized_region::dump_to_pp): New.
5890 (sized_region::get_byte_size): New.
5891 (sized_region::get_bit_size): New.
5892 * region.h (enum region_kind): Add RK_SIZED.
5893 (region::dyn_cast_sized_region): New.
5894 (region::get_byte_size): Make virtual.
5895 (region::get_bit_size): Likewise.
5896 (region::get_byte_size_sval): New decl.
5897 (region::get_relative_concrete_offset): New decl.
5898 (field_region::get_relative_concrete_offset): New decl.
5899 (element_region::get_relative_concrete_offset): Likewise.
5900 (offset_region::get_relative_concrete_offset): Likewise.
5901 (class sized_region): New.
5902 * store.cc (binding_kind_to_string): Delete.
5903 (binding_key::make): Drop enum binding_kind.
5904 (binding_key::dump_to_pp): Delete.
5905 (binding_key::cmp_ptrs): Drop enum binding_kind.
5906 (bit_range::contains_p): New.
5907 (byte_range::dump): New.
5908 (byte_range::contains_p): New.
5909 (byte_range::cmp): New.
5910 (concrete_binding::dump_to_pp): Drop enum binding_kind.
5911 (concrete_binding::cmp_ptr_ptr): Likewise.
5912 (symbolic_binding::dump_to_pp): Likewise.
5913 (symbolic_binding::cmp_ptr_ptr): Likewise.
5914 (binding_map::apply_ctor_val_to_range): Likewise.
5915 (binding_map::apply_ctor_pair_to_child_region): Likewise.
5916 (binding_map::get_overlapping_bindings): New.
5917 (binding_map::remove_overlapping_bindings): New.
5918 (binding_cluster::validate): New.
5919 (binding_cluster::bind): Drop enum binding_kind.
5920 (binding_cluster::bind_compound_sval): Likewise.
5921 (binding_cluster::purge_region): Likewise.
5922 (binding_cluster::zero_fill_region): Reimplement in terms of...
5923 (binding_cluster::fill_region): New.
5924 (binding_cluster::mark_region_as_unknown): Drop enum binding_kind.
5925 (binding_cluster::get_binding): Likewise.
5926 (binding_cluster::get_binding_recursive): Likewise.
5927 (binding_cluster::get_any_binding): Likewise.
5928 (binding_cluster::maybe_get_compound_binding): Reimplement.
5929 (binding_cluster::get_overlapping_bindings): Delete.
5930 (binding_cluster::remove_overlapping_bindings): Reimplement in
5931 terms of binding_map::remove_overlapping_bindings.
5932 (binding_cluster::can_merge_p): Update for removal of
5934 (binding_cluster::on_unknown_fncall): Drop enum binding_kind.
5935 (binding_cluster::maybe_get_simple_value): Likewise.
5936 (store_manager::get_concrete_binding): Likewise.
5937 (store_manager::get_symbolic_binding): Likewise.
5938 (store::validate): New.
5939 (store::set_value): Drop enum binding_kind.
5940 (store::zero_fill_region): Reimplement in terms of...
5941 (store::fill_region): New.
5942 (selftest::test_binding_key_overlap): Drop enum binding_kind.
5943 * store.h (enum binding_kind): Delete.
5944 (binding_kind_to_string): Delete decl.
5945 (binding_key::make): Drop enum binding_kind.
5946 (binding_key::dump_to_pp): Make pure virtual.
5947 (binding_key::get_kind): Delete.
5948 (binding_key::mark_deleted): Delete.
5949 (binding_key::mark_empty): Delete.
5950 (binding_key::is_deleted): Delete.
5951 (binding_key::is_empty): Delete.
5952 (binding_key::binding_key): Delete.
5953 (binding_key::impl_hash): Delete.
5954 (binding_key::impl_eq): Delete.
5955 (binding_key::m_kind): Delete.
5956 (bit_range::get_last_bit_offset): New.
5957 (bit_range::contains_p): New.
5958 (byte_range::contains_p): New.
5959 (byte_range::operator==): New.
5960 (byte_range::get_start_byte_offset): New.
5961 (byte_range::get_next_byte_offset): New.
5962 (byte_range::get_last_byte_offset): New.
5963 (byte_range::as_bit_range): New.
5964 (byte_range::cmp): New.
5965 (concrete_binding::concrete_binding): Drop enum binding_kind.
5966 (concrete_binding::hash): Likewise.
5967 (concrete_binding::operator==): Likewise.
5968 (concrete_binding::mark_deleted): New.
5969 (concrete_binding::mark_empty): New.
5970 (concrete_binding::is_deleted): New.
5971 (concrete_binding::is_empty): New.
5972 (default_hash_traits<ana::concrete_binding>::empty_zero_p): Make false.
5973 (symbolic_binding::symbolic_binding): Drop enum binding_kind.
5974 (symbolic_binding::hash): Likewise.
5975 (symbolic_binding::operator==): Likewise.
5976 (symbolic_binding::mark_deleted): New.
5977 (symbolic_binding::mark_empty): New.
5978 (symbolic_binding::is_deleted): New.
5979 (symbolic_binding::is_empty): New.
5980 (binding_map::remove_overlapping_bindings): New decl.
5981 (binding_map::get_overlapping_bindings): New decl.
5982 (binding_cluster::validate): New decl.
5983 (binding_cluster::bind): Drop enum binding_kind.
5984 (binding_cluster::fill_region): New decl.
5985 (binding_cluster::get_binding): Drop enum binding_kind.
5986 (binding_cluster::get_binding_recursive): Likewise.
5987 (binding_cluster::get_overlapping_bindings): Delete.
5988 (store::validate): New decl.
5989 (store::set_value): Drop enum binding_kind.
5990 (store::fill_region): New decl.
5991 (store_manager::get_concrete_binding): Drop enum binding_kind.
5992 (store_manager::get_symbolic_binding): Likewise.
5993 * svalue.cc (svalue::cmp_ptr): Handle SK_REPEATED and
5995 (svalue::extract_bit_range): New.
5996 (svalue::maybe_fold_bits_within): New.
5997 (constant_svalue::maybe_fold_bits_within): New.
5998 (unknown_svalue::maybe_fold_bits_within): New.
5999 (unaryop_svalue::maybe_fold_bits_within): New.
6000 (repeated_svalue::repeated_svalue): New.
6001 (repeated_svalue::dump_to_pp): New.
6002 (repeated_svalue::accept): New.
6003 (repeated_svalue::all_zeroes_p): New.
6004 (repeated_svalue::maybe_fold_bits_within): New.
6005 (bits_within_svalue::bits_within_svalue): New.
6006 (bits_within_svalue::dump_to_pp): New.
6007 (bits_within_svalue::maybe_fold_bits_within): New.
6008 (bits_within_svalue::accept): New.
6009 (bits_within_svalue::implicitly_live_p): New.
6010 (compound_svalue::maybe_fold_bits_within): New.
6011 * svalue.h (enum svalue_kind): Add SK_REPEATED and SK_BITS_WITHIN.
6012 (svalue::dyn_cast_repeated_svalue): New.
6013 (svalue::dyn_cast_bits_within_svalue): New.
6014 (svalue::extract_bit_range): New decl.
6015 (svalue::maybe_fold_bits_within): New vfunc decl.
6016 (region_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6017 (region_svalue::key_t::is_empty): Likewise.
6018 (default_hash_traits<region_svalue::key_t>::empty_zero_p): Make false.
6019 (constant_svalue::maybe_fold_bits_within): New.
6020 (unknown_svalue::maybe_fold_bits_within): New.
6021 (poisoned_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6022 (poisoned_svalue::key_t::is_empty): Likewise.
6023 (default_hash_traits<poisoned_svalue::key_t>::empty_zero_p): Make
6025 (setjmp_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6026 (setjmp_svalue::key_t::is_empty): Likewise.
6027 (default_hash_traits<setjmp_svalue::key_t>::empty_zero_p): Make
6029 (unaryop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6030 (unaryop_svalue::key_t::is_empty): Likewise.
6031 (unaryop_svalue::maybe_fold_bits_within): New.
6032 (default_hash_traits<unaryop_svalue::key_t>::empty_zero_p): Make
6034 (binop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6035 (binop_svalue::key_t::is_empty): Likewise.
6036 (default_hash_traits<binop_svalue::key_t>::empty_zero_p): Make
6038 (sub_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6039 (sub_svalue::key_t::is_empty): Likewise.
6040 (default_hash_traits<sub_svalue::key_t>::empty_zero_p): Make
6042 (class repeated_svalue): New.
6043 (is_a_helper <const repeated_svalue *>::test): New.
6044 (struct default_hash_traits<repeated_svalue::key_t>): New.
6045 (class bits_within_svalue): New.
6046 (is_a_helper <const bits_within_svalue *>::test): New.
6047 (struct default_hash_traits<bits_within_svalue::key_t>): New.
6048 (widening_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6049 (widening_svalue::key_t::is_empty): Likewise.
6050 (default_hash_traits<widening_svalue::key_t>::empty_zero_p): Make
6052 (compound_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6053 (compound_svalue::key_t::is_empty): Likewise.
6054 (compound_svalue::maybe_fold_bits_within): New.
6055 (default_hash_traits<compound_svalue::key_t>::empty_zero_p): Make
6058 2021-06-28 David Malcolm <dmalcolm@redhat.com>
6060 * analyzer.h (byte_offset_t): New typedef.
6061 * store.cc (bit_range::dump_to_pp): Dump as a byte range if
6063 (bit_range::as_byte_range): New.
6064 (byte_range::dump_to_pp): New.
6065 * store.h (class byte_range): New forward decl.
6066 (struct bit_range): Add comment.
6067 (bit_range::as_byte_range): New decl.
6068 (struct byte_range): New.
6070 2021-06-22 David Malcolm <dmalcolm@redhat.com>
6073 * region-model.cc (compat_types_p): New function.
6074 (region_model::create_region_for_heap_alloc): Convert assertion to
6076 (region_model::create_region_for_alloca): Likewise.
6078 2021-06-18 David Malcolm <dmalcolm@redhat.com>
6080 * store.cc (binding_cluster::get_any_binding): Make symbolic reads
6081 from a cluster with concrete bindings return unknown.
6083 2021-06-18 David Malcolm <dmalcolm@redhat.com>
6085 * region-model-manager.cc
6086 (region_model_manager::get_or_create_int_cst): New.
6087 (region_model_manager::maybe_undo_optimize_bit_field_compare): Use
6088 it to simplify away a local tree.
6089 * region-model.cc (region_model::on_setjmp): Likewise.
6090 (region_model::on_longjmp): Likewise.
6091 * region-model.h (region_model_manager::get_or_create_int_cst):
6093 * store.cc (binding_cluster::zero_fill_region): Use it to simplify
6096 2021-06-18 David Malcolm <dmalcolm@redhat.com>
6098 * checker-path.cc (class custom_event): Make abstract to allow for
6099 custom vfuncs, splitting existing implementation into...
6100 (class precanned_custom_event): New subclass.
6101 (custom_event::get_desc): Move to...
6102 (precanned_custom_event::get_desc): ...subclass.
6103 * checker-path.h (class custom_event): Make abstract to allow for
6104 custom vfuncs, splitting existing implementation into...
6105 (class precanned_custom_event): New subclass.
6106 * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
6107 Use precanned_custom_event.
6109 (stale_jmp_buf::maybe_add_custom_events_for_superedge): Likewise.
6110 * sm-signal.cc (signal_delivery_edge_info_t::add_events_to_path):
6113 2021-06-15 David Malcolm <dmalcolm@redhat.com>
6117 * engine.cc: Include "target.h".
6118 (impl_run_checkers): Log BITS_BIG_ENDIAN, BYTES_BIG_ENDIAN, and
6120 * region-model-manager.cc
6121 (region_model_manager::maybe_fold_binop): Move support for masking
6122 via ARG0 & CST into...
6123 (region_model_manager::maybe_undo_optimize_bit_field_compare):
6124 ...this new function. Flatten by converting from nested
6125 conditionals to a series of early return statements to reject
6126 failures. Reject if type is not unsigned_char_type_node.
6127 Handle BYTES_BIG_ENDIAN when determining which bits are bound
6130 (region_model_manager::maybe_undo_optimize_bit_field_compare):
6132 * store.cc (bit_range::dump): New function.
6133 * store.h (bit_range::dump): New decl.
6135 2021-06-15 David Malcolm <dmalcolm@redhat.com>
6137 * engine.cc (exploded_node::on_stmt): Handle __analyzer_dump_capacity.
6138 (exploded_node::on_stmt): Drop m_sm_changes from on_stmt_flags.
6139 (state_change_requires_new_enode_p): New function...
6140 (exploded_graph::process_node): Call it, rather than querying
6141 flags.m_sm_changes, so that dynamic-extent differences can also
6142 trigger the splitting of nodes.
6143 * exploded-graph.h (struct on_stmt_flags): Drop field m_sm_changes.
6144 * program-state.cc (program_state::detect_leaks): Purge dead
6145 heap-allocated regions from dynamic extents.
6146 (selftest::test_program_state_1): Fix type of "size_in_bytes".
6147 (selftest::test_program_state_merging): Likewise.
6148 * region-model-impl-calls.cc
6149 (region_model::impl_call_analyzer_dump_capacity): New.
6150 (region_model::impl_call_free): Remove dynamic extents from the
6152 * region-model-reachability.h
6153 (reachable_regions::begin_mutable_base_regs): New.
6154 (reachable_regions::end_mutable_base_regs): New.
6155 * region-model.cc: Include "tree-object-size.h".
6156 (region_model::region_model): Support new field m_dynamic_extents.
6157 (region_model::operator=): Likewise.
6158 (region_model::operator==): Likewise.
6159 (region_model::dump_to_pp): Dump sizes of dynamic regions.
6160 (region_model::handle_unrecognized_call): Purge dynamic extents
6161 from any regions that have escaped mutably:.
6162 (region_model::get_capacity): New function.
6163 (region_model::add_constraint): Unset dynamic extents when a
6164 heap-allocated region's address is NULL.
6165 (region_model::unbind_region_and_descendents): Purge dynamic
6166 extents of unbound regions.
6167 (region_model::can_merge_with_p): Call
6168 m_dynamic_extents.can_merge_with_p.
6169 (region_model::create_region_for_heap_alloc): Assert that
6170 size_in_bytes's type is compatible with size_type_node. Update
6171 for renaming of record_dynamic_extents to set_dynamic_extents.
6172 (region_model::create_region_for_alloca): Likewise.
6173 (region_model::record_dynamic_extents): Rename to...
6174 (region_model::set_dynamic_extents): ...this. Assert that
6175 size_in_bytes's type is compatible with size_type_node. Add it
6176 to the m_dynamic_extents map.
6177 (region_model::get_dynamic_extents): New.
6178 (region_model::unset_dynamic_extents): New.
6179 (selftest::test_state_merging): Fix type of "size".
6180 (selftest::test_malloc_constraints): Likewise.
6181 (selftest::test_malloc): Verify dynamic extents.
6182 (selftest::test_alloca): Likewise.
6183 * region-model.h (region_to_value_map::is_empty): New.
6184 (region_model::dynamic_extents_t): New typedef.
6185 (region_model::impl_call_analyzer_dump_capacity): New decl.
6186 (region_model::get_dynamic_extents): New function.
6187 (region_model::get_dynamic_extents): New decl.
6188 (region_model::set_dynamic_extents): New decl.
6189 (region_model::unset_dynamic_extents): New decl.
6190 (region_model::get_capacity): New decl.
6191 (region_model::record_dynamic_extents): Rename to set_dynamic_extents.
6192 (region_model::m_dynamic_extents): New field.
6194 2021-06-15 David Malcolm <dmalcolm@redhat.com>
6196 * region-model.cc (region_to_value_map::operator=): New.
6197 (region_to_value_map::operator==): New.
6198 (region_to_value_map::dump_to_pp): New.
6199 (region_to_value_map::dump): New.
6200 (region_to_value_map::can_merge_with_p): New.
6201 * region-model.h (class region_to_value_map): New class.
6203 2021-06-13 Trevor Saunders <tbsaunde@tbsaunde.org>
6205 * call-string.cc (call_string::call_string): Use range based for
6206 to iterate over vec<>.
6207 (call_string::to_json): Likewise.
6208 (call_string::hash): Likewise.
6209 (call_string::calc_recursion_depth): Likewise.
6210 * checker-path.cc (checker_path::fixup_locations): Likewise.
6211 * constraint-manager.cc (equiv_class::equiv_class): Likewise.
6212 (equiv_class::to_json): Likewise.
6213 (equiv_class::hash): Likewise.
6214 (constraint_manager::to_json): Likewise.
6215 * engine.cc (impl_region_model_context::on_svalue_leak):
6217 (on_liveness_change): Likewise.
6218 (impl_region_model_context::on_unknown_change): Likewise.
6219 * program-state.cc (sm_state_map::set_state): Likewise.
6220 * region-model.cc (test_canonicalization_4): Likewise.
6222 2021-06-11 David Malcolm <dmalcolm@redhat.com>
6224 * engine.cc (worklist::key_t::cmp): Move sort by call_string to
6227 2021-06-09 David Malcolm <dmalcolm@redhat.com>
6229 * region-model.cc (region_model::get_lvalue_1): Make const.
6230 (region_model::get_lvalue): Likewise.
6231 (region_model::get_rvalue_1): Likewise.
6232 (region_model::get_rvalue): Likewise.
6233 (region_model::deref_rvalue): Likewise.
6234 (region_model::get_rvalue_for_bits): Likewise.
6235 * region-model.h (region_model::get_lvalue): Likewise.
6236 (region_model::get_rvalue): Likewise.
6237 (region_model::deref_rvalue): Likewise.
6238 (region_model::get_rvalue_for_bits): Likewise.
6239 (region_model::get_lvalue_1): Likewise.
6240 (region_model::get_rvalue_1): Likewise.
6242 2021-06-08 David Malcolm <dmalcolm@redhat.com>
6245 * region-model-manager.cc
6246 (region_model_manager::maybe_fold_binop): Add support for folding
6247 BIT_AND_EXPR of compound_svalue and a mask constant.
6248 * region-model.cc (region_model::get_rvalue_1): Implement
6249 BIT_FIELD_REF in terms of...
6250 (region_model::get_rvalue_for_bits): New function.
6251 * region-model.h (region_model::get_rvalue_for_bits): New decl.
6252 * store.cc (bit_range::from_mask): New function.
6253 (selftest::test_bit_range_intersects_p): New selftest.
6254 (selftest::assert_bit_range_from_mask_eq): New.
6255 (ASSERT_BIT_RANGE_FROM_MASK_EQ): New macro.
6256 (selftest::assert_no_bit_range_from_mask_eq): New.
6257 (ASSERT_NO_BIT_RANGE_FROM_MASK): New macro.
6258 (selftest::test_bit_range_from_mask): New selftest.
6259 (selftest::analyzer_store_cc_tests): Call the new selftests.
6260 * store.h (bit_range::intersects_p): New.
6261 (bit_range::from_mask): New decl.
6262 (concrete_binding::get_bit_range): New accessor.
6263 (store_manager::get_concrete_binding): New overload taking
6266 2021-06-08 David Malcolm <dmalcolm@redhat.com>
6268 * analyzer.h (int_size_in_bits): New decl.
6269 * region.cc (int_size_in_bits): New function.
6270 (region::get_bit_size): Reimplement in terms of the above.
6272 2021-06-08 David Malcolm <dmalcolm@redhat.com>
6274 * store.cc (concrete_binding::dump_to_pp): Move bulk of
6275 implementation to...
6276 (bit_range::dump_to_pp): ...this new function.
6277 (bit_range::cmp): New.
6278 (concrete_binding::overlaps_p): Update for use of bit_range.
6279 (concrete_binding::cmp_ptr_ptr): Likewise.
6280 * store.h (struct bit_range): New.
6281 (class concrete_binding): Replace fields m_start_bit_offset and
6282 m_size_in_bits with new field m_bit_range.
6284 2021-06-08 David Malcolm <dmalcolm@redhat.com>
6286 * svalue.h (conjured_svalue::iterator_t): Delete.
6288 2021-06-03 David Malcolm <dmalcolm@redhat.com>
6290 * store.h (store::get_direct_binding): Remove unused decl.
6291 (store::get_default_binding): Likewise.
6293 2021-06-03 David Malcolm <dmalcolm@redhat.com>
6295 * svalue.cc (poisoned_svalue::dump_to_pp): Dump type.
6296 (compound_svalue::dump_to_pp): Dump any type.
6298 2021-05-18 David Malcolm <dmalcolm@redhat.com>
6301 * sm-malloc.cc: Include "analyzer/function-set.h".
6302 (malloc_state_machine::on_stmt): Call unaffected_by_call_p and
6303 bail on the functions it recognizes.
6304 (malloc_state_machine::unaffected_by_call_p): New.
6306 2021-05-10 Martin Liska <mliska@suse.cz>
6308 * sm-file.cc (is_file_using_fn_p): Use startswith
6309 function instead of strncmp.
6311 2021-05-10 Martin Liska <mliska@suse.cz>
6313 * program-state.cc (program_state::operator=): Remove
6314 __cplusplus >= 201103.
6315 (program_state::program_state): Likewise.
6316 * program-state.h: Likewise.
6317 * region-model.h (class region_model): Remove dead code.
6319 2021-04-24 David Malcolm <dmalcolm@redhat.com>
6322 * sm-malloc.cc (free_of_non_heap::describe_state_change):
6323 Bulletproof against change.m_expr being NULL.
6325 2021-04-13 David Malcolm <dmalcolm@redhat.com>
6328 * supergraph.cc (saved_uids::make_uid_unique): New.
6329 (saved_uids::restore_uids): New.
6330 (supergraph::supergraph): Replace assignments to stmt->uid with
6331 calls to m_stmt_uids.make_uid_unique.
6332 (supergraph::~supergraph): New.
6333 * supergraph.h (class saved_uids): New.
6334 (supergraph::~supergraph): New decl.
6335 (supergraph::m_stmt_uids): New field.
6337 2021-04-10 David Malcolm <dmalcolm@redhat.com>
6340 * region-model.cc (region_model::on_assignment): Avoid NULL
6341 dereference if ctxt is NULL when assigning from a STRING_CST.
6343 2021-04-08 David Malcolm <dmalcolm@redhat.com>
6348 (impl_region_model_context::impl_region_model_context): Add
6349 uncertainty param and use it to initialize m_uncertainty.
6350 (impl_region_model_context::get_uncertainty): New.
6351 (impl_sm_context::get_fndecl_for_call): Add NULL for new
6352 uncertainty param when constructing impl_region_model_context.
6353 (impl_sm_context::get_state): Likewise.
6354 (impl_sm_context::set_next_state): Likewise.
6355 (impl_sm_context::warn): Likewise.
6356 (exploded_node::on_stmt): Add uncertainty param
6357 and use it when constructing impl_region_model_context.
6358 (exploded_node::on_edge): Add uncertainty param and pass
6360 (exploded_node::detect_leaks): Create uncertainty_t and pass to
6361 impl_region_model_context.
6362 (exploded_graph::get_or_create_node): Create uncertainty_t and
6363 pass to prune_for_point.
6364 (maybe_process_run_of_before_supernode_enodes): Create
6365 uncertainty_t and pass to impl_region_model_context.
6366 (exploded_graph::process_node): Create uncertainty_t instances and
6367 pass around as needed.
6369 (impl_region_model_context::impl_region_model_context): Add
6371 (impl_region_model_context::get_uncertainty): New decl.
6372 (impl_region_model_context::m_uncertainty): New field.
6373 (exploded_node::on_stmt): Add uncertainty param.
6374 (exploded_node::on_edge): Likewise.
6375 * program-state.cc (sm_state_map::on_liveness_change): Get
6376 uncertainty from context and use it to unset sm-state from
6377 svalues as appropriate.
6378 (program_state::on_edge): Add uncertainty param and use it when
6379 constructing impl_region_model_context. Fix indentation.
6380 (program_state::prune_for_point): Add uncertainty param and use it
6381 when constructing impl_region_model_context.
6382 (program_state::detect_leaks): Get any uncertainty from ctxt and
6383 use it to get maybe-live svalues for dest_state, rather than
6384 definitely-live ones; use this when determining which svalues
6386 (selftest::test_program_state_merging): Create uncertainty_t and
6387 pass to impl_region_model_context.
6388 * program-state.h (program_state::on_edge): Add uncertainty param.
6389 (program_state::prune_for_point): Likewise.
6390 * region-model-impl-calls.cc (call_details::get_uncertainty): New.
6391 (region_model::impl_call_memcpy): Pass uncertainty to
6392 mark_region_as_unknown call.
6393 (region_model::impl_call_memset): Likewise.
6394 (region_model::impl_call_strcpy): Likewise.
6395 * region-model-reachability.cc (reachable_regions::handle_sval):
6396 Also add sval to m_mutable_svals.
6397 * region-model.cc (region_model::on_assignment): Pass any
6398 uncertainty from ctxt to the store::set_value call.
6399 (region_model::handle_unrecognized_call): Get any uncertainty from
6400 ctxt and use it to record mutable svalues at the unknown call.
6401 (region_model::get_reachable_svalues): Add uncertainty param and
6402 use it to mark any maybe-bound svalues as being reachable.
6403 (region_model::set_value): Pass any uncertainty from ctxt to the
6404 store::set_value call.
6405 (region_model::mark_region_as_unknown): Add uncertainty param and
6406 pass it on to the store::mark_region_as_unknown call.
6407 (region_model::update_for_call_summary): Add uncertainty param and
6408 pass it on to the region_model::mark_region_as_unknown call.
6409 * region-model.h (call_details::get_uncertainty): New decl.
6410 (region_model::get_reachable_svalues): Add uncertainty param.
6411 (region_model::mark_region_as_unknown): Add uncertainty param.
6412 (region_model_context::get_uncertainty): New vfunc.
6413 (noop_region_model_context::get_uncertainty): New vfunc
6415 * store.cc (dump_svalue_set): New.
6416 (uncertainty_t::dump_to_pp): New.
6417 (uncertainty_t::dump): New.
6418 (binding_cluster::clobber_region): Pass NULL for uncertainty to
6419 remove_overlapping_bindings.
6420 (binding_cluster::mark_region_as_unknown): Add uncertainty param
6421 and pass it to remove_overlapping_bindings.
6422 (binding_cluster::remove_overlapping_bindings): Add uncertainty param.
6423 Use it to record any svalues that were in clobbered bindings.
6424 (store::set_value): Add uncertainty param. Pass it to
6425 binding_cluster::mark_region_as_unknown when handling symbolic
6427 (store::mark_region_as_unknown): Add uncertainty param and pass it
6428 to binding_cluster::mark_region_as_unknown.
6429 (store::remove_overlapping_bindings): Add uncertainty param and
6430 pass it to binding_cluster::remove_overlapping_bindings.
6431 * store.h (binding_cluster::mark_region_as_unknown): Add
6433 (binding_cluster::remove_overlapping_bindings): Likewise.
6434 (store::set_value): Likewise.
6435 (store::mark_region_as_unknown): Likewise.
6437 2021-04-05 David Malcolm <dmalcolm@redhat.com>
6440 * analyzer.cc (maybe_reconstruct_from_def_stmt): Fix NULL
6441 dereference on calls with zero arguments.
6442 * sm-malloc.cc (malloc_state_machine::on_stmt): When handling
6443 __attribute__((nonnull)), only call get_diagnostic_tree if the
6444 result will be used.
6446 2021-04-05 David Malcolm <dmalcolm@redhat.com>
6449 * diagnostic-manager.cc
6450 (diagnostic_manager::prune_interproc_events): Use signed integers
6451 when subtracting one from path->num_events ().
6452 (diagnostic_manager::consolidate_conditions): Likewise. Convert
6453 next_idx to a signed int.
6455 2021-04-01 David Malcolm <dmalcolm@redhat.com>
6457 * diagnostic-manager.cc (diagnostic_manager::add_diagnostic): Make
6458 enode param non-constant, and call add_diagnostic on it. Add
6459 enode index to log message.
6460 (diagnostic_manager::add_diagnostic): Make enode param
6462 * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
6463 Likewise for both decls.
6465 (impl_region_model_context::impl_region_model_context): Likewise
6467 (impl_sm_context::impl_sm_context): Likewise.
6468 (impl_sm_context::m_enode_for_diag): Likewise.
6469 (exploded_node::dump_dot): Don't pass the diagnostic manager
6470 to dump_saved_diagnostics.
6471 (exploded_node::dump_saved_diagnostics): Drop param. Iterate
6472 directly through all saved diagnostics for the enode, rather
6473 than all saved diagnostics in the diagnostic_manager and
6475 (exploded_node::on_stmt): Make non-const.
6476 (exploded_node::on_edge): Likewise.
6477 (exploded_node::on_longjmp): Likewise.
6478 (exploded_node::detect_leaks): Likewise.
6479 (exploded_graph::get_or_create_node): Make enode_for_diag param
6481 (exploded_graph_annotator::print_enode): Iterate
6482 directly through all saved diagnostics for the enode, rather
6483 than all saved diagnostics in the diagnostic_manager and
6486 (impl_region_model_context::impl_region_model_context): Make
6487 enode_for_diag param non-constant.
6488 (impl_region_model_context::m_enode_for_diag): Likewise.
6489 (exploded_node::dump_saved_diagnostics): Drop param.
6490 (exploded_node::on_stmt): Make non-const.
6491 (exploded_node::on_edge): Likewise.
6492 (exploded_node::on_longjmp): Likewise.
6493 (exploded_node::detect_leaks): Likewise.
6494 (exploded_node::add_diagnostic): New.
6495 (exploded_node::get_num_diagnostics): New.
6496 (exploded_node::get_saved_diagnostic): New.
6497 (exploded_node::m_saved_diagnostics): New.
