1 2022-11-11 David Malcolm <dmalcolm@redhat.com>
3 * sm-fd.dot: Fix typo in comment.
4 * sm-file.dot: New file.
5 * varargs.cc: Fix typo in comment.
6 * varargs.dot: New file.
8 2022-11-11 David Malcolm <dmalcolm@redhat.com>
10 * checker-path.h: Split out checker_event and its subclasses to...
11 * checker-event.h: ...this new header.
13 2022-11-11 David Malcolm <dmalcolm@redhat.com>
16 * analyzer.opt (Wanalyzer-infinite-recursion): New.
17 * call-string.cc (call_string::count_occurrences_of_function):
19 * call-string.h (call_string::count_occurrences_of_function): New
21 * checker-path.cc (function_entry_event::function_entry_event):
23 (checker_path::add_final_event): Delete.
24 * checker-path.h (function_entry_event::function_entry_event): New
26 (function_entry_event::get_desc): Drop "final".
27 (checker_path::add_final_event): Delete.
28 * diagnostic-manager.cc
29 (diagnostic_manager::emit_saved_diagnostic): Create the final
30 event via a new pending_diagnostic::add_final_event vfunc, rather
31 than checker_path::add_final_event.
32 (diagnostic_manager::add_events_for_eedge): Create function entry
33 events via a new pending_diagnostic::add_function_entry_event
35 * engine.cc (exploded_graph::process_node): When creating a new
36 PK_BEFORE_SUPERNODE node, call
37 exploded_graph::detect_infinite_recursion on it after adding the
39 * exploded-graph.h (exploded_graph::detect_infinite_recursion):
41 (exploded_graph::find_previous_entry_to): New decl.
42 * infinite-recursion.cc: New file.
43 * pending-diagnostic.cc
44 (pending_diagnostic::add_function_entry_event): New.
45 (pending_diagnostic::add_final_event): New.
46 * pending-diagnostic.h
47 (pending_diagnostic::add_function_entry_event): New vfunc.
48 (pending_diagnostic::add_final_event): New vfunc.
50 2022-11-10 David Malcolm <dmalcolm@redhat.com>
53 * analyzer.opt (Wanalyzer-deref-before-check): New warning.
54 * diagnostic-manager.cc
55 (null_assignment_sm_context::set_next_state): Only add state
56 change events for transition to "null" state.
57 (null_assignment_sm_context::is_transition_to_null): New.
58 * engine.cc (impl_region_model_context::on_pop_frame): New.
59 * exploded-graph.h (impl_region_model_context::on_pop_frame): New
61 * program-state.cc (sm_state_map::clear_any_state): New.
62 (sm_state_map::can_merge_with_p): New.
63 (program_state::can_merge_with_p): Replace requirement that
64 sm-states be equal in favor of an attempt to merge them.
65 * program-state.h (sm_state_map::clear_any_state): New decl.
66 (sm_state_map::can_merge_with_p): New decl.
67 * region-model.cc (region_model::eval_condition): Make const.
68 (region_model::pop_frame): Call ctxt->on_pop_frame.
69 * region-model.h (region_model::eval_condition): Make const.
70 (region_model_context::on_pop_frame): New vfunc.
71 (noop_region_model_context::on_pop_frame): New.
72 (region_model_context_decorator::on_pop_frame): New.
73 * sm-malloc.cc (enum resource_state): Add RS_ASSUMED_NON_NULL.
74 (allocation_state::dump_to_pp): Drop "final".
75 (struct assumed_non_null_state): New subclass.
76 (malloc_state_machine::m_assumed_non_null): New.
77 (assumed_non_null_p): New.
78 (class deref_before_check): New.
79 (assumed_non_null_state::dump_to_pp): New.
80 (malloc_state_machine::get_or_create_assumed_non_null_state_for_frame):
82 (malloc_state_machine::maybe_assume_non_null): New.
83 (malloc_state_machine::on_stmt): Transition from start state to
84 "assumed-non-null" state for pointers passed to
85 __attribute__((nonnull)) arguments, and for pointers explicitly
86 dereferenced. Call maybe_complain_about_deref_before_check for
87 pointers explicitly compared against NULL.
88 (malloc_state_machine::maybe_complain_about_deref_before_check):
90 (malloc_state_machine::on_deallocator_call): Also transition
91 "assumed-non-null" states to "freed".
92 (malloc_state_machine::on_pop_frame): New.
93 (malloc_state_machine::maybe_get_merged_states_nonequal): New.
94 * sm-malloc.dot: Update for changes to sm-malloc.cc.
95 * sm.h (state_machine::on_pop_frame): New.
96 (state_machine::maybe_get_merged_state): New.
97 (state_machine::maybe_get_merged_states_nonequal): New.
99 2022-11-09 David Malcolm <dmalcolm@redhat.com>
101 * checker-path.cc (checker_event::debug): New.
102 (checker_path::add_event): Move here from checker-path.h. Add
104 * checker-path.h (checker_event::debug): New decl.
105 (checker_path::checker_path): Add logger param.
106 (checker_path::add_event): Move definition from here to
108 (checker_path::m_logger): New field.
109 * diagnostic-manager.cc
110 (diagnostic_manager::emit_saved_diagnostic): Pass logger to
112 (diagnostic_manager::add_events_for_eedge): Log scope when
113 processing a run of stmts.
115 2022-11-08 David Malcolm <dmalcolm@redhat.com>
118 * region-model-impl-calls.cc: Update comment.
119 * region-model.cc (region_model::check_symbolic_bounds): Fix
120 layout of "void" return. Replace usage of
121 eval_condition_without_cm with eval_condition.
122 (region_model::eval_condition): Take over body of...
123 (region_model::eval_condition_without_cm): ...this subroutine,
124 dropping the latter. Eliminating this distinction avoids issues
125 where constraints were not considered when recursing.
126 (region_model::compare_initial_and_pointer): Update comment.
127 (region_model::symbolic_greater_than): Replace usage of
128 eval_condition_without_cm with eval_condition.
130 (region_model::eval_condition_without_cm): Delete decl.
132 2022-11-08 David Malcolm <dmalcolm@redhat.com>
134 * region-model-impl-calls.cc
135 (region_model::impl_call_errno_location): New.
136 * region-model-manager.cc
137 (region_model_manager::region_model_manager): Initialize
138 m_thread_local_region and m_errno_region.
139 * region-model-manager.h (region_model_manager::get_errno_region):
141 (region_model_manager::m_thread_local_region): New.
142 (region_model_manager::m_errno_region): New.
143 * region-model.cc (region_model::on_call_pre): Special-case
145 (region_model::set_errno): New.
146 * region-model.h (impl_call_errno_location): New decl.
147 (region_model::set_errno): New decl.
148 * region.cc (thread_local_region::dump_to_pp): New.
149 (errno_region::dump_to_pp): New.
150 * region.h (enum memory_space): Add MEMSPACE_THREAD_LOCAL.
151 (enum region_kind): Add RK_THREAD_LOCAL and RK_ERRNO.
152 (class thread_local_region): New.
153 (is_a_helper <const thread_local_region *>::test): New.
154 (class errno_region): New.
155 (is_a_helper <const errno_region *>::test): New.
156 * store.cc (binding_cluster::escaped_p): New.
157 (store::escaped_p): Treat errno as always having escaped.
158 (store::replay_call_summary_cluster): Handle RK_THREAD_LOCAL and
160 * store.h (binding_cluster::escaped_p): Remove definition.
162 2022-11-08 David Malcolm <dmalcolm@redhat.com>
164 * call-info.cc (success_call_info::get_desc): Delete.
165 (failed_call_info::get_desc): Likewise.
166 (succeed_or_fail_call_info::get_desc): New.
167 * call-info.h (class succeed_or_fail_call_info): New.
168 (class success_call_info): Convert to a subclass of
169 succeed_or_fail_call_info.
170 (class failed_call_info): Likewise.
172 2022-11-08 David Malcolm <dmalcolm@redhat.com>
174 * region-model-impl-calls.cc (region_model::impl_call_strchr):
175 Move to on_call_post. Handle both outcomes using bifurcation,
176 rather than just the "not found" case.
177 * region-model.cc (region_model::on_call_pre): Move
178 BUILT_IN_STRCHR and "strchr" to...
179 (region_model::on_call_post): ...here.
181 2022-11-03 David Malcolm <dmalcolm@redhat.com>
183 * analyzer.h: Use std::unique_ptr for state machines from plugins.
184 * engine.cc: Likewise.
186 2022-11-03 David Malcolm <dmalcolm@redhat.com>
188 * analyzer.h: Use std::unique_ptr for known functions.
189 * engine.cc: Likewise.
190 * known-function-manager.cc: Likewise.
191 * known-function-manager.h: Likewise.
193 2022-11-03 David Malcolm <dmalcolm@redhat.com>
195 * analysis-plan.cc: Define INCLUDE_MEMORY before including
197 * analyzer-pass.cc: Likewise.
198 * analyzer-selftests.cc: Likewise.
199 * analyzer.cc: Likewise.
200 * analyzer.h: Use std::unique_ptr in bifurcation code.
201 * call-string.cc: Define INCLUDE_MEMORY before including system.h.
202 * complexity.cc: Likewise.
203 * engine.cc: Use std::unique_ptr in bifurcation code.
204 * exploded-graph.h: Likewise.
205 * known-function-manager.cc: Define INCLUDE_MEMORY before
207 * region-model-impl-calls.cc: Use std::unique_ptr in bifurcation
209 * region-model.cc: Likewise.
210 * region-model.h: Likewise.
211 * supergraph.cc: Define INCLUDE_MEMORY before including system.h.
213 2022-11-03 David Malcolm <dmalcolm@redhat.com>
215 * call-info.cc: Use std::unique_ptr for checker_event.
216 * checker-path.cc: Likewise.
217 * checker-path.h: Likewise.
218 * diagnostic-manager.cc: Likewise.
219 * engine.cc: Likewise.
220 * pending-diagnostic.cc: Likewise.
221 * sm-signal.cc: Likewise.
222 * varargs.cc: Likewise.
224 2022-11-03 David Malcolm <dmalcolm@redhat.com>
226 * diagnostic-manager.cc: Include "make-unique.h".
227 Use std::unique_ptr for feasibility_problems and exploded_path.
228 Delete explicit saved_diagnostic dtor.
229 * diagnostic-manager.h: Likewise.
230 * engine.cc: Likewise.
231 * exploded-graph.h: Likewise.
232 * feasible-graph.cc: Likewise.
233 * feasible-graph.h: Likewise.
235 2022-11-03 David Malcolm <dmalcolm@redhat.com>
237 * checker-path.cc (rewind_event::rewind_event): Update for usage of
238 std::unique_ptr on custom_edge_info.
239 * engine.cc (exploded_node::on_longjmp): Likewise.
240 (exploded_edge::exploded_edge): Likewise.
241 (exploded_edge::~exploded_edge): Delete.
242 (exploded_graph::add_function_entry): Update for usage of
243 std::unique_ptr on custom_edge_info.
244 (exploded_graph::add_edge): Likewise.
245 (add_tainted_args_callback): Likewise.
246 (exploded_graph::maybe_create_dynamic_call): Likewise.
247 (exploded_graph::process_node): Likewise.
248 * exploded-graph.h (exploded_edge::~exploded_edge): Delete.
249 (exploded_edge::m_custom_info): Use std::unique_ptr.
250 (exploded_edge::add_edge): Likewise.
251 * sm-signal.cc (register_signal_handler::impl_transition): Use
254 2022-11-03 David Malcolm <dmalcolm@redhat.com>
256 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic): Make
258 (saved_diagnostic::~saved_diagnostic): Remove explicit delete of
260 (diagnostic_manager::add_diagnostic): Make stmt_finder const.
261 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic):
263 (saved_diagnostic::m_stmt_finder): Convert to std::unique_ptr.
264 (diagnostic_manager::add_diagnostic): Make stmt_finder const.
265 * engine.cc (impl_sm_context::impl_sm_context): Likewise.
266 (impl_sm_context::m_stmt_finder): Likewise.
267 (leak_stmt_finder::clone): Convert return type to std::unique_ptr.
268 * exploded-graph.h (stmt_finder::clone): Likewise.
270 2022-11-03 David Malcolm <dmalcolm@redhat.com>
272 * call-info.cc: Add define of INCLUDE_MEMORY.
273 * call-summary.cc: Likewise.
274 * checker-path.cc: Likewise.
275 * constraint-manager.cc: Likewise.
276 * diagnostic-manager.cc: Likewise.
277 (saved_diagnostic::saved_diagnostic): Use std::unique_ptr for
278 param d and field m_d.
279 (saved_diagnostic::~saved_diagnostic): Remove explicit delete of m_d.
280 (saved_diagnostic::add_note): Use std::unique_ptr for
282 (saved_diagnostic::get_pending_diagnostic): Update for conversion
283 of m_sd.m_d to unique_ptr.
284 (diagnostic_manager::add_diagnostic): Use std::unique_ptr for
285 param d. Remove explicit deletion.
286 (diagnostic_manager::add_note): Use std::unique_ptr for param pn.
287 (diagnostic_manager::emit_saved_diagnostic): Update for conversion
288 of m_sd.m_d to unique_ptr.
289 (null_assignment_sm_context::warn): Use std::unique_ptr for
290 param d. Remove explicit deletion.
291 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Use
292 std::unique_ptr for param d.
293 (saved_diagnostic::add_note): Likewise for param pn.
294 (saved_diagnostic::m_d): Likewise.
295 (diagnostic_manager::add_diagnostic): Use std::unique_ptr for
297 (diagnostic_manager::add_note): Use std::unique_ptr for param pn.
298 * engine.cc: Include "make-unique.h".
299 (impl_region_model_context::warn): Update to use std::unique_ptr
300 for param, removing explicit deletion.
301 (impl_region_model_context::add_note): Likewise.
302 (impl_sm_context::warn): Update to use std::unique_ptr
304 (impl_region_model_context::on_state_leak): Likewise for result of
306 (exploded_node::on_longjmp): Use make_unique when creating
308 (exploded_graph::process_node): Likewise.
309 * exploded-graph.h (impl_region_model_context::warn): Update to
310 use std::unique_ptr for param.
311 (impl_region_model_context::add_note): Likewise.
312 * feasible-graph.cc: Add define of INCLUDE_MEMORY.
313 * pending-diagnostic.cc: Likewise.
314 * pending-diagnostic.h: Include analyzer.sm.h"
315 * program-point.cc: Add define of INCLUDE_MEMORY.
316 * program-state.cc: Likewise.
317 * region-model-asm.cc: Likewise.
318 * region-model-impl-calls.cc: Likewise. Include "make-unique.h".
319 (region_model::impl_call_putenv): Use make_unique when creating
321 * region-model-manager.cc: Add define of INCLUDE_MEMORY.
322 * region-model-reachability.cc: Likewise.
323 * region-model.cc: Likewise. Include "make-unique.h".
324 (region_model::get_gassign_result): Use make_unique when creating
326 (region_model::check_for_poison): Likewise.
327 (region_model::on_stmt_pre): Likewise.
328 (region_model::check_symbolic_bounds): Likewise.
329 (region_model::check_region_bounds): Likewise.
330 (annotating_ctxt: make_note): Use std::unique_ptr for result.
331 (region_model::deref_rvalue): Use make_unique when creating
333 (region_model::check_for_writable_region): Likewise.
334 (region_model::check_region_size): Likewise.
335 (region_model::check_dynamic_size_for_floats): Likewise.
336 (region_model::maybe_complain_about_infoleak): Likewise.
337 (noop_region_model_context::add_note): Use std::unique_ptr for
338 param. Remove explicit deletion.
339 * region-model.h: Include "analyzer/pending-diagnostic.h".
340 (region_model_context::warn): Convert param to std::unique_ptr.
341 (region_model_context::add_note): Likewise.
342 (noop_region_model_context::warn): Likewise.
343 (noop_region_model_context::add_note): Likewise.
344 (region_model_context_decorator::warn): Likewise.
345 (region_model_context_decorator::add_note): Likewise.
346 (note_adding_context::warn): Likewise.
347 (note_adding_context::make_note): Likewise for return type.
348 (test_region_model_context::warn): Convert param to
350 * region.cc: Add define of INCLUDE_MEMORY.
351 * sm-fd.cc: Likewise. Include "make-unique.h".
352 (fd_state_machine::check_for_fd_attrs): Use make_unique when
353 creating pending_diagnostics.
354 (fd_state_machine::on_open): Likewise.
355 (fd_state_machine::on_creat): Likewise.
356 (fd_state_machine::check_for_dup): Likewise.
357 (fd_state_machine::on_close): Likewise.
358 (fd_state_machine::check_for_open_fd): Likewise.
359 (fd_state_machine::on_leak): Likewise, converting return type to
361 * sm-file.cc: Add define of INCLUDE_MEMORY. Include
363 (fileptr_state_machine::on_stmt): Use make_unique when creating
365 (fileptr_state_machine::on_leak): Likewise, converting return type
367 * sm-malloc.cc: Add define of INCLUDE_MEMORY. Include
369 (malloc_state_machine::on_stmt): Use make_unique when creating
371 (malloc_state_machine::handle_free_of_non_heap): Likewise.
372 (malloc_state_machine::on_deallocator_call): Likewise.
373 (malloc_state_machine::on_realloc_call): Likewise.
374 (malloc_state_machine::on_leak): Likewise, converting return type
376 * sm-pattern-test.cc: Add define of INCLUDE_MEMORY. Include
378 (pattern_test_state_machine::on_condition): Use make_unique when
379 creating pending_diagnostic.
380 * sm-sensitive.cc: Add define of INCLUDE_MEMORY. Include
382 (sensitive_state_machine::warn_for_any_exposure): Use make_unique
383 when creating pending_diagnostic.
384 * sm-signal.cc: Add define of INCLUDE_MEMORY. Include
386 (signal_state_machine::on_stmt): Use make_unique when creating
388 * sm-taint.cc: Add define of INCLUDE_MEMORY. Include
390 (taint_state_machine::check_for_tainted_size_arg): Use make_unique
391 when creating pending_diagnostic.
392 (taint_state_machine::check_for_tainted_divisor): Likewise.
393 (region_model::check_region_for_taint): Likewise.
394 (region_model::check_dynamic_size_for_taint): Likewise.
395 * sm.cc: Add define of INCLUDE_MEMORY. Include
396 "analyzer/pending-diagnostic.h".
397 (state_machine::on_leak): Move here from sm.h, changing return
398 type to std::unique_ptr.
399 * sm.h (state_machine::on_leak): Change return type to
400 std::unique_ptr. Move defn of base impl to sm.cc
401 (sm_context::warn): Convert param d to std_unique_ptr.
402 * state-purge.cc: Add define of INCLUDE_MEMORY.
403 * store.cc: Likewise.
404 * svalue.cc: Likewise.
405 * trimmed-graph.cc: Likewise.
406 * varargs.cc: Likewise. Include "make-unique.h".
407 (va_list_state_machine::check_for_ended_va_list): Use make_unique
408 when creating pending_diagnostic.
409 (va_list_state_machine::on_leak): Likewise, converting return type
411 (region_model::impl_call_va_arg): Use make_unique when creating
414 2022-11-03 David Malcolm <dmalcolm@redhat.com>
417 * analyzer.cc (is_pipe_call_p): New.
418 * analyzer.h (is_pipe_call_p): New decl.
419 * region-model.cc (region_model::on_call_pre): Use it.
420 (region_model::on_call_post): Likewise.