6498 (exploded_graph::get_or_create_node): Make enode_for_diag param
6500 * feasible-graph.cc (feasible_node::dump_dot): Drop
6501 diagnostic_manager from call to dump_saved_diagnostics.
6502 * program-state.cc (program_state::on_edge): Convert enode param
6503 to non-const pointer.
6504 (program_state::prune_for_point): Likewise for enode_for_diag
6506 * program-state.h (program_state::on_edge): Convert enode param
6507 to non-const pointer.
6508 (program_state::prune_for_point): Likewise for enode_for_diag
6511 2021-03-31 David Malcolm <dmalcolm@redhat.com>
6514 * analyzer.cc (maybe_reconstruct_from_def_stmt): New.
6515 (fixup_tree_for_diagnostic_1): New.
6516 (fixup_tree_for_diagnostic): New.
6517 * analyzer.h (fixup_tree_for_diagnostic): New decl.
6518 * checker-path.cc (call_event::get_desc): Call
6519 fixup_tree_for_diagnostic and use it for the call_with_state call.
6520 (warning_event::get_desc): Likewise for the final_event and
6521 make_label_text calls.
6522 * engine.cc (impl_region_model_context::on_state_leak): Likewise
6523 for the on_leak and add_diagnostic calls.
6524 * region-model.cc (region_model::get_representative_tree):
6525 Likewise for the result.
6527 2021-03-30 David Malcolm <dmalcolm@redhat.com>
6529 * region.h (region::dump_to_pp): Remove old decl.
6531 2021-03-30 David Malcolm <dmalcolm@redhat.com>
6533 * sm-file.cc (fileptr_state_machine::on_stmt): Only call
6534 get_diagnostic_tree if the result will be used.
6535 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
6536 (malloc_state_machine::on_deallocator_call): Likewise.
6537 (malloc_state_machine::on_realloc_call): Likewise.
6538 (malloc_state_machine::on_realloc_call): Likewise.
6540 (sensitive_state_machine::warn_for_any_exposure): Likewise.
6541 * sm-taint.cc (taint_state_machine::on_stmt): Likewise.
6543 2021-03-25 David Malcolm <dmalcolm@redhat.com>
6548 * engine.cc (exploded_node::on_stmt): Clear sm-state involving
6549 an SSA name at the def-stmt of that SSA name.
6550 * program-state.cc (sm_state_map::purge_state_involving): New.
6551 * program-state.h (sm_state_map::purge_state_involving): New decl.
6552 * region-model.cc (selftest::test_involves_p): New.
6553 (selftest::analyzer_region_model_cc_tests): Call it.
6554 * svalue.cc (class involvement_visitor): New class
6555 (svalue::involves_p): New.
6556 * svalue.h (svalue::involves_p): New decl.
6558 2021-03-19 David Malcolm <dmalcolm@redhat.com>
6561 * diagnostic-manager.cc (class epath_finder): Add
6562 DISABLE_COPY_AND_ASSIGN.
6564 2021-03-15 Martin Liska <mliska@suse.cz>
6566 * sm-file.cc (get_file_using_fns): Add missing comma in initializer.
6568 2021-03-11 David Malcolm <dmalcolm@redhat.com>
6571 * analyzer.opt (-param=analyzer-max-infeasible-edges=): New param.
6572 (fdump-analyzer-feasibility): New flag.
6573 * diagnostic-manager.cc: Include "analyzer/trimmed-graph.h" and
6574 "analyzer/feasible-graph.h".
6575 (epath_finder::epath_finder): Convert m_sep to a pointer and
6576 only create it if !flag_analyzer_feasibility.
6577 (epath_finder::~epath_finder): New.
6578 (epath_finder::m_sep): Convert to a pointer.
6579 (epath_finder::get_best_epath): Add param "diag_idx" and use it
6580 when logging. Rather than finding the shortest path and then
6581 checking feasibility, instead use explore_feasible_paths unless
6582 !flag_analyzer_feasibility, in which case simply use the shortest
6583 path, and note if it is infeasible. Update for m_sep becoming a
6585 (class feasible_worklist): New.
6586 (epath_finder::explore_feasible_paths): New.
6587 (epath_finder::process_worklist_item): New.
6588 (class dump_eg_with_shortest_path): New.
6589 (epath_finder::dump_trimmed_graph): New.
6590 (epath_finder::dump_feasible_graph): New.
6591 (saved_diagnostic::saved_diagnostic): Add "idx" param, using it
6593 (saved_diagnostic::to_json): Dump m_idx.
6594 (saved_diagnostic::calc_best_epath): Pass m_idx to get_best_epath.
6595 Remove assertion that m_problem was set when m_best_epath is NULL.
6596 (diagnostic_manager::add_diagnostic): Pass an index when created
6597 saved_diagnostic instances.
6598 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add
6600 (saved_diagnostic::get_index): New accessor.
6601 (saved_diagnostic::m_idx): New field.
6602 * engine.cc (exploded_node::dump_dot): Call args.dump_extra_info.
6604 (exploded_node::dump_processed_stmts): ...this new function and...
6605 (exploded_node::dump_saved_diagnostics): ...this new function.
6606 Add index of each diagnostic.
6607 (exploded_edge::dump_dot): Move bulk of code to...
6608 (exploded_edge::dump_dot_label): ...this new function.
6609 * exploded-graph.h (eg_traits::dump_args_t::dump_extra_info): New
6611 (exploded_node::dump_processed_stmts): New decl.
6612 (exploded_node::dump_saved_diagnostics): New decl.
6613 (exploded_edge::dump_dot_label): New decl.
6614 * feasible-graph.cc: New file.
6615 * feasible-graph.h: New file.
6616 * trimmed-graph.cc: New file.
6617 * trimmed-graph.h: New file.
6619 2021-03-11 David Malcolm <dmalcolm@redhat.com>
6621 * diagnostic-manager.cc (epath_finder::epath_finder):
6622 Update shortest_paths init for new param.
6624 2021-03-10 David Malcolm <dmalcolm@redhat.com>
6627 * engine.cc (exploded_path::feasible_p): Move "snodes_visited" and
6628 "model" locals into a new class feasibility_state. Move heart
6629 of per-edge processing into
6630 feasibility_state::maybe_update_for_edge.
6631 (feasibility_state::feasibility_state): New.
6632 (feasibility_state::maybe_update_for_edge): New, based on loop
6633 body in exploded_path::feasible_p.
6634 * exploded-graph.h (class feasibility_state): New.
6636 2021-03-10 David Malcolm <dmalcolm@redhat.com>
6639 (callgraph_superedge::dyn_cast_callgraph_superedge): New.
6640 (call_superedge::dyn_cast_callgraph_superedge): Delete.
6641 (return_superedge::dyn_cast_callgraph_superedge): Delete.
6643 2021-03-02 Martin Liska <mliska@suse.cz>
6645 * diagnostic-manager.cc (diagnostic_manager::emit_saved_diagnostics):
6648 2021-02-26 David Malcolm <dmalcolm@redhat.com>
6650 * engine.cc (exploded_path::exploded_path): New copy-ctor.
6651 * exploded-graph.h (exploded_path::operator=): Drop decl.
6653 2021-02-26 David Malcolm <dmalcolm@redhat.com>
6656 * diagnostic-manager.cc (class epath_finder): New.
6657 (epath_finder::get_best_epath): New.
6658 (saved_diagnostic::saved_diagnostic): Update for replacement of
6659 m_state and m_epath_length with m_best_epath.
6660 (saved_diagnostic::~saved_diagnostic): Delete m_best_epath.
6661 (saved_diagnostic::to_json): Update "path_length" to be optional.
6662 (saved_diagnostic::calc_best_epath): New, based on
6663 dedupe_winners::add and parts of dedupe_key::dedupe_key.
6664 (saved_diagnostic::get_epath_length): New.
6665 (saved_diagnostic::add_duplicate): New.
6666 (dedupe_key::dedupe_key): Drop epath param. Move invocation of
6667 stmt_finder to saved_diagnostic::calc_best_epath.
6668 (class dedupe_candidate): Delete.
6669 (class dedupe_hash_map_traits): Update to use saved_diagnotic *
6670 rather than dedupe_candidate * as the value_type/compare_type.
6671 (dedupe_winners::~dedupe_winners): Don't delete the values.
6672 (dedupe_winners::add): Convert param from shortest_exploded_paths to
6673 epath_finder. Drop "eg" param. Drop dedupe_candidate, moving
6674 path generation and feasiblity checking to
6675 epath_finder::get_best_epath. Update winner-selection for move
6676 of epaths from dedupe_candidate to saved_diagnostic.
6677 (dedupe_winners::emit_best): Update for removal of class
6679 (dedupe_winners::map_t): Update to use saved_diagnotic * rather
6680 than dedupe_candidate * as the value_type/compare_type.
6681 (diagnostic_manager::emit_saved_diagnostics): Move
6682 shortest_exploded_paths instance into epath_finder and pass that
6684 (diagnostic_manager::emit_saved_diagnostic): Drop epath, stmt
6685 and num_dupes params, instead getting these from the
6686 saved_diagnostic. Use correct location in inform_n call.
6687 * diagnostic-manager.h (class epath_finder): New forward decl.
6688 (saved_diagnostic::status): Drop enum.
6689 (saved_diagnostic::set_feasible): Drop.
6690 (saved_diagnostic::set_infeasible): Drop.
6691 (saved_diagnostic::get_status): Drop.
6692 (saved_diagnostic::calc_best_epath): New decl.
6693 (saved_diagnostic::get_best_epath): New decl.
6694 (saved_diagnostic::get_epath_length): New decl.
6695 (saved_diagnostic::set_epath_length): Drop.
6696 (saved_diagnostic::get_epath_length): Drop inline implementation.
6697 (saved_diagnostic::add_duplicate): New.
6698 (saved_diagnostic::get_num_dupes): New.
6699 (saved_diagnostic::m_d): Document ownership.
6700 (saved_diagnostic::m_trailing_eedge): Make const.
6701 (saved_diagnostic::m_status): Drop field.
6702 (saved_diagnostic::m_epath_length): Drop field.
6703 (saved_diagnostic::m_best_epath): New field.
6704 (saved_diagnostic::m_problem): Document ownership.
6705 (saved_diagnostic::m_duplicates): New field.
6706 (diagnostic_manager::emit_saved_diagnostic): Drop params epath,
6707 stmt, and num_dupes.
6708 * engine.cc (exploded_graph_annotator::print_saved_diagnostic):
6709 Update for changes to saved_diagnostic class.
6710 * exploded-graph.h (exploded_path::feasible_p): Drop unused
6713 2021-02-25 David Malcolm <dmalcolm@redhat.com>
6716 * region-model-impl-calls.cc (region_model::impl_call_realloc): New.
6717 * region-model.cc (region_model::on_call_pre): Call it.
6718 * region-model.h (region_model::impl_call_realloc): New decl.
6719 * sm-malloc.cc (enum wording): Add WORDING_REALLOCATED.
6720 (malloc_state_machine::m_realloc): New field.
6721 (use_after_free::describe_state_change): Add case for
6722 WORDING_REALLOCATED.
6723 (use_after_free::describe_final_event): Likewise.
6724 (malloc_state_machine::malloc_state_machine): Initialize
6726 (malloc_state_machine::on_stmt): Handle realloc by calling...
6727 (malloc_state_machine::on_realloc_call): New.
6729 2021-02-22 David Malcolm <dmalcolm@redhat.com>
6732 * engine.cc (exploded_node::on_stmt): Provide terminate_path
6733 flag as a way for on_call_pre to terminate the current analysis
6735 * region-model-impl-calls.cc (call_details::num_args): New.
6736 (region_model::impl_call_error): New.
6737 * region-model.cc (region_model::on_call_pre): Add param
6738 "out_terminate_path". Handle "error" and "error_at_line".
6739 * region-model.h (call_details::num_args): New decl.
6740 (region_model::on_call_pre): Add param "out_terminate_path".
6741 (region_model::impl_call_error): New decl.
6743 2021-02-17 David Malcolm <dmalcolm@redhat.com>
6746 * constraint-manager.cc (dead_svalue_purger::should_purge_p):
6747 Update for change to svalue::live_p.
6748 * program-state.cc (sm_state_map::on_liveness_change): Likewise.
6749 (program_state::detect_leaks): Likewise.
6750 * region-model-reachability.cc (reachable_regions::init_cluster):
6751 When dealing with a symbolic region, if the underlying pointer is
6752 implicitly live, add the region to the reachable regions.
6753 * region-model.cc (region_model::compare_initial_and_pointer):
6754 Move logic for detecting initial values of params to
6755 initial_svalue::initial_value_of_param_p.
6756 * svalue.cc (svalue::live_p): Convert "live_svalues" from a
6757 reference to a pointer; support it being NULL.
6758 (svalue::implicitly_live_p): Convert first param from a
6759 refererence to a pointer.
6760 (region_svalue::implicitly_live_p): Likewise.
6761 (constant_svalue::implicitly_live_p): Likewise.
6762 (initial_svalue::implicitly_live_p): Likewise. Treat the initial
6763 values of params for the top level frame as still live.
6764 (initial_svalue::initial_value_of_param_p): New function, taken
6765 from a test in region_model::compare_initial_and_pointer.
6766 (unaryop_svalue::implicitly_live_p): Convert first param from a
6767 refererence to a pointer.
6768 (binop_svalue::implicitly_live_p): Likewise.
6769 (sub_svalue::implicitly_live_p): Likewise.
6770 (unmergeable_svalue::implicitly_live_p): Likewise.
6771 * svalue.h (svalue::live_p): Likewise.
6772 (svalue::implicitly_live_p): Likewise.
6773 (region_svalue::implicitly_live_p): Likewise.
6774 (constant_svalue::implicitly_live_p): Likewise.
6775 (initial_svalue::implicitly_live_p): Likewise.
6776 (initial_svalue::initial_value_of_param_p): New decl.
6777 (unaryop_svalue::implicitly_live_p): Convert first param from a
6778 refererence to a pointer.
6779 (binop_svalue::implicitly_live_p): Likewise.
6780 (sub_svalue::implicitly_live_p): Likewise.
6781 (unmergeable_svalue::implicitly_live_p): Likewise.
6783 2021-02-12 David Malcolm <dmalcolm@redhat.com>
6786 * engine.cc (readability): Add names for the various arbitrary
6787 values. Handle NOP_EXPR and INTEGER_CST.
6788 (readability_comparator): Combine the readability tests for
6789 tree and stack depth, rather than performing them sequentially.
6790 (impl_region_model_context::on_state_leak): Strip off top-level
6792 * region-model.cc (region_model::get_representative_path_var): Add
6793 type-checking, moving the bulk of the implementation to...
6794 (region_model::get_representative_path_var_1): ...here. Respect
6795 types in casts by recursing and re-adding the cast, rather than
6796 merely stripping them off. Use the correct type when handling
6798 (region_model::get_representative_tree): Strip off any top-level
6800 (region_model::get_representative_path_var): Add type-checking,
6801 moving the bulk of the implementation to...
6802 (region_model::get_representative_path_var_1): ...here.
6803 * region-model.h (region_model::get_representative_path_var_1):
6805 (region_model::get_representative_path_var_1): New decl.
6806 * store.cc (append_pathvar_with_type): New.
6807 (binding_cluster::get_representative_path_vars): Cast path_vars
6808 to the correct type when adding them to *OUT_PVS.
6810 2021-02-09 David Malcolm <dmalcolm@redhat.com>
6813 * sm-file.cc (is_file_using_fn_p): Support "_IO_"-prefixed
6816 2021-02-09 David Malcolm <dmalcolm@redhat.com>
6819 * store.cc (store::set_value): Treat a pointer written to *UNKNOWN
6822 2021-02-02 David Malcolm <dmalcolm@redhat.com>
6826 * engine.cc (toplevel_function_p): Simplify so that
6827 we only reject functions with a "__analyzer_" prefix.
6828 (add_any_callbacks): Delete.
6829 (exploded_graph::build_initial_worklist): Update for
6830 dropped param of toplevel_function_p.
6831 (exploded_graph::build_initial_worklist): Don't bother
6832 looking for callbacks that are reachable from global
6835 2021-02-01 David Malcolm <dmalcolm@redhat.com>
6838 * region-model-manager.cc
6839 (region_model_manager::get_or_create_initial_value):
6840 Fold the initial value of *UNKNOWN_PTR to an UNKNOWN value.
6841 (region_model_manager::get_field_region): Fold the value
6842 of UNKNOWN_PTR->FIELD to *UNKNOWN_PTR_OF_&FIELD_TYPE.
6844 2021-01-29 David Malcolm <dmalcolm@redhat.com>
6846 * checker-path.cc (event_kind_to_string): Handle
6847 EK_START_CONSOLIDATED_CFG_EDGES and
6848 EK_END_CONSOLIDATED_CFG_EDGES.
6849 (start_consolidated_cfg_edges_event::get_desc): New.
6850 (checker_path::cfg_edge_pair_at_p): New.
6851 * checker-path.h (enum event_kind): Add
6852 EK_START_CONSOLIDATED_CFG_EDGES and
6853 EK_END_CONSOLIDATED_CFG_EDGES.
6854 (class start_consolidated_cfg_edges_event): New class.
6855 (class end_consolidated_cfg_edges_event): New class.
6856 (checker_path::delete_events): New.
6857 (checker_path::replace_event): New.
6858 (checker_path::cfg_edge_pair_at_p): New decl.
6859 * diagnostic-manager.cc (diagnostic_manager::prune_path): Call
6860 consolidate_conditions.
6861 (same_line_as_p): New.
6862 (diagnostic_manager::consolidate_conditions): New.
6863 * diagnostic-manager.h
6864 (diagnostic_manager::consolidate_conditions): New decl.
6866 2021-01-18 David Malcolm <dmalcolm@redhat.com>
6868 * analyzer.h (is_std_named_call_p): New decl.
6869 * diagnostic-manager.cc (path_builder::get_sm): New.
6870 (state_change_event_creator::state_change_event_creator): Add "pb"
6872 (state_change_event_creator::on_global_state_change): Don't consider
6873 state changes affecting other state_machines.
6874 (state_change_event_creator::on_state_change): Likewise.
6875 (state_change_event_creator::m_pb): New field.
6876 (diagnostic_manager::add_events_for_eedge): Pass pb to visitor
6878 * region-model-impl-calls.cc
6879 (region_model::impl_deallocation_call): New.
6880 * region-model.cc: Include "attribs.h".
6881 (region_model::on_call_post): Handle fndecls referenced by
6882 __attribute__((deallocated_by(FOO))).
6883 * region-model.h (region_model::impl_deallocation_call): New decl.
6884 * sm-malloc.cc: Include "stringpool.h" and "attribs.h". Add
6886 (class api): Delete.
6887 (enum resource_state): Update comment for change from api to
6888 deallocator and deallocator_set.
6889 (allocation_state::allocation_state): Drop api param. Add
6890 "deallocators" and "deallocator".
6891 (allocation_state::m_api): Drop field in favor of...
6892 (allocation_state::m_deallocators): New field.
6893 (allocation_state::m_deallocator): New field.
6894 (enum wording): Add WORDING_DEALLOCATED.
6895 (struct deallocator): New.
6896 (struct standard_deallocator): New.
6897 (struct custom_deallocator): New.
6898 (struct deallocator_set): New.
6899 (struct custom_deallocator_set): New.
6900 (struct standard_deallocator_set): New.
6901 (struct deallocator_set_map_traits): New.
6902 (malloc_state_machine::m_malloc): Drop field
6903 (malloc_state_machine::m_scalar_new): Likewise.
6904 (malloc_state_machine::m_vector_new): Likewise.
6905 (malloc_state_machine::m_free): New field
6906 (malloc_state_machine::m_scalar_delete): Likewise.
6907 (malloc_state_machine::m_vector_delete): Likewise.
6908 (malloc_state_machine::deallocator_map_t): New typedef.
6909 (malloc_state_machine::m_deallocator_map): New field.
6910 (malloc_state_machine::deallocator_set_cache_t): New typedef.
6911 (malloc_state_machine::m_custom_deallocator_set_cache): New field.
6912 (malloc_state_machine::custom_deallocator_set_map_t): New typedef.
6913 (malloc_state_machine::m_custom_deallocator_set_map): New field.
6914 (malloc_state_machine::m_dynamic_sets): New field.
6915 (malloc_state_machine::m_dynamic_deallocators): New field.
6917 (deallocator::deallocator): New ctor.
6918 (deallocator::hash): New.
6919 (deallocator::dump_to_pp): New.
6920 (deallocator::cmp): New.
6921 (deallocator::cmp_ptr_ptr): New.
6922 (standard_deallocator::standard_deallocator): New ctor.
6923 (deallocator_set::deallocator_set): New ctor.
6924 (deallocator_set::dump): New.
6925 (custom_deallocator_set::custom_deallocator_set): New ctor.
6926 (custom_deallocator_set::contains_p): New.
6927 (custom_deallocator_set::maybe_get_single): New.
6928 (custom_deallocator_set::dump_to_pp): New.
6929 (standard_deallocator_set::standard_deallocator_set): New ctor.
6930 (standard_deallocator_set::contains_p): New.
6931 (standard_deallocator_set::maybe_get_single): New.
6932 (standard_deallocator_set::dump_to_pp): New.
6934 (class mismatching_deallocation): Update for conversion from api
6935 to deallocator_set and deallocator.
6936 (double_free::emit): Use %qs.
6937 (class use_after_free): Update for conversion from api to
6938 deallocator_set and deallocator.
6939 (malloc_leak::describe_state_change): Only emit "allocated here" on
6940 a start->nonnull transition, rather than on other transitions to
6942 (allocation_state::dump_to_pp): Update for conversion from api to
6944 (allocation_state::get_nonnull): Likewise.
6945 (malloc_state_machine::malloc_state_machine): Likewise.
6946 (malloc_state_machine::~malloc_state_machine): New.
6947 (malloc_state_machine::add_state): Update for conversion from api
6949 (malloc_state_machine::get_or_create_custom_deallocator_set): New.
6950 (malloc_state_machine::maybe_create_custom_deallocator_set): New.
6951 (malloc_state_machine::get_or_create_deallocator): New.
6952 (malloc_state_machine::on_stmt): Update for conversion from api
6953 to deallocator_set. Handle "__attribute__((malloc(FOO)))", and
6954 the special attribute set on FOO.
6955 (malloc_state_machine::on_allocator_call): Update for conversion
6956 from api to deallocator_set. Add "returns_nonnull" param and use
6957 it to affect which state to transition to.
6958 (malloc_state_machine::on_deallocator_call): Update for conversion
6959 from api to deallocator_set.
6961 2021-01-14 David Malcolm <dmalcolm@redhat.com>
6963 * engine.cc (strongly_connected_components::to_json): New.
6964 (worklist::to_json): New.
6965 (exploded_graph::to_json): JSON-ify the worklist.
6966 * exploded-graph.h (strongly_connected_components::to_json): New
6968 (worklist::to_json): New decl.
6969 * store.cc (store::to_json): Fix comment.
6970 * supergraph.cc (supernode::to_json): Fix reference to
6971 "returning_call" in comment. Add optional "fun" to JSON.
6972 (edge_kind_to_string): New.
6973 (superedge::to_json): Add "kind" to JSON.
6975 2021-01-14 David Malcolm <dmalcolm@redhat.com>
6978 * analyzer.h (region_offset::operator==): Make const.
6979 * pending-diagnostic.h (pending_diagnostic::equal_p): Likewise.
6980 * store.h (binding_cluster::for_each_value): Likewise.
6981 (binding_cluster::for_each_binding): Likewise.
6983 2021-01-12 David Malcolm <dmalcolm@redhat.com>
6986 * store.cc (binding_cluster::make_unknown_relative_to): Don't mark
6987 dereferenced unknown pointers as having escaped.
6989 2021-01-07 David Malcolm <dmalcolm@redhat.com>
6992 * region.cc (decl_region::get_svalue_for_initializer): Gracefully
6993 handle when LTO writes out DECL_INITIAL as error_mark_node.
6995 2021-01-07 David Malcolm <dmalcolm@redhat.com>
6998 * store.cc (binding_cluster::can_merge_p): Add "out_store" param
6999 and pass to calls to binding_cluster::make_unknown_relative_to.
7000 (binding_cluster::make_unknown_relative_to): Add "out_store"
7001 param. Use it to mark base regions that are pointed to by
7002 pointers that become unknown as having escaped.
7003 (store::can_merge_p): Pass out_store to
7004 binding_cluster::can_merge_p.
7005 * store.h (binding_cluster::can_merge_p): Add "out_store" param.
7006 (binding_cluster::make_unknown_relative_to): Likewise.
7007 * svalue.cc (region_svalue::implicitly_live_p): New vfunc.
7008 * svalue.h (region_svalue::implicitly_live_p): New vfunc decl.
7010 2021-01-07 David Malcolm <dmalcolm@redhat.com>
7013 * engine.cc (exploded_path::feasible_p): Add missing call to
7016 2021-01-06 David Malcolm <dmalcolm@redhat.com>
7019 * region-model-reachability.cc (reachable_regions::init_cluster):
7020 Convert symbolic region handling to a switch statement. Add cases
7021 to handle SK_UNKNOWN and SK_CONJURED.
7023 2021-01-05 David Malcolm <dmalcolm@redhat.com>
7026 * store.cc (binding_map::apply_ctor_to_region): When "index" is
7027 NULL, iterate through the fields for RECORD_TYPEs, rather than
7028 creating an INTEGER_CST index.
7030 2020-11-30 David Malcolm <dmalcolm@redhat.com>
7032 * analyzer-pass.cc: Include "analyzer/analyzer.h" for the
7033 declaration of sorry_no_analyzer; include "tree.h" and
7034 "function.h" as these are needed by it.
7036 2020-11-30 David Malcolm <dmalcolm@redhat.com>
7038 * analyzer-pass.cc (pass_analyzer::execute): Move sorry call to...
7039 (sorry_no_analyzer): New.
7040 * analyzer.h (class state_machine): New forward decl.
7041 (class logger): New forward decl.
7042 (class plugin_analyzer_init_iface): New.
7043 (sorry_no_analyzer): New decl.
7044 * checker-path.cc (checker_path::fixup_locations): New.
7045 * checker-path.h (checker_event::set_location): New.
7046 (checker_path::fixup_locations): New decl.
7047 * diagnostic-manager.cc
7048 (diagnostic_manager::emit_saved_diagnostic): Call
7049 checker_path::fixup_locations, and call fixup_location
7050 on the primary location.
7051 * engine.cc: Include "plugin.h".
7052 (class plugin_analyzer_init_impl): New.
7053 (impl_run_checkers): Invoke PLUGIN_ANALYZER_INIT callbacks.
7054 * pending-diagnostic.h (pending_diagnostic::fixup_location): New
7057 2020-11-18 David Malcolm <dmalcolm@redhat.com>
7060 * sm-malloc.cc (null_deref::emit): Use CWE-476 rather than
7061 CWE-690, as this isn't due to an unchecked return value.
7062 (null_arg::emit): Likewise.
7064 2020-11-12 David Malcolm <dmalcolm@redhat.com>
7066 * checker-path.h (checker_event::get_id_ptr): New.
7067 * diagnostic-manager.cc (path_builder::path_builder): Add "sd"
7068 param and use it to initialize new field "m_sd".
7069 (path_builder::get_pending_diagnostic): New.
7070 (path_builder::m_sd): New field.
7071 (diagnostic_manager::emit_saved_diagnostic): Pass sd to
7073 (diagnostic_manager::add_events_for_superedge): Call new
7074 maybe_add_custom_events_for_superedge vfunc.
7075 * engine.cc (stale_jmp_buf::stale_jmp_buf): Add "setjmp_point"
7076 param and use it to initialize new field "m_setjmp_point".
7077 Initialize new field "m_stack_pop_event".
7078 (stale_jmp_buf::maybe_add_custom_events_for_superedge): New vfunc
7080 (stale_jmp_buf::describe_final_event): New vfunc implementation.
7081 (stale_jmp_buf::m_setjmp_point): New field.
7082 (stale_jmp_buf::m_stack_pop_event): New field.
7083 (exploded_node::on_longjmp): Pass setjmp_point to stale_jmp_buf
7085 * pending-diagnostic.h
7086 (pending_diagnostic::maybe_add_custom_events_for_superedge): New
7089 2020-11-12 David Malcolm <dmalcolm@redhat.com>
7091 PR tree-optimization/97424
7092 * analyzer.opt (Wanalyzer-shift-count-negative): New.
7093 (Wanalyzer-shift-count-overflow): New.
7094 * region-model.cc (class shift_count_negative_diagnostic): New.
7095 (class shift_count_overflow_diagnostic): New.
7096 (region_model::get_gassign_result): Complain about shift counts that
7097 are negative or are >= the operand's type's width.
7099 2020-11-10 Martin Liska <mliska@suse.cz>
7101 * constraint-manager.cc (constraint_manager::merge): Remove
7103 * constraint-manager.h: Likewise.
7104 * program-state.cc (sm_state_map::sm_state_map): Likewise.
7105 (program_state::program_state): Likewise.
7106 (test_sm_state_map): Likewise.
7107 * program-state.h: Likewise.
7108 * region-model-reachability.cc (reachable_regions::reachable_regions): Likewise.
7109 * region-model-reachability.h: Likewise.
7110 * region-model.cc (region_model::handle_unrecognized_call): Likewise.
7111 (region_model::get_reachable_svalues): Likewise.
7112 (region_model::can_merge_with_p): Likewise.
7114 2020-11-05 David Malcolm <dmalcolm@redhat.com>
7117 * svalue.cc (cmp_cst): Handle COMPLEX_CST.
7119 2020-10-29 David Malcolm <dmalcolm@redhat.com>
7121 * program-state.cc (sm_state_map::on_liveness_change): Sort the
7122 leaking svalues before calling on_state_leak.
7123 (program_state::detect_leaks): Likewise when calling
7125 * region-model-reachability.cc
7126 (reachable_regions::mark_escaped_clusters): Likewise when
7127 calling on_escaped_function.
7129 2020-10-29 David Malcolm <dmalcolm@redhat.com>
7132 * region-model-reachability.cc (reachable_regions::handle_sval):
7133 Operands of reachable reversible operations are reachable.
7135 2020-10-29 David Malcolm <dmalcolm@redhat.com>
7137 * analyzer.h (class state_machine): New forward decl.
7138 (class logger): Likewise.
7139 (class visitor): Likewise.
7140 * complexity.cc: New file, taken from svalue.cc.
7141 * complexity.h: New file, taken from region-model.h.
7142 * region-model.h: Include "analyzer/svalue.h" and
7143 "analyzer/region.h". Move struct complexity to complexity.h.
7144 Move svalue, its subclasses and supporting decls to svalue.h.
7145 Move region, its subclasses and supporting decls to region.h.
7146 * region.cc: Include "analyzer/region.h".
7147 (symbolic_region::symbolic_region): Move here from region-model.h.
7148 * region.h: New file, based on material from region-model.h.
7149 * svalue.cc: Include "analyzer/svalue.h".
7150 (complexity::complexity): Move to complexity.cc.
7151 (complexity::from_pair): Likewise.
7152 * svalue.h: New file, based on material from region-model.h.
7154 2020-10-29 David Malcolm <dmalcolm@redhat.com>
7156 * program-state.cc (sm_state_map::print): Guard the printing of
7157 the origin pointer with !flag_dump_noaddr.
7158 * region.cc (string_region::dump_to_pp): Likewise for
7161 2020-10-27 David Malcolm <dmalcolm@redhat.com>
7164 * region-model.cc (region_model::get_initial_value_for_global):
7165 Move check that !DECL_EXTERNAL from here to...
7166 * region.cc (decl_region::get_svalue_for_initializer): ...here,
7167 using it to reject zero initialization.
7169 2020-10-27 Markus Böck <markus.boeck02@gmail.com>
7172 * store.h (hash): Cast to intptr_t instead of long
7174 2020-10-27 David Malcolm <dmalcolm@redhat.com>
7176 * constraint-manager.cc (svalue_cmp_by_ptr): Delete.
7177 (equiv_class::canonicalize): Use svalue::cmp_ptr_ptr instead.
7178 (equiv_class_cmp): Eliminate pointer comparison.
7179 * diagnostic-manager.cc (dedupe_key::comparator): If they are at
7180 the same location, also compare epath ength and pending_diagnostic
7182 * engine.cc (readability_comparator): If two path_vars have the
7183 same readability, then impose an arbitrary ordering on them.
7184 (worklist::key_t::cmp): If two points have the same plan ordering,
7185 continue the comparison. Call sm_state_map::cmp rather than
7186 comparing hash values.
7187 * program-state.cc (sm_state_map::entry_t::cmp): New.
7188 (sm_state_map::cmp): New.
7189 * program-state.h (sm_state_map::entry_t::cmp): New decl.
7190 (sm_state_map::elements): New.
7191 (sm_state_map::cmp): New.
7193 2020-10-27 David Malcolm <dmalcolm@redhat.com>
7195 * engine.cc (setjmp_record::cmp): New.
7196 (supernode_cluster::dump_dot): Avoid embedding pointer in cluster
7198 (supernode_cluster::cmp_ptr_ptr): New.
7199 (function_call_string_cluster::dump_dot): Avoid embedding pointer
7200 in cluster name. Sort m_map when dumping child clusters.
7201 (function_call_string_cluster::cmp_ptr_ptr): New.
7202 (root_cluster::dump_dot): Sort m_map when dumping child clusters.
7203 * program-point.cc (function_point::cmp): New.
7204 (function_point::cmp_ptr): New.
7205 * program-point.h (function_point::cmp): New decl.
7206 (function_point::cmp_ptr): New decl.
7207 * program-state.cc (sm_state_map::print): Sort the values. Guard
7208 the printing of pointers with !flag_dump_noaddr.
7209 (program_state::prune_for_point): Sort the regions.
7210 (log_set_of_svalues): Sort the values. Guard the printing of
7211 pointers with !flag_dump_noaddr.
7212 * region-model-manager.cc (log_uniq_map): Sort the values.
7213 * region-model-reachability.cc (dump_set): New function template.
7214 (reachable_regions::dump_to_pp): Use it.
7215 * region-model.h (svalue::cmp_ptr): New decl.
7216 (svalue::cmp_ptr_ptr): New decl.
7217 (setjmp_record::cmp): New decl.
7218 (placeholder_svalue::get_name): New accessor.
7219 (widening_svalue::get_point): New accessor.
7220 (compound_svalue::get_map): New accessor.
7221 (conjured_svalue::get_stmt): New accessor.
7222 (conjured_svalue::get_id_region): New accessor.
7223 (region::cmp_ptrs): Rename to...
7224 (region::cmp_ptr_ptr): ...this.
7225 * region.cc (region::cmp_ptrs): Rename to...
7226 (region::cmp_ptr_ptr): ...this.
7228 (state_purge_per_ssa_name::state_purge_per_ssa_name): Sort
7229 m_points_needing_name when dumping.
7230 * store.cc (concrete_binding::cmp_ptr_ptr): New.
7231 (symbolic_binding::cmp_ptr_ptr): New.
7232 (binding_map::cmp): New.
7233 (get_sorted_parent_regions): Update for renaming of
7234 region::cmp_ptrs to region::cmp_ptr_ptr.
7235 (store::dump_to_pp): Likewise.
7236 (store::to_json): Likewise.
7237 (store::can_merge_p): Sort the base regions before considering
7239 * store.h (concrete_binding::cmp_ptr_ptr): New decl.
7240 (symbolic_binding::cmp_ptr_ptr): New decl.
7241 (binding_map::cmp): New decl.
7242 * supergraph.cc (supergraph::supergraph): Assign UIDs to the
7244 * svalue.cc (cmp_cst): New.
7245 (svalue::cmp_ptr): New.
7246 (svalue::cmp_ptr_ptr): New.
7248 2020-10-27 David Malcolm <dmalcolm@redhat.com>
7250 * engine.cc (exploded_graph::get_or_create_node): Fix off-by-one
7251 when imposing param_analyzer_max_enodes_per_program_point limit.
7253 2020-10-27 David Malcolm <dmalcolm@redhat.com>
7255 * region-model.cc (region_model::get_representative_path_var):
7256 Implement case RK_LABEL.
7257 * region-model.h (label_region::get_label): New accessor.
7259 2020-10-22 David Malcolm <dmalcolm@redhat.com>
7262 * engine.cc (exploded_graph::add_function_entry): Handle failure
7263 to create an enode, rather than asserting.
7265 2020-10-22 David Malcolm <dmalcolm@redhat.com>
7268 * engine.cc (exploded_graph::add_function_entry): Assert that we
7269 have a function body.
7270 (exploded_graph::on_escaped_function): Reject fndecls that don't
7271 have a function body.
7273 2020-10-14 David Malcolm <dmalcolm@redhat.com>
7276 * region-model.cc (region_model::get_initial_value_for_global):
7277 Fall back to returning an initial_svalue if
7278 decl_region::get_svalue_for_initializer fails.
7279 * region.cc (decl_region::get_svalue_for_initializer): Don't
7280 attempt to create a compound_svalue if the region has an unknown
7283 2020-10-14 David Malcolm <dmalcolm@redhat.com>
7286 * store.cc (binding_map::apply_ctor_to_region): Remove redundant
7289 2020-10-12 David Malcolm <dmalcolm@redhat.com>
7292 * engine.cc (impl_region_model_context::on_escaped_function): New
7294 (exploded_graph::add_function_entry): Use m_functions_with_enodes
7295 to implement idempotency.
7296 (add_any_callbacks): New.
7297 (exploded_graph::build_initial_worklist): Use the above to find
7298 callbacks that are reachable from global initializers.
7299 (exploded_graph::on_escaped_function): New.
7301 (impl_region_model_context::on_escaped_function): New decl.
7302 (exploded_graph::on_escaped_function): New decl.
7303 (exploded_graph::m_functions_with_enodes): New field.
7304 * region-model-reachability.cc
7305 (reachable_regions::reachable_regions): Replace "store" param with
7306 "model" param; use it to initialize m_model.
7307 (reachable_regions::add): When getting the svalue for the region,
7308 call get_store_value on the model rather than using an initial
7310 (reachable_regions::mark_escaped_clusters): Add ctxt param and
7311 use it to call on_escaped_function when a function_region escapes.
7312 * region-model-reachability.h
7313 (reachable_regions::reachable_regions): Replace "store" param with
7315 (reachable_regions::mark_escaped_clusters): Add ctxt param.
7316 (reachable_regions::m_model): New field.
7317 * region-model.cc (region_model::handle_unrecognized_call): Update
7318 for change in reachable_regions ctor.
7319 (region_model::handle_unrecognized_call): Pass ctxt to
7320 mark_escaped_clusters.
7321 (region_model::get_reachable_svalues): Update for change in
7322 reachable_regions ctor.
7323 (region_model::get_initial_value_for_global): Read-only variables
7324 keep their initial values.
7325 * region-model.h (region_model_context::on_escaped_function): New
7327 (noop_region_model_context::on_escaped_function): New.
7329 2020-10-12 David Malcolm <dmalcolm@redhat.com>
7331 * analyzer.opt (Wanalyzer-write-to-const): New.
7332 (Wanalyzer-write-to-string-literal): New.
7333 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
7334 Call check_for_writable_region.
7335 (region_model::impl_call_memset): Likewise.
7336 (region_model::impl_call_strcpy): Likewise.
7337 * region-model.cc (class write_to_const_diagnostic): New.
7338 (class write_to_string_literal_diagnostic): New.
7339 (region_model::check_for_writable_region): New.
7340 (region_model::set_value): Call check_for_writable_region.
7341 * region-model.h (region_model::check_for_writable_region): New
7344 2020-10-07 David Malcolm <dmalcolm@redhat.com>
7347 * sm-malloc.cc (method_p): New.
7348 (describe_argument_index): New.
7349 (inform_nonnull_attribute): Use describe_argument_index.
7350 (possible_null_arg::describe_final_event): Likewise.
7351 (null_arg::describe_final_event): Likewise.
7353 2020-09-29 David Malcolm <dmalcolm@redhat.com>
7356 * engine.cc (stmt_requires_new_enode_p): Split enodes before
7359 2020-09-29 David Malcolm <dmalcolm@redhat.com>
7361 * constraint-manager.cc
7362 (constraint_manager::add_constraint_internal): Whitespace fixes.
7363 Silence -Wsign-compare warning.
7364 * engine.cc (maybe_process_run_of_before_supernode_enodes):
7365 Silence -Wsign-compare warning.
7367 2020-09-28 David Malcolm <dmalcolm@redhat.com>
7369 * region-model.h (binop_svalue::dyn_cast_binop_svalue): Remove
7370 redundant "virtual". Add FINAL OVERRIDE.
7371 (widening_svalue::dyn_cast_widening_svalue): Add FINAL OVERRIDE.
7372 (compound_svalue::dyn_cast_compound_svalue): Likewise.
7373 (conjured_svalue::dyn_cast_conjured_svalue): Likewise.
7375 2020-09-28 David Malcolm <dmalcolm@redhat.com>
7377 * diagnostic-manager.cc (null_assignment_sm_context::m_visitor):
7378 Remove unused field.
7380 2020-09-28 David Malcolm <dmalcolm@redhat.com>
7383 * analyzer.cc (is_longjmp_call_p): Require the initial argument
7385 * engine.cc (exploded_node::on_longjmp): Likewise.
7387 2020-09-28 David Malcolm <dmalcolm@redhat.com>
7389 * program-state.cc (sm_state_map::print): Update check
7390 for m_global_state being the start state.
7392 2020-09-26 David Malcolm <dmalcolm@redhat.com>
7396 * region-model.cc (region_model::get_representative_path_var):
7397 When handling offset_region, wrap the MEM_REF's first argument in
7398 an ADDR_EXPR of pointer type, rather than simply using the tree
7399 for the parent region. Require the MEM_REF's second argument to
7400 be an integer constant.
7402 2020-09-24 David Malcolm <dmalcolm@redhat.com>
7404 * analyzer.h (struct rejected_constraint): New decl.
7405 * analyzer.opt (fanalyzer-feasibility): New option.
7406 * diagnostic-manager.cc (path_builder::path_builder): Add
7407 "problem" param and use it to initialize new field.
7408 (path_builder::get_feasibility_problem): New accessor.
7409 (path_builder::m_feasibility_problem): New field.
7410 (dedupe_winners::add): Remove inversion of logic in "if" clause,
7411 swapping if/else suites. In the !feasible_p suite, inspect
7412 flag_analyzer_feasibility and add code to handle when this
7413 is off, accepting the infeasible path, but recording the
7414 feasibility_problem.
7415 (diagnostic_manager::emit_saved_diagnostic): Pass the
7416 feasibility_problem to the path_builder.
7417 (diagnostic_manager::add_events_for_eedge): If we have
7418 a feasibility_problem at this edge, use it to add a custom event.
7419 * engine.cc (exploded_path::feasible_p): Pass a
7420 rejected_constraint ** to model.maybe_update_for_edge and transfer
7421 ownership of any created instance to any feasibility_problem.
7422 (feasibility_problem::dump_to_pp): New.
7423 * exploded-graph.h (feasibility_problem::feasibility_problem):
7424 Drop "model" param; add rejected_constraint * param.
7425 (feasibility_problem::~feasibility_problem): New.
7426 (feasibility_problem::dump_to_pp): New decl.
7427 (feasibility_problem::m_model): Drop field.
7428 (feasibility_problem::m_rc): New field.
7429 * program-point.cc (function_point::get_location): Handle
7430 PK_BEFORE_SUPERNODE and PK_AFTER_SUPERNODE.
7431 * program-state.cc (program_state::on_edge): Pass NULL to new
7432 param of region_model::maybe_update_for_edge.
7433 * region-model.cc (region_model::add_constraint): New overload
7434 adding a rejected_constraint ** param.
7435 (region_model::maybe_update_for_edge): Add rejected_constraint **
7436 param and pass it to the various apply_constraints_for_ calls.
7437 (region_model::apply_constraints_for_gcond): Add
7438 rejected_constraint ** param and pass it to add_constraint calls.
7439 (region_model::apply_constraints_for_gswitch): Likewise.
7440 (region_model::apply_constraints_for_exception): Likewise.
7441 (rejected_constraint::dump_to_pp): New.
7442 * region-model.h (region_model::maybe_update_for_edge):
7443 Add rejected_constraint ** param.
7444 (region_model::add_constraint): New overload adding a
7445 rejected_constraint ** param.
7446 (region_model::apply_constraints_for_gcond): Add
7447 rejected_constraint ** param.
7448 (region_model::apply_constraints_for_gswitch): Likewise.
7449 (region_model::apply_constraints_for_exception): Likewise.
7450 (struct rejected_constraint): New.
7452 2020-09-23 David Malcolm <dmalcolm@redhat.com>
7455 * engine.cc (impl_run_checkers): Update for change to ext_state
7457 * program-state.cc (selftest::test_sm_state_map): Pass an engine
7458 instance to ext_state ctor.
7459 (selftest::test_program_state_1): Likewise.
7460 (selftest::test_program_state_2): Likewise.
7461 (selftest::test_program_state_merging): Likewise.
7462 (selftest::test_program_state_merging_2): Likewise.
7463 * program-state.h (extrinsic_state::extrinsic_state): Remove NULL
7464 default value for "eng" param.
7466 2020-09-23 Tobias Burnus <tobias@codesourcery.com>
7468 * analyzer-logging.cc: Guard '#pragma ... ignored "-Wformat-diag"'
7469 by '#if __GNUC__ >= 10'
7470 * analyzer.h: Likewise.
7471 * call-string.cc: Likewise.
7473 2020-09-23 David Malcolm <dmalcolm@redhat.com>
7475 * engine.cc (exploded_node::on_stmt): Replace sequence of dyn_cast
7478 2020-09-22 David Malcolm <dmalcolm@redhat.com>
7480 * analysis-plan.cc: Include "json.h".
7481 * analyzer.opt (fdump-analyzer-json): New.
7482 * call-string.cc: Include "json.h".
7483 (call_string::to_json): New.
7484 * call-string.h (call_string::to_json): New decl.
7485 * checker-path.cc: Include "json.h".
7486 * constraint-manager.cc: Include "json.h".
7487 (equiv_class::to_json): New.
7488 (constraint::to_json): New.
7489 (constraint_manager::to_json): New.
7490 * constraint-manager.h (equiv_class::to_json): New decl.
7491 (constraint::to_json): New decl.
7492 (constraint_manager::to_json): New decl.
7493 * diagnostic-manager.cc: Include "json.h".
7494 (saved_diagnostic::to_json): New.
7495 (diagnostic_manager::to_json): New.
7496 * diagnostic-manager.h (saved_diagnostic::to_json): New decl.
7497 (diagnostic_manager::to_json): New decl.
7498 * engine.cc: Include "json.h", <zlib.h>.
7499 (exploded_node::status_to_str): New.
7500 (exploded_node::to_json): New.
7501 (exploded_edge::to_json): New.
7502 (exploded_graph::to_json): New.
7503 (dump_analyzer_json): New.
7504 (impl_run_checkers): Call it.
7505 * exploded-graph.h (exploded_node::status_to_str): New decl.
7506 (exploded_node::to_json): New.
7507 (exploded_edge::to_json): New.
7508 (exploded_graph::to_json): New.
7509 * pending-diagnostic.cc: Include "json.h".
7510 * program-point.cc: Include "json.h".
7511 (program_point::to_json): New.
7512 * program-point.h (program_point::to_json): New decl.
7513 * program-state.cc: Include "json.h".
7514 (extrinsic_state::to_json): New.
7515 (sm_state_map::to_json): New.
7516 (program_state::to_json): New.
7517 * program-state.h (extrinsic_state::to_json): New decl.
7518 (sm_state_map::to_json): New decl.
7519 (program_state::to_json): New decl.
7520 * region-model-impl-calls.cc: Include "json.h".
7521 * region-model-manager.cc: Include "json.h".
7522 * region-model-reachability.cc: Include "json.h".
7523 * region-model.cc: Include "json.h".
7524 * region-model.h (svalue::to_json): New decl.
7525 (region::to_json): New decl.
7526 * region.cc: Include "json.h".
7527 (region::to_json: New.
7528 * sm-file.cc: Include "json.h".
7529 * sm-malloc.cc: Include "json.h".
7530 * sm-pattern-test.cc: Include "json.h".
7531 * sm-sensitive.cc: Include "json.h".
7532 * sm-signal.cc: Include "json.h".
7533 (signal_delivery_edge_info_t::to_json): New.
7534 * sm-taint.cc: Include "json.h".
7535 * sm.cc: Include "diagnostic.h", "tree-diagnostic.h", and
7537 (state_machine::state::to_json): New.
7538 (state_machine::to_json): New.
7539 * sm.h (state_machine::state::to_json): New.
7540 (state_machine::to_json): New.
7541 * state-purge.cc: Include "json.h".
7542 * store.cc: Include "json.h".
7543 (binding_key::get_desc): New.
7544 (binding_map::to_json): New.
7545 (binding_cluster::to_json): New.
7546 (store::to_json): New.
7547 * store.h (binding_key::get_desc): New decl.
7548 (binding_map::to_json): New decl.
7549 (binding_cluster::to_json): New decl.
7550 (store::to_json): New decl.
7551 * supergraph.cc: Include "json.h".
7552 (supergraph::to_json): New.
7553 (supernode::to_json): New.
7554 (superedge::to_json): New.
7555 * supergraph.h (supergraph::to_json): New decl.
7556 (supernode::to_json): New decl.
7557 (superedge::to_json): New decl.
7558 * svalue.cc: Include "json.h".
7559 (svalue::to_json): New.
7561 2020-09-21 David Malcolm <dmalcolm@redhat.com>
7564 * region-model-impl-calls.cc (call_details::get_arg_type): New.
7565 * region-model.cc (region_model::on_call_pre): Check that the
7566 initial arg is a pointer before calling impl_call_memset and
7568 * region-model.h (call_details::get_arg_type): New decl.
7570 2020-09-21 David Malcolm <dmalcolm@redhat.com>
7573 * sm-malloc.cc (malloc_state_machine::get_default_state): Look at
7574 the base region when considering pointers. Treat pointers to
7575 decls as being non-heap.
7577 2020-09-18 David Malcolm <dmalcolm@redhat.com>
7579 * checker-path.cc (warning_event::get_desc): Handle global state
7582 2020-09-18 David Malcolm <dmalcolm@redhat.com>
7584 * sm-malloc.cc (malloc_state_machine::on_stmt): Handle strdup and
7585 strndup as being malloc-like allocators.
7587 2020-09-16 David Malcolm <dmalcolm@redhat.com>
7589 * engine.cc (strongly_connected_components::strong_connect): Only
7590 consider intraprocedural edges when creating SCCs.
7591 (worklist::key_t::cmp): Add comment. Treat call_string
7592 differences as more important than differences of program_point
7595 2020-09-16 David Malcolm <dmalcolm@redhat.com>
7597 * engine.cc (supernode_cluster::dump_dot): Show the SCC id
7598 in the per-supernode clusters in FILENAME.eg.dot output.
7599 (exploded_graph_annotator::add_node_annotations):
7600 Show the SCC of the supernode in FILENAME.supernode.eg.dot output.
7601 * exploded-graph.h (worklist::scc_id): New.
7602 (exploded_graph::get_scc_id): New.
7604 2020-09-16 David Malcolm <dmalcolm@redhat.com>
7606 * engine.cc (exploded_node::dump_dot): Show STATUS_BULK_MERGED.
7607 (exploded_graph::process_worklist): Call
7608 maybe_process_run_of_before_supernode_enodes.
7609 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
7611 (exploded_graph_annotator::print_enode): Show STATUS_BULK_MERGED.
7612 * exploded-graph.h (enum exploded_node::status): Add
7615 2020-09-16 David Malcolm <dmalcolm@redhat.com>
7618 (exploded_graph::process_node) <case PK_BEFORE_SUPERNODE>:
7619 Simplify by using program_point::get_next.
7620 * program-point.cc (program_point::get_next): New.
7621 * program-point.h (program_point::get_next): New decl.
7623 2020-09-16 David Malcolm <dmalcolm@redhat.com>
7625 * engine.cc (exploded_graph::get_or_create_node): Show the
7626 program point when issuing -Wanalyzer-too-complex due to hitting
7627 the per-program-point limit.
7629 2020-09-16 David Malcolm <dmalcolm@redhat.com>
7631 * region-model.cc (region_model::on_call_pre): Treat getchar as
7632 having no side-effects.
7634 2020-09-15 David Malcolm <dmalcolm@redhat.com>
7637 * constraint-manager.cc (merger_fact_visitor::on_fact): Replace
7638 assertion that add_constraint succeeded with an assertion that
7639 if it fails, -fanalyzer-transitivity is off.
7641 2020-09-14 David Malcolm <dmalcolm@redhat.com>
7643 * analyzer.opt (-param=analyzer-max-constraints=): New param.
7644 * constraint-manager.cc
7645 (constraint_manager::add_constraint_internal): Silently reject
7646 attempts to add constraints when the above limit is reached.
7648 2020-09-14 David Malcolm <dmalcolm@redhat.com>
7651 * constraint-manager.cc
7652 (constraint_manager::get_or_add_equiv_class): Don't accumulate
7653 transitive closure of all constraints on constants.
7655 2020-09-14 David Malcolm <dmalcolm@redhat.com>
7658 * analyzer.cc (is_setjmp_call_p): Require the initial arg to be a
7660 * region-model.cc (region_model::deref_rvalue): Assert that the
7661 svalue is of pointer type.
7663 2020-09-11 David Malcolm <dmalcolm@redhat.com>
7666 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
7668 (region_model::impl_call_strcpy): New.
7669 * region-model.cc (region_model::on_call_pre): Flag unhandled
7670 builtins that are non-pure as having unknown side-effects.
7671 Implement BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_STRCPY,
7672 BUILT_IN_STRCPY_CHK, BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED,
7673 BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_FPUTC,
7674 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
7675 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
7676 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR,
7677 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED,
7678 BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF.
7679 * region-model.h (region_model::impl_call_memcpy): New decl.
7680 (region_model::impl_call_strcpy): New decl.
7682 2020-09-09 David Malcolm <dmalcolm@redhat.com>
7685 * analyzer.opt (Wanalyzer-mismatching-deallocation): New warning.
7686 * region-model-impl-calls.cc
7687 (region_model::impl_call_operator_new): New.
7688 (region_model::impl_call_operator_delete): New.
7689 * region-model.cc (region_model::on_call_pre): Detect operator new
7690 and operator delete.
7691 (region_model::on_call_post): Likewise.
7692 (region_model::maybe_update_for_edge): Detect EH edges and call...
7693 (region_model::apply_constraints_for_exception): New function.
7694 * region-model.h (region_model::impl_call_operator_new): New decl.
7695 (region_model::impl_call_operator_delete): New decl.
7696 (region_model::apply_constraints_for_exception): New decl.
7697 * sm-malloc.cc (enum resource_state): New.
7698 (struct allocation_state): New state subclass.
7699 (enum wording): New.
7701 (malloc_state_machine::custom_data_t): New typedef.
7702 (malloc_state_machine::add_state): New decl.
7703 (malloc_state_machine::m_unchecked)
7704 (malloc_state_machine::m_nonnull)
7705 (malloc_state_machine::m_freed): Delete these states in favor
7707 (malloc_state_machine::m_malloc)
7708 (malloc_state_machine::m_scalar_new)
7709 (malloc_state_machine::m_vector_new): ...this new api instances,
7710 which own their own versions of these states.
7711 (malloc_state_machine::on_allocator_call): New decl.
7712 (malloc_state_machine::on_deallocator_call): New decl.
7713 (api::api): New ctor.
7714 (dyn_cast_allocation_state): New.
7715 (as_a_allocation_state): New.
7720 (malloc_diagnostic::describe_state_change): Use unchecked_p and
7722 (class mismatching_deallocation): New.
7723 (double_free::double_free): Add funcname param for initializing
7725 (double_free::emit): Use m_funcname in warning message rather
7726 than hardcoding "free".
7727 (double_free::describe_state_change): Likewise. Use freed_p.
7728 (double_free::describe_call_with_state): Use freed_p.
7729 (double_free::describe_final_event): Use m_funcname in message
7730 rather than hardcoding "free".
7731 (double_free::m_funcname): New field.
7732 (possible_null::describe_state_change): Use unchecked_p.
7733 (possible_null::describe_return_of_state): Likewise.
7734 (use_after_free::use_after_free): Add param for initializing m_api.
7735 (use_after_free::emit): Use m_api->m_dealloc_funcname in message
7736 rather than hardcoding "free".
7737 (use_after_free::describe_state_change): Use freed_p. Change the
7738 wording of the message based on the API.
7739 (use_after_free::describe_final_event): Use
7740 m_api->m_dealloc_funcname in message rather than hardcoding
7741 "free". Change the wording of the message based on the API.
7742 (use_after_free::m_api): New field.
7743 (malloc_leak::describe_state_change): Use unchecked_p. Update
7744 for renaming of m_malloc_event to m_alloc_event.
7745 (malloc_leak::describe_final_event): Update for renaming of
7746 m_malloc_event to m_alloc_event.
7747 (malloc_leak::m_malloc_event): Rename...
7748 (malloc_leak::m_alloc_event): ...to this.
7749 (free_of_non_heap::free_of_non_heap): Add param for initializing
7751 (free_of_non_heap::emit): Use m_funcname in message rather than
7753 (free_of_non_heap::describe_final_event): Likewise.
7754 (free_of_non_heap::m_funcname): New field.
7755 (allocation_state::dump_to_pp): New.
7756 (allocation_state::get_nonnull): New.
7757 (malloc_state_machine::malloc_state_machine): Update for changes
7758 to state fields and new api fields.
7759 (malloc_state_machine::add_state): New.
7760 (malloc_state_machine::on_stmt): Move malloc/calloc handling to
7761 on_allocator_call and call it, passing in the API pointer.
7762 Likewise for free, moving it to on_deallocator_call. Handle calls
7763 to operator new and delete in an analogous way. Use unchecked_p
7764 when testing for possibly-null-arg and possibly-null-deref, and
7765 transition to the non-null for the correct API. Remove redundant
7766 node param from call to on_zero_assignment. Use freed_p for
7767 use-after-free check, and pass in API.
7768 (malloc_state_machine::on_allocator_call): New, based on code in
7770 (malloc_state_machine::on_deallocator_call): Likewise.
7771 (malloc_state_machine::on_phi): Mark node param with
7772 ATTRIBUTE_UNUSED; don't pass it to on_zero_assignment.
7773 (malloc_state_machine::on_condition): Mark node param with
7774 ATTRIBUTE_UNUSED. Replace on_transition calls with get_state and
7775 set_next_state pairs, transitioning to the non-null state for the
7777 (malloc_state_machine::can_purge_p): Port to new state approach.
7778 (malloc_state_machine::on_zero_assignment): Replace on_transition
7779 calls with get_state and set_next_state pairs. Drop redundant
7781 * sm.h (state_machine::add_custom_state): New.
7783 2020-09-09 David Malcolm <dmalcolm@redhat.com>
7785 * diagnostic-manager.cc
7786 (null_assignment_sm_context::warn_for_state): Replace with...
7787 (null_assignment_sm_context::warn): ...this.