422 2022-10-26 David Malcolm <dmalcolm@redhat.com>
424 * sm-fd.cc (fd_state_machine::on_open): Transition to "unchecked"
425 when the mode is symbolic, rather than just on integer constants.
426 (fd_state_machine::check_for_open_fd): Don't complain about
427 unchecked values in the start state.
429 2022-10-26 David Malcolm <dmalcolm@redhat.com>
431 * sm-fd.dot: New file.
433 2022-10-24 David Malcolm <dmalcolm@redhat.com>
436 * varargs.cc (get_va_copy_arg): Fix the non-pointer case.
438 2022-10-24 David Malcolm <dmalcolm@redhat.com>
441 * region-model.cc (region_model::eval_condition_without_cm):
442 Ensure that constants are on the right-hand side before checking
445 2022-10-24 David Malcolm <dmalcolm@redhat.com>
447 * engine.cc (impl_region_model_context::get_malloc_map): Replace
449 (impl_region_model_context::get_state_map_by_name): ...this.
450 (impl_region_model_context::get_fd_map): Delete.
451 (impl_region_model_context::get_taint_map): Delete.
452 * exploded-graph.h (impl_region_model_context::get_fd_map):
454 (impl_region_model_context::get_malloc_map): Delete.
455 (impl_region_model_context::get_taint_map): Delete.
456 (impl_region_model_context::get_state_map_by_name): New.
457 * region-model.h (region_model_context::get_state_map_by_name):
459 (region_model_context::get_fd_map): Convert from vfunc to
461 (region_model_context::get_malloc_map): Likewise.
462 (region_model_context::get_taint_map): Likewise.
463 (noop_region_model_context::get_state_map_by_name): New.
464 (noop_region_model_context::get_fd_map): Delete.
465 (noop_region_model_context::get_malloc_map): Delete.
466 (noop_region_model_context::get_taint_map): Delete.
467 (region_model_context_decorator::get_state_map_by_name): New.
468 (region_model_context_decorator::get_fd_map): Delete.
469 (region_model_context_decorator::get_malloc_map): Delete.
470 (region_model_context_decorator::get_taint_map): Delete.
472 2022-10-24 David Malcolm <dmalcolm@redhat.com>
475 * engine.cc (impl_region_model_context::get_fd_map): New.
476 * exploded-graph.h (impl_region_model_context::get_fd_map): New
478 * region-model-impl-calls.cc (region_model::impl_call_pipe): New.
479 * region-model.cc (region_model::update_for_int_cst_return): New,
481 (region_model::update_for_zero_return): ...this. Reimplement in
483 (region_model::on_call_pre): Handle "pipe" and "pipe2".
484 (region_model::on_call_post): Likewise.
485 * region-model.h (region_model::impl_call_pipe): New decl.
486 (region_model::update_for_int_cst_return): New decl.
487 (region_model::mark_as_valid_fd): New decl.
488 (region_model_context::get_fd_map): New pure virtual fn.
489 (noop_region_model_context::get_fd_map): New.
490 (region_model_context_decorator::get_fd_map): New.
491 * sm-fd.cc: Include "analyzer/program-state.h".
492 (fd_state_machine::describe_state_change): Handle transitions from
493 start state to valid states.
494 (fd_state_machine::mark_as_valid_fd): New.
495 (fd_state_machine::on_stmt): Add missing return for "creat".
496 (region_model::mark_as_valid_fd): New.
498 2022-10-19 David Malcolm <dmalcolm@redhat.com>
501 * varargs.cc (get_BT_VALIST_ARG): Rename to...
502 (get_va_copy_arg): ...this, and update logic for determining level
503 of indirection of va_copy's argument to use type of argument,
504 rather than looking at va_list_type_node, to correctly handle
505 __builtin_ms_va_copy.
506 (get_stateful_BT_VALIST_ARG): Rename to...
507 (get_stateful_va_copy_arg): ...this.
508 (va_list_state_machine::on_va_copy): Update for renaming.
509 (region_model::impl_call_va_copy): Likewise.
511 2022-10-13 David Malcolm <dmalcolm@redhat.com>
514 * svalue.cc (constant_svalue::maybe_fold_bits_within): Only
515 attempt to extract individual bits when tree_fits_uhwi_p.
517 2022-10-07 David Malcolm <dmalcolm@redhat.com>
520 * region-model.cc (selftest::get_bit): New function.
521 (selftest::test_bits_within_svalue_folding): New.
522 (selfftest::analyzer_region_model_cc_tests): Call it.
523 * svalue.cc (constant_svalue::maybe_fold_bits_within): Handle the
524 case of extracting a single bit.
526 2022-10-06 David Malcolm <dmalcolm@redhat.com>
529 * store.cc (store::replay_call_summary_cluster): Eliminate
530 special-casing of RK_HEAP_ALLOCATED in favor of sharing code with
531 RK_DECL, avoiding an ICE due to attempting to bind a
532 compound_svalue into a binding_cluster when an svalue in the
533 summary cluster converts to a compound_svalue in the caller.
535 2022-10-06 David Malcolm <dmalcolm@redhat.com>
537 * call-summary.cc (call_summary_replay::dump_to_pp): Bulletproof
538 against NULL caller regions/svalues.
540 2022-10-05 David Malcolm <dmalcolm@redhat.com>
542 * analysis-plan.cc: Simplify includes.
543 * analyzer-pass.cc: Likewise.
544 * analyzer-selftests.cc: Likewise.
545 * analyzer.cc: Likewise.
546 * analyzer.h: Add includes of "json.h" and "tristate.h".
547 * call-info.cc: Simplify includes.
548 * call-string.cc: Likewise.
549 * call-summary.cc: Likewise.
550 * checker-path.cc: Likewise.
551 * complexity.cc: Likewise.
552 * constraint-manager.cc: Likewise.
553 * diagnostic-manager.cc: Likewise.
554 * engine.cc: Likewise.
555 * feasible-graph.cc: Likewise.
556 * known-function-manager.cc: Likewise.
557 * pending-diagnostic.cc: Likewise.
558 * program-point.cc: Likewise.
559 * program-state.cc: Likewise.
560 * region-model-asm.cc: Likewise.
561 * region-model-impl-calls.cc: Likewise.
562 * region-model-manager.cc: Likewise.
563 * region-model-reachability.cc: Likewise.
564 * region-model.cc: Likewise.
565 * region-model.h: Include "selftest.h".
566 * region.cc: Simplify includes.
567 * sm-fd.cc: Likewise.
568 * sm-file.cc: Likewise.
569 * sm-malloc.cc: Likewise.
570 * sm-pattern-test.cc: Likewise.
571 * sm-sensitive.cc: Likewise.
572 * sm-signal.cc: Likewise.
573 * sm-taint.cc: Likewise.
575 * state-purge.cc: Likewise.
576 * store.cc: Likewise.
578 * supergraph.cc: Likewise.
579 * svalue.cc: Likewise.
580 * svalue.h: Likewise.
581 * trimmed-graph.cc: Likewise.
582 * varargs.cc: Likewise.
584 2022-10-05 David Malcolm <dmalcolm@redhat.com>
588 (call_summary_replay::convert_svalue_from_summary_1): Handle NULL
589 results from convert_svalue_from_summary in SK_UNARY_OP and
591 * engine.cc (impl_region_model_context::on_unknown_change): Bail
592 out on svalues that can't have associated state.
593 * region-model-impl-calls.cc
594 (region_model::impl_call_analyzer_get_unknown_ptr): New.
595 * region-model.cc (region_model::on_stmt_pre): Handle
596 "__analyzer_get_unknown_ptr".
598 (region_model::impl_call_analyzer_get_unknown_ptr): New decl.
599 * store.cc (store::replay_call_summary_cluster): Avoid trying to
600 create binding clusters for base regions that shouldn't have them.
602 2022-10-05 Martin Liska <mliska@suse.cz>
604 * call-summary.cc (call_summary_replay::call_summary_replay):
605 Remove unused variable and arguments.
606 * call-summary.h: Likewise.
607 * engine.cc (exploded_node::on_stmt): Likewise.
608 (exploded_node::replay_call_summaries): Likewise.
609 (exploded_node::replay_call_summary): Likewise.
610 * exploded-graph.h (class exploded_node): Likewise.
612 2022-10-05 David Malcolm <dmalcolm@redhat.com>
615 * analyzer-logging.h: Include "diagnostic-core.h".
616 * analyzer.h: Include "function.h".
617 (class call_summary): New forward decl.
618 (class call_summary_replay): New forward decl.
619 (struct per_function_data): New forward decl.
620 (struct interesting_t): New forward decl.
621 (custom_edge_info::update_state): New vfunc.
622 * call-info.cc (custom_edge_info::update_state): New.
623 * call-summary.cc: New file.
624 * call-summary.h: New file.
625 * constraint-manager.cc: Include "analyzer/call-summary.h".
626 (class replay_fact_visitor): New.
627 (constraint_manager::replay_call_summary): New.
628 * constraint-manager.h (constraint_manager::replay_call_summary):
630 * engine.cc: Include "analyzer/call-summary.h".
631 (exploded_node::on_stmt): Handle call summaries.
632 (class call_summary_edge_info): New.
633 (exploded_node::replay_call_summaries): New.
634 (exploded_node::replay_call_summary): New.
635 (per_function_data::~per_function_data): New.
636 (per_function_data::add_call_summary): Move here from header and
638 (exploded_graph::process_node): Call update_state rather than
639 update_model when handling bifurcation
640 (viz_callgraph_node::dump_dot): Use a regular label rather
641 than an HTML table; add summaries to dump.
642 * exploded-graph.h: Include "alloc-pool.h", "fibonacci_heap.h",
643 "supergraph.h", "sbitmap.h", "shortest-paths.h", "analyzer/sm.h",
644 "analyzer/program-state.h", and "analyzer/diagnostic-manager.h".
645 (exploded_node::replay_call_summaries): New decl.
646 (exploded_node::replay_call_summary): New decl.
647 (per_function_data::~per_function_data): New decl.
648 (per_function_data::add_call_summary): Move implemention from
650 (per_function_data::m_summaries): Update type of element.
651 * known-function-manager.h: Include "analyzer/analyzer-logging.h".
652 * program-point.h: Include "pretty-print.h" and
653 "analyzer/call-string.h".
654 * program-state.cc: Include "analyzer/call-summary.h".
655 (sm_state_map::replay_call_summary): New.
656 (program_state::replay_call_summary): New.
657 * program-state.h (sm_state_map::replay_call_summary): New decl.
658 (program_state::replay_call_summary): New decl.
659 * region-model-manager.cc
660 (region_model_manager::get_or_create_asm_output_svalue): New
662 * region-model-manager.h
663 (region_model_manager::get_or_create_asm_output_svalue): New
665 * region-model.cc: Include "analyzer/call-summary.h".
666 (region_model::maybe_update_for_edge): Remove call to
667 region_model::update_for_call_summary on
668 SUPEREDGE_INTRAPROCEDURAL_CALL.
669 (region_model::update_for_call_summary): Delete.
670 (region_model::replay_call_summary): New.
671 * region-model.h (region_model::replay_call_summary): New decl.
672 (region_model::update_for_call_summary): Delete decl.
673 * store.cc: Include "analyzer/call-summary.h".
674 (store::replay_call_summary): New.
675 (store::replay_call_summary_cluster): New.
676 * store.h: Include "tristate.h".
677 (is_a_helper <const ana::concrete_binding *>::test): New.
678 (store::replay_call_summary): New decl.
679 (store::replay_call_summary_cluster): New decl.
680 * supergraph.cc (get_ultimate_function_for_cgraph_edge): Remove
682 (supergraph_call_edge): Make stmt param const.
683 * supergraph.h: Include "ordered-hash-map.h", "cfg.h",
684 "basic-block.h", "gimple.h", "gimple-iterator.h", and "digraph.h".
685 (supergraph_call_edge): Make stmt param const.
686 (get_ultimate_function_for_cgraph_edge): New decl.
687 * svalue.cc (compound_svalue::compound_svalue): Assert that we're
688 not nesting compound_svalues.
689 * svalue.h: Include "json.h", "analyzer/store.h", and
690 "analyzer/program-point.h".
691 (asm_output_svalue::get_num_outputs): New accessor.
693 2022-10-05 David Malcolm <dmalcolm@redhat.com>
695 * region-model.h: Include "analyzer/region-model-manager.h"
696 (class region_model_manager): Move decl to...
697 * region-model-manager.h: ...this new file.
699 2022-10-05 David Malcolm <dmalcolm@redhat.com>
701 * region-model-manager.cc
702 (region_model_manager::maybe_fold_unaryop): Fold -(-(VAL)) to VAL.
704 2022-10-05 David Malcolm <dmalcolm@redhat.com>
706 * region-model-manager.cc
707 (region_model_manager::get_or_create_widening_svalue): Use a
708 function_point rather than a program_point.
709 * region-model.cc (selftest::test_widening_constraints): Likewise.
711 (region_model_manager::get_or_create_widening_svalue): Likewise.
712 (model_merger::get_function_point): New.
713 * svalue.cc (svalue::can_merge_p): Use a function_point rather
714 than a program_point.
715 (svalue::can_merge_p): Likewise.
716 * svalue.h (widening_svalue::key_t): Likewise.
717 (widening_svalue::widening_svalue): Likewise.
719 2022-09-12 Martin Liska <mliska@suse.cz>
721 * region-model.cc (region_model::maybe_complain_about_infoleak):
722 Remove unused fields.
724 2022-09-11 Tim Lange <mail@tim-lange.me>
727 * region-model.cc (region_model::check_region_bounds):
728 Bail out if 0 bytes were accessed.
729 * store.cc (byte_range::dump_to_pp):
730 Add special case for empty ranges.
731 (byte_range::exceeds_p): Restrict to non-empty ranges.
732 (byte_range::falls_short_of_p): Restrict to non-empty ranges.
733 * store.h (bit_range::empty_p): New function.
734 (bit_range::get_last_byte_offset): Restrict to non-empty ranges.
735 (byte_range::empty_p): New function.
736 (byte_range::get_last_byte_offset): Restrict to non-empty ranges.
738 2022-09-09 David Malcolm <dmalcolm@redhat.com>
740 * analyzer.opt (Wanalyzer-exposure-through-uninit-copy): New.
741 * checker-path.cc (region_creation_event::region_creation_event):
742 Add "capacity" and "kind" params.
743 (region_creation_event::get_desc): Generalize to different kinds
745 (checker_path::add_region_creation_event): Convert to...
746 (checker_path::add_region_creation_events): ...this.
747 * checker-path.h (enum rce_kind): New.
748 (region_creation_event::region_creation_event): Add "capacity" and
750 (region_creation_event::m_capacity): New field.
751 (region_creation_event::m_rce_kind): New field.
752 (checker_path::add_region_creation_event): Convert to...
753 (checker_path::add_region_creation_events): ...this.
754 * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
755 Update for multiple region creation events.
756 (diagnostic_manager::add_event_on_final_node): Likewise.
757 (diagnostic_manager::add_events_for_eedge): Likewise.
758 * region-model-impl-calls.cc (call_details::get_logger): New.
759 * region-model.cc: Define INCLUDE_MEMORY before including
760 "system.h". Include "gcc-rich-location.h".
761 (class record_layout): New.
762 (class exposure_through_uninit_copy): New.
763 (contains_uninit_p): New.
764 (region_model::maybe_complain_about_infoleak): New.
765 * region-model.h (call_details::get_logger): New decl.
766 (region_model::maybe_complain_about_infoleak): New decl.
767 (region_model::mark_as_tainted): New decl.
768 * sm-taint.cc (region_model::mark_as_tainted): New.
770 2022-09-09 David Malcolm <dmalcolm@redhat.com>
772 * analyzer.h (class known_function_manager): New forward decl.
773 (class known_function): New.
774 (plugin_analyzer_init_iface::register_known_function): New.
775 * engine.cc: Include "analyzer/known-function-manager.h".
776 (plugin_analyzer_init_impl::plugin_analyzer_init_impl): Add
778 (plugin_analyzer_init_impl::register_state_machine): Add
780 (plugin_analyzer_init_impl::register_known_function): New.
781 (plugin_analyzer_init_impl::m_known_fn_mgr): New.
782 (impl_run_checkers): Update plugin callback invocation to use
783 eng's known_function_manager.
784 * known-function-manager.cc: New file.
785 * known-function-manager.h: New file.
786 * region-model-manager.cc
787 (region_model_manager::region_model_manager): Pass logger to
788 m_known_fn_mgr's ctor.
789 * region-model.cc (region_model::update_for_zero_return): New.
790 (region_model::update_for_nonzero_return): New.
791 (maybe_simplify_upper_bound): New.
792 (region_model::maybe_get_copy_bounds): New.
793 (region_model::get_known_function): New.
794 (region_model::on_call_pre): Handle plugin-supplied known
796 * region-model.h: Include "analyzer/known-function-manager.h".
797 (region_model_manager::get_known_function_manager): New.
798 (region_model_manager::m_known_fn_mgr): New.
799 (call_details::get_model): New accessor.
800 (region_model::maybe_get_copy_bounds): New decl.
801 (region_model::update_for_zero_return): New decl.
802 (region_model::update_for_nonzero_return): New decl.
803 (region_model::get_known_function): New decl.
804 (region_model::get_known_function_manager): New.
806 2022-09-08 Tim Lange <mail@tim-lange.me>
809 * analyzer.h (region_offset): Eliminate m_is_symbolic member.
810 * region-model-impl-calls.cc (region_model::impl_call_realloc):
811 Refine implementation to be more precise.
812 * region-model.cc (class symbolic_past_the_end):
813 Abstract diagnostic class to complain about accesses past the end
814 with symbolic values.
815 (class symbolic_buffer_overflow):
816 Concrete diagnostic class to complain about buffer overflows with
818 (class symbolic_buffer_overread):
819 Concrete diagnostic class to complain about buffer overreads with
821 (region_model::check_symbolic_bounds): New function.
822 (maybe_get_integer_cst_tree): New helper function.
823 (region_model::check_region_bounds):
824 Add call to check_symbolic_bounds if offset is not concrete.
825 (region_model::eval_condition_without_cm):
826 Add support for EQ_EXPR and GT_EXPR with binaryop_svalues.
827 (is_positive_svalue): New hleper function.
828 (region_model::symbolic_greater_than):
829 New function to handle GT_EXPR comparisons with symbolic values.
830 (region_model::structural_equality): New function to compare
831 whether two svalues are structured the same, i.e. evaluate to
833 (test_struct): Reflect changes to region::calc_offset.
834 (test_var): Likewise.
835 (test_array_2): Likewise and add selftest with symbolic i.
836 * region-model.h (class region_model): Add check_symbolic_bounds,
837 symbolic_greater_than and structural_equality.
838 * region.cc (region::get_offset):
839 Reflect changes to region::calc_offset.
840 (region::calc_offset):
841 Compute the symbolic offset if the offset is not concrete.
842 (region::get_relative_symbolic_offset): New function to return the
843 symbolic offset in bytes relative to its parent.
844 (field_region::get_relative_symbolic_offset): Likewise.
845 (element_region::get_relative_symbolic_offset): Likewise.
846 (offset_region::get_relative_symbolic_offset): Likewise.
847 (bit_range_region::get_relative_symbolic_offset): Likewise.
848 * region.h: Add get_relative_symbolic_offset.
849 * store.cc (binding_key::make):
850 Reflect changes to region::calc_offset.
851 (binding_map::apply_ctor_val_to_range): Likewise.
852 (binding_map::apply_ctor_pair_to_child_region): Likewise.
853 (binding_cluster::bind_compound_sval): Likewise.
854 (binding_cluster::get_any_binding): Likewise.
855 (binding_cluster::maybe_get_compound_binding): Likewise.
857 2022-09-05 Tim Lange <mail@tim-lange.me>
859 * region-model-impl-calls.cc (region_model::impl_call_strcpy):
860 Handle the constant string case.
861 * region-model.cc (region_model::get_string_size):
862 New function to get the string size from a region or svalue.
863 * region-model.h (class region_model): Add get_string_size.
865 2022-09-05 Tim Lange <mail@tim-lange.me>
867 * region.cc (cast_region::get_relative_concrete_offset):
868 New overloaded method.
869 * region.h: Add cast_region::get_relative_concrete_offset.
871 2022-08-22 Martin Liska <mliska@suse.cz>
873 * region-model.cc: Add missing final keyword.
875 2022-08-18 Tim Lange <mail@tim-lange.me>
878 * analyzer.opt: Add Wanalyzer-imprecise-floating-point-arithmetic.
879 * region-model.cc (is_any_cast_p): Formatting.
880 (region_model::check_region_size): Ensure precondition.
881 (class imprecise_floating_point_arithmetic): New abstract
882 diagnostic class for all floating-point related warnings.
883 (class float_as_size_arg): Concrete diagnostic class to complain
884 about floating-point operands inside the size argument.
885 (class contains_floating_point_visitor):
886 New visitor to find floating-point operands inside svalues.
887 (region_model::check_dynamic_size_for_floats): New function.
888 (region_model::set_dynamic_extents):
889 Call to check_dynamic_size_for_floats.
890 * region-model.h (class region_model):
891 Add region_model::check_dynamic_size_for_floats.
893 2022-08-16 Martin Liska <mliska@suse.cz>
895 * region-model.cc: Fix -Winconsistent-missing-override clang
897 * region.h: Likewise.
899 2022-08-15 David Malcolm <dmalcolm@redhat.com>
902 * region-model.cc (buffer_overread::emit): Fix copy&paste error in
903 direction of the access in the note.
905 2022-08-15 David Malcolm <dmalcolm@redhat.com>
908 * region-model.cc (region_model::on_call_pre): Use check_call_args
909 when ensuring that we call get_arg_svalue on all args. Remove
910 redundant call from handling for stdio builtins.
912 2022-08-15 Immad Mir <mirimmad@outlook.com>
915 * sm-fd.cc (check_for_dup): exit early if first
916 argument is invalid for all dup functions.
918 2022-08-12 Tim Lange <mail@tim-lange.me>
921 * analyzer.opt: Add Wanalyzer-out-of-bounds.
922 * region-model.cc (class out_of_bounds): Diagnostics base class
923 for all out-of-bounds diagnostics.
924 (class past_the_end): Base class derived from out_of_bounds for
925 the buffer_overflow and buffer_overread diagnostics.
926 (class buffer_overflow): Buffer overflow diagnostics.
927 (class buffer_overread): Buffer overread diagnostics.
928 (class buffer_underflow): Buffer underflow diagnostics.
929 (class buffer_underread): Buffer overread diagnostics.
930 (region_model::check_region_bounds): New function to check region
931 bounds for out-of-bounds accesses.
932 (region_model::check_region_access):
933 Add call to check_region_bounds.
934 (region_model::get_representative_tree): New function that accepts
935 a region instead of an svalue.
936 * region-model.h (class region_model):
937 Add region_model::check_region_bounds.
938 * region.cc (region::symbolic_p): New predicate.
939 (offset_region::get_byte_size_sval): Only return the remaining
940 byte size on offset_regions.
941 * region.h: Add region::symbolic_p.
942 * store.cc (byte_range::intersects_p):
943 Add new function equivalent to bit_range::intersects_p.
944 (byte_range::exceeds_p): New function.
945 (byte_range::falls_short_of_p): New function.
946 * store.h (struct byte_range): Add byte_range::intersects_p,
947 byte_range::exceeds_p and byte_range::falls_short_of_p.
949 2022-08-12 Tim Lange <mail@tim-lange.me>
952 * region-model-impl-calls.cc (region_model::impl_call_realloc):
953 Use the result of get_copied_size as the size for the
954 sized_regions in realloc.
955 (success_with_move::get_copied_size): New function.
957 2022-08-11 Immad Mir <mirimmad@outlook.com>
960 * sm-fd.cc (check_for_dup): handle the m_start
961 state when transitioning the state of LHS
962 of dup, dup2 and dup3 call.
964 2022-08-09 David Malcolm <dmalcolm@redhat.com>
967 * region-model.cc (region_model::on_call_pre): Ensure that we call
968 get_arg_svalue on all arguments.
970 2022-08-05 David Malcolm <dmalcolm@redhat.com>
973 * analyzer.opt (Wanalyzer-jump-through-null): New option.
974 * engine.cc (class jump_through_null): New.
975 (exploded_graph::process_node): Complain about jumps through NULL
978 2022-08-02 Immad Mir <mirimmad@outlook.com>
981 * sm-fd.cc (fd_state_machine::on_open): Add
982 creat, dup, dup2 and dup3 functions.
984 (fd_state_machine::valid_to_unchecked_state): New.
985 (fd_state_machine::on_creat): New.
986 (fd_state_machine::on_dup): New.
988 2022-07-28 David Malcolm <dmalcolm@redhat.com>
991 * analyzer.opt (Wanalyzer-putenv-of-auto-var): New.
992 * region-model-impl-calls.cc (class putenv_of_auto_var): New.
993 (region_model::impl_call_putenv): New.
994 * region-model.cc (region_model::on_call_pre): Handle putenv.
995 * region-model.h (region_model::impl_call_putenv): New decl.
997 2022-07-28 David Malcolm <dmalcolm@redhat.com>
999 * sm-malloc.cc (free_of_non_heap::emit): Add comment about CWE.
1000 * sm-taint.cc (tainted_size::emit): Likewise.
1002 2022-07-28 David Malcolm <dmalcolm@redhat.com>
1004 * region.h: Add notes to the comment describing the region
1007 2022-07-27 Immad Mir <mirimmad@outlook.com>
1011 (fd_diagnostic::get_meaning_for_state_change): New.
1013 2022-07-26 David Malcolm <dmalcolm@redhat.com>
1016 * store.cc (store::set_value): Don't strip away casts if the
1017 region has NULL type.
1019 2022-07-26 David Malcolm <dmalcolm@redhat.com>
1021 * region.h (code_region::get_element): Remove stray decl.
1022 (function_region::get_element): Likewise.
1024 2022-07-25 Martin Liska <mliska@suse.cz>
1026 * sm-fd.cc: Run dos2unix and fix coding style issues.
1028 2022-07-23 Immad Mir <mirimmad@outlook.com>
1030 * sm-fd.cc (fd_param_diagnostic): New diagnostic class.
1031 (fd_access_mode_mismatch): Change inheritance from fd_diagnostic
1032 to fd_param_diagnostic. Add new overloaded constructor.
1033 (fd_use_after_close): Likewise.
1034 (unchecked_use_of_fd): Likewise and also change name to fd_use_without_check.
1035 (double_close): Change name to fd_double_close.
1036 (enum access_directions): New.
1037 (fd_state_machine::on_stmt): Handle calls to function with the
1038 new three function attributes.
1039 (fd_state_machine::check_for_fd_attrs): New.
1040 (fd_state_machine::on_open): Use the new overloaded constructors
1041 of diagnostic classes.
1043 2022-07-22 David Malcolm <dmalcolm@redhat.com>
1046 * varargs.cc (region_model::impl_call_va_start): Avoid iterating
1047 through non-existant variadic arguments by initializing the
1048 impl_region to "UNKNOWN" if the va_start occurs in the top-level
1049 function to the analysis.
1051 2022-07-22 David Malcolm <dmalcolm@redhat.com>
1054 * store.cc (binding_cluster::binding_cluster): Remove overzealous
1055 assertion; we're checking for tracked_p in
1056 store::get_or_create_cluster.
1058 2022-07-22 Tim Lange <mail@tim-lange.me>
1061 * region-model.cc (capacity_compatible_with_type): Always return true
1062 if alloc_size is zero.
1064 2022-07-21 David Malcolm <dmalcolm@redhat.com>
1067 * varargs.cc (region_model::impl_call_va_arg): When determining if
1068 we're doing interprocedural analysis, use the stack depth of the
1069 frame in which va_start was called, rather than the current stack
1072 2022-07-21 David Malcolm <dmalcolm@redhat.com>
1074 * sm-taint.cc (tainted_array_index::emit): Bulletproof against
1076 (tainted_array_index::describe_final_event): Likewise.
1077 (tainted_size::emit): Likewise.
1078 (tainted_size::describe_final_event): Likewise.
1080 2022-07-21 David Malcolm <dmalcolm@redhat.com>
1083 * region.cc (decl_region::get_svalue_for_initializer): Bail out on
1086 2022-07-20 David Malcolm <dmalcolm@redhat.com>
1089 * sm-taint.cc (taint_state_machine::on_condition): Potentially
1090 update the state of the RHS as well as the LHS.
1092 2022-07-20 David Malcolm <dmalcolm@redhat.com>
1095 * region.h (string_region::tracked_p): New.
1096 * store.cc (binding_cluster::binding_cluster): Move here from
1097 store.h. Add assertion that base_region is tracked_p.
1098 * store.h (binding_cluster::binding_cluster): Move to store.cc.
1100 2022-07-19 David Malcolm <dmalcolm@redhat.com>
1103 * constraint-manager.h (bounded_ranges::get_count): New.
1104 (bounded_ranges::get_range): New.
1105 * engine.cc (impl_region_model_context::on_bounded_ranges): New.
1106 * exploded-graph.h (impl_region_model_context::on_bounded_ranges):
1108 * region-model.cc (region_model::apply_constraints_for_gswitch):
1109 Potentially call ctxt->on_bounded_ranges.
1110 * region-model.h (region_model_context::on_bounded_ranges): New
1112 (noop_region_model_context::on_bounded_ranges): New.
1113 (region_model_context_decorator::on_bounded_ranges): New.
1114 * sm-taint.cc: Include "analyzer/constraint-manager.h".
1115 (taint_state_machine::on_bounded_ranges): New.
1116 * sm.h (state_machine::on_bounded_ranges): New.
1118 2022-07-19 David Malcolm <dmalcolm@redhat.com>
1120 * engine.cc (exploded_graph::process_node): Show any description
1121 of the out-edge when logging it for consideration.
1123 2022-07-15 David Malcolm <dmalcolm@redhat.com>
1126 * sm-taint.cc (taint_state_machine::on_condition): Handle range
1127 checks optimized by build_range_check.
1129 2022-07-15 Jonathan Wakely <jwakely@redhat.com>
1131 * call-info.cc (call_info::print): Adjust to new label_text API.
1132 * checker-path.cc (checker_event::dump): Likewise.
1133 (region_creation_event::get_desc): Likewise.
1134 (state_change_event::get_desc): Likewise.
1135 (superedge_event::should_filter_p): Likewise.
1136 (start_cfg_edge_event::get_desc): Likewise.
1137 (call_event::get_desc): Likewise.
1138 (return_event::get_desc): Likewise.
1139 (warning_event::get_desc): Likewise.
1140 (checker_path::dump): Likewise.
1141 (checker_path::debug): Likewise.
1142 * diagnostic-manager.cc (diagnostic_manager::prune_for_sm_diagnostic):
1144 (diagnostic_manager::prune_interproc_events): Likewise.
1145 * engine.cc (feasibility_state::maybe_update_for_edge):
1147 * program-state.cc (sm_state_map::to_json): Likewise.
1148 * region-model-impl-calls.cc (region_model::impl_call_analyzer_describe): Likewise.
1149 (region_model::impl_call_analyzer_dump_capacity): Likewise.
1150 * region.cc (region::to_json): Likewise.
1151 * sm-malloc.cc (inform_nonnull_attribute): Likewise.
1152 * store.cc (binding_map::to_json): Likewise.
1153 (store::to_json): Likewise.
1154 * supergraph.cc (superedge::dump): Likewise.
1155 * svalue.cc (svalue::to_json): Likewise.
1157 2022-07-07 David Malcolm <dmalcolm@redhat.com>
1159 * checker-path.cc (start_cfg_edge_event::get_desc): Update for
1160 superedge::get_description returning a label_text.
1161 * engine.cc (feasibility_state::maybe_update_for_edge): Likewise.
1162 * supergraph.cc (superedge::dump): Likewise.
1163 (superedge::get_description): Convert return type from char * to
1165 * supergraph.h (superedge::get_description): Likewise.
1167 2022-07-07 David Malcolm <dmalcolm@redhat.com>
1169 * call-info.cc (call_info::print): Update for removal of
1170 label_text::maybe_free in favor of automatic memory management.
1171 * checker-path.cc (checker_event::dump): Likewise.
1172 (checker_event::prepare_for_emission): Likewise.
1173 (state_change_event::get_desc): Likewise.
1174 (superedge_event::should_filter_p): Likewise.
1175 (start_cfg_edge_event::get_desc): Likewise.
1176 (warning_event::get_desc): Likewise.
1177 (checker_path::dump): Likewise.
1178 (checker_path::debug): Likewise.
1179 * diagnostic-manager.cc
1180 (diagnostic_manager::prune_for_sm_diagnostic): Likewise.
1181 (diagnostic_manager::prune_interproc_events): Likewise.
1182 * program-state.cc (sm_state_map::to_json): Likewise.
1183 * region.cc (region::to_json): Likewise.
1184 * sm-malloc.cc (inform_nonnull_attribute): Likewise.
1185 * store.cc (binding_map::to_json): Likewise.
1186 (store::to_json): Likewise.
1187 * svalue.cc (svalue::to_json): Likewise.
1189 2022-07-07 David Malcolm <dmalcolm@redhat.com>
1192 * sm-taint.cc (taint_state_machine::on_stmt): Move handling of
1193 assignments from division to...
1194 (taint_state_machine::check_for_tainted_divisor): ...this new
1195 function. Reject warning when the divisor is known to be non-zero.
1196 * sm.cc: Include "analyzer/program-state.h".
1197 (sm_context::get_old_region_model): New.
1198 * sm.h (sm_context::get_old_region_model): New decl.
1200 2022-07-06 Immad Mir <mirimmad@outlook.com>
1203 * sm-fd.cc (fd_state_machine): Change ordering of initialization
1204 of state m_invalid so that the order of initializers is same as
1205 the ordering of the fields in the class decl.
1207 2022-07-06 Immad Mir <mirimmad@outlook.com>
1209 * sm-fd.cc (use_after_close): save the "close" event and
1210 show it where possible.
1212 2022-07-06 David Malcolm <dmalcolm@redhat.com>
1215 * region-model.cc (within_short_circuited_stmt_p): Move extraction
1216 of assign_stmt to caller.
1217 (due_to_ifn_deferred_init_p): New.
1218 (region_model::check_for_poison): Move extraction of assign_stmt
1219 from within_short_circuited_stmt_p to here. Share logic with
1220 call to due_to_ifn_deferred_init_p.
1222 2022-07-02 Tim Lange <mail@tim-lange.me>
1225 * analyzer.opt: Added Wanalyzer-allocation-size.
1226 * checker-path.cc (region_creation_event::get_desc): Added call to new
1227 virtual function pending_diagnostic::describe_region_creation_event.
1228 * checker-path.h: Added region_creation_event::get_desc.
1229 * diagnostic-manager.cc (diagnostic_manager::add_event_on_final_node):
1231 * diagnostic-manager.h:
1232 Added diagnostic_manager::add_event_on_final_node.
1233 * pending-diagnostic.h (struct region_creation): New event_desc struct.
1234 (pending_diagnostic::describe_region_creation_event): Added virtual
1235 function to overwrite description of a region creation.
1236 * region-model.cc (class dubious_allocation_size): New class.
1237 (capacity_compatible_with_type): New helper function.
1238 (class size_visitor): New class.
1239 (struct_or_union_with_inheritance_p): New helper function.
1240 (is_any_cast_p): New helper function.
1241 (region_model::check_region_size): New function.
1242 (region_model::set_value): Added call to
1243 region_model::check_region_size.
1244 * region-model.h (class region_model): New function check_region_size.
1245 * svalue.cc (region_svalue::accept): Changed to post-order traversal.
1246 (initial_svalue::accept): Likewise.
1247 (unaryop_svalue::accept): Likewise.
1248 (binop_svalue::accept): Likewise.
1249 (sub_svalue::accept): Likewise.
1250 (repeated_svalue::accept): Likewise.
1251 (bits_within_svalue::accept): Likewise.
1252 (widening_svalue::accept): Likewise.
1253 (unmergeable_svalue::accept): Likewise.
1254 (compound_svalue::accept): Likewise.
1255 (conjured_svalue::accept): Likewise.
1256 (asm_output_svalue::accept): Likewise.
1257 (const_fn_result_svalue::accept): Likewise.
1259 2022-07-02 Immad Mir <mirimmad17@gmail.com>
1262 * analyzer.opt (Wanalyzer-fd-leak): New option.
1263 (Wanalyzer-fd-access-mode-mismatch): New option.
1264 (Wanalyzer-fd-use-without-check): New option.
1265 (Wanalyzer-fd-double-close): New option.
1266 (Wanalyzer-fd-use-after-close): New option.
1267 * sm.h (make_fd_state_machine): New decl.
1268 * sm.cc (make_checkers): Call make_fd_state_machine.
1269 * sm-fd.cc: New file.
1271 2022-06-24 David Malcolm <dmalcolm@redhat.com>
1273 * call-string.cc: Add includes of "analyzer/analyzer.h"
1274 and "analyzer/analyzer-logging.h".
1275 (call_string::call_string): Delete copy ctor.
1276 (call_string::operator=): Delete.
1277 (call_string::operator==): Delete.
1278 (call_string::hash): Delete.
1279 (call_string::push_call): Make const, returning the resulting
1281 (call_string::pop): Delete.
1282 (call_string::cmp_ptr_ptr): New.
1283 (call_string::validate): Assert that m_parent is non-NULL, or
1284 m_elements is empty.
1285 (call_string::call_string): Move default ctor here from
1286 call-string.h and reimplement. Add ctor taking a parent
1288 (call_string::~call_string): New.
1289 (call_string::recursive_log): New.
1290 * call-string.h (call_string::call_string): Move default ctor's
1291 defn to call-string.cc. Delete copy ctor. Add ctor taking a
1292 parent and an element.
1293 (call_string::operator=): Delete.
1294 (call_string::operator==): Delete.
1295 (call_string::hash): Delete.
1296 (call_string::push_call): Make const, returning the resulting
1298 (call_string::pop): Delete decl.
1299 (call_string::get_parent): New.
1300 (call_string::cmp_ptr_ptr): New decl.
1301 (call_string::get_top_of_stack): New.
1302 (struct call_string::hashmap_traits_t): New.
1303 (class call_string): Add friend class region_model_manager. Add
1304 DISABLE_COPY_AND_ASSIGN.
1305 (call_string::~call_string): New decl.
1306 (call_string::recursive_log): New decl.
1307 (call_string::m_parent): New field.
1308 (call_string::m_children): New field.
1309 * constraint-manager.cc (selftest::test_many_constants): Pass
1310 model manager to program_point::origin.
1311 * engine.cc (exploded_graph::exploded_graph): Likewise.
1312 (exploded_graph::add_function_entry): Likewise for
1313 program_point::from_function_entry.
1314 (add_tainted_args_callback): Likewise.
1315 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
1316 Update for change to program_point.get_call_string.
1317 (exploded_graph::process_node): Likewise.