7788 * engine.cc (impl_sm_context::warn_for_state): Replace with...
7789 (impl_sm_context::warn): ...this.
7790 * sm-file.cc (fileptr_state_machine::on_stmt): Replace
7791 warn_for_state and on_transition calls with a get_state
7792 test guarding warn and set_next_state calls.
7793 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
7794 * sm-pattern-test.cc (pattern_test_state_machine::on_condition):
7795 Replace warn_for_state call with warn call.
7797 (sensitive_state_machine::warn_for_any_exposure): Replace
7798 warn_for_state call with a get_state test guarding a warn call.
7799 * sm-signal.cc (signal_state_machine::on_stmt): Likewise.
7800 * sm-taint.cc (taint_state_machine::on_stmt): Replace
7801 warn_for_state and on_transition calls with a get_state
7802 test guarding warn and set_next_state calls.
7803 * sm.h (sm_context::warn_for_state): Replace with...
7804 (sm_context::warn): ...this.
7806 2020-09-09 David Malcolm <dmalcolm@redhat.com>
7808 * diagnostic-manager.cc
7809 (null_assignment_sm_context::null_assignment_sm_context): Add old_state
7810 and ext_state params, initializing m_old_state and m_ext_state.
7811 (null_assignment_sm_context::on_transition): Split into...
7812 (null_assignment_sm_context::get_state): ...this new vfunc
7813 implementation and...
7814 (null_assignment_sm_context::set_next_state): ...this new vfunc
7816 (null_assignment_sm_context::m_old_state): New field.
7817 (null_assignment_sm_context::m_ext_state): New field.
7818 (diagnostic_manager::add_events_for_eedge): Pass in old state and
7819 ext_state when creating sm_ctxt.
7820 * engine.cc (impl_sm_context::on_transition): Split into...
7821 (impl_sm_context::get_state): ...this new vfunc
7822 implementation and...
7823 (impl_sm_context::set_next_state): ...this new vfunc
7825 * sm.h (sm_context::get_state): New pure virtual function.
7826 (sm_context::set_next_state): Likewise.
7827 (sm_context::on_transition): Convert from a pure virtual function
7828 to a regular function implemented in terms of get_state and
7831 2020-09-09 David Malcolm <dmalcolm@redhat.com>
7833 * checker-path.cc (state_change_event::get_desc): Update
7834 state_machine::get_state_name calls to state::get_name.
7835 (warning_event::get_desc): Likewise.
7836 * diagnostic-manager.cc
7837 (null_assignment_sm_context::on_transition): Update comparison
7838 against 0 with comparison with m_sm.get_start_state.
7839 (diagnostic_manager::prune_for_sm_diagnostic): Update
7840 state_machine::get_state_name calls to state::get_name.
7841 * engine.cc (impl_sm_context::on_transition): Likewise.
7842 (exploded_node::get_dot_fillcolor): Use get_id when summing
7844 * program-state.cc (sm_state_map::sm_state_map): Don't hardcode
7845 0 as the start state when initializing m_global_state.
7846 (sm_state_map::print): Use dump_to_pp rather than get_state_name
7847 when dumping states.
7848 (sm_state_map::is_empty_p): Don't hardcode 0 as the start state
7849 when examining m_global_state.
7850 (sm_state_map::hash): Use get_id when hashing states.
7851 (selftest::test_sm_state_map): Use state objects rather than
7852 arbitrary hardcoded integers.
7853 (selftest::test_program_state_merging): Likewise.
7854 (selftest::test_program_state_merging_2): Likewise.
7855 * sm-file.cc (fileptr_state_machine::m_start): Move to base class.
7856 (file_diagnostic::describe_state_change): Use get_start_state.
7857 (fileptr_state_machine::fileptr_state_machine): Drop m_start
7859 * sm-malloc.cc (malloc_state_machine::m_start): Move to base
7861 (malloc_diagnostic::describe_state_change): Use get_start_state.
7862 (possible_null::describe_state_change): Likewise.
7863 (malloc_state_machine::malloc_state_machine): Drop m_start
7865 * sm-pattern-test.cc (pattern_test_state_machine::m_start): Move
7867 (pattern_test_state_machine::pattern_test_state_machine): Drop
7868 m_start initialization.
7869 * sm-sensitive.cc (sensitive_state_machine::m_start): Move to base
7871 (sensitive_state_machine::sensitive_state_machine): Drop m_start
7873 * sm-signal.cc (signal_state_machine::m_start): Move to base
7875 (signal_state_machine::signal_state_machine): Drop m_start
7877 * sm-taint.cc (taint_state_machine::m_start): Move to base class.
7878 (taint_state_machine::taint_state_machine): Drop m_start
7880 * sm.cc (state_machine::state::dump_to_pp): New.
7881 (state_machine::state_machine): Move here from sm.h. Initialize
7882 m_next_state_id and m_start.
7883 (state_machine::add_state): Reimplement in terms of state objects.
7884 (state_machine::get_state_name): Delete.
7885 (state_machine::get_state_by_name): Reimplement in terms of state
7886 objects. Make const.
7887 (state_machine::validate): Delete.
7888 (state_machine::dump_to_pp): Reimplement in terms of state
7890 * sm.h (state_machine::state): New class.
7891 (state_machine::state_t): Convert typedef from "unsigned" to
7892 "const state_machine::state *".
7893 (state_machine::state_machine): Move to sm.cc.
7894 (state_machine::get_default_state): Use m_start rather than
7896 (state_machine::get_state_name): Delete.
7897 (state_machine::get_state_by_name): Make const.
7898 (state_machine::get_start_state): New accessor.
7899 (state_machine::alloc_state_id): New.
7900 (state_machine::m_state_names): Drop in favor of...
7901 (state_machine::m_states): New field
7902 (state_machine::m_start): New field
7903 (start_start_p): Delete.
7905 2020-09-08 David Malcolm <dmalcolm@redhat.com>
7908 * store.cc (binding_map::apply_ctor_val_to_range): Add
7909 error-handling for the cases where we have symbolic offsets.
7911 2020-09-08 David Malcolm <dmalcolm@redhat.com>
7914 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
7915 where min_index == max_index.
7916 (binding_map::apply_ctor_val_to_range): Replace assertion that we
7917 don't have a CONSTRUCTOR value with error-handling.
7919 2020-09-08 David Malcolm <dmalcolm@redhat.com>
7922 * region-model.cc (region_model::on_call_pre): Fix guard on switch
7923 on built-ins to only consider BUILT_IN_NORMAL, rather than other
7926 2020-09-01 David Malcolm <dmalcolm@redhat.com>
7929 * region-model.cc (region_model::deref_rvalue): Add the constraint
7930 that PTR_SVAL is non-NULL.
7932 2020-08-31 David Malcolm <dmalcolm@redhat.com>
7935 * region-model.cc (region_model::on_call_pre): Handle
7936 BUILT_IN_MEMSET_CHK.
7938 2020-08-31 David Malcolm <dmalcolm@redhat.com>
7940 * region-model.cc (region_model::on_call_pre): Gather handling of
7941 builtins and of internal fns into switch statements. Handle
7942 "alloca" and BUILT_IN_ALLOCA_WITH_ALIGN.
7944 2020-08-31 David Malcolm <dmalcolm@redhat.com>
7947 * region.cc (decl_region::get_svalue_for_constructor): Support
7948 apply_ctor_to_region failing.
7949 * store.cc (binding_map::apply_ctor_to_region): Add failure
7951 (binding_map::apply_ctor_val_to_range): Likewise.
7952 (binding_map::apply_ctor_pair_to_child_region): Likewise. Replace
7953 assertion that child_base_offset is not symbolic with error
7955 * store.h (binding_map::apply_ctor_to_region): Convert return type
7957 (binding_map::apply_ctor_val_to_range): Likewise.
7958 (binding_map::apply_ctor_pair_to_child_region): Likewise.
7960 2020-08-31 David Malcolm <dmalcolm@redhat.com>
7963 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
7964 by calling a new binding_map::apply_ctor_val_to_range subroutine.
7965 Split out the existing non-CONSTRUCTOR-handling code to a new
7966 apply_ctor_pair_to_child_region subroutine.
7967 (binding_map::apply_ctor_val_to_range): New.
7968 (binding_map::apply_ctor_pair_to_child_region): New, split out
7969 from binding_map::apply_ctor_to_region as noted above.
7970 * store.h (binding_map::apply_ctor_val_to_range): New decl.
7971 (binding_map::apply_ctor_pair_to_child_region): New decl.
7973 2020-08-31 David Malcolm <dmalcolm@redhat.com>
7976 * region-model-manager.cc
7977 (region_model_manager::maybe_fold_unaryop): Handle VIEW_CONVERT_EXPR.
7978 (region_model_manager::get_or_create_cast): Move logic for
7979 real->integer casting to...
7980 (get_code_for_cast): ...this new function, and add logic for
7981 real->non-integer casts.
7982 (region_model_manager::maybe_fold_sub_svalue): Handle
7985 (region_model::add_any_constraints_from_gassign): Likewise.
7986 * svalue.cc (svalue::maybe_undo_cast): Likewise.
7987 (unaryop_svalue::dump_to_pp): Likewise.
7989 2020-08-26 David Malcolm <dmalcolm@redhat.com>
7992 * region-model-manager.cc
7993 (region_model_manager::get_or_create_widening_svalue): Assert that
7994 neither of the inputs are themselves widenings.
7995 * store.cc (store::eval_alias_1): The initial value of a pointer
7996 can't point to a region that was allocated on the heap after the
7997 beginning of the path. A widened pointer value can't alias anything
7998 that the initial pointer value can't alias.
7999 * svalue.cc (svalue::can_merge_p): Merge BINOP (X, OP, CST) with X
8000 to a widening svalue. Merge
8001 BINOP(WIDENING(BASE, BINOP(BASE, X)), X) and BINOP(BASE, X) to
8002 to the LHS of the first BINOP.
8004 2020-08-26 David Malcolm <dmalcolm@redhat.com>
8007 * region-model.h (class compound_svalue): Document that all keys
8009 (compound_svalue::compound_svalue): Move definition to svalue.cc.
8010 * store.cc (binding_map::apply_ctor_to_region): Handle
8011 initializers for trailing arrays with incomplete size.
8012 * svalue.cc (compound_svalue::compound_svalue): Move definition
8013 here from region-model.h. Add assertion that all keys are
8016 2020-08-22 David Malcolm <dmalcolm@redhat.com>
8019 * region-model-manager.cc
8020 (region_model_manager::maybe_fold_binop): Fold bitwise "& 0" to 0.
8022 2020-08-22 David Malcolm <dmalcolm@redhat.com>
8024 * store.cc (store::eval_alias): Make const. Split out 2nd half
8025 into store::eval_alias_1 and call it twice for symmetry, avoiding
8027 (store::eval_alias_1): New function, split out from the above.
8028 * store.h (store::eval_alias): Make const.
8029 (store::eval_alias_1): New decl.
8031 2020-08-22 David Malcolm <dmalcolm@redhat.com>
8033 * region-model.cc (region_model::push_frame): Bind the default
8034 SSA name for each parm if it exists, falling back to the parm
8035 itself otherwise, rather than doing both.
8037 2020-08-20 David Malcolm <dmalcolm@redhat.com>
8040 * region-model-manager.cc
8041 (region_model_manager::get_field_region): Assert that field is a
8043 * region.cc (region::get_subregions_for_binding): In
8044 union-handling, filter the TYPE_FIELDS traversal to just FIELD_DECLs.
8046 2020-08-20 David Malcolm <dmalcolm@redhat.com>
8049 * region-model.cc (region_model::get_gassign_result): For
8050 comparisons, only use eval_condition when the lhs has boolean
8051 type, and use get_or_create_constant_svalue on the boolean
8052 constants directly rather than via get_rvalue.
8054 2020-08-19 David Malcolm <dmalcolm@redhat.com>
8057 * region-model.cc (region_model::deref_rvalue): Rather than
8058 attempting to handle all svalue kinds in the switch, only cover
8059 the special cases, and move symbolic-region handling to after
8060 the switch, thus implicitly handling the missing case SK_COMPOUND.
8062 2020-08-19 David Malcolm <dmalcolm@redhat.com>
8065 * region-model-manager.cc
8066 (region_model_manager::maybe_fold_binop): Check that we have an
8067 integral type before calling build_int_cst.
8069 2020-08-19 David Malcolm <dmalcolm@redhat.com>
8072 * region-model-manager.cc
8073 (region_model_manager::get_or_create_cast): Use FIX_TRUNC_EXPR for
8074 casting from REAL_TYPE to INTEGER_TYPE.
8076 2020-08-19 David Malcolm <dmalcolm@redhat.com>
8079 * region-model.cc (region_model::called_from_main_p): New.
8080 (region_model::get_store_value): Move handling for globals into...
8081 (region_model::get_initial_value_for_global): ...this new
8082 function, and add logic for extracting values from decl
8084 * region-model.h (decl_region::get_svalue_for_constructor): New
8086 (decl_region::get_svalue_for_initializer): New decl.
8087 (region_model::called_from_main_p): New decl.
8088 (region_model::get_initial_value_for_global): New.
8089 * region.cc (decl_region::maybe_get_constant_value): Move logic
8090 for getting an svalue from a CONSTRUCTOR node to...
8091 (decl_region::get_svalue_for_constructor): ...this new function.
8092 (decl_region::get_svalue_for_initializer): New.
8093 * store.cc (get_svalue_for_ctor_val): Rewrite in terms of
8094 region_model::get_rvalue.
8095 * store.h (binding_cluster::get_map): New accessor.
8097 2020-08-19 David Malcolm <dmalcolm@redhat.com>
8100 * region.cc (get_field_at_bit_offset): Gracefully handle negative
8101 values for bit_offset.
8103 2020-08-18 David Malcolm <dmalcolm@redhat.com>
8105 * region-model.cc (region_model::get_rvalue_1): Fix name of local.
8107 2020-08-18 David Malcolm <dmalcolm@redhat.com>
8110 * region-model.cc (region_model::get_rvalue_1): Handle
8111 unrecognized tree codes by returning "UNKNOWN.
8113 2020-08-18 David Malcolm <dmalcolm@redhat.com>
8116 * region-model.cc (region_model::get_gassign_result): Handle various
8117 VEC_* tree codes by returning UNKNOWN.
8118 (region_model::on_assignment): Handle unrecognized tree codes by
8119 setting lhs to an unknown value, rather than issuing a "sorry" and
8122 2020-08-17 David Malcolm <dmalcolm@redhat.com>
8125 * region-model-manager.cc (get_region_for_unexpected_tree_code):
8126 Handle ctxt being NULL.
8128 2020-08-17 David Malcolm <dmalcolm@redhat.com>
8131 * region.cc (region::get_subregions_for_binding): Check for "type"
8134 2020-08-17 David Malcolm <dmalcolm@redhat.com>
8137 * store.cc (get_svalue_for_ctor_val): New.
8138 (binding_map::apply_ctor_to_region): Call it.
8140 2020-08-14 David Malcolm <dmalcolm@redhat.com>
8144 * region-model.cc (region_model::get_store_value): Call
8145 maybe_get_constant_value on decl_regions first.
8146 * region-model.h (decl_region::maybe_get_constant_value): New decl.
8147 * region.cc (decl_region::get_stack_depth): Likewise.
8148 (decl_region::maybe_get_constant_value): New.
8149 * store.cc (get_subregion_within_ctor): New.
8150 (binding_map::apply_ctor_to_region): New.
8151 * store.h (binding_map::apply_ctor_to_region): New decl.
8153 2020-08-14 David Malcolm <dmalcolm@redhat.com>
8156 * store.cc (store::mark_as_escaped): Reject attempts to
8157 get a cluster for an unknown pointer.
8159 2020-08-13 David Malcolm <dmalcolm@redhat.com>
8175 * analyzer-logging.cc: Ignore "-Wformat-diag".
8176 (logger::enter_scope): Use inc_indent in both overloads.
8177 (logger::exit_scope): Use dec_indent.
8178 * analyzer-logging.h (logger::inc_indent): New.
8179 (logger::dec_indent): New.
8180 * analyzer-selftests.cc (run_analyzer_selftests): Call
8181 analyzer_store_cc_tests.
8182 * analyzer-selftests.h (analyzer_store_cc_tests): New decl.
8183 * analyzer.cc (get_stmt_location): New function.
8184 * analyzer.h (class initial_svalue): New forward decl.
8185 (class unaryop_svalue): New forward decl.
8186 (class binop_svalue): New forward decl.
8187 (class sub_svalue): New forward decl.
8188 (class unmergeable_svalue): New forward decl.
8189 (class placeholder_svalue): New forward decl.
8190 (class widening_svalue): New forward decl.
8191 (class compound_svalue): New forward decl.
8192 (class conjured_svalue): New forward decl.
8193 (svalue_set): New typedef.
8194 (class map_region): Delete.
8195 (class array_region): Delete.
8196 (class frame_region): New forward decl.
8197 (class function_region): New forward decl.
8198 (class label_region): New forward decl.
8199 (class decl_region): New forward decl.
8200 (class element_region): New forward decl.
8201 (class offset_region): New forward decl.
8202 (class cast_region): New forward decl.
8203 (class field_region): New forward decl.
8204 (class string_region): New forward decl.
8205 (class region_model_manager): New forward decl.
8206 (class store_manager): New forward decl.
8207 (class store): New forward decl.
8208 (class call_details): New forward decl.
8209 (struct svalue_id_merger_mapping): Delete.
8210 (struct canonicalization): Delete.
8211 (class function_point): New forward decl.
8212 (class engine): New forward decl.
8213 (dump_tree): New function decl.
8214 (print_quoted_type): New function decl.
8215 (readability_comparator): New function decl.
8216 (tree_cmp): New function decl.
8217 (class path_var): Move here from region-model.h
8218 (bit_offset_t, bit_size_t, byte_size_t): New typedefs.
8219 (class region_offset): New class.
8220 (get_stmt_location): New decl.
8221 (struct member_function_hash_traits): New struct.
8222 (class consolidation_map): New class.
8223 Ignore "-Wformat-diag".
8224 * analyzer.opt (-param=analyzer-max-svalue-depth=): New param.
8225 (-param=analyzer-max-enodes-for-full-dump=): New param.
8226 * call-string.cc: Ignore -Wformat-diag.
8227 * checker-path.cc: Move includes of "analyzer/call-string.h" and
8228 "analyzer/program-point.h" to before "analyzer/region-model.h",
8229 and also include "analyzer/store.h" before it.
8230 (state_change_event::state_change_event): Replace "tree var" param
8231 with "const svalue *sval". Convert "origin" param from tree to
8233 (state_change_event::get_desc): Call get_representative_tree to
8234 convert the var and origin from const svalue * to tree. Use
8235 svalue::get_desc rather than %qE when describing state changes.
8236 (checker_path::add_final_event): Use get_stmt_location.
8237 * checker-path.h (state_change_event::state_change_event): Port
8238 from tree to const svalue *.
8239 (state_change_event::get_lvalue): Delete.
8240 (state_change_event::get_dest_function): New.
8241 (state_change_event::m_var): Replace with...
8242 (state_change_event::m_sval): ...this.
8243 (state_change_event::m_origin): Convert from tree to
8245 * constraint-manager.cc: Include "analyzer/call-string.h",
8246 "analyzer/program-point.h", and "analyzer/store.h" before
8247 "analyzer/region-model.h".
8248 (struct bound, struct range): Move to constraint-manager.h.
8249 (compare_constants): New function.
8250 (range::dump): Rename to...
8251 (range::dump_to_pp): ...this. Support NULL constants.
8252 (range::dump): Reintroduce for dumping to stderr.
8253 (range::constrained_to_single_element): Return result, rather than
8255 (range::eval_condition): New.
8256 (range::below_lower_bound): New.
8257 (range::above_upper_bound): New.
8258 (equiv_class::equiv_class): Port from svalue_id to const svalue *.
8259 (equiv_class::print): Likewise.
8260 (equiv_class::hash): Likewise.
8261 (equiv_class::operator==): Port from svalue_id to const svalue *.
8262 (equiv_class::add): Port from svalue_id to const svalue *. Drop
8264 (equiv_class::del): Port from svalue_id to const svalue *.
8265 (equiv_class::get_representative): Likewise.
8266 (equiv_class::remap_svalue_ids): Delete.
8267 (svalue_id_cmp_by_id): Rename to...
8268 (svalue_cmp_by_ptr): ...this, porting from svalue_id to
8270 (equiv_class::canonicalize): Update qsort comparator.
8271 (constraint::implied_by): New.
8272 (constraint_manager::constraint_manager): Copy m_mgr in copy ctor.
8273 (constraint_manager::dump_to_pp): Add "multiline" param
8274 (constraint_manager::dump): Pass "true" for "multiline".
8275 (constraint_manager::add_constraint): Port from svalue_id to
8276 const svalue *. Split out second part into...
8277 (constraint_manager::add_unknown_constraint): ...this new
8278 function. Remove self-constraints when merging equivalence
8280 (constraint_manager::add_constraint_internal): Remove constraints
8281 that would be implied by the new constraint. Port from svalue_id
8283 (constraint_manager::get_equiv_class_by_sid): Rename to...
8284 (constraint_manager::get_equiv_class_by_svalue): ...this, porting
8285 from svalue_id to const svalue *.
8286 (constraint_manager::get_or_add_equiv_class): Port from svalue_id
8288 (constraint_manager::eval_condition): Make const. Call
8289 compare_constants and return early if it provides a known result.
8290 (constraint_manager::get_ec_bounds): New.
8291 (constraint_manager::eval_condition): New overloads. Make
8292 existing one const, and use compare_constants.
8293 (constraint_manager::purge): Convert "p" param to a template
8294 rather that an abstract base class. Port from svalue_id to
8296 (class dead_svalue_purger): New class.
8297 (constraint_manager::remap_svalue_ids): Delete.
8298 (constraint_manager::on_liveness_change): New.
8299 (equiv_class_cmp): Port from svalue_id to const svalue *.
8300 (constraint_manager::canonicalize): Likewise. Combine with
8301 purging of redundant equivalence classes and constraints.
8302 (class cleaned_constraint_manager): Delete.
8303 (class merger_fact_visitor): Make "m_cm_b" const. Add "m_merger"
8305 (merger_fact_visitor::fact): Port from svalue_id to const svalue *.
8306 Add special case for widening.
8307 (constraint_manager::merge): Port from svalue_id to const svalue *.
8308 (constraint_manager::clean_merger_input): Delete.
8309 (constraint_manager::for_each_fact): Port from svalue_id to
8311 (constraint_manager::validate): Likewise.
8312 (selftest::test_constraint_conditions): Provide a
8313 region_model_manager when creating region_model instances.
8314 Add test for self-equality not creating equivalence classes.
8315 (selftest::test_transitivity): Provide a region_model_manager when
8316 creating region_model instances. Verify that EC-merging happens
8317 when constraints are implied.
8318 (selftest::test_constant_comparisons): Provide a
8319 region_model_manager when creating region_model instances.
8320 (selftest::test_constraint_impl): Likewise. Remove over-specified
8322 (selftest::test_equality): Provide a region_model_manager when
8323 creating region_model instances.
8324 (selftest::test_many_constants): Likewise. Provide a
8325 program_point when testing merging.
8326 (selftest::run_constraint_manager_tests): Move call to
8327 test_constant_comparisons to outside the transitivity guard.
8328 * constraint-manager.h (struct bound): Move here from
8329 constraint-manager.cc.
8330 (struct range): Likewise.
8331 (struct::eval_condition): New decl.
8332 (struct::below_lower_bound): New decl.
8333 (struct::above_upper_bound): New decl.
8334 (equiv_class::add): Port from svalue_id to const svalue *.
8335 (equiv_class::del): Likewise.
8336 (equiv_class::get_representative): Likewise.
8337 (equiv_class::remap_svalue_ids): Drop.
8338 (equiv_class::m_cst_sid): Convert to..
8339 (equiv_class::m_cst_sval): ...this.
8340 (equiv_class::m_vars): Port from svalue_id to const svalue *.
8341 (constraint::bool implied_by): New decl.
8342 (fact_visitor::on_fact): Port from svalue_id to const svalue *.
8343 (constraint_manager::constraint_manager): Add mgr param.
8344 (constraint_manager::clone): Delete.
8345 (constraint_manager::maybe_get_constant): Delete.
8346 (constraint_manager::get_sid_for_constant): Delete.
8347 (constraint_manager::get_num_svalues): Delete.
8348 (constraint_manager::dump_to_pp): Add "multiline" param.
8349 (constraint_manager::get_equiv_class): Port from svalue_id to
8351 (constraint_manager::add_constraint): Likewise.
8352 (constraint_manager::get_equiv_class_by_sid): Rename to...
8353 (constraint_manager::get_equiv_class_by_svalue): ...this, porting
8354 from svalue_id to const svalue *.
8355 (constraint_manager::add_unknown_constraint): New decl.
8356 (constraint_manager::get_or_add_equiv_class): Port from svalue_id
8358 (constraint_manager::eval_condition): Likewise. Add overloads.
8359 (constraint_manager::get_ec_bounds): New decl.
8360 (constraint_manager::purge): Convert to template.
8361 (constraint_manager::remap_svalue_ids): Delete.
8362 (constraint_manager::on_liveness_change): New decl.
8363 (constraint_manager::canonicalize): Drop param.
8364 (constraint_manager::clean_merger_input): Delete.
8365 (constraint_manager::m_mgr): New field.
8366 * diagnostic-manager.cc: Move includes of
8367 "analyzer/call-string.h" and "analyzer/program-point.h" to before
8368 "analyzer/region-model.h", and also include "analyzer/store.h"
8370 (saved_diagnostic::saved_diagnostic): Add "sval" param.
8371 (diagnostic_manager::diagnostic_manager): Add engine param.
8372 (diagnostic_manager::add_diagnostic): Add "sval" param, passing it
8373 to saved_diagnostic ctor. Update overload to pass NULL for it.
8374 (dedupe_winners::dedupe_winners): Add engine param.
8375 (dedupe_winners::add): Add "eg" param. Pass m_engine to
8377 (dedupe_winner::m_engine): New field.
8378 (diagnostic_manager::emit_saved_diagnostics): Pass engine to
8379 dedupe_winners. Pass &eg when adding candidates. Pass svalue
8380 rather than tree to prune_path. Use get_stmt_location to get
8381 primary location of diagnostic.
8382 (diagnostic_manager::emit_saved_diagnostic): Likewise.
8383 (get_any_origin): Drop.
8384 (state_change_event_creator::on_global_state_change): Pass NULL
8385 const svalue * rather than NULL_TREE trees to state_change_event
8387 (state_change_event_creator::on_state_change): Port from tree and
8388 svalue_id to const svalue *.
8389 (for_each_state_change): Port from svalue_id to const svalue *.
8390 (struct null_assignment_sm_context): New.
8391 (diagnostic_manager::add_events_for_eedge): Add state change
8392 events for assignment to NULL.
8393 (diagnostic_manager::prune_path): Update param from tree to
8395 (diagnostic_manager::prune_for_sm_diagnostic): Port from tracking
8396 by tree to by const svalue *.
8397 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add sval
8399 (saved_diagnostic::m_sval): New field.
8400 (diagnostic_manager::diagnostic_manager): Add engine param.
8401 (diagnostic_manager::get_engine): New.
8402 (diagnostic_manager::add_diagnostic): Add "sval" param.
8403 (diagnostic_manager::prune_path): Likewise.
8404 (diagnostic_manager::prune_for_sm_diagnostic): New overload.
8405 (diagnostic_manager::m_eng): New field.
8406 * engine.cc: Move includes of "analyzer/call-string.h" and
8407 "analyzer/program-point.h" to before "analyzer/region-model.h",
8408 and also include "analyzer/store.h" before it.
8409 (impl_region_model_context::impl_region_model_context): Update for
8410 removal of m_change field.
8411 (impl_region_model_context::remap_svalue_ids): Delete.
8412 (impl_region_model_context::on_svalue_leak): New.
8413 (impl_region_model_context::on_svalue_purge): Delete.
8414 (impl_region_model_context::on_liveness_change): New.
8415 (impl_region_model_context::on_unknown_change): Update param
8416 from svalue_id to const svalue *. Add is_mutable param.
8417 (setjmp_svalue::compare_fields): Delete.
8418 (setjmp_svalue::accept): New.
8419 (setjmp_svalue::add_to_hash): Delete.
8420 (setjmp_svalue::dump_to_pp): New.
8421 (setjmp_svalue::print_details): Delete.
8422 (impl_sm_context::impl_sm_context): Drop "change" param.
8423 (impl_sm_context::get_fndecl_for_call): Drop "m_change".
8424 (impl_sm_context::on_transition): Drop ATTRIBUTE_UNUSED from
8425 "stmt" param. Drop m_change. Port from svalue_id to
8427 (impl_sm_context::warn_for_state): Drop m_change. Port from
8428 svalue_id to const svalue *.
8429 (impl_sm_context::get_readable_tree): Rename to...
8430 (impl_sm_context::get_diagnostic_tree): ...this. Port from
8431 svalue_id to const svalue *.
8432 (impl_sm_context::is_zero_assignment): New.
8433 (impl_sm_context::m_change): Delete field.
8434 (leak_stmt_finder::find_stmt): Handle m_var being NULL.
8435 (readability): Increase penalty for MEM_REF. For SSA_NAMEs,
8436 slightly favor the underlying var over the SSA name. Heavily
8437 penalize temporaries. Handle RESULT_DECL.
8438 (readability_comparator): Make non-static. Consider stack depths.
8439 (impl_region_model_context::on_state_leak): Convert from svalue_id
8440 to const svalue *, updating for region_model changes. Use
8442 (impl_region_model_context::on_inherited_svalue): Delete.
8443 (impl_region_model_context::on_cast): Delete.