1318 (class function_call_string_cluster): Convert m_cs from a
1319 call_string to a const call_string &.
1320 (struct function_call_string): Likewise.
1321 (pod_hash_traits<function_call_string>::hash): Use pointer_hash
1323 (pod_hash_traits<function_call_string>::equal): Update for change
1325 (root_cluster::add_node): Update for change to
1326 function_call_string.
1327 (viz_callgraph_node::dump_dot): Update for change to call_string.
1328 * exploded-graph.h (per_call_string_data::m_key): Convert to a
1330 (struct eg_call_string_hash_map_traits): Delete.
1331 (exploded_graph::call_string_data_map_t): Remove traits class.
1332 * program-point.cc: Move include of "analyzer/call-string.h" to
1333 after "analyzer/analyzer-logging.h".
1334 (program_point::print): Update for conversion of m_call_string to
1336 (program_point::to_json): Likewise.
1337 (program_point::push_to_call_stack): Update for immutability of
1339 (program_point::pop_from_call_stack): Likewise.
1340 (program_point::hash): Use pointer hashing for m_call_string.
1341 (program_point::get_function_at_depth): Update for change to
1343 (program_point::validate): Update for changes to call_string.
1344 (program_point::on_edge): Likewise.
1345 (program_point::origin): Move here from call-string.h. Add
1346 region_model_manager param and use it to get empty call string.
1347 (program_point::from_function_entry): Likewise.
1348 (selftest::test_function_point_ordering): Likewise.
1349 (selftest::test_function_point_ordering): Likewise.
1350 * program-point.h (program_point::program_point): Update for
1351 change to m_call_string.
1352 (program_point::get_call_string): Likewise.
1353 (program_point::get_stack_depth): Likewise.
1354 (program_point::origin): Add region_model_manager param, and move
1355 defn to call-string.cc.
1356 (program_point::from_function_entry): Likewise.
1357 (program_point::empty): Drop call_string.
1358 (program_point::deleted): Likewise.
1359 (program_point::program_point): New private ctor.
1360 (program_point::m_call_string): Convert from call_string to const
1362 * program-state.cc (selftest::test_program_state_merging): Update
1363 for call_string changes.
1364 (selftest::test_program_state_merging_2): Likewise.
1365 * region-model-manager.cc
1366 (region_model_manager::region_model_manager): Construct
1367 m_empty_call_string.
1368 (region_model_manager::log_stats): Log the call strings.
1369 * region-model.cc (assert_region_models_merge): Pass the
1370 region_model_manager when creating program_point instances.
1371 (selftest::test_state_merging): Likewise.
1372 (selftest::test_constraint_merging): Likewise.
1373 (selftest::test_widening_constraints): Likewise.
1374 (selftest::test_iteration_1): Likewise.
1375 * region-model.h (region_model_manager::get_empty_call_string):
1377 (region_model_manager::m_empty_call_string): New.
1378 * sm-signal.cc (register_signal_handler::impl_transition): Update
1379 for changes to call_string.
1381 2022-06-24 David Malcolm <dmalcolm@redhat.com>
1383 * call-string.cc (call_string::calc_recursion_depth): Whitespace
1385 (call_string::cmp): Likewise.
1386 (call_string::get_caller_node): Likewise.
1387 (call_string::validate): Likewise.
1388 * engine.cc (dynamic_call_info_t::add_events_to_path): Likewise.
1389 (exploded_graph::get_per_function_data): Likewise.
1390 (exploded_graph::maybe_create_dynamic_call): Likewise.
1391 (exploded_graph::maybe_create_dynamic_call): Likewise.
1392 (exploded_graph::process_node): Likewise.
1394 2022-06-16 David Malcolm <dmalcolm@redhat.com>
1396 * varargs.cc (va_arg_type_mismatch::emit): Associate the warning
1397 with CWE-686 ("Function Call With Incorrect Argument Type").
1399 2022-06-16 David Malcolm <dmalcolm@redhat.com>
1401 * varargs.cc: Include "diagnostic-metadata.h".
1402 (va_list_exhausted::emit): Associate the warning with
1403 CWE-685 ("Function Call With Incorrect Number of Arguments").
1405 2022-06-16 David Malcolm <dmalcolm@redhat.com>
1407 * sm-file.cc (double_fclose::emit): Associate the warning with
1408 CWE-1341 ("Multiple Releases of Same Resource or Handle").
1410 2022-06-15 David Malcolm <dmalcolm@redhat.com>
1413 * analyzer.opt (fanalyzer-undo-inlining): New option.
1414 * checker-path.cc: Include "diagnostic-core.h" and
1415 "inlining-iterator.h".
1416 (event_kind_to_string): Handle EK_INLINED_CALL.
1417 (class inlining_info): New class.
1418 (checker_event::checker_event): Move here from checker-path.h.
1419 Store original fndecl and depth, and calculate effective fndecl
1420 and depth based on inlining information.
1421 (checker_event::dump): Emit original depth as well as effective
1422 depth when they differ; likewise for fndecl.
1423 (region_creation_event::get_desc): Use m_effective_fndecl.
1424 (inlined_call_event::get_desc): New.
1425 (inlined_call_event::get_meaning): New.
1426 (checker_path::inject_any_inlined_call_events): New.
1427 * checker-path.h (enum event_kind): Add EK_INLINED_CALL.
1428 (checker_event::checker_event): Make protected, and move
1429 definition to checker-path.cc.
1430 (checker_event::get_fndecl): Use effective fndecl.
1431 (checker_event::get_stack_depth): Use effective stack depth.
1432 (checker_event::get_logical_location): Use effective stack depth.
1433 (checker_event::get_original_stack_depth): New.
1434 (checker_event::m_fndecl): Rename to...
1435 (checker_event::m_original_fndecl): ...this.
1436 (checker_event::m_depth): Rename to...
1437 (checker_event::m_original_depth): ...this.
1438 (checker_event::m_effective_fndecl): New field.
1439 (checker_event::m_effective_depth): New field.
1440 (class inlined_call_event): New checker_event subclass.
1441 (checker_path::inject_any_inlined_call_events): New decl.
1442 * diagnostic-manager.cc: Include "inlining-iterator.h".
1443 (diagnostic_manager::emit_saved_diagnostic): Call
1444 checker_path::inject_any_inlined_call_events.
1445 (diagnostic_manager::prune_for_sm_diagnostic): Handle
1447 * engine.cc (tainted_args_function_custom_event::get_desc): Use
1449 * inlining-iterator.h: New file.
1451 2022-06-15 David Malcolm <dmalcolm@redhat.com>
1453 * diagnostic-manager.cc (saved_diagnostic::dump_dot_id): New.
1454 (saved_diagnostic::dump_as_dot_node): New.
1455 * diagnostic-manager.h (saved_diagnostic::dump_dot_id): New decl.
1456 (saved_diagnostic::dump_as_dot_node): New decl.
1457 * engine.cc (exploded_node::dump_dot): Add nodes for saved
1460 2022-06-02 David Malcolm <dmalcolm@redhat.com>
1462 * checker-path.cc (checker_event::get_meaning): New.
1463 (function_entry_event::get_meaning): New.
1464 (state_change_event::get_desc): Add dump of meaning of the event
1465 to the -fanalyzer-verbose-state-changes output.
1466 (state_change_event::get_meaning): New.
1467 (cfg_edge_event::get_meaning): New.
1468 (call_event::get_meaning): New.
1469 (return_event::get_meaning): New.
1470 (start_consolidated_cfg_edges_event::get_meaning): New.
1471 (warning_event::get_meaning): New.
1472 * checker-path.h: Include "tree-logical-location.h".
1473 (checker_event::checker_event): Construct m_logical_loc.
1474 (checker_event::get_logical_location): New.
1475 (checker_event::get_meaning): New decl.
1476 (checker_event::m_logical_loc): New.
1477 (function_entry_event::get_meaning): New decl.
1478 (state_change_event::get_meaning): New decl.
1479 (cfg_edge_event::get_meaning): New decl.
1480 (call_event::get_meaning): New decl.
1481 (return_event::get_meaning): New decl.
1482 (start_consolidated_cfg_edges_event::get_meaning): New.
1483 (warning_event::get_meaning): New decl.
1484 * pending-diagnostic.h: Include "diagnostic-path.h".
1485 (pending_diagnostic::get_meaning_for_state_change): New vfunc.
1486 * sm-file.cc (file_diagnostic::get_meaning_for_state_change): New
1488 * sm-malloc.cc (malloc_diagnostic::get_meaning_for_state_change):
1491 (exposure_through_output_file::get_meaning_for_state_change):
1493 * sm-taint.cc (taint_diagnostic::get_meaning_for_state_change):
1496 (va_list_sm_diagnostic::get_meaning_for_state_change): Likewise.
1498 2022-05-23 David Malcolm <dmalcolm@redhat.com>
1500 * call-info.cc: Add "final" and "override" to all vfunc
1501 implementations that were missing them, as appropriate.
1502 * engine.cc: Likewise.
1503 * region-model.cc: Likewise.
1504 * sm-malloc.cc: Likewise.
1505 * supergraph.h: Likewise.
1506 * svalue.cc: Likewise.
1507 * varargs.cc: Likewise.
1509 2022-05-20 David Malcolm <dmalcolm@redhat.com>
1511 * analyzer-pass.cc: Replace uses of "FINAL" and "OVERRIDE" with
1512 "final" and "override".
1513 * call-info.h: Likewise.
1514 * checker-path.h: Likewise.
1515 * constraint-manager.cc: Likewise.
1516 * diagnostic-manager.cc: Likewise.
1517 * engine.cc: Likewise.
1518 * exploded-graph.h: Likewise.
1519 * feasible-graph.h: Likewise.
1520 * pending-diagnostic.h: Likewise.
1521 * region-model-impl-calls.cc: Likewise.
1522 * region-model.cc: Likewise.
1523 * region-model.h: Likewise.
1524 * region.h: Likewise.
1525 * sm-file.cc: Likewise.
1526 * sm-malloc.cc: Likewise.
1527 * sm-pattern-test.cc: Likewise.
1528 * sm-sensitive.cc: Likewise.
1529 * sm-signal.cc: Likewise.
1530 * sm-taint.cc: Likewise.
1531 * state-purge.h: Likewise.
1532 * store.cc: Likewise.
1533 * store.h: Likewise.
1534 * supergraph.h: Likewise.
1535 * svalue.h: Likewise.
1536 * trimmed-graph.h: Likewise.
1537 * varargs.cc: Likewise.
1539 2022-05-16 David Malcolm <dmalcolm@redhat.com>
1542 * analyzer.cc (make_label_text_n): New.
1543 * analyzer.h (class var_arg_region): New forward decl.
1544 (make_label_text_n): New decl.
1545 * analyzer.opt (Wanalyzer-va-arg-type-mismatch): New option.
1546 (Wanalyzer-va-list-exhausted): New option.
1547 (Wanalyzer-va-list-leak): New option.
1548 (Wanalyzer-va-list-use-after-va-end): New option.
1549 * checker-path.cc (call_event::get_desc): Split out decl access
1551 (call_event::get_caller_fndecl): ...this new function and...
1552 (call_event::get_callee_fndecl): ...this new function.
1553 * checker-path.h (call_event::get_desc): Drop "FINAL".
1554 (call_event::get_caller_fndecl): New decl.
1555 (call_event::get_callee_fndecl): New decl.
1556 (class call_event): Make fields protected.
1557 * diagnostic-manager.cc (null_assignment_sm_context::warn): New
1559 (null_assignment_sm_context::get_new_program_state): New.
1560 (diagnostic_manager::add_events_for_superedge): Move case
1561 SUPEREDGE_CALL to a new pending_diagnostic::add_call_event vfunc.
1562 * engine.cc (impl_sm_context::warn): Implement new override.
1563 (impl_sm_context::get_new_program_state): New.
1564 * pending-diagnostic.cc: Include "analyzer/diagnostic-manager.h",
1565 "cpplib.h", "digraph.h", "ordered-hash-map.h", "cfg.h",
1566 "basic-block.h", "gimple.h", "gimple-iterator.h", "cgraph.h"
1567 "analyzer/supergraph.h", "analyzer/program-state.h",
1568 "alloc-pool.h", "fibonacci_heap.h", "shortest-paths.h",
1569 "sbitmap.h", "analyzer/exploded-graph.h", "diagnostic-path.h",
1570 and "analyzer/checker-path.h".
1572 (fixup_location_in_macro_p): New.
1573 (pending_diagnostic::fixup_location): New.
1574 (pending_diagnostic::add_call_event): New.
1575 * pending-diagnostic.h (pending_diagnostic::fixup_location): Drop
1576 no-op inline implementation in favor of the more complex
1577 implementation above.
1578 (pending_diagnostic::add_call_event): New vfunc.
1579 * region-model-impl-calls.cc: Include "analyzer/sm.h",
1580 "diagnostic-path.h", and "analyzer/pending-diagnostic.h".
1581 * region-model-manager.cc
1582 (region_model_manager::get_var_arg_region): New.
1583 (region_model_manager::log_stats): Log m_var_arg_regions.
1584 * region-model.cc (region_model::on_call_pre): Handle IFN_VA_ARG,
1585 BUILT_IN_VA_START, and BUILT_IN_VA_COPY.
1586 (region_model::on_call_post): Handle BUILT_IN_VA_END.
1587 (region_model::get_representative_path_var_1): Handle RK_VAR_ARG.
1588 (region_model::push_frame): Push variadic arguments.
1589 * region-model.h (region_model_manager::get_var_arg_region): New
1591 (region_model_manager::m_var_arg_regions): New field.
1592 (region_model::impl_call_va_start): New decl.
1593 (region_model::impl_call_va_copy): New decl.
1594 (region_model::impl_call_va_arg): New decl.
1595 (region_model::impl_call_va_end): New decl.
1596 * region.cc (alloca_region::dump_to_pp): Dump the id.
1597 (var_arg_region::dump_to_pp): New.
1598 (var_arg_region::get_frame_region): New.
1599 * region.h (enum region_kind): Add RK_VAR_ARG.
1600 (region::dyn_cast_var_arg_region): New.
1601 (class var_arg_region): New.
1602 (is_a_helper <const var_arg_region *>::test): New.
1603 (struct default_hash_traits<var_arg_region::key_t>): New.
1604 * sm.cc (make_checkers): Call make_va_list_state_machine.
1605 * sm.h (sm_context::warn): New vfunc.
1606 (sm_context::get_old_svalue): Drop unused decl.
1607 (sm_context::get_new_program_state): New vfunc.
1608 (make_va_list_state_machine): New decl.
1609 * varargs.cc: New file.
1611 2022-05-16 Martin Liska <mliska@suse.cz>
1613 * engine.cc (exploded_node::get_dot_fillcolor): Use ARRAY_SIZE.
1614 * function-set.cc (test_stdio_example): Likewise.
1615 * sm-file.cc (get_file_using_fns): Likewise.
1616 * sm-malloc.cc (malloc_state_machine::unaffected_by_call_p): Likewise.
1617 * sm-signal.cc (get_async_signal_unsafe_fns): Likewise.
1619 2022-05-13 Richard Biener <rguenther@suse.de>
1621 * supergraph.cc: Re-order gimple-fold.h include.
1623 2022-05-11 David Malcolm <dmalcolm@redhat.com>
1625 * checker-path.cc (state_change_event::get_desc): Call maybe_free
1626 on label_text temporaries.
1627 * diagnostic-manager.cc
1628 (diagnostic_manager::prune_for_sm_diagnostic): Likewise.
1629 * engine.cc (exploded_graph::~exploded_graph): Fix leak of
1630 m_per_point_data and m_per_call_string_data values. Simplify
1631 cleanup of m_per_function_stats and m_per_point_data values.
1632 (feasibility_state::maybe_update_for_edge): Fix leak of result of
1633 superedge::get_description.
1634 * region-model-manager.cc
1635 (region_model_manager::~region_model_manager): Move cleanup of
1636 m_setjmp_values to match the ordering of the fields within
1637 region_model_manager. Fix leak of values within
1638 m_repeated_values_map, m_bits_within_values_map,
1639 m_asm_output_values_map, and m_const_fn_result_values_map.
1641 2022-04-28 David Malcolm <dmalcolm@redhat.com>
1644 * store.cc (binding_cluster::get_any_binding): Handle accessing
1645 sub_svalues of clusters where the base region has a symbolic
1648 2022-04-28 David Malcolm <dmalcolm@redhat.com>
1650 * diagnostic-manager.cc (epath_finder::process_worklist_item):
1651 Call dump_feasible_path when a path that reaches the the target
1653 (epath_finder::dump_feasible_path): New.
1654 * engine.cc (feasibility_state::dump_to_pp): New.
1655 * exploded-graph.h (feasibility_state::dump_to_pp): New decl.
1656 * feasible-graph.cc (feasible_graph::dump_feasible_path): New.
1657 * feasible-graph.h (feasible_graph::dump_feasible_path): New
1659 * program-point.cc (function_point::print): Fix missing trailing
1661 * program-point.h (program_point::print_source_line): Remove
1664 2022-04-25 David Malcolm <dmalcolm@redhat.com>
1669 (cmp_cst): Rename to...
1670 (cmp_csts_same_type): ...this. Convert all recursive calls to
1672 (cmp_csts_and_types): ....this new function.
1673 (svalue::cmp_ptr): Update for renaming of cmp_cst
1675 2022-04-14 David Malcolm <dmalcolm@redhat.com>
1678 * region-model-reachability.cc (reachable_regions::handle_parm):
1679 Use maybe_get_deref_base_region rather than just region_svalue, to
1680 handle pointer arithmetic also.
1681 * svalue.cc (svalue::maybe_get_deref_base_region): New.
1682 * svalue.h (svalue::maybe_get_deref_base_region): New decl.
1684 2022-04-14 David Malcolm <dmalcolm@redhat.com>
1687 * svalue.cc (cmp_cst): When comparing VECTOR_CSTs, compare the
1688 types of the encoded elements before calling cmp_cst on them.
1690 2022-04-09 David Malcolm <dmalcolm@redhat.com>
1693 * region-model-manager.cc
1694 (region_model_manager::get_unknown_symbolic_region): New,
1696 (region_model_manager::get_field_region): ...here.
1697 (region_model_manager::get_element_region): Use it here.
1698 (region_model_manager::get_offset_region): Likewise.
1699 (region_model_manager::get_sized_region): Likewise.
1700 (region_model_manager::get_cast_region): Likewise.
1701 (region_model_manager::get_bit_range): Likewise.
1703 (region_model_manager::get_unknown_symbolic_region): New decl.
1704 * region.cc (symbolic_region::symbolic_region): Handle sval_ptr
1706 (symbolic_region::dump_to_pp): Handle having NULL type.
1708 2022-04-07 David Malcolm <dmalcolm@redhat.com>
1711 * store.cc (binding_map::remove_overlapping_bindings): Add
1712 "always_overlap" param, using it to generalize to the case where
1713 we want to remove all bindings. Update "uncertainty" logic to
1714 only record maybe-bound values for cases where there is a symbolic
1716 (binding_cluster::mark_region_as_unknown): Split param "reg" into
1717 "reg_to_bind" and "reg_for_overlap".
1718 (binding_cluster::maybe_get_compound_binding): Pass "false" to
1719 binding_map::remove_overlapping_bindings new "always_overlap" param.
1720 (binding_cluster::remove_overlapping_bindings): Determine
1721 "always_overlap" and pass it to
1722 binding_map::remove_overlapping_bindings.