8444 (impl_region_model_context::on_condition): Drop m_change.
8445 (impl_region_model_context::on_phi): Likewise.
8446 (impl_region_model_context::on_unexpected_tree_code): Handle t
8448 (point_and_state::validate): Update stack checking for
8449 region_model changes.
8450 (eg_traits::dump_args_t::show_enode_details_p): New.
8451 (exploded_node::exploded_node): Initialize m_num_processed_stmts.
8452 (exploded_node::get_processed_stmt): New function.
8453 (exploded_node::get_dot_fillcolor): Add more colors.
8454 (exploded_node::dump_dot): Guard the printing of the point and
8455 state with show_enode_details_p. Print the processed stmts for
8456 this enode after the initial state.
8457 (exploded_node::dump_to_pp): Pass true for new multiline param
8458 of program_state::dump_to_pp.
8459 (exploded_node::on_stmt): Drop "change" param. Log the stmt.
8460 Set input_location. Implement __analyzer_describe. Update
8461 implementation of __analyzer_dump and __analyzer_eval.
8462 Remove purging of sm-state for unknown fncalls from here.
8463 (exploded_node::on_edge): Drop "change" param.
8464 (exploded_node::on_longjmp): Port from region_id/svalue_id to
8465 const region */const svalue *. Call program_state::detect_leaks.
8467 (exploded_node::detect_leaks): Update for changes to region_model.
8468 Call program_state::detect_leaks.
8469 (exploded_edge::exploded_edge): Drop ext_state and change params.
8470 (exploded_edge::dump_dot): "args" is no longer used. Drop dumping
8472 (exploded_graph::exploded_graph): Pass engine to
8473 m_diagnostic_manager ctor. Use program_point::origin.
8474 (exploded_graph::add_function_entry): Drop ctxt. Use
8475 program_state::push_frame. Drop state_change.
8476 (exploded_graph::get_or_create_node): Drop "change" param. Add
8477 "enode_for_diag" param. Update dumping calls for API changes.
8478 Pass point to can_merge_with_p. Show enode indices
8479 within -Wanalyzer-too-complex diagnostic for hitting the per-point
8481 (exploded_graph::add_edge): Drop "change" param. Log which nodes
8482 are being connected. Update for changes to exploded_edge ctor.
8483 (exploded_graph::get_per_program_point_data): New.
8484 (exploded_graph::process_worklist): Pass point to
8485 can_merge_with_p. Drop state_change. Update dumping call for API
8487 (exploded_graph::process_node): Drop state_change. Split the
8488 node in-place if an sm-state-change occurs. Update
8489 m_num_processed_stmts. Update dumping calls for API change.
8490 (exploded_graph::log_stats): Call engine::log_stats.
8491 (exploded_graph::dump_states_for_supernode): Update dumping
8493 (exploded_path::feasible_p): Add "eng" and "eg" params.
8494 Rename "i" to "end_idx". Pass the manager to the region_model
8495 ctor. Update for every processed stmt in the enode, not just the
8496 first. Keep track of which snodes have been visited, and call
8497 loop_replay_fixup when revisiting one.
8498 (enode_label::get_text): Update dump call for new param.
8499 (exploded_graph::dump_exploded_nodes): Likewise.
8500 (exploded_graph::get_node_by_index): New.
8501 (impl_run_checkers): Create engine instance and pass its address
8502 to extrinsic_state ctor.
8504 (impl_region_model_context::impl_region_model_context): Drop
8506 (impl_region_model_context::void remap_svalue_ids): Delete.
8507 (impl_region_model_context::on_svalue_purge): Delete.
8508 (impl_region_model_context::on_svalue_leak): New.
8509 (impl_region_model_context::on_liveness_change): New.
8510 (impl_region_model_context::on_state_leak): Update signature.
8511 (impl_region_model_context::on_inherited_svalue): Delete.
8512 (impl_region_model_context::on_cast): Delete.
8513 (impl_region_model_context::on_unknown_change): Update signature.
8514 (impl_region_model_context::m_change): Delete.
8515 (eg_traits::dump_args_t::show_enode_details_p): New.
8516 (exploded_node::on_stmt): Drop "change" param.
8517 (exploded_node::on_edge): Likewise.
8518 (exploded_node::get_processed_stmt): New decl.
8519 (exploded_node::m_num_processed_stmts): New field.
8520 (exploded_edge::exploded_edge): Drop ext_state and change params.
8521 (exploded_edge::m_change): Delete.
8522 (exploded_graph::get_engine): New accessor.
8523 (exploded_graph::get_or_create_node): Drop "change" param. Add
8524 "enode_for_diag" param.
8525 (exploded_graph::add_edge): Drop "change" param.
8526 (exploded_graph::get_per_program_point_data): New decl.
8527 (exploded_graph::get_node_by_index): New decl.
8528 (exploded_path::feasible_p): Add "eng" and "eg" params.
8529 * program-point.cc: Include "analyzer/store.h" before including
8530 "analyzer/region-model.h".
8531 (function_point::function_point): Move here from
8533 (function_point::get_function): Likewise.
8534 (function_point::from_function_entry): Likewise.
8535 (function_point::before_supernode): Likewise.
8536 (function_point::next_stmt): New function.
8537 * program-point.h (function_point::function_point): Move
8538 implementation from here to program-point.cc.
8539 (function_point::get_function): Likewise.
8540 (function_point::from_function_entry): Likewise.
8541 (function_point::before_supernode): Likewise.
8542 (function_point::next_stmt): New decl.
8543 (program_point::operator!=): New.
8544 (program_point::origin): New.
8545 (program_point::next_stmt): New.
8546 (program_point::m_function_point): Make non-const.
8547 * program-state.cc: Move includes of "analyzer/call-string.h" and
8548 "analyzer/program-point.h" to before "analyzer/region-model.h",
8549 and also include "analyzer/store.h" before it.
8550 (extrinsic_state::get_model_manager): New.
8551 (sm_state_map::sm_state_map): Pass in sm and sm_idx to ctor,
8552 rather than pass the around.
8553 (sm_state_map::clone_with_remapping): Delete.
8554 (sm_state_map::print): Remove "sm" param in favor of "m_sm". Add
8555 "simple" and "multiline" params and support multiline vs single
8557 (sm_state_map::dump): Remove "sm" param in favor of "m_sm". Add
8559 (sm_state_map::hash): Port from svalue_id to const svalue *.
8560 (sm_state_map::operator==): Likewise.
8561 (sm_state_map::get_state): Likewise. Call canonicalize_svalue on
8562 input. Handle inheritance of sm-state. Call get_default_state.
8563 (sm_state_map::get_origin): Port from svalue_id to const svalue *.
8564 (sm_state_map::set_state): Likewise. Pass in ext_state. Reject
8565 attempts to set state on UNKNOWN.
8566 (sm_state_map::impl_set_state): Port from svalue_id to
8567 const svalue *. Pass in ext_state. Call canonicalize_svalue on
8569 (sm_state_map::purge_for_unknown_fncall): Delete.
8570 (sm_state_map::on_svalue_leak): New.
8571 (sm_state_map::remap_svalue_ids): Delete.
8572 (sm_state_map::on_liveness_change): New.
8573 (sm_state_map::on_unknown_change): Reimplement.
8574 (sm_state_map::on_svalue_purge): Delete.
8575 (sm_state_map::on_inherited_svalue): Delete.
8576 (sm_state_map::on_cast): Delete.
8577 (sm_state_map::validate): Delete.
8578 (sm_state_map::canonicalize_svalue): New.
8579 (program_state::program_state): Update to pass manager to
8580 region_model's ctor. Constify num_states and pass state machine
8581 and index to sm_state_map ctor.
8582 (program_state::print): Update for changes to dump API.
8583 (program_state::dump_to_pp): Ignore the summarize param. Add
8585 (program_state::dump_to_file): Add "multiline" param.
8586 (program_state::dump): Pass "true" for new "multiline" param.
8587 (program_state::push_frame): New.
8588 (program_state::on_edge): Drop "change" param. Call
8589 program_state::detect_leaks.
8590 (program_state::prune_for_point): Add enode_for_diag param.
8591 Reimplement based on store class. Call detect_leaks
8592 (program_state::remap_svalue_ids): Delete.
8593 (program_state::get_representative_tree): Port from svalue_id to
8595 (program_state::can_merge_with_p): Add "point" param. Add early
8596 reject for sm-differences. Drop id remapping.
8597 (program_state::validate): Drop region model and sm_state_map
8599 (state_change::sm_change::dump): Delete.
8600 (state_change::sm_change::remap_svalue_ids): Delete.
8601 (state_change::sm_change::on_svalue_purge): Delete.
8602 (log_set_of_svalues): New.
8603 (state_change::sm_change::validate): Delete.
8604 (state_change::state_change): Delete.
8605 (state_change::add_sm_change): Delete.
8606 (state_change::affects_p): Delete.
8607 (state_change::dump): Delete.
8608 (state_change::remap_svalue_ids): Delete.
8609 (state_change::on_svalue_purge): Delete.
8610 (state_change::validate): Delete.
8611 (selftest::assert_dump_eq): Delete.
8612 (ASSERT_DUMP_EQ): Delete.
8613 (selftest::test_sm_state_map): Update for changes to region_model
8614 and sm_state_map, porting from svalue_id to const svalue *.
8615 (selftest::test_program_state_dumping): Likewise. Drop test of
8616 dumping, renaming to...
8617 (selftest::test_program_state_1): ...this.
8618 (selftest::test_program_state_dumping_2): Likewise, renaming to...
8619 (selftest::test_program_state_2): ...this.
8620 (selftest::test_program_state_merging): Update for changes to
8622 (selftest::test_program_state_merging_2): Likewise.
8623 (selftest::analyzer_program_state_cc_tests): Update for renamed
8625 * program-state.h (extrinsic_state::extrinsic_state): Add logger
8627 (extrinsic_state::get_logger): New accessor.
8628 (extrinsic_state::get_engine): New accessor.
8629 (extrinsic_state::get_model_manager): New accessor.
8630 (extrinsic_state::m_logger): New field.
8631 (extrinsic_state::m_engine): New field.
8632 (struct default_hash_traits<svalue_id>): Delete.
8633 (pod_hash_traits<svalue_id>::hash): Delete.
8634 (pod_hash_traits<svalue_id>::equal): Delete.
8635 (pod_hash_traits<svalue_id>::mark_deleted): Delete.
8636 (pod_hash_traits<svalue_id>::mark_empty): Delete.
8637 (pod_hash_traits<svalue_id>::is_deleted): Delete.
8638 (pod_hash_traits<svalue_id>::is_empty): Delete.
8639 (sm_state_map::entry_t::entry_t): Port from svalue_id to
8641 (sm_state_map::entry_t::m_origin): Likewise.
8642 (sm_state_map::map_t): Likewise.
8643 (sm_state_map::sm_state_map): Add state_machine and index params.
8644 (sm_state_map::clone_with_remapping): Delete.
8645 (sm_state_map::print): Drop sm param; add simple and multiline
8647 (sm_state_map::dump): Drop sm param; add simple param.
8648 (sm_state_map::get_state): Port from svalue_id to const svalue *.
8649 Add ext_state param.
8650 (sm_state_map::get_origin): Likewise.
8651 (sm_state_map::set_state): Likewise.
8652 (sm_state_map::impl_set_state): Likewise.
8653 (sm_state_map::purge_for_unknown_fncall): Delete.
8654 (sm_state_map::remap_svalue_ids): Delete.
8655 (sm_state_map::on_svalue_purge): Delete.
8656 (sm_state_map::on_svalue_leak): New.
8657 (sm_state_map::on_liveness_change): New.
8658 (sm_state_map::on_inherited_svalue): Delete.
8659 (sm_state_map::on_cast): Delete.
8660 (sm_state_map::validate): Delete.
8661 (sm_state_map::on_unknown_change): Port from svalue_id to
8662 const svalue *. Add is_mutable and ext_state params.
8663 (sm_state_map::canonicalize_svalue): New.
8664 (sm_state_map::m_sm): New field.
8665 (sm_state_map::m_sm_idx): New field.
8666 (program_state::operator=): Delete.
8667 (program_state::dump_to_pp): Drop "summarize" param, adding
8668 "simple" and "multiline".
8669 (program_state::dump_to_file): Likewise.
8670 (program_state::dump): Rename "summarize" to "simple".
8671 (program_state::push_frame): New.
8672 (program_state::get_current_function): New.
8673 (program_state::on_edge): Drop "change" param.
8674 (program_state::prune_for_point): Likewise. Add enode_for_diag
8676 (program_state::remap_svalue_ids): Delete.
8677 (program_state::get_representative_tree): Port from svalue_id to
8679 (program_state::can_purge_p): Likewise. Pass ext_state to get_state.
8680 (program_state::can_merge_with_p): Add point param.
8681 (program_state::detect_leaks): New.
8682 (state_change_visitor::on_state_change): Port from tree and
8683 svalue_id to a pair of const svalue *.
8684 (class state_change): Delete.
8685 * region.cc: New file.
8686 * region-model-impl-calls.cc: New file.
8687 * region-model-manager.cc: New file.
8688 * region-model-reachability.cc: New file.
8689 * region-model-reachability.h: New file.
8690 * region-model.cc: Include "analyzer/call-string.h",
8691 "analyzer/program-point.h", and "analyzer/store.h" before
8692 "analyzer/region-model.h". Include
8693 "analyzer/region-model-reachability.h".
8694 (dump_tree): Make non-static.
8695 (dump_quoted_tree): Make non-static.
8696 (print_quoted_type): Make non-static.
8697 (path_var::dump): Delete.
8698 (dump_separator): Delete.
8699 (class impl_constraint_manager): Delete.
8700 (svalue_id::print): Delete.
8701 (svalue_id::dump_node_name_to_pp): Delete.
8702 (svalue_id::validate): Delete.
8703 (region_id::print): Delete.
8704 (region_id::dump_node_name_to_pp): Delete.
8705 (region_id::validate): Delete.
8706 (region_id_set::region_id_set): Delete.
8707 (svalue_id_set::svalue_id_set): Delete.
8708 (svalue::operator==): Delete.
8709 (svalue::hash): Delete.
8710 (svalue::print): Delete.
8711 (svalue::dump_dot_to_pp): Delete.
8712 (svalue::remap_region_ids): Delete.
8713 (svalue::walk_for_canonicalization): Delete.
8714 (svalue::get_child_sid): Delete.
8715 (svalue::maybe_get_constant): Delete.
8716 (region_svalue::compare_fields): Delete.
8717 (region_svalue::add_to_hash): Delete.
8718 (region_svalue::print_details): Delete.
8719 (region_svalue::dump_dot_to_pp): Delete.
8720 (region_svalue::remap_region_ids): Delete.
8721 (region_svalue::merge_values): Delete.
8722 (region_svalue::walk_for_canonicalization): Delete.
8723 (region_svalue::eval_condition): Delete.
8724 (constant_svalue::compare_fields): Delete.
8725 (constant_svalue::add_to_hash): Delete.
8726 (constant_svalue::merge_values): Delete.
8727 (constant_svalue::eval_condition): Move to svalue.cc.
8728 (constant_svalue::print_details): Delete.
8729 (constant_svalue::get_child_sid): Delete.
8730 (unknown_svalue::compare_fields): Delete.
8731 (unknown_svalue::add_to_hash): Delete.
8732 (unknown_svalue::print_details): Delete.
8733 (poison_kind_to_str): Move to svalue.cc.
8734 (poisoned_svalue::compare_fields): Delete.
8735 (poisoned_svalue::add_to_hash): Delete.
8736 (poisoned_svalue::print_details): Delete.
8737 (region_kind_to_str): Move to region.cc and reimplement.
8738 (region::operator==): Delete.
8739 (region::get_parent_region): Delete.
8740 (region::set_value): Delete.
8741 (region::become_active_view): Delete.
8742 (region::deactivate_any_active_view): Delete.
8743 (region::deactivate_view): Delete.
8744 (region::get_value): Delete.
8745 (region::get_inherited_child_sid): Delete.
8746 (region_model::copy_region): Delete.
8747 (region_model::copy_struct_region): Delete.
8748 (region_model::copy_union_region): Delete.
8749 (region_model::copy_array_region): Delete.
8750 (region::hash): Delete.
8751 (region::print): Delete.
8752 (region::dump_dot_to_pp): Delete.
8753 (region::dump_to_pp): Delete.
8754 (region::dump_child_label): Delete.
8755 (region::validate): Delete.
8756 (region::remap_svalue_ids): Delete.
8757 (region::remap_region_ids): Delete.
8758 (region::add_view): Delete.
8759 (region::get_view): Delete.
8760 (region::region): Move to region.cc.
8761 (region::add_to_hash): Delete.
8762 (region::print_fields): Delete.
8763 (region::non_null_p): Delete.
8764 (primitive_region::clone): Delete.
8765 (primitive_region::walk_for_canonicalization): Delete.
8766 (map_region::map_region): Delete.
8767 (map_region::compare_fields): Delete.
8768 (map_region::print_fields): Delete.
8769 (map_region::validate): Delete.
8770 (map_region::dump_dot_to_pp): Delete.
8771 (map_region::dump_child_label): Delete.
8772 (map_region::get_or_create): Delete.
8773 (map_region::get): Delete.
8774 (map_region::add_to_hash): Delete.
8775 (map_region::remap_region_ids): Delete.
8776 (map_region::unbind): Delete.
8777 (map_region::get_tree_for_child_region): Delete.
8778 (map_region::get_tree_for_child_region): Delete.
8779 (tree_cmp): Move to region.cc.
8780 (map_region::can_merge_p): Delete.
8781 (map_region::walk_for_canonicalization): Delete.
8782 (map_region::get_value_by_name): Delete.
8783 (struct_or_union_region::valid_key_p): Delete.
8784 (struct_or_union_region::compare_fields): Delete.
8785 (struct_region::clone): Delete.
8786 (struct_region::compare_fields): Delete.
8787 (union_region::clone): Delete.
8788 (union_region::compare_fields): Delete.
8789 (frame_region::compare_fields): Delete.
8790 (frame_region::clone): Delete.
8791 (frame_region::valid_key_p): Delete.
8792 (frame_region::print_fields): Delete.
8793 (frame_region::add_to_hash): Delete.
8794 (globals_region::compare_fields): Delete.
8795 (globals_region::clone): Delete.
8796 (globals_region::valid_key_p): Delete.
8797 (code_region::compare_fields): Delete.
8798 (code_region::clone): Delete.
8799 (code_region::valid_key_p): Delete.
8800 (array_region::array_region): Delete.
8801 (array_region::get_element): Delete.
8802 (array_region::clone): Delete.
8803 (array_region::compare_fields): Delete.
8804 (array_region::print_fields): Delete.
8805 (array_region::validate): Delete.
8806 (array_region::dump_dot_to_pp): Delete.
8807 (array_region::dump_child_label): Delete.
8808 (array_region::get_or_create): Delete.
8809 (array_region::get): Delete.
8810 (array_region::add_to_hash): Delete.
8811 (array_region::remap_region_ids): Delete.
8812 (array_region::get_key_for_child_region): Delete.
8813 (array_region::key_cmp): Delete.
8814 (array_region::walk_for_canonicalization): Delete.
8815 (array_region::key_from_constant): Delete.
8816 (array_region::constant_from_key): Delete.
8817 (function_region::compare_fields): Delete.
8818 (function_region::clone): Delete.
8819 (function_region::valid_key_p): Delete.
8820 (stack_region::stack_region): Delete.
8821 (stack_region::compare_fields): Delete.
8822 (stack_region::clone): Delete.
8823 (stack_region::print_fields): Delete.
8824 (stack_region::dump_child_label): Delete.
8825 (stack_region::validate): Delete.
8826 (stack_region::push_frame): Delete.
8827 (stack_region::get_current_frame_id): Delete.
8828 (stack_region::pop_frame): Delete.
8829 (stack_region::add_to_hash): Delete.
8830 (stack_region::remap_region_ids): Delete.
8831 (stack_region::can_merge_p): Delete.
8832 (stack_region::walk_for_canonicalization): Delete.
8833 (stack_region::get_value_by_name): Delete.
8834 (heap_region::heap_region): Delete.
8835 (heap_region::compare_fields): Delete.
8836 (heap_region::clone): Delete.
8837 (heap_region::walk_for_canonicalization): Delete.
8838 (root_region::root_region): Delete.
8839 (root_region::compare_fields): Delete.
8840 (root_region::clone): Delete.
8841 (root_region::print_fields): Delete.
8842 (root_region::validate): Delete.
8843 (root_region::dump_child_label): Delete.
8844 (root_region::push_frame): Delete.
8845 (root_region::get_current_frame_id): Delete.
8846 (root_region::pop_frame): Delete.
8847 (root_region::ensure_stack_region): Delete.
8848 (root_region::get_stack_region): Delete.
8849 (root_region::ensure_globals_region): Delete.
8850 (root_region::get_code_region): Delete.
8851 (root_region::ensure_code_region): Delete.
8852 (root_region::get_globals_region): Delete.
8853 (root_region::ensure_heap_region): Delete.
8854 (root_region::get_heap_region): Delete.
8855 (root_region::remap_region_ids): Delete.
8856 (root_region::can_merge_p): Delete.
8857 (root_region::add_to_hash): Delete.
8858 (root_region::walk_for_canonicalization): Delete.
8859 (root_region::get_value_by_name): Delete.
8860 (symbolic_region::symbolic_region): Delete.
8861 (symbolic_region::compare_fields): Delete.
8862 (symbolic_region::clone): Delete.
8863 (symbolic_region::walk_for_canonicalization): Delete.
8864 (symbolic_region::print_fields): Delete.
8865 (region_model::region_model): Add region_model_manager * param.
8866 Reimplement in terms of store, dropping impl_constraint_manager
8868 (region_model::operator=): Reimplement in terms of store
8869 (region_model::operator==): Likewise.
8870 (region_model::hash): Likewise.
8871 (region_model::print): Delete.
8872 (region_model::print_svalue): Delete.
8873 (region_model::dump_dot_to_pp): Delete.
8874 (region_model::dump_dot_to_file): Delete.
8875 (region_model::dump_dot): Delete.
8876 (region_model::dump_to_pp): Replace "summarize" param with
8877 "simple" and "multiline". Port to store-based implementation.
8878 (region_model::dump): Replace "summarize" param with "simple" and
8880 (dump_vec_of_tree): Delete.
8881 (region_model::dump_summary_of_rep_path_vars): Delete.
8882 (region_model::validate): Delete.
8883 (svalue_id_cmp_by_constant_svalue_model): Delete.
8884 (svalue_id_cmp_by_constant_svalue): Delete.
8885 (region_model::canonicalize): Drop "ctxt" param. Reimplement in
8886 terms of store and constraints.
8887 (region_model::canonicalized_p): Remove NULL arg to canonicalize.
8888 (region_model::loop_replay_fixup): New.
8889 (poisoned_value_diagnostic::emit): Tweak wording of warnings.
8890 (region_model::check_for_poison): Delete.
8891 (region_model::get_gassign_result): New.
8892 (region_model::on_assignment): Port to store-based implementation.
8893 (region_model::on_call_pre): Delete calls to check_for_poison.
8894 Move implementations to region-model-impl-calls.c and port to
8895 store-based implementation.
8896 (region_model::on_call_post): Likewise.
8897 (class reachable_regions): Move to region-model-reachability.h/cc
8898 and port to store-based implementation.
8899 (region_model::handle_unrecognized_call): Port to store-based
8901 (region_model::get_reachable_svalues): New.
8902 (region_model::on_setjmp): Port to store-based implementation.
8903 (region_model::on_longjmp): Likewise.
8904 (region_model::handle_phi): Drop is_back_edge param and the logic
8906 (region_model::get_lvalue_1): Port from region_id to const region *.
8907 (region_model::make_region_for_unexpected_tree_code): Delete.
8908 (assert_compat_types): If the check fails, use internal_error to
8910 (region_model::get_lvalue): Port from region_id to const region *.
8911 (region_model::get_rvalue_1): Port from svalue_id to const svalue *.
8912 (region_model::get_rvalue): Likewise.
8913 (region_model::get_or_create_ptr_svalue): Delete.
8914 (region_model::get_or_create_constant_svalue): Delete.
8915 (region_model::get_svalue_for_fndecl): Delete.
8916 (region_model::get_region_for_fndecl): Delete.
8917 (region_model::get_svalue_for_label): Delete.
8918 (region_model::get_region_for_label): Delete.
8919 (build_cast): Delete.
8920 (region_model::maybe_cast_1): Delete.
8921 (region_model::maybe_cast): Delete.
8922 (region_model::get_field_region): Delete.
8923 (region_model::get_store_value): New.
8924 (region_model::region_exists_p): New.
8925 (region_model::deref_rvalue): Port from svalue_id to const svalue *.
8926 (region_model::set_value): Likewise.
8927 (region_model::clobber_region): New.
8928 (region_model::purge_region): New.
8929 (region_model::zero_fill_region): New.
8930 (region_model::mark_region_as_unknown): New.
8931 (region_model::eval_condition): Port from svalue_id to
8933 (region_model::eval_condition_without_cm): Likewise.
8934 (region_model::compare_initial_and_pointer): New.
8935 (region_model::add_constraint): Port from svalue_id to
8937 (region_model::maybe_get_constant): Delete.
8938 (region_model::get_representative_path_var): New.
8939 (region_model::add_new_malloc_region): Delete.
8940 (region_model::get_representative_tree): Port to const svalue *.
8941 (region_model::get_representative_path_var): Port to
8943 (region_model::get_path_vars_for_svalue): Delete.
8944 (region_model::set_to_new_unknown_value): Delete.
8945 (region_model::update_for_phis): Don't pass is_back_edge to handle_phi.
8946 (region_model::update_for_call_superedge): Port from svalue_id to
8948 (region_model::update_for_return_superedge): Port to store-based
8950 (region_model::update_for_call_summary): Replace
8951 set_to_new_unknown_value with mark_region_as_unknown.
8952 (region_model::get_root_region): Delete.
8953 (region_model::get_stack_region_id): Delete.
8954 (region_model::push_frame): Delete.
8955 (region_model::get_current_frame_id): Delete.
8956 (region_model::get_current_function): Delete.
8957 (region_model::pop_frame): Delete.
8958 (region_model::on_top_level_param): New.
8959 (region_model::get_stack_depth): Delete.
8960 (region_model::get_function_at_depth): Delete.
8961 (region_model::get_globals_region_id): Delete.
8962 (region_model::add_svalue): Delete.
8963 (region_model::replace_svalue): Delete.
8964 (region_model::add_region): Delete.
8965 (region_model::get_svalue): Delete.
8966 (region_model::get_region): Delete.
8967 (make_region_for_type): Delete.
8968 (region_model::add_region_for_type): Delete.
8969 (region_model::on_top_level_param): New.
8970 (class restrict_to_used_svalues): Delete.
8971 (region_model::purge_unused_svalues): Delete.
8972 (region_model::push_frame): New.
8973 (region_model::remap_svalue_ids): Delete.
8974 (region_model::remap_region_ids): Delete.
8975 (region_model::purge_regions): Delete.
8976 (region_model::get_descendents): Delete.
8977 (region_model::delete_region_and_descendents): Delete.
8978 (region_model::poison_any_pointers_to_bad_regions): Delete.
8979 (region_model::can_merge_with_p): Delete.
8980 (region_model::get_current_function): New.
8981 (region_model::get_value_by_name): Delete.
8982 (region_model::convert_byte_offset_to_array_index): Delete.
8983 (region_model::pop_frame): New.
8984 (region_model::get_or_create_mem_ref): Delete.
8985 (region_model::get_stack_depth): New.
8986 (region_model::get_frame_at_index): New.
8987 (region_model::unbind_region_and_descendents): New.
8988 (struct bad_pointer_finder): New.
8989 (region_model::get_or_create_pointer_plus_expr): Delete.
8990 (region_model::poison_any_pointers_to_descendents): New.
8991 (region_model::get_or_create_view): Delete.
8992 (region_model::can_merge_with_p): New.
8993 (region_model::get_fndecl_for_call): Port from svalue_id to
8995 (struct append_ssa_names_cb_data): New.
8996 (get_ssa_name_regions_for_current_frame): New.
8997 (region_model::append_ssa_names_cb): New.
8998 (model_merger::dump_to_pp): Add "simple" param. Drop dumping of
9000 (model_merger::dump): Add "simple" param to both overloads.
9001 (model_merger::can_merge_values_p): Delete.
9002 (model_merger::record_regions): Delete.
9003 (model_merger::record_svalues): Delete.
9004 (svalue_id_merger_mapping::svalue_id_merger_mapping): Delete.
9005 (svalue_id_merger_mapping::dump_to_pp): Delete.
9006 (svalue_id_merger_mapping::dump): Delete.
9007 (region_model::create_region_for_heap_alloc): New.
9008 (region_model::create_region_for_alloca): New.
9009 (region_model::record_dynamic_extents): New.
9010 (canonicalization::canonicalization): Delete.
9011 (canonicalization::walk_rid): Delete.
9012 (canonicalization::walk_sid): Delete.
9013 (canonicalization::dump_to_pp): Delete.
9014 (canonicalization::dump): Delete.
9015 (inchash::add): Delete overloads for svalue_id and region_id.
9016 (engine::log_stats): New.
9017 (assert_condition): Add overload comparing svalues.
9018 (assert_dump_eq): Pass "true" for multiline.
9019 (selftest::test_dump): Update for rewrite of region_model.
9020 (selftest::test_dump_2): Rename to...
9021 (selftest::test_struct): ...this. Provide a region_model_manager
9022 when creating region_model instance. Remove dump test. Add
9023 checks for get_offset.
9024 (selftest::test_dump_3): Rename to...
9025 (selftest::test_array_1): ...this. Provide a region_model_manager
9026 when creating region_model instance. Remove dump test.
9027 (selftest::test_get_representative_tree): Port from svalue_id to
9028 new API. Add test coverage for various expressions.
9029 (selftest::test_unique_constants): Provide a region_model_manager
9030 for the region_model. Add test coverage for comparing const vs
9032 (selftest::test_svalue_equality): Delete.
9033 (selftest::test_region_equality): Delete.
9034 (selftest::test_unique_unknowns): New.
9035 (class purge_all_svalue_ids): Delete.
9036 (class purge_one_svalue_id): Delete.
9037 (selftest::test_purging_by_criteria): Delete.
9038 (selftest::test_initial_svalue_folding): New.
9039 (selftest::test_unaryop_svalue_folding): New.
9040 (selftest::test_binop_svalue_folding): New.
9041 (selftest::test_sub_svalue_folding): New.
9042 (selftest::test_purge_unused_svalues): Delete.
9043 (selftest::test_descendent_of_p): New.
9044 (selftest::test_assignment): Provide a region_model_manager for
9045 the region_model. Drop the dump test.
9046 (selftest::test_compound_assignment): Likewise.
9047 (selftest::test_stack_frames): Port to new implementation.
9048 (selftest::test_get_representative_path_var): Likewise.
9049 (selftest::test_canonicalization_1): Rename to...
9050 (selftest::test_equality_1): ...this. Port to new API, and add
9051 (selftest::test_canonicalization_2): Provide a
9052 region_model_manager when creating region_model instances.
9053 Remove redundant canicalization.
9054 (selftest::test_canonicalization_3): Provide a
9055 region_model_manager when creating region_model instances.
9056 Remove param from calls to region_model::canonicalize.
9057 (selftest::test_canonicalization_4): Likewise.
9058 (selftest::assert_region_models_merge): Constify
9059 out_merged_svalue. Port to new API.
9060 (selftest::test_state_merging): Provide a
9061 region_model_manager when creating region_model instances.
9062 Provide a program_point point when merging them. Replace
9063 set_to_new_unknown_value with usage of placeholder_svalues.
9064 Drop get_value_by_name. Port from svalue_id to const svalue *.
9065 Add test of heap allocation.
9066 (selftest::test_constraint_merging): Provide a
9067 region_model_manager when creating region_model instances.
9068 Provide a program_point point when merging them. Eliminate use
9069 of set_to_new_unknown_value.
9070 (selftest::test_widening_constraints): New.
9071 (selftest::test_iteration_1): New.
9072 (selftest::test_malloc_constraints): Port to store-based
9074 (selftest::test_var): New test.
9075 (selftest::test_array_2): New test.
9076 (selftest::test_mem_ref): New test.
9077 (selftest::test_POINTER_PLUS_EXPR_then_MEM_REF): New.
9078 (selftest::test_malloc): New.
9079 (selftest::test_alloca): New.
9080 (selftest::analyzer_region_model_cc_tests): Update for renamings.
9082 * region-model.h (class path_var): Move to analyzer.h.
9083 (class svalue_id): Delete.
9084 (class region_id): Delete.
9085 (class id_map): Delete.
9086 (svalue_id_map): Delete.
9087 (region_id_map): Delete.
9088 (id_map<T>::id_map): Delete.
9089 (id_map<T>::put): Delete.
9090 (id_map<T>::get_dst_for_src): Delete.
9091 (id_map<T>::get_src_for_dst): Delete.
9092 (id_map<T>::dump_to_pp): Delete.
9093 (id_map<T>::dump): Delete.
9094 (id_map<T>::update): Delete.
9095 (one_way_svalue_id_map): Delete.
9096 (one_way_region_id_map): Delete.
9097 (class region_id_set): Delete.
9098 (class svalue_id_set): Delete.
9099 (struct complexity): New.
9100 (class visitor): New.
9101 (enum svalue_kind): Add SK_SETJMP, SK_INITIAL, SK_UNARYOP,
9102 SK_BINOP, SK_SUB,SK_UNMERGEABLE, SK_PLACEHOLDER, SK_WIDENING,
9103 SK_COMPOUND, and SK_CONJURED.
9104 (svalue::operator==): Delete.
9105 (svalue::operator!=): Delete.
9106 (svalue::clone): Delete.
9107 (svalue::hash): Delete.
9108 (svalue::dump_dot_to_pp): Delete.
9109 (svalue::dump_to_pp): New.
9110 (svalue::dump): New.
9111 (svalue::get_desc): New.
9112 (svalue::dyn_cast_initial_svalue): New.
9113 (svalue::dyn_cast_unaryop_svalue): New.
9114 (svalue::dyn_cast_binop_svalue): New.
9115 (svalue::dyn_cast_sub_svalue): New.
9116 (svalue::dyn_cast_unmergeable_svalue): New.
9117 (svalue::dyn_cast_widening_svalue): New.
9118 (svalue::dyn_cast_compound_svalue): New.
9119 (svalue::dyn_cast_conjured_svalue): New.
9120 (svalue::maybe_undo_cast): New.
9121 (svalue::unwrap_any_unmergeable): New.
9122 (svalue::remap_region_ids): Delete
9123 (svalue::can_merge_p): New.
9124 (svalue::walk_for_canonicalization): Delete
9125 (svalue::get_complexity): New.
9126 (svalue::get_child_sid): Delete
9127 (svalue::accept): New.
9128 (svalue::live_p): New.
9129 (svalue::implicitly_live_p): New.
9130 (svalue::svalue): Add complexity param.
9131 (svalue::add_to_hash): Delete
9132 (svalue::print_details): Delete
9133 (svalue::m_complexity): New field.
9134 (region_svalue::key_t): New struct.
9135 (region_svalue::region_svalue): Port from region_id to
9136 const region_id *. Add complexity.
9137 (region_svalue::compare_fields): Delete.
9138 (region_svalue::clone): Delete.
9139 (region_svalue::dump_dot_to_pp): Delete.
9140 (region_svalue::get_pointee): Port from region_id to
9142 (region_svalue::remap_region_ids): Delete.
9143 (region_svalue::merge_values): Delete.
9144 (region_svalue::dump_to_pp): New.
9145 (region_svalue::accept): New.
9146 (region_svalue::walk_for_canonicalization): Delete.
9147 (region_svalue::eval_condition): Make params const.
9148 (region_svalue::add_to_hash): Delete.
9149 (region_svalue::print_details): Delete.
9150 (region_svalue::m_rid): Replace with...
9151 (region_svalue::m_reg): ...this.
9152 (is_a_helper <region_svalue *>::test): Convert to...
9153 (is_a_helper <const region_svalue *>::test): ...this.
9154 (template <> struct default_hash_traits<region_svalue::key_t>):
9156 (constant_svalue::constant_svalue): Add complexity.
9157 (constant_svalue::compare_fields): Delete.
9158 (constant_svalue::clone): Delete.
9159 (constant_svalue::add_to_hash): Delete.
9160 (constant_svalue::dump_to_pp): New.
9161 (constant_svalue::accept): New.
9162 (constant_svalue::implicitly_live_p): New.
9163 (constant_svalue::merge_values): Delete.
9164 (constant_svalue::eval_condition): Make params const.
9165 (constant_svalue::get_child_sid): Delete.
9166 (constant_svalue::print_details): Delete.
9167 (is_a_helper <constant_svalue *>::test): Convert to...
9168 (is_a_helper <const constant_svalue *>::test): ...this.
9169 (class unknown_svalue): Update leading comment.
9170 (unknown_svalue::unknown_svalue): Add complexity.
9171 (unknown_svalue::compare_fields): Delete.
9172 (unknown_svalue::add_to_hash): Delete.
9173 (unknown_svalue::dyn_cast_unknown_svalue): Delete.
9174 (unknown_svalue::print_details): Delete.
9175 (unknown_svalue::dump_to_pp): New.
9176 (unknown_svalue::accept): New.
9177 (poisoned_svalue::key_t): New struct.
9178 (poisoned_svalue::poisoned_svalue): Add complexity.
9179 (poisoned_svalue::compare_fields): Delete.
9180 (poisoned_svalue::clone): Delete.
9181 (poisoned_svalue::add_to_hash): Delete.
9182 (poisoned_svalue::dump_to_pp): New.
9183 (poisoned_svalue::accept): New.
9184 (poisoned_svalue::print_details): Delete.
9185 (is_a_helper <poisoned_svalue *>::test): Convert to...
9186 (is_a_helper <const poisoned_svalue *>::test): ...this.
9187 (template <> struct default_hash_traits<poisoned_svalue::key_t>):
9189 (setjmp_record::add_to_hash): New.
9190 (setjmp_svalue::key_t): New struct.
9191 (setjmp_svalue::compare_fields): Delete.
9192 (setjmp_svalue::clone): Delete.
9193 (setjmp_svalue::add_to_hash): Delete.
9194 (setjmp_svalue::setjmp_svalue): Add complexity.
9195 (setjmp_svalue::dump_to_pp): New.
9196 (setjmp_svalue::accept): New.
9197 (setjmp_svalue::void print_details): Delete.
9198 (is_a_helper <const setjmp_svalue *>::test): New.
9199 (template <> struct default_hash_traits<setjmp_svalue::key_t>): New.
9200 (class initial_svalue : public svalue): New.
9201 (is_a_helper <const initial_svalue *>::test): New.
9202 (class unaryop_svalue): New.
9203 (is_a_helper <const unaryop_svalue *>::test): New.
9204 (template <> struct default_hash_traits<unaryop_svalue::key_t>): New.
9205 (class binop_svalue): New.
9206 (is_a_helper <const binop_svalue *>::test): New.
9207 (template <> struct default_hash_traits<binop_svalue::key_t>): New.
9208 (class sub_svalue): New.
9209 (is_a_helper <const sub_svalue *>::test): New.
9210 (template <> struct default_hash_traits<sub_svalue::key_t>): New.
9211 (class unmergeable_svalue): New.
9212 (is_a_helper <const unmergeable_svalue *>::test): New.
9213 (class placeholder_svalue): New.
9214 (is_a_helper <placeholder_svalue *>::test): New.
9215 (class widening_svalue): New.
9216 (is_a_helper <widening_svalue *>::test): New.
9217 (template <> struct default_hash_traits<widening_svalue::key_t>): New.
9218 (class compound_svalue): New.
9219 (is_a_helper <compound_svalue *>::test): New.
9220 (template <> struct default_hash_traits<compound_svalue::key_t>): New.
9221 (class conjured_svalue): New.
9222 (is_a_helper <conjured_svalue *>::test): New.
9223 (template <> struct default_hash_traits<conjured_svalue::key_t>): New.
9224 (enum region_kind): Delete RK_PRIMITIVE, RK_STRUCT, RK_UNION, and
9225 RK_ARRAY. Add RK_LABEL, RK_DECL, RK_FIELD, RK_ELEMENT, RK_OFFSET,
9226 RK_CAST, RK_HEAP_ALLOCATED, RK_ALLOCA, RK_STRING, and RK_UNKNOWN.
9227 (region_kind_to_str): Delete.
9228 (region::~region): Move implementation to region.cc.
9229 (region::operator==): Delete.
9230 (region::operator!=): Delete.
9231 (region::clone): Delete.
9232 (region::get_id): New.
9233 (region::cmp_ids): New.
9234 (region::dyn_cast_map_region): Delete.
9235 (region::dyn_cast_array_region): Delete.
9236 (region::region_id get_parent): Delete.
9237 (region::get_parent_region): Convert to a simple accessor.
9238 (region::void set_value): Delete.
9239 (region::svalue_id get_value): Delete.
9240 (region::svalue_id get_value_direct): Delete.
9241 (region::svalue_id get_inherited_child_sid): Delete.
9242 (region::dyn_cast_frame_region): New.
9243 (region::dyn_cast_function_region): New.
9244 (region::dyn_cast_decl_region): New.
9245 (region::dyn_cast_field_region): New.
9246 (region::dyn_cast_element_region): New.
9247 (region::dyn_cast_offset_region): New.
9248 (region::dyn_cast_cast_region): New.
9249 (region::dyn_cast_string_region): New.
9250 (region::accept): New.
9251 (region::get_base_region): New.
9252 (region::base_region_p): New.
9253 (region::descendent_of_p): New.
9254 (region::maybe_get_frame_region): New.
9255 (region::maybe_get_decl): New.
9256 (region::hash): Delete.
9257 (region::rint): Delete.
9258 (region::dump_dot_to_pp): Delete.
9259 (region::get_desc): New.
9260 (region::dump_to_pp): Convert to vfunc, changing signature.
9261 (region::dump_child_label): Delete.
9262 (region::remap_svalue_ids): Delete.
9263 (region::remap_region_ids): Delete.
9264 (region::dump): New.
9265 (region::walk_for_canonicalization): Delete.
9266 (region::non_null_p): Drop region_model param.
9267 (region::add_view): Delete.
9268 (region::get_view): Delete.
9269 (region::get_active_view): Delete.
9270 (region::is_view_p): Delete.
9271 (region::cmp_ptrs): New.
9272 (region::validate): Delete.
9273 (region::get_offset): New.
9274 (region::get_byte_size): New.
9275 (region::get_bit_size): New.
9276 (region::get_subregions_for_binding): New.
9277 (region::region): Add complexity param. Convert parent from
9278 region_id to const region *. Drop svalue_id. Drop copy ctor.
9279 (region::symbolic_for_unknown_ptr_p): New.
9280 (region::add_to_hash): Delete.
9281 (region::print_fields): Delete.
9282 (region::get_complexity): New accessor.
9283 (region::become_active_view): Delete.
9284 (region::deactivate_any_active_view): Delete.
9285 (region::deactivate_view): Delete.
9286 (region::calc_offset): New.
9287 (region::m_parent_rid): Delete.
9288 (region::m_sval_id): Delete.
9289 (region::m_complexity): New.
9290 (region::m_id): New.
9291 (region::m_parent): New.
9292 (region::m_view_rids): Delete.
9293 (region::m_is_view): Delete.
9294 (region::m_active_view_rid): Delete.
9295 (region::m_cached_offset): New.
9296 (is_a_helper <region *>::test): Convert to...
9297 (is_a_helper <const region *>::test): ... this.
9298 (class primitive_region): Delete.
9299 (class space_region): New.
9300 (class map_region): Delete.
9301 (is_a_helper <map_region *>::test): Delete.
9302 (class frame_region): Reimplement.
9303 (template <> struct default_hash_traits<frame_region::key_t>):
9305 (class globals_region): Reimplement.
9306 (is_a_helper <globals_region *>::test): Convert to...
9307 (is_a_helper <const globals_region *>::test): ...this.
9308 (class struct_or_union_region): Delete.
9309 (is_a_helper <struct_or_union_region *>::test): Delete.
9310 (class code_region): Reimplement.
9311 (is_a_helper <const code_region *>::test): New.
9312 (class struct_region): Delete.
9313 (is_a_helper <struct_region *>::test): Delete.
9314 (class function_region): Reimplement.
9315 (is_a_helper <function_region *>::test): Convert to...
9316 (is_a_helper <const function_region *>::test): ...this.
9317 (class union_region): Delete.
9318 (is_a_helper <union_region *>::test): Delete.
9319 (class label_region): New.
9320 (is_a_helper <const label_region *>::test): New.
9321 (class scope_region): Delete.
9322 (class stack_region): Reimplement.
9323 (is_a_helper <stack_region *>::test): Convert to...
9324 (is_a_helper <const stack_region *>::test): ...this.
9325 (class heap_region): Reimplement.
9326 (is_a_helper <heap_region *>::test): Convert to...
9327 (is_a_helper <const heap_region *>::test): ...this.
9328 (class root_region): Reimplement.
9329 (is_a_helper <root_region *>::test): Convert to...
9330 (is_a_helper <const root_region *>::test): ...this.
9331 (class symbolic_region): Reimplement.
9332 (is_a_helper <const symbolic_region *>::test): New.
9333 (template <> struct default_hash_traits<symbolic_region::key_t>):
9335 (class decl_region): New.
9336 (is_a_helper <const decl_region *>::test): New.
9337 (class field_region): New.
9338 (template <> struct default_hash_traits<field_region::key_t>): New.
9339 (class array_region): Delete.
9340 (class element_region): New.
9341 (is_a_helper <array_region *>::test): Delete.
9342 (is_a_helper <const element_region *>::test): New.
9343 (template <> struct default_hash_traits<element_region::key_t>):
9345 (class offset_region): New.
9346 (is_a_helper <const offset_region *>::test): New.
9347 (template <> struct default_hash_traits<offset_region::key_t>):
9349 (class cast_region): New.
9350 (is_a_helper <const cast_region *>::test): New.
9351 (template <> struct default_hash_traits<cast_region::key_t>): New.
9352 (class heap_allocated_region): New.
9353 (class alloca_region): New.
9354 (class string_region): New.
9355 (is_a_helper <const string_region *>::test): New.
9356 (class unknown_region): New.
9357 (class region_model_manager): New.
9358 (struct append_ssa_names_cb_data): New.
9359 (class call_details): New.
9360 (region_model::region_model): Add region_model_manager param.
9361 (region_model::print_svalue): Delete.
9362 (region_model::dump_dot_to_pp): Delete.
9363 (region_model::dump_dot_to_file): Delete.
9364 (region_model::dump_dot): Delete.
9365 (region_model::dump_to_pp): Drop summarize param in favor of
9366 simple and multiline.
9367 (region_model::dump): Likewise.
9368 (region_model::summarize_to_pp): Delete.
9369 (region_model::summarize): Delete.
9370 (region_model::void canonicalize): Drop ctxt param.
9371 (region_model::void check_for_poison): Delete.
9372 (region_model::get_gassign_result): New.
9373 (region_model::impl_call_alloca): New.
9374 (region_model::impl_call_analyzer_describe): New.
9375 (region_model::impl_call_analyzer_eval): New.
9376 (region_model::impl_call_builtin_expect): New.
9377 (region_model::impl_call_calloc): New.
9378 (region_model::impl_call_free): New.
9379 (region_model::impl_call_malloc): New.
9380 (region_model::impl_call_memset): New.
9381 (region_model::impl_call_strlen): New.
9382 (region_model::get_reachable_svalues): New.
9383 (region_model::handle_phi): Drop is_back_edge param.
9384 (region_model::region_id get_root_rid): Delete.
9385 (region_model::root_region *get_root_region): Delete.
9386 (region_model::region_id get_stack_region_id): Delete.
9387 (region_model::push_frame): Convert from region_id and svalue_id
9388 to const region * and const svalue *.
9389 (region_model::get_current_frame_id): Replace with...
9390 (region_model::get_current_frame): ...this.
9391 (region_model::pop_frame): Convert from region_id to
9392 const region *. Drop purge and stats param. Add out_result.
9393 (region_model::function *get_function_at_depth): Delete.
9394 (region_model::get_globals_region_id): Delete.
9395 (region_model::add_svalue): Delete.
9396 (region_model::replace_svalue): Delete.
9397 (region_model::add_region): Delete.
9398 (region_model::add_region_for_type): Delete.
9399 (region_model::get_svalue): Delete.
9400 (region_model::get_region): Delete.
9401 (region_model::get_lvalue): Convert from region_id to
9403 (region_model::get_rvalue): Convert from svalue_id to
9405 (region_model::get_or_create_ptr_svalue): Delete.
9406 (region_model::get_or_create_constant_svalue): Delete.
9407 (region_model::get_svalue_for_fndecl): Delete.
9408 (region_model::get_svalue_for_label): Delete.
9409 (region_model::get_region_for_fndecl): Delete.
9410 (region_model::get_region_for_label): Delete.
9411 (region_model::get_frame_at_index (int index) const;): New.
9412 (region_model::maybe_cast): Delete.
9413 (region_model::maybe_cast_1): Delete.
9414 (region_model::get_field_region): Delete.
9415 (region_model::id deref_rvalue): Convert from region_id and
9416 svalue_id to const region * and const svalue *. Drop overload,
9417 passing in both a tree and an svalue.
9418 (region_model::set_value): Convert from region_id and svalue_id to
9419 const region * and const svalue *.
9420 (region_model::set_to_new_unknown_value): Delete.
9421 (region_model::clobber_region (const region *reg);): New.
9422 (region_model::purge_region (const region *reg);): New.
9423 (region_model::zero_fill_region (const region *reg);): New.
9424 (region_model::mark_region_as_unknown (const region *reg);): New.
9425 (region_model::copy_region): Convert from region_id to
9427 (region_model::eval_condition): Convert from svalue_id to
9429 (region_model::eval_condition_without_cm): Likewise.
9430 (region_model::compare_initial_and_pointer): New.
9431 (region_model:maybe_get_constant): Delete.
9432 (region_model::add_new_malloc_region): Delete.
9433 (region_model::get_representative_tree): Convert from svalue_id to
9435 (region_model::get_representative_path_var): Delete decl taking a
9436 region_id in favor of two decls, for svalue vs region, with an
9437 svalue_set to ensure termination.
9438 (region_model::get_path_vars_for_svalue): Delete.
9439 (region_model::create_region_for_heap_alloc): New.
9440 (region_model::create_region_for_alloca): New.
9441 (region_model::purge_unused_svalues): Delete.
9442 (region_model::remap_svalue_ids): Delete.
9443 (region_model::remap_region_ids): Delete.
9444 (region_model::purge_regions): Delete.
9445 (region_model::get_num_svalues): Delete.
9446 (region_model::get_num_regions): Delete.
9447 (region_model::get_descendents): Delete.
9448 (region_model::get_store): New.
9449 (region_model::delete_region_and_descendents): Delete.
9450 (region_model::get_manager): New.
9451 (region_model::unbind_region_and_descendents): New.
9452 (region_model::can_merge_with_p): Add point param. Drop
9453 svalue_id_merger_mapping.
9454 (region_model::get_value_by_name): Delete.
9455 (region_model::convert_byte_offset_to_array_index): Delete.
9456 (region_model::get_or_create_mem_ref): Delete.
9457 (region_model::get_or_create_pointer_plus_expr): Delete.
9458 (region_model::get_or_create_view): Delete.
9459 (region_model::get_lvalue_1): Convert from region_id to
9461 (region_model::get_rvalue_1): Convert from svalue_id to
9463 (region_model::get_ssa_name_regions_for_current_frame): New.
9464 (region_model::append_ssa_names_cb): New.
9465 (region_model::get_store_value): New.
9466 (region_model::copy_struct_region): Delete.
9467 (region_model::copy_union_region): Delete.
9468 (region_model::copy_array_region): Delete.
9469 (region_model::region_exists_p): New.
9470 (region_model::make_region_for_unexpected_tree_code): Delete.
9471 (region_model::loop_replay_fixup): New.
9472 (region_model::poison_any_pointers_to_bad_regions): Delete.
9473 (region_model::poison_any_pointers_to_descendents): New.
9474 (region_model::dump_summary_of_rep_path_vars): Delete.
9475 (region_model::on_top_level_param): New.
9476 (region_model::record_dynamic_extents): New.
9477 (region_model::m_mgr;): New.
9478 (region_model::m_store;): New.
9479 (region_model::m_svalues;): Delete.
9480 (region_model::m_regions;): Delete.
9481 (region_model::m_root_rid;): Delete.
9482 (region_model::m_current_frame;): New.
9483 (region_model_context::remap_svalue_ids): Delete.
9484 (region_model_context::can_purge_p): Delete.
9485 (region_model_context::on_svalue_leak): New.
9486 (region_model_context::on_svalue_purge): Delete.
9487 (region_model_context::on_liveness_change): New.
9488 (region_model_context::on_inherited_svalue): Delete.
9489 (region_model_context::on_cast): Delete.
9490 (region_model_context::on_unknown_change): Convert from svalue_id to
9491 const svalue * and add is_mutable.
9492 (class noop_region_model_context): Update for region_model_context
9494 (model_merger::model_merger): Add program_point. Drop
9495 svalue_id_merger_mapping.
9496 (model_merger::dump_to_pp): Add "simple" param.
9497 (model_merger::dump): Likewise.
9498 (model_merger::get_region_a): Delete.
9499 (model_merger::get_region_b): Delete.
9500 (model_merger::can_merge_values_p): Delete.
9501 (model_merger::record_regions): Delete.
9502 (model_merger::record_svalues): Delete.
9503 (model_merger::m_point): New field.
9504 (model_merger::m_map_regions_from_a_to_m): Delete.
9505 (model_merger::m_map_regions_from_b_to_m): Delete.
9506 (model_merger::m_sid_mapping): Delete.
9507 (struct svalue_id_merger_mapping): Delete.
9508 (class engine): New.
9509 (struct canonicalization): Delete.
9510 (inchash::add): Delete decls for hashing svalue_id and region_id.
9511 (test_region_model_context::on_unexpected_tree_code): Require t to
9513 (selftest::assert_condition): Add overload comparing a pair of
9515 * sm-file.cc: Include "tristate.h", "selftest.h",
9516 "analyzer/call-string.h", "analyzer/program-point.h",
9517 "analyzer/store.h", and "analyzer/region-model.h".
9518 (fileptr_state_machine::get_default_state): New.
9519 (fileptr_state_machine::on_stmt): Remove calls to
9520 get_readable_tree in favor of get_diagnostic_tree.
9521 * sm-malloc.cc: Include "tristate.h", "selftest.h",
9522 "analyzer/call-string.h", "analyzer/program-point.h",
9523 "analyzer/store.h", and "analyzer/region-model.h".
9524 (malloc_state_machine::get_default_state): New.
9525 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New.
9526 (malloc_diagnostic::describe_state_change): Handle change.m_expr
9528 (null_arg::emit): Avoid printing "NULL '0'".
9529 (null_arg::describe_final_event): Avoid printing "(0) NULL".
9530 (malloc_leak::emit): Handle m_arg being NULL.
9531 (malloc_leak::describe_final_event): Handle ev.m_expr being NULL.
9532 (malloc_state_machine::on_stmt): Don't call get_readable_tree.
9533 Call get_diagnostic_tree when creating pending diagnostics.
9534 Update for is_zero_assignment becoming a member function of
9536 Don't transition to m_non_heap for ADDR_EXPR(MEM_REF()).
9537 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New
9538 vfunc implementation.
9539 * sm-sensitive.cc (sensitive_state_machine::warn_for_any_exposure): Call
9540 get_diagnostic_tree and pass the result to warn_for_state.
9541 * sm-signal.cc: Move includes of "analyzer/call-string.h" and
9542 "analyzer/program-point.h" to before "analyzer/region-model.h",
9543 and also include "analyzer/store.h" before it.
9544 (signal_unsafe_call::describe_state_change): Use
9545 get_dest_function to get handler.
9546 (update_model_for_signal_handler): Pass manager to region_model
9548 (register_signal_handler::impl_transition): Update for changes to
9549 get_or_create_node and add_edge.
9550 * sm-taint.cc (taint_state_machine::on_stmt): Remove calls to
9551 get_readable_tree, replacing them when calling warn_for_state with
9552 calls to get_diagnostic_tree.
9553 * sm.cc (is_zero_assignment): Delete.
9554 (any_pointer_p): Move to within namespace ana.
9555 * sm.h (is_zero_assignment): Remove decl.
9556 (any_pointer_p): Move decl to within namespace ana.
9557 (state_machine::get_default_state): New vfunc.
9558 (state_machine::reset_when_passed_to_unknown_fn_p): New vfunc.
9559 (sm_context::get_readable_tree): Rename to...
9560 (sm_context::get_diagnostic_tree): ...this.
9561 (sm_context::is_zero_assignment): New vfunc.
9562 * store.cc: New file.
9563 * store.h: New file.
9564 * svalue.cc: New file.
9566 2020-05-22 Mark Wielaard <mark@klomp.org>
9568 * sm-signal.cc(signal_unsafe_call::emit): Possibly add
9569 gcc_rich_location note for replacement.
9570 (signal_unsafe_call::get_replacement_fn): New private function.
9571 (get_async_signal_unsafe_fns): Add "exit".
9573 2020-04-28 David Malcolm <dmalcolm@redhat.com>
9576 * engine.cc (impl_region_model_context::on_unexpected_tree_code):
9578 * region-model.cc (region_model::add_region_for_type): Handle
9581 (test_region_model_context::on_unexpected_tree_code): Handle NULL
9584 2020-04-28 David Malcolm <dmalcolm@redhat.com>
9590 * analyzer.opt (Wanalyzer-use-of-uninitialized-value): Delete.
9591 * program-state.cc (selftest::test_program_state_dumping): Update
9592 expected dump result for removal of "uninit".
9593 * region-model.cc (poison_kind_to_str): Delete POISON_KIND_UNINIT
9595 (root_region::ensure_stack_region): Initialize stack with null
9596 svalue_id rather than with a typeless POISON_KIND_UNINIT value.
9597 (root_region::ensure_heap_region): Likewise for the heap.
9598 (region_model::dump_summary_of_rep_path_vars): Remove
9599 summarization of uninit values.
9600 (region_model::validate): Remove check that the stack has a
9601 POISON_KIND_UNINIT value.
9602 (poisoned_value_diagnostic::emit): Remove POISON_KIND_UNINIT
9604 (poisoned_value_diagnostic::describe_final_event): Likewise.
9605 (selftest::test_dump): Update expected dump result for removal of
9607 (selftest::test_svalue_equality): Remove "uninit" and "freed".
9608 * region-model.h (enum poison_kind): Remove POISON_KIND_UNINIT.
9610 2020-04-01 David Malcolm <dmalcolm@redhat.com>
9613 * checker-path.cc: Include "bitmap.h".
9614 * constraint-manager.cc: Likewise.
9615 * diagnostic-manager.cc: Likewise.
9616 * engine.cc: Likewise.
9617 (exploded_node::detect_leaks): Pass null region_id to pop_frame.
9618 * program-point.cc: Include "bitmap.h".
9619 * program-state.cc: Likewise.