1723 (store::set_value): Pass uncertainty to remove_overlapping_bindings
1724 call. Update for new param of
1725 binding_cluster::mark_region_as_unknown, passing both the base
1726 region of the iter_cluster, and the lhs_reg.
1727 (store::mark_region_as_unknown): Update for new param of
1728 binding_cluster::mark_region_as_unknown, passing "reg" for both.
1729 (store::remove_overlapping_bindings): Add param "uncertainty", and
1730 pass it on to call to
1731 binding_cluster::remove_overlapping_bindings.
1732 * store.h (binding_map::remove_overlapping_bindings): Add
1733 "always_overlap" param.
1734 (binding_cluster::mark_region_as_unknown): Split param "reg" into
1735 "reg_to_bind" and "reg_for_overlap".
1736 (store::remove_overlapping_bindings): Add param "uncertainty".
1738 2022-03-29 David Malcolm <dmalcolm@redhat.com>
1741 * region-model-manager.cc (dump_untracked_region): Skip decls in
1744 2022-03-29 David Malcolm <dmalcolm@redhat.com>
1747 * analyzer.h (class conjured_purge): New forward decl.
1748 * region-model-asm.cc (region_model::on_asm_stmt): Add
1749 conjured_purge param to calls binding_cluster::on_asm and
1750 region_model_manager::get_or_create_conjured_svalue.
1751 * region-model-impl-calls.cc
1752 (call_details::get_or_create_conjured_svalue): Likewise for call
1753 to region_model_manager::get_or_create_conjured_svalue.
1754 (region_model::impl_call_fgets): Remove call to
1755 region_model::purge_state_involving, as this is now done
1756 implicitly by call_details::get_or_create_conjured_svalue.
1757 (region_model::impl_call_fread): Likewise.
1758 (region_model::impl_call_strchr): Pass conjured_purge param to
1759 call to region_model_manager::get_or_create_conjured_svalue.
1760 * region-model-manager.cc (conjured_purge::purge): New.
1761 (region_model_manager::get_or_create_conjured_svalue): Add
1762 param "p". Use it to purge state when reusing an existing
1764 * region-model.cc (region_model::on_call_pre): Replace call to
1765 region_model::purge_state_involving with passing conjured_purge
1766 to region_model_manager::get_or_create_conjured_svalue.
1767 (region_model::handle_unrecognized_call): Pass conjured_purge to
1768 store::on_unknown_fncall.
1770 (region_model_manager::get_or_create_conjured_svalue): Add param
1772 * store.cc (binding_cluster::on_unknown_fncall): Likewise. Pass
1773 it on to region_model_manager::get_or_create_conjured_svalue.
1774 (binding_cluster::on_asm): Likewise.
1775 (store::on_unknown_fncall): Add param "p" and pass it on to
1776 binding_cluster::on_unknown_fncall.
1777 * store.h (binding_cluster::on_unknown_fncall): Add param p.
1778 (binding_cluster::on_asm): Likewise.
1779 (store::on_unknown_fncall): Likewise.
1780 * svalue.h (class conjured_purge): New.
1782 2022-03-29 David Malcolm <dmalcolm@redhat.com>
1785 * region.cc (ipa_ref_requires_tracking): Drop "context_fndecl",
1786 instead using the ref->referring to get the cgraph node of the
1788 (symnode_requires_tracking_p): Likewise.
1790 2022-03-26 David Malcolm <dmalcolm@redhat.com>
1793 * store.cc (binding_cluster::make_unknown_relative_to): Reject
1794 attempts to create a cluster for untracked base regions.
1795 (store::set_value): Likewise.
1796 (store::fill_region): Likewise.
1797 (store::mark_region_as_unknown): Likewise.
1799 2022-03-25 David Malcolm <dmalcolm@redhat.com>
1802 * analyzer.opt (-fdump-analyzer-untracked): New option.
1803 * engine.cc (impl_run_checkers): Handle it.
1804 * region-model-asm.cc (region_model::on_asm_stmt): Don't attempt
1805 to clobber regions with !tracked_p ().
1806 * region-model-manager.cc (dump_untracked_region): New.
1807 (region_model_manager::dump_untracked_regions): New.
1808 (frame_region::dump_untracked_regions): New.
1809 * region-model.h (region_model_manager::dump_untracked_regions):
1811 * region.cc (ipa_ref_requires_tracking): New.
1812 (symnode_requires_tracking_p): New.
1813 (decl_region::calc_tracked_p): New.
1814 * region.h (region::tracked_p): New vfunc.
1815 (frame_region::dump_untracked_regions): New decl.
1816 (class decl_region): Note that this is also used fo SSA names.
1817 (decl_region::decl_region): Initialize m_tracked.
1818 (decl_region::tracked_p): New.
1819 (decl_region::calc_tracked_p): New decl.
1820 (decl_region::m_tracked): New.
1821 * store.cc (store::get_or_create_cluster): Assert that we
1822 don't try to create clusters for base regions that aren't
1824 (store::mark_as_escaped): Don't mark base regions that we're not
1827 2022-03-23 David Malcolm <dmalcolm@redhat.com>
1830 * engine.cc (impl_run_checkers): Create the engine after the
1831 supergraph, and pass the supergraph to the engine.
1832 * region-model.cc (region_model::get_lvalue_1): Pass ctxt to
1833 frame_region::get_region_for_local.
1834 (region_model::update_for_return_gcall): Pass the lvalue for the
1835 result to pop_frame as a tree, rather than as a region.
1836 (region_model::pop_frame): Update for above change, determining
1837 the destination region after the frame is popped and thus with
1838 respect to the caller frame rather than the called frame.
1839 Likewise, set the value of the region to the return value after
1840 the frame is popped.
1841 (engine::engine): Add supergraph pointer.
1842 (selftest::test_stack_frames): Set the DECL_CONTECT of PARM_DECLs.
1843 (selftest::test_get_representative_path_var): Likewise.
1844 (selftest::test_state_merging): Likewise.
1845 * region-model.h (region_model::pop_frame): Convert first param
1846 from a const region * to a tree.
1847 (engine::engine): Add param "sg".
1848 (engine::m_sg): New field.
1849 * region.cc: Include "analyzer/sm.h" and
1850 "analyzer/program-state.h".
1851 (frame_region::get_region_for_local): Add "ctxt" param.
1852 Add assertions that VAR_DECLs are locals, and that expr is for the
1854 * region.h (frame_region::get_region_for_local): Add "ctxt" param.
1856 2022-03-23 David Malcolm <dmalcolm@redhat.com>
1859 * sm-taint.cc (taint_diagnostic::subclass_equal_p): Check
1860 m_has_bounds as well as m_arg.
1861 (tainted_allocation_size::subclass_equal_p): Chain up to base
1862 class implementation. Also check m_mem_space.
1863 (tainted_allocation_size::emit): Add note showing stack-based vs
1864 heap-based allocations.
1866 2022-03-23 David Malcolm <dmalcolm@redhat.com>
1869 * diagnostic-manager.cc (diagnostic_manager::add_diagnostic):
1870 Convert return type from "void" to "bool", reporting success vs
1871 failure to caller, for both overloads.
1872 * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
1874 * engine.cc (impl_region_model_context::warn): Propagate return
1875 value from diagnostic_manager::add_diagnostic.
1877 2022-03-18 David Malcolm <dmalcolm@redhat.com>
1882 * analyzer.h (class state_purge_per_decl): New forward decl.
1883 * engine.cc (impl_run_checkers): Pass region_model_manager to
1884 state_purge_map ctor.
1885 * program-point.cc (function_point::final_stmt_p): New.
1886 (function_point::get_next): New.
1887 * program-point.h (function_point::final_stmt_p): New decl.
1888 (function_point::get_next): New decl.
1889 * program-state.cc (program_state::prune_for_point): Generalize to
1890 purge local decls as well as SSA names.
1891 (program_state::can_purge_base_region_p): New.
1892 * program-state.h (program_state::can_purge_base_region_p): New
1894 * region-model.cc (struct append_ssa_names_cb_data): Rename to...
1895 (struct append_regions_cb_data): ...this.
1896 (region_model::get_ssa_name_regions_for_current_frame): Rename
1898 (region_model::get_regions_for_current_frame): ...this, updating
1899 for other renamings.
1900 (region_model::append_ssa_names_cb): Rename to...
1901 (region_model::append_regions_cb): ...this, and drop the requirement
1902 that the subregion be a SSA name.
1903 * region-model.h (struct append_ssa_names_cb_data): Rename decl
1905 (struct append_regions_cb_data): ...this.
1906 (region_model::get_ssa_name_regions_for_current_frame): Rename
1908 (region_model::get_regions_for_current_frame): ...this.
1909 (region_model::append_ssa_names_cb): Rename decl to...
1910 (region_model::append_regions_cb): ...this.
1911 * state-purge.cc: Include "tristate.h", "selftest.h",
1912 "analyzer/store.h", "analyzer/region-model.h", and
1914 (get_candidate_for_purging): New.
1915 (class gimple_op_visitor): New.
1919 (state_purge_map::state_purge_map): Add "mgr" param. Update for
1920 renamings. Find uses of local variables.
1921 (state_purge_map::~state_purge_map): Update for renaming of m_map
1922 to m_ssa_map. Clean up m_decl_map.
1923 (state_purge_map::get_or_create_data_for_decl): New.
1924 (state_purge_per_ssa_name::state_purge_per_ssa_name): Update for
1925 inheriting from state_purge_per_tree.
1926 (state_purge_per_ssa_name::add_to_worklist): Likewise.
1927 (state_purge_per_decl::state_purge_per_decl): New.
1928 (state_purge_per_decl::add_needed_at): New.
1929 (state_purge_per_decl::add_pointed_to_at): New.
1930 (state_purge_per_decl::process_worklists): New.
1931 (state_purge_per_decl::add_to_worklist): New.
1932 (same_binding_p): New.
1933 (fully_overwrites_p): New.
1934 (state_purge_per_decl::process_point_backwards): New.
1935 (state_purge_per_decl::process_point_forwards): New.
1936 (state_purge_per_decl::needed_at_point_p): New.
1937 (state_purge_annotator::print_needed): Generalize to print local
1938 decls as well as SSA names.
1939 * state-purge.h (class state_purge_map): Update leading comment.
1940 (state_purge_map::map_t): Rename to...
1941 (state_purge_map::ssa_map_t): ...this.
1942 (state_purge_map::iterator): Rename to...
1943 (state_purge_map::ssa_iterator): ...this.
1944 (state_purge_map::decl_map_t): New typedef.
1945 (state_purge_map::decl_iterator): New typedef.
1946 (state_purge_map::state_purge_map): Add "mgr" param.
1947 (state_purge_map::get_data_for_ssa_name): Update for renaming.
1948 (state_purge_map::get_any_data_for_decl): New.
1949 (state_purge_map::get_or_create_data_for_decl): New decl.
1950 (state_purge_map::begin): Rename to...
1951 (state_purge_map::begin_ssas): ...this.
1952 (state_purge_map::end): Rename to...
1953 (state_purge_map::end_ssa): ...this.
1954 (state_purge_map::begin_decls): New.
1955 (state_purge_map::end_decls): New.
1956 (state_purge_map::m_map): Rename to...
1957 (state_purge_map::m_ssa_map): ...this.
1958 (state_purge_map::m_decl_map): New field.
1959 (class state_purge_per_tree): New class.
1960 (class state_purge_per_ssa_name): Inherit from state_purge_per_tree.
1961 (state_purge_per_ssa_name::get_function): Move to base class.
1962 (state_purge_per_ssa_name::point_set_t): Likewise.
1963 (state_purge_per_ssa_name::m_fun): Likewise.
1964 (class state_purge_per_decl): New.
1966 2022-03-17 David Malcolm <dmalcolm@redhat.com>
1968 * state-purge.cc (state_purge_annotator::add_node_annotations):
1969 Avoid duplicate before-supernode annotations when returning from
1970 an interprocedural call. Show after-supernode annotations.
1972 2022-03-17 David Malcolm <dmalcolm@redhat.com>
1974 * program-point.cc (program_point::get_next): Fix missing
1977 2022-03-16 David Malcolm <dmalcolm@redhat.com>
1980 * diagnostic-manager.cc (get_emission_location): New.
1981 (diagnostic_manager::diagnostic_manager): Initialize
1982 m_num_disabled_diagnostics.
1983 (diagnostic_manager::add_diagnostic): Reject diagnostics that
1984 will eventually be rejected due to being disabled.
1985 (diagnostic_manager::emit_saved_diagnostics): Log the number
1986 of disabled diagnostics.
1987 (diagnostic_manager::emit_saved_diagnostic): Split out logic for
1988 determining emission location to get_emission_location.
1989 * diagnostic-manager.h
1990 (diagnostic_manager::m_num_disabled_diagnostics): New field.
1991 * engine.cc (stale_jmp_buf::get_controlling_option): New.
1992 (stale_jmp_buf::emit): Use it.
1993 * pending-diagnostic.h
1994 (pending_diagnostic::get_controlling_option): New vfunc.
1996 (poisoned_value_diagnostic::get_controlling_option): New.
1997 (poisoned_value_diagnostic::emit): Use it.
1998 (shift_count_negative_diagnostic::get_controlling_option): New.
1999 (shift_count_negative_diagnostic::emit): Use it.
2000 (shift_count_overflow_diagnostic::get_controlling_option): New.
2001 (shift_count_overflow_diagnostic::emit): Use it.
2002 (dump_path_diagnostic::get_controlling_option): New.
2003 (dump_path_diagnostic::emit): Use it.
2004 (write_to_const_diagnostic::get_controlling_option): New.
2005 (write_to_const_diagnostic::emit): Use it.
2006 (write_to_string_literal_diagnostic::get_controlling_option): New.
2007 (write_to_string_literal_diagnostic::emit): Use it.
2008 * sm-file.cc (double_fclose::get_controlling_option): New.
2009 (double_fclose::emit): Use it.
2010 (file_leak::get_controlling_option): New.
2011 (file_leak::emit): Use it.
2012 * sm-malloc.cc (mismatching_deallocation::get_controlling_option):
2014 (mismatching_deallocation::emit): Use it.
2015 (double_free::get_controlling_option): New.
2016 (double_free::emit): Use it.
2017 (possible_null_deref::get_controlling_option): New.
2018 (possible_null_deref::emit): Use it.
2019 (possible_null_arg::get_controlling_option): New.
2020 (possible_null_arg::emit): Use it.
2021 (null_deref::get_controlling_option): New.
2022 (null_deref::emit): Use it.
2023 (null_arg::get_controlling_option): New.
2024 (null_arg::emit): Use it.
2025 (use_after_free::get_controlling_option): New.
2026 (use_after_free::emit): Use it.
2027 (malloc_leak::get_controlling_option): New.
2028 (malloc_leak::emit): Use it.
2029 (free_of_non_heap::get_controlling_option): New.
2030 (free_of_non_heap::emit): Use it.
2031 * sm-pattern-test.cc (pattern_match::get_controlling_option): New.
2032 (pattern_match::emit): Use it.
2034 (exposure_through_output_file::get_controlling_option): New.
2035 (exposure_through_output_file::emit): Use it.
2036 * sm-signal.cc (signal_unsafe_call::get_controlling_option): New.
2037 (signal_unsafe_call::emit): Use it.
2038 * sm-taint.cc (tainted_array_index::get_controlling_option): New.
2039 (tainted_array_index::emit): Use it.
2040 (tainted_offset::get_controlling_option): New.
2041 (tainted_offset::emit): Use it.
2042 (tainted_size::get_controlling_option): New.
2043 (tainted_size::emit): Use it.
2044 (tainted_divisor::get_controlling_option): New.
2045 (tainted_divisor::emit): Use it.
2046 (tainted_allocation_size::get_controlling_option): New.
2047 (tainted_allocation_size::emit): Use it.
2049 2022-03-15 David Malcolm <dmalcolm@redhat.com>
2051 * store.cc (store::store): Presize m_cluster_map.
2053 2022-03-10 David Malcolm <dmalcolm@redhat.com>
2056 * constraint-manager.cc (constraint_manager::add_constraint):
2057 Refresh the EC IDs when adding constraints implied by offsets.
2059 2022-03-10 David Malcolm <dmalcolm@redhat.com>
2062 * analyzer.h (class pending_note): New forward decl.
2063 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
2065 (saved_diagnostic::operator==): Compare m_notes.
2066 (saved_diagnostic::add_note): New.
2067 (saved_diagnostic::emit_any_notes): New.
2068 (diagnostic_manager::add_note): New.
2069 (diagnostic_manager::emit_saved_diagnostic): Call emit_any_notes
2070 after emitting the warning.
2071 * diagnostic-manager.h (saved_diagnostic::add_note): New decl.
2072 (saved_diagnostic::emit_any_notes): New decl.
2073 (saved_diagnostic::m_notes): New field.
2074 (diagnostic_manager::add_note): New decl.
2075 * engine.cc (impl_region_model_context::add_note): New.
2076 * exploded-graph.h (impl_region_model_context::add_note): New
2078 * pending-diagnostic.h (class pending_note): New.
2079 (class pending_note_subclass): New template.
2080 * region-model.cc (class reason_attr_access): New.
2081 (check_external_function_for_access_attr): Add class
2082 annotating_ctxt and use it when checking region.
2083 (noop_region_model_context::add_note): New.
2084 * region-model.h (region_model_context::add_note): New vfunc.
2085 (noop_region_model_context::add_note): New decl.
2086 (class region_model_context_decorator): New.
2087 (class note_adding_context): New.
2089 2022-03-10 David Malcolm <dmalcolm@redhat.com>
2093 (region_model::check_external_function_for_access_attr): New.
2094 (region_model::handle_unrecognized_call): Call it.
2096 (region_model::check_external_function_for_access_attr): New decl.
2097 (region_model::handle_unrecognized_call): New decl.
2099 2022-03-10 David Malcolm <dmalcolm@redhat.com>
2101 * sm-taint.cc (taint_state_machine::check_for_tainted_size_arg):
2102 Avoid generating duplicate saved_diagnostics by only handling the
2103 rdwr_map entry for the ptrarg, not the duplicate entry for the
2106 2022-03-07 David Malcolm <dmalcolm@redhat.com>
2109 * engine.cc (returning_from_function_p): New.
2110 (impl_region_model_context::on_state_leak): Use it when rejecting
2111 leaks at the return from "main".
2113 2022-03-07 Jakub Jelinek <jakub@redhat.com>
2115 * store.cc: Fix up duplicated word issue in a comment.
2116 * analyzer.cc: Likewise.
2117 * engine.cc: Likewise.
2118 * sm-taint.cc: Likewise.
2120 2022-03-04 David Malcolm <dmalcolm@redhat.com>
2123 * analyzer.opt (-param=analyzer-max-svalue-depth=): Reduce from 13
2126 2022-02-23 David Malcolm <dmalcolm@redhat.com>
2129 * analyzer.h (class const_fn_result_svalue): New decl.
2130 * region-model-impl-calls.cc (call_details::get_manager): New.
2131 * region-model-manager.cc
2132 (region_model_manager::get_or_create_const_fn_result_svalue): New.
2133 (region_model_manager::log_stats): Log
2134 m_const_fn_result_values_map.
2135 * region-model.cc (const_fn_p): New.
2136 (maybe_get_const_fn_result): New.
2137 (region_model::on_call_pre): Handle fndecls with
2138 __attribute__((const)) by calling the above rather than making
2140 * region-model.h (visitor::visit_const_fn_result_svalue): New.
2141 (region_model_manager::get_or_create_const_fn_result_svalue): New
2143 (region_model_manager::const_fn_result_values_map_t): New typedef.
2144 (region_model_manager::m_const_fn_result_values_map): New field.
2145 (call_details::get_manager): New decl.
2146 * svalue.cc (svalue::cmp_ptr): Handle SK_CONST_FN_RESULT.
2147 (const_fn_result_svalue::dump_to_pp): New.
2148 (const_fn_result_svalue::dump_input): New.
2149 (const_fn_result_svalue::accept): New.
2150 * svalue.h (enum svalue_kind): Add SK_CONST_FN_RESULT.
2151 (svalue::dyn_cast_const_fn_result_svalue): New.
2152 (class const_fn_result_svalue): New.
2153 (is_a_helper <const const_fn_result_svalue *>::test): New.
2154 (template <> struct default_hash_traits<const_fn_result_svalue::key_t>):
2157 2022-02-17 David Malcolm <dmalcolm@redhat.com>
2160 * region-model.cc: Include "calls.h".
2161 (region_model::on_call_pre): Use flags_from_decl_or_type to
2162 generalize check for DECL_PURE_P to also check for ECF_CONST.
2164 2022-02-16 David Malcolm <dmalcolm@redhat.com>
2167 * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
2168 Add region creation events for globals of interest.
2169 (null_assignment_sm_context::get_old_program_state): New.
2170 (diagnostic_manager::add_events_for_eedge): Move check for
2171 changing dynamic extents from PK_BEFORE_STMT case to after the
2172 switch on the dst_point's kind so that we can emit them for the
2173 final stmt in a basic block.
2174 * engine.cc (impl_sm_context::get_old_program_state): New.
2175 * sm-malloc.cc (malloc_state_machine::get_default_state): Rewrite
2176 detection of m_non_heap to use get_memory_space.
2177 (free_of_non_heap::free_of_non_heap): Add freed_reg param.
2178 (free_of_non_heap::subclass_equal_p): Update for changes to
2180 (free_of_non_heap::emit): Drop m_kind in favor of
2182 (free_of_non_heap::describe_state_change): Remove logic for
2184 (free_of_non_heap::mark_interesting_stuff): Add region-creation of
2186 (free_of_non_heap::get_memory_space): New.
2187 (free_of_non_heap::kind): Drop enum.
2188 (free_of_non_heap::m_freed_reg): New field.
2189 (free_of_non_heap::m_kind): Drop field.
2190 (malloc_state_machine::on_stmt): Drop transition to m_non_heap.
2191 (malloc_state_machine::handle_free_of_non_heap): New function,
2192 split out from on_deallocator_call and on_realloc_call, adding
2193 detection of the freed region.
2194 (malloc_state_machine::on_deallocator_call): Use it.
2195 (malloc_state_machine::on_realloc_call): Likewise.
2196 * sm.h (sm_context::get_old_program_state): New vfunc.
2198 2022-02-15 David Malcolm <dmalcolm@redhat.com>
2201 * region-model-manager.cc
2202 (region_model_manager::maybe_fold_sub_svalue): Only call
2203 get_or_create_cast if type is non-NULL.
2205 2022-02-15 David Malcolm <dmalcolm@redhat.com>
2208 * exploded-graph.h (impl_region_model_context::get_stmt): New.
2209 * region-model.cc: Include "gimple-ssa.h", "tree-phinodes.h",
2210 "tree-ssa-operands.h", and "ssa-iterators.h".
2211 (within_short_circuited_stmt_p): New.
2212 (region_model::check_for_poison): Don't warn about uninit values
2213 if within_short_circuited_stmt_p.
2214 * region-model.h (region_model_context::get_stmt): New vfunc.
2215 (noop_region_model_context::get_stmt): New.
2217 2022-02-11 David Malcolm <dmalcolm@redhat.com>
2220 * region-model.cc (region_model::check_for_poison): Ignore
2221 uninitialized uses of empty types.
2223 2022-02-10 David Malcolm <dmalcolm@redhat.com>
2226 * region-model-manager.cc
2227 (region_model_manager::maybe_fold_sub_svalue): Generalize getting
2228 individual chars of a STRING_CST from element_region to any
2229 subregion which is a concrete access of a single byte from its
2231 * region.cc (region::get_relative_concrete_byte_range): New.
2232 * region.h (region::get_relative_concrete_byte_range): New decl.
2234 2022-02-09 David Malcolm <dmalcolm@redhat.com>
2237 * region-model.cc (selftest::test_bit_range_regions): New.
2238 (selftest::analyzer_region_model_cc_tests): Call it.
2239 * region.h (bit_range_region::key_t::hash): Fix hashing of m_bits
2240 to avoid using uninitialized data.
2242 2022-02-07 David Malcolm <dmalcolm@redhat.com>
2245 * sm-taint.cc (tainted_allocation_size::tainted_allocation_size):
2246 Remove overzealous assertion.
2247 (tainted_allocation_size::emit): Likewise.
2248 (region_model::check_dynamic_size_for_taint): Likewise.
2250 2022-02-07 David Malcolm <dmalcolm@redhat.com>
2253 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
2254 Reimplement in terms of a get_store_value followed by a set_value.
2256 2022-02-03 David Malcolm <dmalcolm@redhat.com>
2259 * engine.cc (exploded_graph::process_node): Use the node for any
2260 diagnostics, avoiding ICE if a bifurcation update adds a
2261 saved_diagnostic, such as for a tainted realloc size.
2262 * region-model-impl-calls.cc
2263 (region_model::impl_call_realloc::success_no_move::update_model):
2264 Require the old pointer to be non-NULL to be able successfully
2265 grow in place. Use model->deref_rvalue rather than maybe_get_region
2266 to support the old pointer being symbolic.
2267 (region_model::impl_call_realloc::success_with_move::update_model):
2268 Likewise. Add a constraint that the new pointer != the old pointer.
2269 Use a sized_region when setting the value of the new region.
2270 Handle the case where we don't know the dynamic size of the old
2271 region by marking the new region as unknown.
2272 * sm-taint.cc (tainted_allocation_size::tainted_allocation_size):
2273 Update assertion to also allow for MEMSPACE_UNKNOWN.
2274 (tainted_allocation_size::emit): Likewise.
2275 (region_model::check_dynamic_size_for_taint): Likewise.
2277 2022-02-03 David Malcolm <dmalcolm@redhat.com>
2279 * region-model-impl-calls.cc (region_model::impl_call_calloc): Use
2280 a sized_region when calling zero_fill_region.
2282 2022-02-02 David Malcolm <dmalcolm@redhat.com>
2284 * region-model.cc (region_model::on_return): Replace usage of
2285 copy_region with get_rvalue/set_value pair.
2286 (region_model::pop_frame): Likewise.
2287 (selftest::test_compound_assignment): Likewise.
2288 * region-model.h (region_model::copy_region): Delete decl.
2289 * region.cc (region_model::copy_region): Delete.
2291 2022-02-02 David Malcolm <dmalcolm@redhat.com>
2293 * region.cc (region::calc_offset): Consolidate effectively
2296 2022-02-02 David Malcolm <dmalcolm@redhat.com>
2298 * analyzer.h (class bit_range_region): New forward decl.
2299 * region-model-manager.cc (region_model_manager::get_bit_range):
2301 (region_model_manager::log_stats): Handle m_bit_range_regions.
2302 * region-model.cc (region_model::get_lvalue_1): Handle
2304 * region-model.h (region_model_manager::get_bit_range): New decl.
2305 (region_model_manager::m_bit_range_regions): New field.
2306 * region.cc (region::get_base_region): Handle RK_BIT_RANGE.
2307 (region::base_region_p): Likewise.
2308 (region::calc_offset): Likewise.
2309 (bit_range_region::dump_to_pp): New.
2310 (bit_range_region::get_byte_size): New.
2311 (bit_range_region::get_bit_size): New.
2312 (bit_range_region::get_byte_size_sval): New.
2313 (bit_range_region::get_relative_concrete_offset): New.
2314 * region.h (enum region_kind): Add RK_BIT_RANGE.
2315 (region::dyn_cast_bit_range_region): New vfunc.
2316 (class bit_range_region): New.
2317 (is_a_helper <const bit_range_region *>::test): New.
2318 (default_hash_traits<bit_range_region::key_t>): New.
2320 2022-02-02 David Malcolm <dmalcolm@redhat.com>
2323 * region-model.cc (region_model::on_call_pre): Handle
2326 2022-01-27 David Malcolm <dmalcolm@redhat.com>
2328 * checker-path.cc (event_kind_to_string): Handle
2330 (region_creation_event::region_creation_event): New.
2331 (region_creation_event::get_desc): New.
2332 (checker_path::add_region_creation_event): New.
2333 * checker-path.h (enum event_kind): Add EK_REGION_CREATION.
2334 (class region_creation_event): New subclass.
2335 (checker_path::add_region_creation_event): New decl.
2336 * diagnostic-manager.cc
2337 (diagnostic_manager::emit_saved_diagnostic): Pass NULL for new
2338 param to add_events_for_eedge when handling trailing eedge.
2339 (diagnostic_manager::build_emission_path): Create an interesting_t
2340 instance, allow the pending diagnostic to populate it, and pass it
2341 to the calls to add_events_for_eedge.
2342 (diagnostic_manager::add_events_for_eedge): Add "interest" param.
2343 Use it to add region_creation_events for on-stack regions created
2344 within at function entry, and when pertinent dynamically-sized
2345 regions are created.
2346 (diagnostic_manager::prune_for_sm_diagnostic): Add case for
2348 * diagnostic-manager.h (diagnostic_manager::add_events_for_eedge):
2349 Add "interest" param.
2350 * pending-diagnostic.cc: Include "selftest.h", "tristate.h",
2351 "analyzer/call-string.h", "analyzer/program-point.h",
2352 "analyzer/store.h", and "analyzer/region-model.h".
2353 (interesting_t::add_region_creation): New.
2354 (interesting_t::dump_to_pp): New.
2355 * pending-diagnostic.h (struct interesting_t): New.
2356 (pending_diagnostic::mark_interesting_stuff): New vfunc.
2358 (poisoned_value_diagnostic::poisoned_value_diagnostic): Add
2359 (poisoned_value_diagnostic::operator==): Compare m_pkind and
2360 m_src_region fields.
2361 (poisoned_value_diagnostic::mark_interesting_stuff): New.
2362 (poisoned_value_diagnostic::m_src_region): New.
2363 (region_model::check_for_poison): Call
2364 get_region_for_poisoned_expr for uninit values and pass the resul
2366 (region_model::get_region_for_poisoned_expr): New.
2367 (region_model::deref_rvalue): Pass NULL for
2368 poisoned_value_diagnostic's src_region.
2369 * region-model.h (region_model::get_region_for_poisoned_expr): New
2371 * region.h (frame_region::get_fndecl): New.
2373 2022-01-27 Martin Liska <mliska@suse.cz>
2376 * constraint-manager.cc (bounded_ranges_manager::log_stats):
2377 Cast to long for format purpose.
2378 * region-model-manager.cc (log_uniq_map): Likewise.
2380 2022-01-26 David Malcolm <dmalcolm@redhat.com>
2383 * region-model.cc (region_model::check_call_args): New.
2384 (region_model::on_call_pre): Call it when ignoring stdio builtins.
2385 * region-model.h (region_model::check_call_args): New decl
2387 2022-01-26 David Malcolm <dmalcolm@redhat.com>
2390 * constraint-manager.cc (range::add_bound): Fix tests for
2391 discarding redundant constraints. Perform test for rejecting
2392 unsatisfiable constraints earlier so that they don't update
2393 the object on failure.
2394 (selftest::test_range): New.
2395 (selftest::test_constant_comparisons): Add test coverage for
2396 existing constraints becoming narrower until they are
2398 (selftest::run_constraint_manager_tests): Call test_range.
2400 2022-01-22 David Malcolm <dmalcolm@redhat.com>
2403 * region-model-manager.cc
2404 (region_model_manager::get_or_create_cast): Bail out if the types
2405 are the same. Don't attempt to handle casts involving vector
2408 2022-01-20 David Malcolm <dmalcolm@redhat.com>
2411 * constraint-manager.cc (bound::ensure_closed): Convert param to
2413 (range::constrained_to_single_element): Likewise.
2414 (range::add_bound): New.
2415 (constraint_manager::add_constraint): Handle SVAL + OFFSET
2416 compared to a constant.
2417 (constraint_manager::get_ec_bounds): Rewrite in terms of
2419 (constraint_manager::eval_condition): Reject if range::add_bound
2421 (selftest::test_constant_comparisons): Add test coverage for
2422 various impossible combinations of integer comparisons.
2423 * constraint-manager.h (enum bound_kind): New.
2424 (struct bound): Likewise.
2425 (bound::ensure_closed): Convert to param to enum bound_kind.
2426 (struct range): Convert to...
2427 (class range): ...this, making fields private.
2428 (range::add_bound): New decls.
2429 * region-model.cc (region_model::add_constraint): Fail if
2430 constraint_manager::add_constraint fails.
2432 2022-01-18 David Malcolm <dmalcolm@redhat.com>
2435 * region-model-manager.cc
2436 (region_model_manager::get_or_create_constant_svalue): Assert that
2437 we have a CONSTANT_CLASS_P.
2438 (region_model_manager::maybe_fold_unaryop): Only fold a constant
2439 when fold_unary's result is a constant or a cast of a constant.
2441 2022-01-18 David Malcolm <dmalcolm@redhat.com>
2444 * region-model-manager.cc
2445 (region_model_manager::maybe_fold_sub_svalue): Avoid casting to
2446 NULL type when folding access to repeated svalue.
2448 2022-01-17 Martin Liska <mliska@suse.cz>
2450 * analyzer.cc (is_special_named_call_p): Rename .c names to .cc.
2451 (is_named_call_p): Likewise.
2452 * region-model-asm.cc (deterministic_p): Likewise.
2453 * region.cc (field_region::get_relative_concrete_offset): Likewise.
2454 * sm-malloc.cc (method_p): Likewise.
2455 * supergraph.cc (superedge::dump_dot): Likewise.
2457 2022-01-14 David Malcolm <dmalcolm@redhat.com>
2459 * sm-taint.cc (taint_state_machine::combine_states): Handle combination
2460 of has_ub and has_lb.
2462 2022-01-14 David Malcolm <dmalcolm@redhat.com>
2465 * sm-taint.cc (taint_state_machine::alt_get_inherited_state):
2466 Remove gcc_unreachable from default case for unary ops.
2468 2022-01-14 David Malcolm <dmalcolm@redhat.com>
2470 * engine.cc: Include "stringpool.h", "attribs.h", and
2472 (mark_params_as_tainted): New.
2473 (class tainted_args_function_custom_event): New.
2474 (class tainted_args_function_info): New.
2475 (exploded_graph::add_function_entry): Handle functions with
2476 "tainted_args" attribute.
2477 (class tainted_args_field_custom_event): New.
2478 (class tainted_args_callback_custom_event): New.
2479 (class tainted_args_call_info): New.
2480 (add_tainted_args_callback): New.
2481 (add_any_callbacks): New.
2482 (exploded_graph::build_initial_worklist): Likewise.
2483 (exploded_graph::build_initial_worklist): Find callbacks that are
2484 reachable from global initializers, calling add_any_callbacks on
2487 2022-01-12 David Malcolm <dmalcolm@redhat.com>
2490 * engine.cc (impl_sm_context::impl_sm_context): Add
2491 "unknown_side_effects" param and use it to initialize
2492 new m_unknown_side_effects field.
2493 (impl_sm_context::unknown_side_effects_p): New.
2494 (impl_sm_context::m_unknown_side_effects): New.
2495 (exploded_node::on_stmt): Pass unknown_side_effects to sm_ctxt
2497 * sm-taint.cc: Include "stringpool.h" and "attribs.h".
2498 (tainted_size::tainted_size): Drop "dir" param.
2499 (tainted_size::get_kind): Drop "FINAL".
2500 (tainted_size::emit): Likewise.
2501 (tainted_size::m_dir): Drop unused field.
2502 (class tainted_access_attrib_size): New subclass.
2503 (taint_state_machine::on_stmt): Call check_for_tainted_size_arg on
2504 external functions with unknown side effects.
2505 (taint_state_machine::check_for_tainted_size_arg): New.
2506 (region_model::check_region_for_taint): Drop "dir" param from
2508 * sm.h (sm_context::unknown_side_effects_p): New.
2510 2022-01-11 David Malcolm <dmalcolm@redhat.com>
2513 * diagnostic-manager.cc
2514 (class auto_disable_complexity_checks): Rename to...
2515 (class auto_checking_feasibility): ...this, updating
2516 the calls accordingly.
2517 (epath_finder::explore_feasible_paths): Update for renaming.
2518 * region-model-manager.cc
2519 (region_model_manager::region_model_manager): Update for change from
2520 m_check_complexity to m_checking_feasibility.
2521 (region_model_manager::reject_if_too_complex): Likewise.
2522 (region_model_manager::get_or_create_unknown_svalue): Handle
2523 m_checking_feasibility.
2524 (region_model_manager::create_unique_svalue): New.
2525 (region_model_manager::maybe_fold_binop): Handle BIT_AND_EXPR and
2526 BIT_IOR_EXPRs on booleans where we know the result.
2527 * region-model.cc (test_binop_svalue_folding): Add test coverage
2529 * region-model.h (region_model_manager::create_unique_svalue): New
2531 (region_model_manager::enable_complexity_check): Replace with...
2532 (region_model_manager::begin_checking_feasibility): ...this.
2533 (region_model_manager::disable_complexity_check): Replace with...
2534 (region_model_manager::end_checking_feasibility): ...this.
2535 (region_model_manager::m_check_complexity): Replace with...
2536 (region_model_manager::m_checking_feasibility): ...this.
2537 (region_model_manager::m_managed_dynamic_svalues): New field.
2539 2022-01-08 David Malcolm <dmalcolm@redhat.com>
2541 * engine.cc (impl_run_checkers): Pass logger to engine ctor.
2542 * region-model-manager.cc
2543 (region_model_manager::region_model_manager): Add logger param and
2544 use it to initialize m_logger.
2545 * region-model.cc (engine::engine): New.
2546 * region-model.h (region_model_manager::region_model_manager):
2548 (region_model_manager::get_logger): New.
2549 (region_model_manager::m_logger): New field.
2550 (engine::engine): New.
2551 * store.cc (store_manager::get_logger): New.
2552 (store::set_value): Log scope. Log when marking a cluster as
2553 unknown due to possible aliasing.
2554 * store.h (store_manager::get_logger): New decl.
2556 2022-01-08 David Malcolm <dmalcolm@redhat.com>
2558 * region-model-impl-calls.cc (cmp_decls): New.
2559 (cmp_decls_ptr_ptr): New.
2560 (region_model::impl_call_analyzer_dump_escaped): New.
2561 * region-model.cc (region_model::on_stmt_pre): Handle
2562 __analyzer_dump_escaped.
2563 * region-model.h (region_model::impl_call_analyzer_dump_escaped):
2565 * store.h (binding_cluster::get_base_region): New accessor.
2567 2022-01-08 David Malcolm <dmalcolm@redhat.com>
2569 * region.cc (region::is_named_decl_p): New.
2570 * region.h (region::is_named_decl_p): New decl.
2572 2022-01-06 David Malcolm <dmalcolm@redhat.com>
2575 * store.cc (store::eval_alias_1): Refactor handling of decl
2576 regions, adding a test for may_be_aliased, rejecting those for
2577 which it returns false.