9620 * region-model.cc (id_set<region_id>::id_set): Convert to...
9621 (region_id_set::region_id_set): ...this.
9622 (svalue_id_set::svalue_id_set): New ctor.
9623 (region_model::copy_region): New function.
9624 (region_model::copy_struct_region): New function.
9625 (region_model::copy_union_region): New function.
9626 (region_model::copy_array_region): New function.
9627 (stack_region::pop_frame): Drop return value. Add
9628 "result_dst_rid" param; if it is non-null, use copy_region to copy
9629 the result to it. Rather than capture and pass a single "known
9630 used" return value to be used by purge_unused_values, instead
9631 gather and pass a set of known used return values.
9632 (root_region::pop_frame): Drop return value. Add "result_dst_rid"
9634 (region_model::on_assignment): Use copy_region.
9635 (region_model::on_return): Likewise for the result.
9636 (region_model::on_longjmp): Pass null for pop_frame's
9638 (region_model::update_for_return_superedge): Pass the region for the
9639 return value of the call, if any, to pop_frame, rather than setting
9640 the lvalue for the lhs of the result.
9641 (region_model::pop_frame): Drop return value. Add
9642 "result_dst_rid" param.
9643 (region_model::purge_unused_svalues): Convert third param from an
9644 svalue_id * to an svalue_id_set *, updating the initial populating
9645 of the "used" bitmap accordingly. Don't remap it when done.
9646 (struct selftest::coord_test): New selftest fixture, extracted from...
9647 (selftest::test_dump_2): ...here.
9648 (selftest::test_compound_assignment): New selftest.
9649 (selftest::test_stack_frames): Pass null to new param of pop_frame.
9650 (selftest::analyzer_region_model_cc_tests): Call the new selftest.
9651 * region-model.h (class id_set): Delete template.
9652 (class region_id_set): Reimplement, using old id_set implementation.
9653 (class svalue_id_set): Likewise. Convert from auto_sbitmap to
9655 (region::get_active_view): New accessor.
9656 (stack_region::pop_frame): Drop return value. Add
9657 "result_dst_rid" param.
9658 (root_region::pop_frame): Likewise.
9659 (region_model::pop_frame): Likewise.
9660 (region_model::copy_region): New decl.
9661 (region_model::purge_unused_svalues): Convert third param from an
9662 svalue_id * to an svalue_id_set *.
9663 (region_model::copy_struct_region): New decl.
9664 (region_model::copy_union_region): New decl.
9665 (region_model::copy_array_region): New decl.
9667 2020-03-27 David Malcolm <dmalcolm@redhat.com>
9669 * program-state.cc (selftest::test_program_state_dumping): Update
9670 expected dump to include symbolic_region's possibly_null field.
9671 * region-model.cc (symbolic_region::print_fields): New vfunc
9673 (region_model::add_constraint): Clear m_possibly_null from
9674 symbolic_regions now known to be non-NULL.
9675 (selftest::test_malloc_constraints): New selftest.
9676 (selftest::analyzer_region_model_cc_tests): Call it.
9677 * region-model.h (region::dyn_cast_symbolic_region): Add non-const
9679 (symbolic_region::dyn_cast_symbolic_region): Implement it.
9680 (symbolic_region::print_fields): New vfunc override decl.
9682 2020-03-27 David Malcolm <dmalcolm@redhat.com>
9684 * analyzer.h (class feasibility_problem): New forward decl.
9685 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
9686 Initialize new fields m_status, m_epath_length, and m_problem.
9687 (saved_diagnostic::~saved_diagnostic): Delete m_problem.
9688 (dedupe_candidate::dedupe_candidate): Convert "sd" param from a
9689 const ref to a mutable ptr.
9690 (dedupe_winners::add): Convert "sd" param from a const ref to a
9691 mutable ptr. Record the length of the exploded_path. Record the
9692 feasibility/infeasibility of sd into sd, capturing a
9693 feasibility_problem when feasible_p fails, and storing it in sd.
9694 (diagnostic_manager::emit_saved_diagnostics): Update for pass by
9695 ptr rather than by const ref.
9696 * diagnostic-manager.h (class saved_diagnostic): Add new enum
9697 status. Add fields m_status, m_epath_length and m_problem.
9698 (saved_diagnostic::set_feasible): New member function.
9699 (saved_diagnostic::set_infeasible): New member function.
9700 (saved_diagnostic::get_feasibility_problem): New accessor.
9701 (saved_diagnostic::get_status): New accessor.
9702 (saved_diagnostic::set_epath_length): New member function.
9703 (saved_diagnostic::get_epath_length): New accessor.
9704 * engine.cc: Include "gimple-pretty-print.h".
9705 (exploded_path::feasible_p): Add OUT param and, if non-NULL, write
9706 a new feasibility_problem to it on failure.
9707 (viz_callgraph_node::dump_dot): Convert begin_tr calls to
9708 begin_trtd. Convert end_tr calls to end_tdtr.
9709 (class exploded_graph_annotator): New subclass of dot_annotator.
9710 (impl_run_checkers): Add a second -fdump-analyzer-supergraph dump
9711 after the analysis runs, using exploded_graph_annotator. dumping
9712 to DUMP_BASE_NAME.supergraph-eg.dot.
9713 * exploded-graph.h (exploded_node::get_dot_fillcolor): Make
9715 (exploded_path::feasible_p): Add OUT param.
9716 (class feasibility_problem): New class.
9717 * state-purge.cc (state_purge_annotator::add_node_annotations):
9718 Return a bool, add a "within_table" param.
9719 (print_vec_of_names): Convert begin_tr calls to begin_trtd.
9720 Convert end_tr calls to end_tdtr.
9721 (state_purge_annotator::add_stmt_annotations): Add "within_row"
9723 * state-purge.h ((state_purge_annotator::add_node_annotations):
9724 Return a bool, add a "within_table" param.
9725 (state_purge_annotator::add_stmt_annotations): Add "within_row"
9727 * supergraph.cc (supernode::dump_dot): Call add_node_annotations
9728 twice: as before, passing false for "within_table", then again
9729 with true when within the TABLE element. Convert some begin_tr
9730 calls to begin_trtd, and some end_tr calls to end_tdtr.
9731 Repeat each add_stmt_annotations call, distinguishing between
9732 calls that add TRs and those that add TDs to an existing TR.
9733 Add a call to add_after_node_annotations.
9734 * supergraph.h (dot_annotator::add_node_annotations): Add a
9735 "within_table" param.
9736 (dot_annotator::add_stmt_annotations): Add a "within_row" param.
9737 (dot_annotator::add_after_node_annotations): New vfunc.
9739 2020-03-27 David Malcolm <dmalcolm@redhat.com>
9741 * diagnostic-manager.cc (dedupe_winners::add): Show the
9742 exploded_node index in the log messages.
9743 (diagnostic_manager::emit_saved_diagnostics): Log a summary of
9744 m_saved_diagnostics at entry.
9746 2020-03-27 David Malcolm <dmalcolm@redhat.com>
9748 * supergraph.cc (superedge::dump): Add space before description;
9749 move newline to non-pretty_printer overload.
9751 2020-03-18 David Malcolm <dmalcolm@redhat.com>
9753 * region-model.cc: Include "stor-layout.h".
9754 (region_model::dump_to_pp): Rather than calling
9755 dump_summary_of_map on each of the current frame and the globals,
9756 instead get a vec of representative path_vars for all regions,
9757 and then dump a summary of all of them.
9758 (region_model::dump_summary_of_map): Delete, rewriting into...
9759 (region_model::dump_summary_of_rep_path_vars): ...this new
9760 function, working on a vec of path_vars.
9761 (region_model::set_value): New overload.
9762 (region_model::get_representative_path_var): Rename
9763 "parent_region" local to "parent_reg" and consolidate with other
9764 local. Guard test for grandparent being stack on parent_reg being
9765 non-NULL. Move handling for parent being an array_region to
9766 within guard for parent_reg being non-NULL.
9767 (selftest::make_test_compound_type): New function.
9768 (selftest::test_dump_2): New selftest.
9769 (selftest::test_dump_3): New selftest.
9770 (selftest::test_stack_frames): Update expected output from
9771 simplified dump to show "a" and "b" from parent frame and "y" in
9773 (selftest::analyzer_region_model_cc_tests): Call test_dump_2 and
9775 * region-model.h (region_model::set_value): New overload decl.
9776 (region_model::dump_summary_of_map): Delete.
9777 (region_model::dump_summary_of_rep_path_vars): New.
9779 2020-03-18 David Malcolm <dmalcolm@redhat.com>
9781 * region-model.h (class noop_region_model_context): New subclass
9782 of region_model_context.
9783 (class tentative_region_model_context): Inherit from
9784 noop_region_model_context rather than from region_model_context;
9785 drop redundant vfunc implementations.
9786 (class test_region_model_context): Likewise.
9788 2020-03-18 David Malcolm <dmalcolm@redhat.com>
9790 * engine.cc (exploded_node::exploded_node): Move implementation
9791 here from header; accept point_and_state by const reference rather
9793 * exploded-graph.h (exploded_node::exploded_node): Pass
9794 point_and_state by const reference rather than by value. Move
9797 2020-03-18 Jakub Jelinek <jakub@redhat.com>
9799 * sm-malloc.cc (malloc_state_machine::on_stmt): Fix up duplicated word
9801 * region-model.cc (region_model::make_region_for_unexpected_tree_code,
9802 region_model::delete_region_and_descendents): Likewise.
9803 * engine.cc (class exploded_cluster): Likewise.
9804 * diagnostic-manager.cc (class path_builder): Likewise.
9806 2020-03-13 David Malcolm <dmalcolm@redhat.com>
9810 * diagnostic-manager.cc (for_each_state_change): Bulletproof
9811 against errors in get_rvalue by passing a
9812 tentative_region_model_context and rejecting if there's an error.
9813 * region-model.cc (region_model::get_lvalue_1): When handling
9814 ARRAY_REF, handle results of error-handling. Handle NOP_EXPR.
9816 2020-03-06 David Malcolm <dmalcolm@redhat.com>
9818 * analyzer.h (class array_region): New forward decl.
9819 * program-state.cc (selftest::test_program_state_dumping_2): New.
9820 (selftest::analyzer_program_state_cc_tests): Call it.
9821 * region-model.cc (array_region::constant_from_key): New.
9822 (region_model::get_representative_tree): Handle region_svalue by
9823 generating an ADDR_EXPR.
9824 (region_model::get_representative_path_var): In view handling,
9825 remove erroneous TREE_TYPE when determining the type of the tree.
9826 Handle array regions and STRING_CST.
9827 (selftest::assert_dump_tree_eq): New.
9828 (ASSERT_DUMP_TREE_EQ): New macro.
9829 (selftest::test_get_representative_tree): New selftest.
9830 (selftest::analyzer_region_model_cc_tests): Call it.
9831 * region-model.h (region::dyn_cast_array_region): New vfunc.
9832 (array_region::dyn_cast_array_region): New vfunc implementation.
9833 (array_region::constant_from_key): New decl.
9835 2020-03-06 David Malcolm <dmalcolm@redhat.com>
9837 * analyzer.h (dump_quoted_tree): New decl.
9838 * engine.cc (exploded_node::dump_dot): Pass region model to
9839 sm_state_map::print.
9840 * program-state.cc: Include diagnostic-core.h.
9841 (sm_state_map::print): Add "model" param and use it to print
9842 representative trees. Only print origin information if non-null.
9843 (sm_state_map::dump): Pass NULL for model to print call.
9844 (program_state::print): Pass region model to sm_state_map::print.
9845 (program_state::dump_to_pp): Use spaces rather than newlines when
9846 summarizing. Pass region_model to sm_state_map::print.
9847 (ana::selftest::assert_dump_eq): New function.
9848 (ASSERT_DUMP_EQ): New macro.
9849 (ana::selftest::test_program_state_dumping): New function.
9850 (ana::selftest::analyzer_program_state_cc_tests): Call it.
9851 * program-state.h (program_state::print): Add model param.
9852 * region-model.cc (dump_quoted_tree): New function.
9853 (map_region::print_fields): Use dump_quoted_tree rather than
9854 %qE to avoid lang-dependent output.
9855 (map_region::dump_child_label): Likewise.
9856 (region_model::dump_summary_of_map): For SK_REGION, when
9857 get_representative_path_var fails, print the region id rather than
9858 erroneously printing NULL.
9859 * sm.cc (state_machine::get_state_by_name): New function.
9860 * sm.h (state_machine::get_state_by_name): New decl.
9862 2020-03-04 David Malcolm <dmalcolm@redhat.com>
9864 * region-model.cc (region::validate): Convert model param from ptr
9865 to reference. Update comment to reflect that it's now a vfunc.
9866 (map_region::validate): New vfunc implementation.
9867 (array_region::validate): New vfunc implementation.
9868 (stack_region::validate): New vfunc implementation.
9869 (root_region::validate): New vfunc implementation.
9870 (region_model::validate): Pass a reference rather than a pointer
9871 to the region::validate vfunc.
9872 * region-model.h (region::validate): Make virtual. Convert model
9873 param from ptr to reference.
9874 (map_region::validate): New vfunc decl.
9875 (array_region::validate): New vfunc decl.
9876 (stack_region::validate): New vfunc decl.
9877 (root_region::validate): New vfunc decl.
9879 2020-03-04 David Malcolm <dmalcolm@redhat.com>
9882 * region-model.cc (region_model::on_call_pre): Handle
9883 BUILT_IN_EXPECT and its variants.
9884 (region_model::add_any_constraints_from_ssa_def_stmt): Split out
9885 gassign handling into add_any_constraints_from_gassign; add gcall
9887 (region_model::add_any_constraints_from_gassign): New function,
9888 based on the above. Add handling for NOP_EXPR.
9889 (region_model::add_any_constraints_from_gcall): New function.
9890 (region_model::get_representative_path_var): Handle views.
9892 (region_model::add_any_constraints_from_ssa_def_stmt): New decl.
9893 (region_model::add_any_constraints_from_gassign): New decl.
9895 2020-03-04 David Malcolm <dmalcolm@redhat.com>
9898 * checker-path.h (state_change_event::get_lvalue): Add ctxt param
9899 and pass it to region_model::get_value call.
9900 * diagnostic-manager.cc (get_any_origin): Pass a
9901 tentative_region_model_context to the calls to get_lvalue and reject
9902 the comparison if errors occur.
9903 (can_be_expr_of_interest_p): New function.
9904 (diagnostic_manager::prune_for_sm_diagnostic): Replace checks for
9905 CONSTANT_CLASS_P with calls to update_for_unsuitable_sm_exprs.
9906 Pass a tentative_region_model_context to the calls to
9907 state_change_event::get_lvalue and reject the comparison if errors
9909 (diagnostic_manager::update_for_unsuitable_sm_exprs): New.
9910 * diagnostic-manager.h
9911 (diagnostic_manager::update_for_unsuitable_sm_exprs): New decl.
9912 * region-model.h (class tentative_region_model_context): New class.
9914 2020-03-04 David Malcolm <dmalcolm@redhat.com>
9916 * engine.cc (worklist::worklist): Remove unused field m_eg.
9917 (class viz_callgraph_edge): Remove unused field m_call_sedge.
9918 (class viz_callgraph): Remove unused field m_sg.
9919 * exploded-graph.h (worklist::::m_eg): Remove unused field.
9921 2020-03-02 David Malcolm <dmalcolm@redhat.com>
9923 * analyzer.opt (fanalyzer-show-duplicate-count): New option.
9924 * diagnostic-manager.cc
9925 (diagnostic_manager::emit_saved_diagnostic): Use the above to
9926 guard the printing of the duplicate count.
9928 2020-03-02 David Malcolm <dmalcolm@redhat.com>
9931 * analyzer.cc (is_std_function_p): New function.
9932 (is_std_named_call_p): New functions.
9933 * analyzer.h (is_std_named_call_p): New decl.
9934 * sm-malloc.cc (malloc_state_machine::on_stmt): Check for "std::"
9935 variants when checking for malloc, calloc and free.
9937 2020-02-26 David Malcolm <dmalcolm@redhat.com>
9940 * diagnostic-manager.cc
9941 (diagnostic_manager::prune_for_sm_diagnostic): Assert that var is
9942 either NULL or not a constant. When updating var, bulletproof
9943 against constant values.
9945 2020-02-26 David Malcolm <dmalcolm@redhat.com>
9948 * region-model.cc (region_model::get_fndecl_for_call): Gracefully
9949 fail for fn_decls that don't have a cgraph_node.
9951 2020-02-26 David Malcolm <dmalcolm@redhat.com>
9953 * bar-chart.cc: New file.
9954 * bar-chart.h: New file.
9955 * engine.cc: Include "analyzer/bar-chart.h".
9956 (stats::log): Only log the m_num_nodes kinds that are non-zero.
9957 (stats::dump): Likewise when dumping.
9958 (stats::get_total_enodes): New.
9959 (exploded_graph::get_or_create_node): Increment the per-point-data
9960 m_excess_enodes when hitting the per-program-point limit on
9962 (exploded_graph::print_bar_charts): New.
9963 (exploded_graph::log_stats): Log the number of unprocessed enodes
9964 in the worklist. Call print_bar_charts.
9965 (exploded_graph::dump_stats): Print the number of unprocessed
9966 enodes in the worklist.
9967 * exploded-graph.h (stats::get_total_enodes): New decl.
9968 (struct per_program_point_data): Add field m_excess_enodes.
9969 (exploded_graph::print_bar_charts): New decl.
9970 * supergraph.cc (superedge::dump): New.
9971 (superedge::dump): New.
9972 * supergraph.h (supernode::get_function): New.
9973 (superedge::dump): New decl.
9974 (superedge::dump): New decl.
9976 2020-02-24 David Malcolm <dmalcolm@redhat.com>
9978 * engine.cc (exploded_graph::get_or_create_node): Dump the
9979 program_state to the pp, rather than to stderr.
9981 2020-02-24 David Malcolm <dmalcolm@redhat.com>
9984 * sm.cc (make_checkers): Require the "taint" checker to be
9987 2020-02-24 David Malcolm <dmalcolm@redhat.com>
9991 (impl_region_model_context::impl_region_model_context): Add logger
9993 * engine.cc (exploded_graph::add_function_entry): Create an
9994 impl_region_model_context and pass it to the push_frame call.
9995 Bail if the resulting state is invalid.
9996 (exploded_graph::build_initial_worklist): Likewise.
9997 (exploded_graph::build_initial_worklist): Handle the case where
9998 add_function_entry fails.
10000 (impl_region_model_context::impl_region_model_context): Add logger
10002 * region-model.cc (map_region::get_or_create): Add ctxt param and
10003 pass it to add_region_for_type.
10004 (map_region::can_merge_p): Pass NULL as a ctxt to call to
10006 (array_region::get_element): Pass ctxt to call to get_or_create.
10007 (array_region::get_or_create): Add ctxt param and pass it to
10008 add_region_for_type.
10009 (root_region::push_frame): Pass ctxt to get_or_create calls.
10010 (region_model::get_lvalue_1): Likewise.
10011 (region_model::make_region_for_unexpected_tree_code): Assert that
10013 (region_model::get_rvalue_1): Pass ctxt to get_svalue_for_fndecl
10014 and get_svalue_for_label calls.
10015 (region_model::get_svalue_for_fndecl): Add ctxt param and pass it
10016 to get_region_for_fndecl.
10017 (region_model::get_region_for_fndecl): Add ctxt param and pass it
10019 (region_model::get_svalue_for_label): Add ctxt param and pass it
10020 to get_region_for_label.
10021 (region_model::get_region_for_label): Add ctxt param and pass it
10022 to get_region_for_fndecl and get_or_create.
10023 (region_model::get_field_region): Add ctxt param and pass it to
10024 get_or_create_view and get_or_create.
10025 (make_region_for_type): Replace gcc_unreachable with return NULL.
10026 (region_model::add_region_for_type): Add ctxt param. Handle a
10027 return of NULL from make_region_for_type by calling
10028 make_region_for_unexpected_tree_code.
10029 (region_model::get_or_create_mem_ref): Pass ctxt to calls to
10030 get_or_create_view.
10031 (region_model::get_or_create_view): Add ctxt param and pass it to
10032 add_region_for_type.
10033 (selftest::test_state_merging): Pass ctxt to get_or_create_view.
10034 * region-model.h (region_model::get_or_create): Add ctxt param.
10035 (region_model::add_region_for_type): Likewise.
10036 (region_model::get_svalue_for_fndecl): Likewise.
10037 (region_model::get_svalue_for_label): Likewise.
10038 (region_model::get_region_for_fndecl): Likewise.
10039 (region_model::get_region_for_label): Likewise.
10040 (region_model::get_field_region): Likewise.
10041 (region_model::get_or_create_view): Likewise.
10043 2020-02-24 David Malcolm <dmalcolm@redhat.com>
10045 * checker-path.cc (superedge_event::should_filter_p): Update
10046 filter for empty descriptions to cover verbosity level 3 as well
10048 * diagnostic-manager.cc: Include "analyzer/reachability.h".
10049 (class path_builder): New class.
10050 (diagnostic_manager::emit_saved_diagnostic): Create a path_builder
10051 and pass it to build_emission_path, rather passing eg; similarly
10052 for add_events_for_eedge and ext_state.
10053 (diagnostic_manager::build_emission_path): Replace "eg" param
10054 with a path_builder, pass it to add_events_for_eedge.
10055 (diagnostic_manager::add_events_for_eedge): Replace ext_state
10056 param with path_builder; pass it to add_events_for_superedge.
10057 (diagnostic_manager::significant_edge_p): New.
10058 (diagnostic_manager::add_events_for_superedge): Add path_builder
10059 param. Reject insignificant edges at verbosity levels below 3.
10060 (diagnostic_manager::prune_for_sm_diagnostic): Update highest
10061 verbosity level to 4.
10062 * diagnostic-manager.h (class path_builder): New forward decl.
10063 (diagnostic_manager::build_emission_path): Replace "eg" param
10064 with a path_builder.
10065 (diagnostic_manager::add_events_for_eedge): Replace ext_state
10066 param with path_builder.
10067 (diagnostic_manager::significant_edge_p): New.
10068 (diagnostic_manager::add_events_for_superedge): Add path_builder
10070 * reachability.h: New file.
10072 2020-02-18 David Malcolm <dmalcolm@redhat.com>
10075 * analyzer.opt (fdump-analyzer-callgraph): Rewrite description.
10077 2020-02-18 David Malcolm <dmalcolm@redhat.com>
10080 * region-model.cc (region_model::maybe_cast_1): Replace assertion
10081 that build_cast returns non-NULL with a conditional, falling
10082 through to the logic which returns a new unknown value of the
10083 desired type if it fails.
10085 2020-02-18 David Malcolm <dmalcolm@redhat.com>
10088 * engine.cc (impl_region_model_context::on_unknown_tree_code):
10090 (impl_region_model_context::on_unexpected_tree_code): ...this and
10091 convert first argument from path_var to tree.
10092 (exploded_node::on_stmt): Pass ctxt to purge_for_unknown_fncall.
10093 * exploded-graph.h (region_model_context::on_unknown_tree_code):
10095 (region_model_context::on_unexpected_tree_code): ...this and
10096 convert first argument from path_var to tree.
10097 * program-state.cc (sm_state_map::purge_for_unknown_fncall): Add
10098 ctxt param and pass on to calls to get_rvalue.
10099 * program-state.h (sm_state_map::purge_for_unknown_fncall): Add
10101 * region-model.cc (region_model::handle_unrecognized_call): Pass
10102 ctxt on to call to get_rvalue.
10103 (region_model::get_lvalue_1): Move body of default case to
10104 region_model::make_region_for_unexpected_tree_code and call it.
10105 Within COMPONENT_REF case, reject attempts to handle types other
10106 than RECORD_TYPE and UNION_TYPE.
10107 (region_model::make_region_for_unexpected_tree_code): New
10108 function, based on default case of region_model::get_lvalue_1.
10110 (region_model::make_region_for_unexpected_tree_code): New decl.
10111 (region_model::on_unknown_tree_code): Rename to...
10112 (region_model::on_unexpected_tree_code): ...this and convert first
10113 argument from path_var to tree.
10114 (class test_region_model_context): Update vfunc implementation for
10117 2020-02-18 David Malcolm <dmalcolm@redhat.com>
10121 (region_model::convert_byte_offset_to_array_index): Use
10122 int_size_in_bytes before calling size_in_bytes, to gracefully fail
10123 on incomplete types.
10125 2020-02-17 David Malcolm <dmalcolm@redhat.com>
10128 * region-model.cc (region_model::get_fndecl_for_call): Handle the
10129 case where the code_region's get_tree_for_child_region returns
10132 2020-02-17 David Malcolm <dmalcolm@redhat.com>
10135 * engine.cc (impl_region_model_context::on_unknown_tree_code):
10137 (exploded_graph::get_or_create_node): Reject invalid states.
10139 (impl_region_model_context::on_unknown_tree_code): New decl.
10140 (point_and_state::point_and_state): Assert that the state is
10142 * program-state.cc (program_state::program_state): Initialize
10144 (program_state::operator=): Copy m_valid.
10145 (program_state::program_state): Likewise for move constructor.
10146 (program_state::print): Print m_valid.
10147 (program_state::dump_to_pp): Likewise.
10148 * program-state.h (program_state::m_valid): New field.
10149 * region-model.cc (region_model::get_lvalue_1): Implement the
10150 default case by returning a new symbolic region and calling
10151 the context's on_unknown_tree_code, rather than issuing an
10152 internal_error. Implement VIEW_CONVERT_EXPR.
10153 * region-model.h (region_model_context::on_unknown_tree_code): New
10155 (test_region_model_context::on_unknown_tree_code): New.
10157 2020-02-17 David Malcolm <dmalcolm@redhat.com>
10159 * sm-malloc.cc (malloc_diagnostic::describe_state_change): For
10160 transition to the "null" state, only say "assuming" when
10161 transitioning from the "unchecked" state.
10163 2020-02-17 David Malcolm <dmalcolm@redhat.com>
10165 * diagnostic-manager.h (diagnostic_manager::get_saved_diagnostic):
10166 Add const overload.
10167 * engine.cc (exploded_node::dump_dot): Dump saved_diagnostics.
10168 * exploded-graph.h (exploded_graph::get_diagnostic_manager): Add
10171 2020-02-11 David Malcolm <dmalcolm@redhat.com>
10174 * analysis-plan.cc (analysis_plan::use_summary_p): Look through
10175 the ultimate_alias_target when getting the called function.
10176 * engine.cc (exploded_node::on_stmt): Rename second "ctxt" to
10177 "sm_ctxt". Use the region_model's get_fndecl_for_call rather than
10178 gimple_call_fndecl.
10179 * region-model.cc (region_model::get_fndecl_for_call): Use
10180 ultimate_alias_target on fndecl.
10181 * supergraph.cc (get_ultimate_function_for_cgraph_edge): New
10183 (supergraph_call_edge): Use it when rejecting edges without
10185 (supergraph::supergraph): Use it to get the function for the
10186 cgraph_edge when building interprocedural superedges.
10187 (callgraph_superedge::get_callee_function): Use it.
10188 * supergraph.h (supergraph::get_num_snodes): Make param const.
10189 (supergraph::function_to_num_snodes_t): Make first type param
10192 2020-02-11 David Malcolm <dmalcolm@redhat.com>
10195 * engine.cc (exploded_edge::exploded_edge): Add ext_state param
10196 and pass it to change.validate.
10197 (exploded_graph::get_or_create_node): Move purging of change
10198 svalues to also cover the case of reusing an existing enode.
10199 (exploded_graph::add_edge): Pass m_ext_state to exploded_edge's
10201 * exploded-graph.h (exploded_edge::exploded_edge): Add ext_state
10203 * program-state.cc (state_change::sm_change::validate): Likewise.
10204 Assert that m_sm_idx is sane. Use ext_state to validate
10205 m_old_state and m_new_state.
10206 (state_change::validate): Add ext_state param and pass it to
10207 the sm_change validate calls.
10208 * program-state.h (state_change::sm_change::validate): Add
10210 (state_change::validate): Likewise.
10212 2020-02-11 David Malcolm <dmalcolm@redhat.com>
10215 * engine.cc (exploded_graph::dump_exploded_nodes): Handle missing
10216 case of STATUS_WORKLIST in implementation of
10217 "__analyzer_dump_exploded_nodes".
10219 2020-02-11 David Malcolm <dmalcolm@redhat.com>
10222 * constraint-manager.cc (constraint_manager::add_constraint): When
10223 merging equivalence classes and updating m_constant, also update
10225 (constraint_manager::validate): If m_constant is non-NULL assert
10226 that m_cst_sid is non-null and is valid.
10228 2020-02-11 David Malcolm <dmalcolm@redhat.com>
10231 * analyzer.opt (fdump-analyzer): Reword description.
10232 (fdump-analyzer-stderr): Likewise.
10234 2020-02-11 David Malcolm <dmalcolm@redhat.com>
10236 * region-model.cc (print_quoted_type): New function.
10237 (svalue::print): Use it to replace %qT.
10238 (region::dump_to_pp): Likewise.
10239 (region::dump_child_label): Likewise.
10240 (region::print_fields): Likewise.
10242 2020-02-10 David Malcolm <dmalcolm@redhat.com>
10245 * analyzer.opt (-param=analyzer-max-recursion-depth=): Fix "tha"
10247 (Wanalyzer-use-of-uninitialized-value): Fix "initialized" ->
10248 "uninitialized" typo.
10250 2020-02-10 David Malcolm <dmalcolm@redhat.com>
10253 * region-model.cc (region_model::get_lvalue_1):
10254 Handle BIT_FIELD_REF.
10255 (make_region_for_type): Handle VECTOR_TYPE.