2579 2021-12-12 Jonathan Wakely <jwakely@redhat.com>
2581 * engine.cc: Define INCLUDE_MEMORY instead of INCLUDE_UNIQUE_PTR.
2583 2021-12-06 David Malcolm <dmalcolm@redhat.com>
2586 * constraint-manager.cc (equiv_class::contains_non_constant_p):
2588 (constraint_manager::canonicalize): Call it when determining
2590 (selftest::test_purging): New selftest.
2591 (selftest::run_constraint_manager_tests): Likewise.
2592 * constraint-manager.h (equiv_class::contains_non_constant_p):
2595 2021-12-01 David Malcolm <dmalcolm@redhat.com>
2598 * region-model-reachability.cc (reachable_regions::handle_parm):
2599 Treat all svalues within a compound parm has reachable, and those
2602 2021-11-29 David Malcolm <dmalcolm@redhat.com>
2605 * store.cc (binding_cluster::can_merge_p): For the "key is bound"
2606 vs "key is not bound" merger case, check that the bound svalue
2607 is mergeable before merging it to "unknown", rejecting the merger
2610 2021-11-19 David Malcolm <dmalcolm@redhat.com>
2613 * engine.cc (exploded_graph::get_or_create_node): Pass in
2614 m_ext_state to program_state::can_merge_with_p.
2615 (exploded_graph::process_worklist): Likewise.
2616 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
2618 (exploded_graph::process_node): Add missing call to detect_leaks
2619 when handling phi nodes.
2620 * program-state.cc (program_state::can_merge_with_p): Add
2621 "ext_state" param. Pass it and state ptrs to
2622 region_model::can_merge_with_p.
2623 (selftest::test_program_state_merging): Update for new ext_state
2624 param of program_state::can_merge_with_p.
2625 (selftest::test_program_state_merging_2): Likewise.
2626 * program-state.h (program_state::can_purge_p): Make const.
2627 (program_state::can_merge_with_p): Add "ext_state" param.
2628 * region-model.cc: Include "analyzer/program-state.h".
2629 (region_model::can_merge_with_p): Add params "ext_state",
2630 "state_a", and "state_b", use them when creating model_merger
2632 (model_merger::mergeable_svalue_p): New.
2633 * region-model.h (region_model::can_merge_with_p): Add params
2634 "ext_state", "state_a", and "state_b".
2635 (model_merger::model_merger) Likewise, initializing new fields.
2636 (model_merger::mergeable_svalue_p): New decl.
2637 (model_merger::m_ext_state): New field.
2638 (model_merger::m_state_a): New field.
2639 (model_merger::m_state_b): New field.
2640 * svalue.cc (svalue::can_merge_p): Call
2641 model_merger::mergeable_svalue_p on both states and reject the
2644 2021-11-17 David Malcolm <dmalcolm@redhat.com>
2647 * region-model-impl-calls.cc (region_model::impl_call_strchr): New.
2648 * region-model-manager.cc
2649 (region_model_manager::maybe_fold_unaryop): Simplify cast to
2650 pointer type of an existing pointer to a region.
2651 * region-model.cc (region_model::on_call_pre): Handle
2652 BUILT_IN_STRCHR and "strchr".
2653 (write_to_const_diagnostic::emit): Add auto_diagnostic_group. Add
2654 alternate wordings for functions and labels.
2655 (write_to_const_diagnostic::describe_final_event): Add alternate
2656 wordings for functions and labels.
2657 (region_model::check_for_writable_region): Handle RK_FUNCTION and
2659 * region-model.h (region_model::impl_call_strchr): New decl.
2661 2021-11-16 David Malcolm <dmalcolm@redhat.com>
2664 * constraint-manager.cc (bounded_range::operator==): Require the
2665 types to be the same for equality.
2667 2021-11-13 David Malcolm <dmalcolm@redhat.com>
2669 * analyzer.opt (Wanalyzer-tainted-allocation-size): New.
2670 (Wanalyzer-tainted-divisor): New.
2671 (Wanalyzer-tainted-offset): New.
2672 (Wanalyzer-tainted-size): New.
2673 * engine.cc (impl_region_model_context::get_taint_map): New.
2674 * exploded-graph.h (impl_region_model_context::get_taint_map):
2676 * program-state.cc (sm_state_map::get_state): Call
2677 alt_get_inherited_state.
2678 (sm_state_map::impl_set_state): Modify states within
2680 (program_state::impl_call_analyzer_dump_state): Undo casts.
2681 (selftest::test_program_state_1): Update for new context param of
2682 create_region_for_heap_alloc.
2683 (selftest::test_program_state_merging): Likewise.
2684 * region-model-impl-calls.cc (region_model::impl_call_alloca):
2686 (region_model::impl_call_calloc): Likewise.
2687 (region_model::impl_call_malloc): Likewise.
2688 (region_model::impl_call_operator_new): Likewise.
2689 (region_model::impl_call_realloc): Likewise.
2690 * region-model.cc (region_model::check_region_access): Call
2691 check_region_for_taint.
2692 (region_model::get_representative_path_var_1): Handle binops.
2693 (region_model::create_region_for_heap_alloc): Add "ctxt" param and
2694 pass it to set_dynamic_extents.
2695 (region_model::create_region_for_alloca): Likewise.
2696 (region_model::set_dynamic_extents): Add "ctxt" param and use it
2697 to call check_dynamic_size_for_taint.
2698 (selftest::test_state_merging): Update for new context param of
2699 create_region_for_heap_alloc.
2700 (selftest::test_malloc_constraints): Likewise.
2701 (selftest::test_malloc): Likewise.
2702 (selftest::test_alloca): Likewise for create_region_for_alloca.
2703 * region-model.h (region_model::create_region_for_heap_alloc): Add
2705 (region_model::create_region_for_alloca): Likewise.
2706 (region_model::set_dynamic_extents): Likewise.
2707 (region_model::check_dynamic_size_for_taint): New decl.
2708 (region_model::check_region_for_taint): New decl.
2709 (region_model_context::get_taint_map): New vfunc.
2710 (noop_region_model_context::get_taint_map): New.
2711 * sm-taint.cc: Remove include of "diagnostic-event-id.h"; add
2712 includes of "gimple-iterator.h", "tristate.h", "selftest.h",
2713 "ordered-hash-map.h", "cgraph.h", "cfg.h", "digraph.h",
2714 "analyzer/supergraph.h", "analyzer/call-string.h",
2715 "analyzer/program-point.h", "analyzer/store.h",
2716 "analyzer/region-model.h", and "analyzer/program-state.h".
2717 (enum bounds): Move to top of file.
2718 (class taint_diagnostic): New.
2719 (class tainted_array_index): Convert to subclass of taint_diagnostic.
2720 (tainted_array_index::emit): Add CWE-129. Reword warning to use
2721 "attacker-controlled" rather than "tainted".
2722 (tainted_array_index::describe_state_change): Move to
2723 taint_diagnostic::describe_state_change.
2724 (tainted_array_index::describe_final_event): Reword to use
2725 "attacker-controlled" rather than "tainted".
2726 (class tainted_offset): New.
2727 (class tainted_size): New.
2728 (class tainted_divisor): New.
2729 (class tainted_allocation_size): New.
2730 (taint_state_machine::alt_get_inherited_state): New.
2731 (taint_state_machine::on_stmt): In assignment handling, remove
2732 ARRAY_REF handling in favor of check_region_for_taint. Add
2733 detection of tainted divisors.
2734 (taint_state_machine::get_taint): New.
2735 (taint_state_machine::combine_states): New.
2736 (region_model::check_region_for_taint): New.
2737 (region_model::check_dynamic_size_for_taint): New.
2738 * sm.h (state_machine::alt_get_inherited_state): New.
2740 2021-11-12 David Malcolm <dmalcolm@redhat.com>
2742 * engine.cc (exploded_node::on_stmt_pre): Return when handling
2743 "__analyzer_dump_state".
2745 2021-11-11 Richard Biener <rguenther@suse.de>
2747 * supergraph.cc: Include bitmap.h.
2749 2021-11-04 David Malcolm <dmalcolm@redhat.com>
2751 * program-state.cc (sm_state_map::dump): Use default_tree_printer
2754 2021-09-16 Maxim Blinov <maxim.blinov@embecosm.com>
2757 * engine.cc (INCLUDE_UNIQUE_PTR): Define.
2759 2021-09-08 David Malcolm <dmalcolm@redhat.com>
2762 * analyzer.h (compat_types_p): New decl.
2763 * constraint-manager.cc
2764 (constraint_manager::get_or_add_equiv_class): Guard against NULL
2765 type when checking for pointer types.
2766 * region-model-impl-calls.cc (region_model::impl_call_realloc):
2767 Guard against NULL lhs type/region. Guard against the size value
2768 not being of a compatible type for dynamic extents.
2769 * region-model.cc (compat_types_p): Make non-static.
2771 2021-08-30 David Malcolm <dmalcolm@redhat.com>
2774 * analyzer.h (class custom_edge_info): New class, adapted from
2775 exploded_edge::custom_info_t. Make member functions const.
2776 Make update_model return bool, converting edge param from
2777 reference to a pointer, and adding a ctxt param.
2778 (class path_context): New class.
2779 * call-info.cc: New file.
2780 * call-info.h: New file.
2781 * engine.cc: Include "analyzer/call-info.h" and <memory>.
2782 (impl_region_model_context::impl_region_model_context): Update for
2783 new m_path_ctxt field.
2784 (impl_region_model_context::bifurcate): New.
2785 (impl_region_model_context::terminate_path): New.
2786 (impl_region_model_context::get_malloc_map): New.
2787 (impl_sm_context::impl_sm_context): Update for new m_path_ctxt
2789 (impl_sm_context::get_fndecl_for_call): Likewise.
2790 (impl_sm_context::set_next_state): Likewise.
2791 (impl_sm_context::warn): Likewise.
2792 (impl_sm_context::is_zero_assignment): Likewise.
2793 (impl_sm_context::get_path_context): New.
2794 (impl_sm_context::m_path_ctxt): New.
2795 (impl_region_model_context::on_condition): Update for new
2796 path_ctxt param. Handle m_enode_for_diag being NULL.
2797 (impl_region_model_context::on_phi): Update for new path_ctxt
2799 (exploded_node::on_stmt): Add path_ctxt param, updating ctor calls
2800 to use it as necessary. Use it to bail out after sm-handling,
2802 (exploded_node::detect_leaks): Update for new path_ctxt param.
2803 (dynamic_call_info_t::update_model): Update for conversion of
2804 exploded_edge::custom_info_t to custom_edge_info.
2805 (dynamic_call_info_t::add_events_to_path): Likewise.
2806 (rewind_info_t::update_model): Likewise.
2807 (rewind_info_t::add_events_to_path): Likewise.
2808 (exploded_edge::exploded_edge): Likewise.
2809 (exploded_graph::add_edge): Likewise.
2810 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
2811 Update for new path_ctxt param.
2812 (class impl_path_context): New.
2813 (exploded_graph::process_node): Update for new path_ctxt param.
2814 Create an impl_path_context and pass it to exploded_node::on_stmt.
2815 Use it to terminate iterating stmts if terminate_path is called
2816 on it. After processing a run of stmts, query path_ctxt to
2817 potentially terminate the analysis path, and/or to "bifurcate" the
2818 analysis into multiple additional paths.
2819 (feasibility_state::maybe_update_for_edge): Update for new
2820 update_model ctxt param.
2822 (impl_region_model_context::impl_region_model_context): Add
2824 (impl_region_model_context::bifurcate): New.
2825 (impl_region_model_context::terminate_path): New
2826 (impl_region_model_context::get_ext_state): New.
2827 (impl_region_model_context::get_malloc_map): New.
2828 (impl_region_model_context::m_path_ctxt): New field.
2829 (exploded_node::on_stmt): Add path_ctxt param.
2830 (class exploded_edge::custom_info_t): Move to analyzer.h, renaming
2831 to custom_edge_info, and making the changes as noted in analyzer.h
2833 (exploded_edge::exploded_edge): Update for these changes to
2834 exploded_edge::custom_info_t.
2835 (exploded_edge::m_custom_info): Likewise.
2836 (class dynamic_call_info_t): Likewise.
2837 (class rewind_info_t): Likewise.
2838 (exploded_graph::add_edge): Likewise.
2839 * program-state.cc (program_state::on_edge): Update for new
2841 (program_state::push_call): Likewise.
2842 (program_state::returning_call): Likewise.
2843 (program_state::prune_for_point): Likewise.
2844 * region-model-impl-calls.cc: Include "analyzer/call-info.h".
2845 (call_details::get_fndecl_for_call): New.
2846 (region_model::impl_call_realloc): Reimplement.
2847 * region-model.cc (region_model::on_call_pre): Move call to
2848 impl_call_realloc to...
2849 (region_model::on_call_post): ...here. Consolidate creation
2850 of call_details instance.
2851 (noop_region_model_context::bifurcate): New.
2852 (noop_region_model_context::terminate_path): New.
2853 * region-model.h (call_details::get_call_stmt): New.
2854 (call_details::get_fndecl_for_call): New.
2855 (region_model::on_realloc_with_move): New.
2856 (region_model_context::bifurcate): New.
2857 (region_model_context::terminate_path): New.
2858 (region_model_context::get_ext_state): New.
2859 (region_model_context::get_malloc_map): New.
2860 (noop_region_model_context::bifurcate): New.
2861 (noop_region_model_context::terminate_path): New.
2862 (noop_region_model_context::get_ext_state): New.
2863 (noop_region_model_context::get_malloc_map): New.
2864 * sm-malloc.cc: Include "analyzer/program-state.h".
2865 (malloc_state_machine::on_realloc_call): Reimplement.
2866 (malloc_state_machine::on_realloc_with_move): New.
2867 (region_model::on_realloc_with_move): New.
2868 * sm-signal.cc (class signal_delivery_edge_info_t): Update for
2869 conversion from exploded_edge::custom_info_t to custom_edge_info.
2870 * sm.h (sm_context::get_path_context): New.
2871 * svalue.cc (svalue::maybe_get_constant): Call
2872 unwrap_any_unmergeable.
2874 2021-08-25 Ankur Saini <arsenic@sourceware.org>
2877 * engine.cc (exploded_graph::maybe_create_dynamic_call): Don't create
2878 calls if max recursion limit is reached.
2880 2021-08-23 David Malcolm <dmalcolm@redhat.com>
2882 * analyzer.h (struct rejected_constraint): Convert to...
2883 (class rejected_constraint): ...this.
2884 (class bounded_ranges): New forward decl.
2885 (class bounded_ranges_manager): New forward decl.
2886 * constraint-manager.cc: Include "analyzer/analyzer-logging.h" and
2887 "tree-pretty-print.h".
2888 (can_plus_one_p): New.
2890 (can_minus_one_p): New.
2892 (bounded_range::bounded_range): New.
2894 (bounded_range::dump_to_pp): New.
2895 (bounded_range::dump): New.
2896 (bounded_range::to_json): New.
2897 (bounded_range::set_json_attr): New.
2898 (bounded_range::contains_p): New.
2899 (bounded_range::intersects_p): New.
2900 (bounded_range::operator==): New.
2901 (bounded_range::cmp): New.
2902 (bounded_ranges::bounded_ranges): New.
2903 (bounded_ranges::bounded_ranges): New.
2904 (bounded_ranges::bounded_ranges): New.
2905 (bounded_ranges::canonicalize): New.
2906 (bounded_ranges::validate): New.
2907 (bounded_ranges::operator==): New.
2908 (bounded_ranges::dump_to_pp): New.
2909 (bounded_ranges::dump): New.
2910 (bounded_ranges::to_json): New.
2911 (bounded_ranges::eval_condition): New.
2912 (bounded_ranges::contain_p): New.
2913 (bounded_ranges::cmp): New.
2914 (bounded_ranges_manager::~bounded_ranges_manager): New.
2915 (bounded_ranges_manager::get_or_create_empty): New.
2916 (bounded_ranges_manager::get_or_create_point): New.
2917 (bounded_ranges_manager::get_or_create_range): New.
2918 (bounded_ranges_manager::get_or_create_union): New.
2919 (bounded_ranges_manager::get_or_create_intersection): New.
2920 (bounded_ranges_manager::get_or_create_inverse): New.
2921 (bounded_ranges_manager::consolidate): New.
2922 (bounded_ranges_manager::get_or_create_ranges_for_switch): New.
2923 (bounded_ranges_manager::create_ranges_for_switch): New.
2924 (bounded_ranges_manager::make_case_label_ranges): New.
2925 (bounded_ranges_manager::log_stats): New.
2926 (bounded_ranges_constraint::print): New.
2927 (bounded_ranges_constraint::to_json): New.
2928 (bounded_ranges_constraint::operator==): New.
2929 (bounded_ranges_constraint::add_to_hash): New.
2930 (constraint_manager::constraint_manager): Update for new field
2931 m_bounded_ranges_constraints.
2932 (constraint_manager::operator=): Likewise.
2933 (constraint_manager::hash): Likewise.
2934 (constraint_manager::operator==): Likewise.
2935 (constraint_manager::print): Likewise.
2936 (constraint_manager::dump_to_pp): Likewise.
2937 (constraint_manager::to_json): Likewise.
2938 (constraint_manager::add_unknown_constraint): Update the lhs_ec_id
2939 if necessary in existing constraints when combining equivalence
2940 classes. Add similar code for handling
2941 m_bounded_ranges_constraints.
2942 (constraint_manager::add_constraint_internal): Add comment.
2943 (constraint_manager::add_bounded_ranges): New.
2944 (constraint_manager::eval_condition): Use new field
2945 m_bounded_ranges_constraints.
2946 (constraint_manager::purge): Update bounded_ranges_constraint
2948 (constraint_manager::canonicalize): Update for new field.
2949 (merger_fact_visitor::on_ranges): New.
2950 (constraint_manager::for_each_fact): Use new field
2951 m_bounded_ranges_constraints.
2952 (constraint_manager::validate): Fix off-by-one error needed due
2953 to bug fixed above in add_unknown_constraint. Validate the EC IDs
2954 in m_bounded_ranges_constraints.
2955 (constraint_manager::get_range_manager): New.
2956 (selftest::assert_dump_bounded_range_eq): New.
2957 (ASSERT_DUMP_BOUNDED_RANGE_EQ): New.
2958 (selftest::test_bounded_range): New.
2959 (selftest::assert_dump_bounded_ranges_eq): New.
2960 (ASSERT_DUMP_BOUNDED_RANGES_EQ): New.
2961 (selftest::test_bounded_ranges): New.
2962 (selftest::run_constraint_manager_tests): Call the new selftests.
2963 * constraint-manager.h (struct bounded_range): New.
2964 (struct bounded_ranges): New.
2965 (template <> struct default_hash_traits<bounded_ranges::key_t>): New.
2966 (class bounded_ranges_manager): New.
2967 (fact_visitor::on_ranges): New pure virtual function.
2968 (class bounded_ranges_constraint): New.
2969 (constraint_manager::add_bounded_ranges): New decl.
2970 (constraint_manager::get_range_manager): New decl.
2971 (constraint_manager::m_bounded_ranges_constraints): New field.
2972 * diagnostic-manager.cc (epath_finder::process_worklist_item):
2973 Transfer ownership of rc to add_feasibility_problem.
2974 * engine.cc (feasibility_problem::dump_to_pp): Use get_model.
2975 * feasible-graph.cc (infeasible_node::dump_dot): Update for
2976 conversion of m_rc to a pointer.
2977 (feasible_graph::add_feasibility_problem): Pass RC by pointer and
2979 * feasible-graph.h (infeasible_node::infeasible_node): Pass RC by
2980 pointer and take ownership.