10257 2020-02-10 David Malcolm <dmalcolm@redhat.com>
10260 * diagnostic-manager.cc
10261 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof against
10262 VAR being constant.
10263 * region-model.cc (region_model::get_lvalue_1): Provide a better
10264 error message when encountering an unhandled tree code.
10266 2020-02-10 David Malcolm <dmalcolm@redhat.com>
10269 * region-model.cc (region_model::get_lvalue_1): Implement
10272 2020-02-06 David Malcolm <dmalcolm@redhat.com>
10274 * region-model.cc (region_model::maybe_cast_1): Attempt to provide
10275 a region_svalue if either type is a pointer, rather than if both
10276 types are pointers.
10278 2020-02-05 David Malcolm <dmalcolm@redhat.com>
10280 * engine.cc (exploded_node::dump_dot): Show merger enodes.
10281 (worklist::add_node): Assert that the node's m_status is
10283 (exploded_graph::process_worklist): Likewise for nodes from the
10284 worklist. Set status of merged nodes to STATUS_MERGER.
10285 (exploded_graph::process_node): Set status of node to
10287 (exploded_graph::dump_exploded_nodes): Rework handling of
10288 "__analyzer_dump_exploded_nodes", splitting enodes by status into
10289 "processed" and "merger", showing the count of just the processed
10290 enodes at the call, rather than the count of all enodes.
10291 * exploded-graph.h (exploded_node::status): New enum.
10292 (exploded_node::exploded_node): Initialize m_status to
10294 (exploded_node::get_status): New getter.
10295 (exploded_node::set_status): New setter.
10297 2020-02-04 David Malcolm <dmalcolm@redhat.com>
10300 * engine.cc (pod_hash_traits<function_call_string>::mark_empty):
10301 Eliminate reinterpret_cast.
10302 (pod_hash_traits<function_call_string>::is_empty): Likewise.
10304 2020-02-03 David Malcolm <dmalcolm@redhat.com>
10306 * constraint-manager.cc (range::constrained_to_single_element):
10307 Replace fold_build2 with fold_binary. Remove unnecessary newline.
10308 (constraint_manager::get_or_add_equiv_class): Replace fold_build2
10309 with fold_binary in two places, and remove out-of-date comment.
10310 (constraint_manager::eval_condition): Replace fold_build2 with
10312 * region-model.cc (constant_svalue::eval_condition): Likewise.
10313 (region_model::on_assignment): Likewise.
10315 2020-02-03 David Malcolm <dmalcolm@redhat.com>
10318 * diagnostic-manager.cc
10319 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof
10320 against bad choices due to bad paths.
10321 * engine.cc (impl_region_model_context::on_phi): New.
10322 * exploded-graph.h (impl_region_model_context::on_phi): New decl.
10323 * region-model.cc (region_model::on_longjmp): Likewise.
10324 (region_model::handle_phi): Add phi param. Call the ctxt's on_phi
10326 (region_model::update_for_phis): Pass phi to handle_phi.
10327 * region-model.h (region_model::handle_phi): Add phi param.
10328 (region_model_context::on_phi): New vfunc.
10329 (test_region_model_context::on_phi): New.
10330 * sm-malloc.cc (malloc_state_machine::on_phi): New.
10331 (malloc_state_machine::on_zero_assignment): New.
10332 * sm.h (state_machine::on_phi): New vfunc.
10334 2020-02-03 David Malcolm <dmalcolm@redhat.com>
10336 * engine.cc (supernode_cluster::dump_dot): Show BB index as
10338 * supergraph.cc (supernode::dump_dot): Likewise.
10340 2020-02-03 David Malcolm <dmalcolm@redhat.com>
10343 * region-model.cc (region_model::on_call_pre): Update for new
10344 param of symbolic_region ctor.
10345 (region_model::deref_rvalue): Likewise.
10346 (region_model::add_new_malloc_region): Likewise.
10347 (make_region_for_type): Likewise, preserving type.
10348 * region-model.h (symbolic_region::symbolic_region): Add "type"
10349 param and pass it to base class ctor.
10351 2020-02-03 David Malcolm <dmalcolm@redhat.com>
10354 * constraint-manager.cc
10355 (constraint_manager::get_or_add_equiv_class): Ensure types are
10356 compatible before comparing constants.
10358 2020-01-31 David Malcolm <dmalcolm@redhat.com>
10361 * region-model.cc (make_region_for_type): Use VOID_TYPE_P rather
10362 than checking against void_type_node.
10364 2020-01-31 David Malcolm <dmalcolm@redhat.com>
10367 * region-model.cc (ASSERT_COMPAT_TYPES): Convert to...
10368 (assert_compat_types): ...this, and bail when either type is NULL,
10369 or when VOID_TYPE_P (dst_type).
10370 (region_model::get_lvalue): Update for above conversion.
10371 (region_model::get_rvalue): Likewise.
10373 2020-01-31 David Malcolm <dmalcolm@redhat.com>
10376 * region-model.cc (region_model::update_for_return_superedge):
10377 Move check for null result so that it also guards setting the
10380 2020-01-31 David Malcolm <dmalcolm@redhat.com>
10383 * region-model.cc (stack_region::can_merge_p): Split into a two
10384 pass approach, creating all stack regions first, then populating
10386 (selftest::test_state_merging): Add test coverage for (a) the case
10387 of self-merging a model in which a local in an older stack frame
10388 points to a local in a more recent stack frame (which previously
10389 would ICE), and (b) the case of self-merging a model in which a
10390 local points to a global (which previously worked OK).
10392 2020-01-31 David Malcolm <dmalcolm@redhat.com>
10394 * analyzer.cc (is_named_call_p): Replace tests for fndecl being
10395 extern at file scope and having a non-NULL DECL_NAME with a call
10396 to maybe_special_function_p.
10397 * function-set.cc (function_set::contains_decl_p): Add call to
10398 maybe_special_function_p.
10400 2020-01-31 David Malcolm <dmalcolm@redhat.com>
10403 * constraint-manager.cc
10404 (constraint_manager::get_or_add_equiv_class): Only compare constants
10405 if their types are compatible.
10406 * region-model.cc (constant_svalue::eval_condition): Replace check
10407 for identical types with call to types_compatible_p.
10409 2020-01-30 David Malcolm <dmalcolm@redhat.com>
10411 * program-state.cc (extrinsic_state::dump_to_pp): New.
10412 (extrinsic_state::dump_to_file): New.
10413 (extrinsic_state::dump): New.
10414 * program-state.h (extrinsic_state::dump_to_pp): New decl.
10415 (extrinsic_state::dump_to_file): New decl.
10416 (extrinsic_state::dump): New decl.
10417 * sm.cc: Include "pretty-print.h".
10418 (state_machine::dump_to_pp): New.
10419 * sm.h (state_machine::dump_to_pp): New decl.
10421 2020-01-30 David Malcolm <dmalcolm@redhat.com>
10423 * diagnostic-manager.cc (for_each_state_change): Use
10424 extrinsic_state::get_num_checkers rather than accessing m_checkers
10426 * program-state.cc (program_state::program_state): Likewise.
10427 * program-state.h (extrinsic_state::m_checkers): Make private.
10429 2020-01-30 David Malcolm <dmalcolm@redhat.com>
10432 * region-model.cc (region_model::eval_condition): In both
10433 overloads, bail out immediately on floating-point types.
10434 (region_model::eval_condition_without_cm): Likewise.
10435 (region_model::add_constraint): Likewise.
10437 2020-01-30 David Malcolm <dmalcolm@redhat.com>
10440 * program-state.cc (sm_state_map::set_state): For the overload
10441 taking an svalue_id, bail out if the set_state on the ec does
10442 nothing. Convert the latter's return type from void to bool,
10443 returning true if anything changed.
10444 (sm_state_map::impl_set_state): Convert the return type from void
10445 to bool, returning true if the state changed.
10446 * program-state.h (sm_state_map::set_state): Convert return type
10448 (sm_state_map::impl_set_state): Likewise.
10449 * region-model.cc (constant_svalue::eval_condition): Only call
10450 fold_build2 if the types are the same.
10452 2020-01-29 Jakub Jelinek <jakub@redhat.com>
10454 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Remove.
10455 * constraint-manager.cc: Include diagnostic-core.h before graphviz.h.
10456 (range::dump, equiv_class::print): Don't use PUSH_IGNORE_WFORMAT or
10457 POP_IGNORE_WFORMAT.
10458 * state-purge.cc: Include diagnostic-core.h before
10459 gimple-pretty-print.h.
10460 (state_purge_annotator::add_node_annotations, print_vec_of_names):
10461 Don't use PUSH_IGNORE_WFORMAT or POP_IGNORE_WFORMAT.
10462 * region-model.cc: Move diagnostic-core.h include before graphviz.h.
10463 (path_var::dump, svalue::print, constant_svalue::print_details,
10464 region::dump_to_pp, region::dump_child_label, region::print_fields,
10465 map_region::print_fields, map_region::dump_dot_to_pp,
10466 map_region::dump_child_label, array_region::print_fields,
10467 array_region::dump_dot_to_pp): Don't use PUSH_IGNORE_WFORMAT or
10468 POP_IGNORE_WFORMAT.
10470 2020-01-28 David Malcolm <dmalcolm@redhat.com>
10473 * engine.cc (rewind_info_t::update_model): Get the longjmp call
10474 stmt via get_longjmp_call () rather than assuming it is the last
10475 stmt in the longjmp's supernode.
10476 (rewind_info_t::add_events_to_path): Get the location_t for the
10477 rewind_from_longjmp_event via get_longjmp_call () rather than from
10478 the supernode's get_end_location ().
10480 2020-01-28 David Malcolm <dmalcolm@redhat.com>
10482 * region-model.cc (poisoned_value_diagnostic::emit): Update for
10483 renaming of warning_at overload to warning_meta.
10484 * sm-file.cc (file_leak::emit): Likewise.
10485 * sm-malloc.cc (double_free::emit): Likewise.
10486 (possible_null_deref::emit): Likewise.
10487 (possible_null_arg::emit): Likewise.
10488 (null_deref::emit): Likewise.
10489 (null_arg::emit): Likewise.
10490 (use_after_free::emit): Likewise.
10491 (malloc_leak::emit): Likewise.
10492 (free_of_non_heap::emit): Likewise.
10493 * sm-sensitive.cc (exposure_through_output_file::emit): Likewise.
10494 * sm-signal.cc (signal_unsafe_call::emit): Likewise.
10495 * sm-taint.cc (tainted_array_index::emit): Likewise.
10497 2020-01-27 David Malcolm <dmalcolm@redhat.com>
10500 * region-model.cc (tree_cmp): For the REAL_CST case, impose an
10501 arbitrary order on NaNs relative to other NaNs and to non-NaNs;
10502 const-correctness tweak.
10503 (ana::selftests::build_real_cst_from_string): New function.
10504 (ana::selftests::append_interesting_constants): New function.
10505 (ana::selftests::test_tree_cmp_on_constants): New test.
10506 (ana::selftests::test_canonicalization_4): New test.
10507 (ana::selftests::analyzer_region_model_cc_tests): Call the new
10510 2020-01-27 David Malcolm <dmalcolm@redhat.com>
10513 * engine.cc (run_checkers): Save and restore input_location.
10515 2020-01-27 David Malcolm <dmalcolm@redhat.com>
10517 * call-string.cc (call_string::cmp_1): Delete, moving body to...
10518 (call_string::cmp): ...here.
10519 * call-string.h (call_string::cmp_1): Delete decl.
10520 * engine.cc (worklist::key_t::cmp_1): Delete, moving body to...
10521 (worklist::key_t::cmp): ...here. Implement hash comparisons
10522 via comparison rather than subtraction to avoid overflow issues.
10523 * exploded-graph.h (worklist::key_t::cmp_1): Delete decl.
10524 * region-model.cc (tree_cmp): Eliminate buggy checking for
10527 2020-01-27 David Malcolm <dmalcolm@redhat.com>
10529 * analyzer.cc (is_named_call_p): Check that fndecl is "extern"
10530 and at file scope. Potentially disregard prefix _ or __ in
10531 fndecl's name. Bail if the identifier is NULL.
10532 (is_setjmp_call_p): Expect a gcall rather than plain gimple.
10533 Remove special-case check for leading prefix, and also check for
10535 (is_longjmp_call_p): Also check for siglongjmp.
10536 (get_user_facing_name): New function.
10537 * analyzer.h (is_setjmp_call_p): Expect a gcall rather than plain
10539 (get_user_facing_name): New decl.
10540 * checker-path.cc (setjmp_event::get_desc): Use
10541 get_user_facing_name to avoid hardcoding the function name.
10542 (rewind_event::rewind_event): Add rewind_info param, using it to
10543 initialize new m_rewind_info field, and strengthen the assertion.
10544 (rewind_from_longjmp_event::get_desc): Use get_user_facing_name to
10545 avoid hardcoding the function name.
10546 (rewind_to_setjmp_event::get_desc): Likewise.
10547 * checker-path.h (setjmp_event::setjmp_event): Add setjmp_call
10548 param and use it to initialize...
10549 (setjmp_event::m_setjmp_call): New field.
10550 (rewind_event::rewind_event): Add rewind_info param.
10551 (rewind_event::m_rewind_info): New protected field.
10552 (rewind_from_longjmp_event::rewind_from_longjmp_event): Add
10554 (class rewind_to_setjmp_event): Move rewind_info field to parent
10556 * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
10557 Update setjmp-handling for is_setjmp_call_p requiring a gcall;
10558 pass the call to the new setjmp_event.
10559 * engine.cc (exploded_node::on_stmt): Update for is_setjmp_call_p
10561 (stale_jmp_buf::emit): Use get_user_facing_name to avoid
10562 hardcoding the function names.
10563 (exploded_node::on_longjmp): Pass the longjmp_call when
10564 constructing rewind_info.
10565 (rewind_info_t::add_events_to_path): Pass the rewind_info_t to the
10566 rewind_from_longjmp_event's ctor.
10567 * exploded-graph.h (rewind_info_t::rewind_info_t): Add
10568 longjmp_call param.
10569 (rewind_info_t::get_longjmp_call): New.
10570 (rewind_info_t::m_longjmp_call): New.
10571 * region-model.cc (region_model::on_setjmp): Update comment to
10572 indicate this is also for sigsetjmp.
10573 * region-model.h (struct setjmp_record): Likewise.
10574 (class setjmp_svalue): Likewise.
10576 2020-01-27 David Malcolm <dmalcolm@redhat.com>
10579 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Guard these
10580 macros with GCC_VERSION >= 4006, making them no-op otherwise.
10581 * engine.cc (exploded_edge::exploded_edge): Specify template for
10582 base class initializer.
10583 (exploded_graph::add_edge): Specify template when chaining up to
10584 base class add_edge implementation.
10585 (viz_callgraph_node::dump_dot): Drop redundant "typename".
10586 (viz_callgraph_edge::viz_callgraph_edge): Specify template for
10587 base class initializer.
10588 * program-state.cc (sm_state_map::clone_with_remapping): Drop
10589 redundant "typename".
10590 (sm_state_map::print): Likewise.
10591 (sm_state_map::hash): Likewise.
10592 (sm_state_map::operator==): Likewise.
10593 (sm_state_map::remap_svalue_ids): Likewise.
10594 (sm_state_map::on_svalue_purge): Likewise.
10595 (sm_state_map::validate): Likewise.
10596 * program-state.h (sm_state_map::iterator_t): Likewise.
10597 * supergraph.h (superedge::superedge): Specify template for base
10600 2020-01-23 David Malcolm <dmalcolm@redhat.com>
10603 * supergraph.cc (callgraph_superedge::get_arg_for_parm): Fail
10604 gracefully is the number of parameters at the callee exceeds the
10605 number of arguments at the call stmt.
10606 (callgraph_superedge::get_parm_for_arg): Likewise.
10608 2020-01-22 David Malcolm <dmalcolm@redhat.com>
10611 * program-state.cc (sm_state_map::on_svalue_purge): If the
10612 entry survives, but the origin is being purged, then reset the
10615 2020-01-22 David Malcolm <dmalcolm@redhat.com>
10617 * sm-signal.cc: Fix nesting of CHECKING_P and namespace ana.
10619 2020-01-22 David Malcolm <dmalcolm@redhat.com>
10622 * engine.cc (setjmp_svalue::compare_fields): Update for
10623 replacement of m_enode with m_setjmp_record.
10624 (setjmp_svalue::add_to_hash): Likewise.
10625 (setjmp_svalue::get_index): Rename...
10626 (setjmp_svalue::get_enode_index): ...to this.
10627 (setjmp_svalue::print_details): Update for replacement of m_enode
10628 with m_setjmp_record.
10629 (exploded_node::on_longjmp): Likewise.
10630 * exploded-graph.h (rewind_info_t::m_enode_origin): Replace...
10631 (rewind_info_t::m_setjmp_record): ...with this.
10632 (rewind_info_t::rewind_info_t): Update for replacement of m_enode
10633 with m_setjmp_record.
10634 (rewind_info_t::get_setjmp_point): Likewise.
10635 (rewind_info_t::get_setjmp_call): Likewise.
10636 * region-model.cc (region_model::dump_summary_of_map): Likewise.
10637 (region_model::on_setjmp): Likewise.
10638 * region-model.h (struct setjmp_record): New struct.
10639 (setjmp_svalue::m_enode): Replace...
10640 (setjmp_svalue::m_setjmp_record): ...with this.
10641 (setjmp_svalue::setjmp_svalue): Update for replacement of m_enode
10642 with m_setjmp_record.
10643 (setjmp_svalue::clone): Likewise.
10644 (setjmp_svalue::get_index): Rename...
10645 (setjmp_svalue::get_enode_index): ...to this.
10646 (setjmp_svalue::get_exploded_node): Replace...
10647 (setjmp_svalue::get_setjmp_record): ...with this.
10649 2020-01-22 David Malcolm <dmalcolm@redhat.com>
10652 * analyzer.cc (is_setjmp_call_p): Check for "setjmp" as well as
10655 2020-01-22 David Malcolm <dmalcolm@redhat.com>
10658 * analysis-plan.h: Wrap everything namespace "ana".
10659 * analyzer-logging.cc: Likewise.
10660 * analyzer-logging.h: Likewise.
10661 * analyzer-pass.cc (pass_analyzer::execute): Update for "ana"
10663 * analyzer-selftests.cc: Wrap everything namespace "ana".
10664 * analyzer-selftests.h: Likewise.
10665 * analyzer.h: Likewise for forward decls of types.
10666 * call-string.h: Likewise.
10667 * checker-path.cc: Likewise.
10668 * checker-path.h: Likewise.
10669 * constraint-manager.cc: Likewise.
10670 * constraint-manager.h: Likewise.
10671 * diagnostic-manager.cc: Likewise.
10672 * diagnostic-manager.h: Likewise.
10673 * engine.cc: Likewise.
10674 * engine.h: Likewise.
10675 * exploded-graph.h: Likewise.
10676 * function-set.cc: Likewise.
10677 * function-set.h: Likewise.
10678 * pending-diagnostic.cc: Likewise.
10679 * pending-diagnostic.h: Likewise.
10680 * program-point.cc: Likewise.
10681 * program-point.h: Likewise.
10682 * program-state.cc: Likewise.
10683 * program-state.h: Likewise.
10684 * region-model.cc: Likewise.
10685 * region-model.h: Likewise.
10686 * sm-file.cc: Likewise.
10687 * sm-malloc.cc: Likewise.
10688 * sm-pattern-test.cc: Likewise.
10689 * sm-sensitive.cc: Likewise.
10690 * sm-signal.cc: Likewise.
10691 * sm-taint.cc: Likewise.
10694 * state-purge.h: Likewise.
10695 * supergraph.cc: Likewise.
10696 * supergraph.h: Likewise.
10698 2020-01-21 David Malcolm <dmalcolm@redhat.com>
10701 * region-model.cc (int_cmp): Rename to...
10702 (array_region::key_cmp): ...this, using key_t rather than int.
10703 Rewrite in terms of comparisons rather than subtraction to
10704 ensure qsort is anti-symmetric when handling extreme values.
10705 (array_region::walk_for_canonicalization): Update for above
10707 * region-model.h (array_region::key_cmp): New decl.
10709 2020-01-17 David Malcolm <dmalcolm@redhat.com>
10712 * region-model.cc (region_model::eval_condition_without_cm): Avoid
10713 gcc_unreachable for unexpected operations for the case where
10714 we're comparing an svalue against itself.
10716 2020-01-17 David Malcolm <dmalcolm@redhat.com>
10720 (region_model::convert_byte_offset_to_array_index): Convert to
10721 ssizetype before dividing by byte_size. Use fold_binary rather
10722 than fold_build2 to avoid needlessly constructing a tree for the
10725 2020-01-15 David Malcolm <dmalcolm@redhat.com>
10727 * engine.cc (class impl_region_model_context): Fix comment.
10729 2020-01-14 David Malcolm <dmalcolm@redhat.com>
10732 * region-model.cc (make_region_for_type): Use
10733 FUNC_OR_METHOD_TYPE_P rather than comparing against FUNCTION_TYPE.
10734 * region-model.h (function_region::function_region): Likewise.
10736 2020-01-14 David Malcolm <dmalcolm@redhat.com>
10738 * program-state.cc (sm_state_map::clone_with_remapping): Copy
10740 (selftest::test_program_state_merging_2): New selftest.
10741 (selftest::analyzer_program_state_cc_tests): Call it.
10743 2020-01-14 David Malcolm <dmalcolm@redhat.com>
10745 * checker-path.h (checker_path::get_checker_event): New function.
10746 (checker_path): Add DISABLE_COPY_AND_ASSIGN; make fields private.
10747 * diagnostic-manager.cc
10748 (diagnostic_manager::prune_for_sm_diagnostic): Replace direct
10749 access to checker_path::m_events with accessor functions. Fix
10751 (diagnostic_manager::prune_interproc_events): Replace direct
10752 access to checker_path::m_events with accessor functions.
10753 (diagnostic_manager::finish_pruning): Likewise.
10755 2020-01-14 David Malcolm <dmalcolm@redhat.com>
10757 * checker-path.h (checker_event::clone): Delete vfunc decl.
10758 (debug_event::clone): Delete vfunc impl.
10759 (custom_event::clone): Delete vfunc impl.
10760 (statement_event::clone): Delete vfunc impl.
10761 (function_entry_event::clone): Delete vfunc impl.
10762 (state_change_event::clone): Delete vfunc impl.
10763 (start_cfg_edge_event::clone): Delete vfunc impl.
10764 (end_cfg_edge_event::clone): Delete vfunc impl.
10765 (call_event::clone): Delete vfunc impl.
10766 (return_event::clone): Delete vfunc impl.
10767 (setjmp_event::clone): Delete vfunc impl.
10768 (rewind_from_longjmp_event::clone): Delete vfunc impl.
10769 (rewind_to_setjmp_event::clone): Delete vfunc impl.
10770 (warning_event::clone): Delete vfunc impl.
10772 2020-01-14 David Malcolm <dmalcolm@redhat.com>
10774 * supergraph.cc (supernode::dump_dot): Ensure that the TABLE
10775 element has at least one TR.
10777 2020-01-14 David Malcolm <dmalcolm@redhat.com>
10780 * engine.cc (leak_stmt_finder::find_stmt): Use get_pure_location
10781 when comparing against UNKNOWN_LOCATION.
10782 (stmt_requires_new_enode_p): Likewise.
10783 (exploded_graph::dump_exploded_nodes): Likewise.
10784 * supergraph.cc (supernode::get_start_location): Likewise.
10785 (supernode::get_end_location): Likewise.
10787 2020-01-14 David Malcolm <dmalcolm@redhat.com>
10790 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
10791 selftest::analyzer_sm_file_cc_tests.
10792 * analyzer-selftests.h (selftest::analyzer_sm_file_cc_tests): New
10794 * sm-file.cc: Include "analyzer/function-set.h" and
10795 "analyzer/analyzer-selftests.h".
10796 (get_file_using_fns): New function.
10797 (is_file_using_fn_p): New function.
10798 (fileptr_state_machine::on_stmt): Return true for known functions.
10799 (selftest::analyzer_sm_file_cc_tests): New function.
10801 2020-01-14 David Malcolm <dmalcolm@redhat.com>
10803 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
10804 selftest::analyzer_sm_signal_cc_tests.
10805 * analyzer-selftests.h (selftest::analyzer_sm_signal_cc_tests):
10807 * sm-signal.cc: Include "analyzer/function-set.h" and
10808 "analyzer/analyzer-selftests.h".
10809 (get_async_signal_unsafe_fns): New function.
10810 (signal_unsafe_p): Reimplement in terms of the above.
10811 (selftest::analyzer_sm_signal_cc_tests): New function.
10813 2020-01-14 David Malcolm <dmalcolm@redhat.com>
10815 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
10816 selftest::analyzer_function_set_cc_tests.
10817 * analyzer-selftests.h (selftest::analyzer_function_set_cc_tests):
10819 * function-set.cc: New file.
10820 * function-set.h: New file.
10822 2020-01-14 David Malcolm <dmalcolm@redhat.com>
10824 * analyzer.h (fndecl_has_gimple_body_p): New decl.
10825 * engine.cc (impl_region_model_context::on_unknown_change): New
10827 (fndecl_has_gimple_body_p): Make non-static.
10828 (exploded_node::on_stmt): Treat __analyzer_dump_exploded_nodes as
10829 known. Track whether we have a call with unknown side-effects and
10830 pass it to on_call_post.
10831 * exploded-graph.h (impl_region_model_context::on_unknown_change):
10833 * program-state.cc (sm_state_map::on_unknown_change): New function.
10834 * program-state.h (sm_state_map::on_unknown_change): New decl.
10835 * region-model.cc: Include "bitmap.h".
10836 (region_model::on_call_pre): Return a bool, capturing whether the
10837 call has unknown side effects.
10838 (region_model::on_call_post): Add arg "bool unknown_side_effects"
10839 and if true, call handle_unrecognized_call.
10840 (class reachable_regions): New class.
10841 (region_model::handle_unrecognized_call): New function.
10842 * region-model.h (region_model::on_call_pre): Return a bool.
10843 (region_model::on_call_post): Add arg "bool unknown_side_effects".
10844 (region_model::handle_unrecognized_call): New decl.
10845 (region_model_context::on_unknown_change): New vfunc.
10846 (test_region_model_context::on_unknown_change): New function.
10848 2020-01-14 David Malcolm <dmalcolm@redhat.com>
10850 * diagnostic-manager.cc (saved_diagnostic::operator==): Move here
10851 from header. Replace pointer equality test on m_var with call to
10852 pending_diagnostic::same_tree_p.
10853 * diagnostic-manager.h (saved_diagnostic::operator==): Move to
10854 diagnostic-manager.cc.
10855 * pending-diagnostic.cc (pending_diagnostic::same_tree_p): New.
10856 * pending-diagnostic.h (pending_diagnostic::same_tree_p): New.
10857 * sm-file.cc (file_diagnostic::subclass_equal_p): Replace pointer
10858 equality on m_arg with call to pending_diagnostic::same_tree_p.
10859 * sm-malloc.cc (malloc_diagnostic::subclass_equal_p): Likewise.
10860 (possible_null_arg::subclass_equal_p): Likewise.
10861 (null_arg::subclass_equal_p): Likewise.
10862 (free_of_non_heap::subclass_equal_p): Likewise.
10863 * sm-pattern-test.cc (pattern_match::operator==): Likewise.
10864 * sm-sensitive.cc (exposure_through_output_file::operator==):
10866 * sm-taint.cc (tainted_array_index::operator==): Likewise.
10868 2020-01-14 David Malcolm <dmalcolm@redhat.com>
10870 * diagnostic-manager.cc (dedupe_winners::add): Add logging
10871 of deduplication decisions made.
10873 2020-01-14 David Malcolm <dmalcolm@redhat.com>
10875 * ChangeLog: New file.
10876 * analyzer-selftests.cc: New file.
10877 * analyzer-selftests.h: New file.
10878 * analyzer.opt: New file.
10879 * analysis-plan.cc: New file.
10880 * analysis-plan.h: New file.
10881 * analyzer-logging.cc: New file.
10882 * analyzer-logging.h: New file.
10883 * analyzer-pass.cc: New file.
10884 * analyzer.cc: New file.
10885 * analyzer.h: New file.
10886 * call-string.cc: New file.
10887 * call-string.h: New file.
10888 * checker-path.cc: New file.
10889 * checker-path.h: New file.
10890 * constraint-manager.cc: New file.
10891 * constraint-manager.h: New file.
10892 * diagnostic-manager.cc: New file.
10893 * diagnostic-manager.h: New file.
10894 * engine.cc: New file.
10895 * engine.h: New file.
10896 * exploded-graph.h: New file.
10897 * pending-diagnostic.cc: New file.
10898 * pending-diagnostic.h: New file.
10899 * program-point.cc: New file.
10900 * program-point.h: New file.
10901 * program-state.cc: New file.
10902 * program-state.h: New file.
10903 * region-model.cc: New file.
10904 * region-model.h: New file.
10905 * sm-file.cc: New file.
10906 * sm-malloc.cc: New file.
10907 * sm-malloc.dot: New file.
10908 * sm-pattern-test.cc: New file.
10909 * sm-sensitive.cc: New file.
10910 * sm-signal.cc: New file.
10911 * sm-taint.cc: New file.
10914 * state-purge.cc: New file.
10915 * state-purge.h: New file.
10916 * supergraph.cc: New file.
10917 * supergraph.h: New file.
10919 2019-12-13 David Malcolm <dmalcolm@redhat.com>
10924 Copyright (C) 2019-2023 Free Software Foundation, Inc.
10926 Copying and distribution of this file, with or without modification,
10927 are permitted in any medium without royalty provided the copyright
10928 notice and this notice are preserved.