2981 (infeasible_node::~infeasible_node): New.
2982 (infeasible_node::m_rc): Convert to a pointer.
2983 (feasible_graph::add_feasibility_problem): Pass RC by pointer and
2985 * region-model-manager.cc: Include
2986 "analyzer/constraint-manager.h".
2987 (region_model_manager::region_model_manager): Initializer new
2989 (region_model_manager::~region_model_manager): Delete it.
2990 (region_model_manager::log_stats): Call log_stats on it.
2991 * region-model.cc (region_model::add_constraint): Use new subclass
2992 rejected_op_constraint.
2993 (region_model::apply_constraints_for_gswitch): Reimplement using
2994 bounded_ranges_manager.
2995 (rejected_constraint::dump_to_pp): Convert to...
2996 (rejected_op_constraint::dump_to_pp): ...this.
2997 (rejected_ranges_constraint::dump_to_pp): New.
2998 * region-model.h (struct purge_stats): Add field
2999 m_num_bounded_ranges_constraints.
3000 (region_model_manager::get_range_manager): New.
3001 (region_model_manager::m_range_mgr): New.
3002 (region_model::get_range_manager): New.
3003 (struct rejected_constraint): Split into...
3004 (class rejected_constraint):...this new abstract base class,
3006 (class rejected_op_constraint): ...this new concrete subclass.
3007 (class rejected_ranges_constraint): New.
3008 * supergraph.cc: Include "tree-cfg.h".
3009 (supergraph::supergraph): Drop idx param from add_cfg_edge.
3010 (supergraph::add_cfg_edge): Drop idx param.
3011 (switch_cfg_superedge::switch_cfg_superedge): Move here from
3012 header. Populate m_case_labels with all cases which go to DST.
3013 (switch_cfg_superedge::dump_label_to_pp): Reimplement to use
3015 (switch_cfg_superedge::get_case_label): Delete.
3016 * supergraph.h (supergraphadd_cfg_edge): Drop "idx" param.
3017 (switch_cfg_superedge::switch_cfg_superedge): Drop idx param and
3018 move implementation to supergraph.cc.
3019 (switch_cfg_superedge::get_case_label): Delete.
3020 (switch_cfg_superedge::get_case_labels): New.
3021 (switch_cfg_superedge::m_idx): Delete.
3022 (switch_cfg_superedge::m_case_labels): New field.
3024 2021-08-23 David Malcolm <dmalcolm@redhat.com>
3027 * sm-file.cc (file_diagnostic::describe_state_change): Handle
3028 change.m_expr being NULL.
3030 2021-08-23 David Malcolm <dmalcolm@redhat.com>
3033 * analyzer.cc (maybe_reconstruct_from_def_stmt): Bail if fn is
3034 NULL, and assert that it's non-NULL before passing it to
3035 build_call_array_loc.
3037 2021-08-23 David Malcolm <dmalcolm@redhat.com>
3040 * region-model.cc (region_model::eval_condition_without_cm):
3041 Refactor comparison against zero, adding a check for
3042 POINTER_PLUS_EXPR of non-NULL.
3044 2021-08-23 David Malcolm <dmalcolm@redhat.com>
3046 * store.cc (bit_range::intersects_p): New overload.
3047 (bit_range::operator-): New.
3048 (binding_cluster::maybe_get_compound_binding): Handle the partial
3050 (selftest::test_bit_range_intersects_p): Add test coverage for
3051 new overload of bit_range::intersects_p.
3052 * store.h (bit_range::intersects_p): New overload.
3053 (bit_range::operator-): New.
3055 2021-08-23 Ankur Saini <arsenic@sourceware.org>
3058 * diagnostic-manager.cc
3059 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Fix typo.
3061 2021-08-21 Ankur Saini <arsenic@sourceware.org>
3064 * diagnostic-manager.cc
3065 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Use
3066 caller_model only when the supergraph_edge doesn't exixt.
3067 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
3069 * engine.cc (exploded_graph::create_dynamic_call): Rename to...
3070 (exploded_graph::maybe_create_dynamic_call): ...this, return call
3072 (exploded_graph::process_node): Handle calls which were not dynamically
3074 * exploded-graph.h (exploded_graph::create_dynamic_call): Rename to...
3075 (exploded_graph::maybe_create_dynamic_call): ...this.
3076 * region-model.cc (region_model::update_for_gcall): New param, use it
3077 to push call to frame.
3078 (region_model::update_for_call_superedge): Pass callee function to
3080 * region-model.h (region_model::update_for_gcall): New param.
3082 2021-08-18 Ankur Saini <arsenic@sourceware.org>
3085 * region-model.cc (region_model::get_rvalue_1): Add case for
3088 2021-08-18 Ankur Saini <arsenic@sourceware.org>
3091 * analysis-plan.cc (analysis_plan::use_summary_p): Don't use call
3092 summaries if there is no callgraph edge
3093 * checker-path.cc (call_event::call_event): Handle calls events that
3094 are not represented by a supergraph call edge
3095 (return_event::return_event): Likewise.
3096 (call_event::get_desc): Work with new call_event structure.
3097 (return_event::get_desc): Likeise.
3098 * checker-path.h (call_event::m_src_snode): New field.
3099 (call_event::m_dest_snode): New field.
3100 (return_event::m_src_snode): New field.
3101 (return_event::m_dest_snode): New field.
3102 * diagnostic-manager.cc
3103 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>:
3104 Refactor to work with edges without callgraph edge.
3105 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
3107 * engine.cc (dynamic_call_info_t::update_model): New function.
3108 (dynamic_call_info_t::add_events_to_path): New function.
3109 (exploded_graph::create_dynamic_call): New function.
3110 (exploded_graph::process_node): Work with dynamically discovered calls.
3111 * exploded-graph.h (class dynamic_call_info_t): New class.
3112 (exploded_graph::create_dynamic_call): New decl.
3113 * program-point.cc (program_point::push_to_call_stack): New function.
3114 (program_point::pop_from_call_stack): New function.
3115 * program-point.h (program_point::push_to_call_stack): New decl.
3116 (program_point::pop_from_call_stack): New decl.
3117 * program-state.cc (program_state::push_call): New function.
3118 (program_state::returning_call): New function.
3119 * program-state.h (program_state::push_call): New decl.
3120 (program_state::returning_call): New decl.
3121 * region-model.cc (region_model::update_for_gcall) New function.
3122 (region_model::update_for_return_gcall): New function.
3123 (egion_model::update_for_call_superedge): Get the underlying gcall and
3125 (region_model::update_for_return_superedge): Likewise.
3126 * region-model.h (region_model::update_for_gcall): New decl.
3127 (region_model::update_for_return_gcall): New decl.
3128 * state-purge.cc (state_purge_per_ssa_name::process_point): Update to
3129 work with calls without underlying cgraph edge.
3130 * supergraph.cc (supergraph::supergraph) Split snodes at every callsite.
3131 * supergraph.h (supernode::get_returning_call) New accessor.
3133 2021-08-04 David Malcolm <dmalcolm@redhat.com>
3136 * analyzer.cc (maybe_reconstruct_from_def_stmt): Add GIMPLE_ASM
3138 * analyzer.h (class asm_output_svalue): New forward decl.
3139 (class reachable_regions): New forward decl.
3140 * complexity.cc (complexity::from_vec_svalue): New.
3141 * complexity.h (complexity::from_vec_svalue): New decl.
3142 * engine.cc (feasibility_state::maybe_update_for_edge): Handle
3143 asm stmts by calling on_asm_stmt.
3144 * region-model-asm.cc: New file.
3145 * region-model-manager.cc
3146 (region_model_manager::maybe_fold_asm_output_svalue): New.
3147 (region_model_manager::get_or_create_asm_output_svalue): New.
3148 (region_model_manager::log_stats): Log m_asm_output_values_map.
3149 * region-model.cc (region_model::on_stmt_pre): Handle GIMPLE_ASM.
3150 * region-model.h (visitor::visit_asm_output_svalue): New.
3151 (region_model_manager::get_or_create_asm_output_svalue): New decl.
3152 (region_model_manager::maybe_fold_asm_output_svalue): New decl.
3153 (region_model_manager::asm_output_values_map_t): New typedef.
3154 (region_model_manager::m_asm_output_values_map): New field.
3155 (region_model::on_asm_stmt): New.
3156 * store.cc (binding_cluster::on_asm): New.
3157 * store.h (binding_cluster::on_asm): New decl.
3158 * svalue.cc (svalue::cmp_ptr): Handle SK_ASM_OUTPUT.
3159 (asm_output_svalue::dump_to_pp): New.
3160 (asm_output_svalue::dump_input): New.
3161 (asm_output_svalue::input_idx_to_asm_idx): New.
3162 (asm_output_svalue::accept): New.
3163 * svalue.h (enum svalue_kind): Add SK_ASM_OUTPUT.
3164 (svalue::dyn_cast_asm_output_svalue): New.
3165 (class asm_output_svalue): New.
3166 (is_a_helper <const asm_output_svalue *>::test): New.
3167 (struct default_hash_traits<asm_output_svalue::key_t>): New.
3169 2021-08-03 Jakub Jelinek <jakub@redhat.com>
3172 * sm-malloc.cc (known_allocator_p): Only check DECL_FUNCTION_CODE on
3173 BUILT_IN_NORMAL builtins.
3175 2021-07-29 Ankur Saini <arsenic@sourceware.org>
3177 * call-string.cc (call_string::element_t::operator==): New operator.
3178 (call_String::element_t::operator!=): New operator.
3179 (call_string::element_t::get_caller_function): New function.
3180 (call_string::element_t::get_callee_function): New function.
3181 (call_string::call_string): Refactor to Initialise m_elements.
3182 (call_string::operator=): Refactor to work with m_elements.
3183 (call_string::operator==): Likewise.
3184 (call_string::to_json): Likewise.
3185 (call_string::hash): Refactor to hash e.m_caller.
3186 (call_string::push_call): Refactor to work with m_elements.
3187 (call_string::push_call): New overload to push call via supernodes.
3188 (call_string::pop): Refactor to work with m_elements.
3189 (call_string::calc_recursion_depth): Likewise.
3190 (call_string::cmp): Likewise.
3191 (call_string::validate): Likewise.
3192 (call_string::operator[]): Likewise.
3193 * call-string.h (class supernode): New forward decl.
3194 (struct call_string::element_t): New struct.
3195 (call_string::call_string): Refactor to initialise m_elements.
3196 (call_string::bool empty_p): Refactor to work with m_elements.
3197 (call_string::get_callee_node): New decl.
3198 (call_string::get_caller_node): New decl.
3199 (m_elements): Replaces m_return_edges.
3200 * program-point.cc (program_point::get_function_at_depth): Refactor to
3201 work with new call-string format.
3202 (program_point::validate): Likewise.
3203 (program_point::on_edge): Likewise.
3205 2021-07-28 David Malcolm <dmalcolm@redhat.com>
3207 * region-model.cc (region_model::on_call_pre): Treat
3208 IFN_UBSAN_BOUNDS, BUILT_IN_STACK_SAVE, and BUILT_IN_STACK_RESTORE
3209 as no-ops, rather than handling them as unknown functions.
3211 2021-07-28 David Malcolm <dmalcolm@redhat.com>
3213 * region-model-impl-calls.cc (region_model::impl_call_alloca):
3214 Drop redundant return value.
3215 (region_model::impl_call_builtin_expect): Likewise.
3216 (region_model::impl_call_calloc): Likewise.
3217 (region_model::impl_call_malloc): Likewise.
3218 (region_model::impl_call_memset): Likewise.
3219 (region_model::impl_call_operator_new): Likewise.
3220 (region_model::impl_call_operator_delete): Likewise.
3221 (region_model::impl_call_strlen): Likewise.
3222 * region-model.cc (region_model::on_call_pre): Fix return value of
3223 known functions that don't have unknown side-effects.
3224 * region-model.h (region_model::impl_call_alloca): Drop redundant
3226 (region_model::impl_call_builtin_expect): Likewise.
3227 (region_model::impl_call_calloc): Likewise.
3228 (region_model::impl_call_malloc): Likewise.
3229 (region_model::impl_call_memset): Likewise.
3230 (region_model::impl_call_strlen): Likewise.
3231 (region_model::impl_call_operator_new): Likewise.
3232 (region_model::impl_call_operator_delete): Likewise.
3234 2021-07-28 Siddhesh Poyarekar <siddhesh@gotplt.org>
3236 * analyzer.cc (is_named_call_p, is_std_named_call_p): Make
3237 first argument a const_tree.
3238 * analyzer.h (is_named_call_p, -s_std_named_call_p): Likewise.
3239 * sm-malloc.cc (known_allocator_p): New function.
3240 (malloc_state_machine::on_stmt): Use it.
3242 2021-07-28 Siddhesh Poyarekar <siddhesh@gotplt.org>
3245 (malloc_state_machine::get_or_create_deallocator): Recognize
3248 2021-07-26 David Malcolm <dmalcolm@redhat.com>
3250 * region-model.cc (region_model::on_call_pre): Always set conjured
3251 LHS, not just for SSA names.
3253 2021-07-23 David Malcolm <dmalcolm@redhat.com>
3255 * diagnostic-manager.cc
3256 (class auto_disable_complexity_checks): New.
3257 (epath_finder::explore_feasible_paths): Use it to disable
3258 complexity checks whilst processing the worklist.
3259 * region-model-manager.cc
3260 (region_model_manager::region_model_manager): Initialize
3262 (region_model_manager::reject_if_too_complex): Bail if
3263 m_check_complexity is false.
3265 (region_model_manager::enable_complexity_check): New.
3266 (region_model_manager::disable_complexity_check): New.
3267 (region_model_manager::m_check_complexity): New.
3269 2021-07-21 David Malcolm <dmalcolm@redhat.com>
3272 * sm-file.cc (file_leak::emit): Handle m_arg being NULL.
3273 (file_leak::describe_final_event): Handle ev.m_expr being NULL.
3275 2021-07-21 David Malcolm <dmalcolm@redhat.com>
3278 * store.cc (binding_cluster::purge_state_involving): Don't change
3279 m_map whilst iterating through it.
3281 2021-07-21 David Malcolm <dmalcolm@redhat.com>
3283 * region-model.cc (region_model::handle_phi): Add "old_state"
3285 (region_model::update_for_phis): Update so that all of the phi
3286 stmts are effectively handled simultaneously, rather than in
3288 * region-model.h (region_model::handle_phi): Add "old_state"
3290 * state-purge.cc (self_referential_phi_p): Replace with...
3291 (name_used_by_phis_p): ...this new function.
3292 (state_purge_per_ssa_name::process_point): Update to use the
3293 above, so that all phi stmts at a basic block are effectively
3294 considered simultaneously, and only consider the phi arguments for
3295 the pertinent in-edge.
3296 * supergraph.cc (cfg_superedge::get_phi_arg_idx): New.
3297 (cfg_superedge::get_phi_arg): Use the above.
3298 * supergraph.h (cfg_superedge::get_phi_arg_idx): New decl.
3300 2021-07-21 David Malcolm <dmalcolm@redhat.com>
3302 * state-purge.cc (state_purge_annotator::add_node_annotations):
3303 Rather than erroneously always using the NULL in-edge, determine
3304 each relevant in-edge, and print the appropriate data for each
3305 in-edge. Use print_needed to print the data as comma-separated
3307 (print_vec_of_names): Add "within_table" param and use it.
3308 (state_purge_annotator::add_stmt_annotations): Factor out
3309 collation and printing code into...
3310 (state_purge_annotator::print_needed): ...this new function.
3311 * state-purge.h (state_purge_annotator::print_needed): New decl.
3313 2021-07-21 David Malcolm <dmalcolm@redhat.com>
3315 * program-point.cc (function_point::print): Show src BB index at
3318 2021-07-21 David Malcolm <dmalcolm@redhat.com>
3320 * svalue.cc (infix_p): New.
3321 (binop_svalue::dump_to_pp): Use it to print MIN_EXPR and MAX_EXPR
3322 in prefix form, rather than infix.
3324 2021-07-19 David Malcolm <dmalcolm@redhat.com>
3327 * constraint-manager.cc (constraint_manager::add_constraint): Use
3328 can_have_associated_state_p rather than testing for unknown.
3329 (constraint_manager::get_or_add_equiv_class): Likewise.
3330 * program-state.cc (sm_state_map::set_state): Likewise.
3331 (sm_state_map::impl_set_state): Add assertion.
3332 * region-model-manager.cc
3333 (region_model_manager::maybe_fold_unaryop): Handle poisoned
3335 (region_model_manager::maybe_fold_binop): Move handling of unknown
3337 (region_model_manager::get_or_create_binop): ...to here, and
3338 generalize to use can_have_associated_state_p.
3339 (region_model_manager::maybe_fold_sub_svalue): Use
3340 can_have_associated_state_p rather than testing for unknown.
3341 (region_model_manager::maybe_fold_repeated_svalue): Use unknown
3342 when the size or repeated value is "unknown"/"poisoned".
3343 * region-model.cc (region_model::purge_state_involving): Reject
3344 attempts to purge unknown/poisoned svalues, as these svalues
3345 should not have state associated with them.
3346 * svalue.cc (sub_svalue::sub_svalue): Assert that we're building
3347 on top of an svalue with can_have_associated_state_p.
3348 (repeated_svalue::repeated_svalue): Likewise.
3349 (bits_within_svalue::bits_within_svalue): Likewise.
3350 * svalue.h (svalue::can_have_associated_state_p): New.
3351 (unknown_svalue::can_have_associated_state_p): New.
3352 (poisoned_svalue::can_have_associated_state_p): New.
3353 (unaryop_svalue::unaryop_svalue): Assert that we're building on
3354 top of an svalue with can_have_associated_state_p.
3355 (binop_svalue::binop_svalue): Likewise.
3356 (widening_svalue::widening_svalue): Likewise.
3358 2021-07-16 David Malcolm <dmalcolm@redhat.com>
3360 * analyzer.h (enum access_direction): New.
3361 * engine.cc (exploded_node::on_longjmp): Update for new param of
3363 * program-state.cc (program_state::prune_for_point): Likewise.
3364 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
3365 Replace call to check_for_writable_region with call to
3366 check_region_for_write.
3367 (region_model::impl_call_memset): Likewise.
3368 (region_model::impl_call_strcpy): Likewise.
3369 * region-model-reachability.cc (reachable_regions::add): Update
3370 for new param of get_store_value.
3371 * region-model.cc (region_model::get_rvalue_1): Likewise, also for
3372 get_rvalue_for_bits.
3373 (region_model::get_store_value): Add ctxt param and use it to call
3374 check_region_for_read.
3375 (region_model::get_rvalue_for_bits): Add ctxt param and use it to
3376 call get_store_value.
3377 (region_model::check_region_access): New.
3378 (region_model::check_region_for_write): New.
3379 (region_model::check_region_for_read): New.
3380 (region_model::set_value): Update comment. Replace call to
3381 check_for_writable_region with call to check_region_for_write.
3382 * region-model.h (region_model::get_rvalue_for_bits): Add ctxt
3384 (region_model::get_store_value): Add ctxt param.
3385 (region_model::check_region_access): New decl.
3386 (region_model::check_region_for_write): New decl.
3387 (region_model::check_region_for_read): New decl.
3388 * region.cc (region_model::copy_region): Update call to
3390 * svalue.cc (initial_svalue::implicitly_live_p): Likewise.
3392 2021-07-16 David Malcolm <dmalcolm@redhat.com>
3394 * engine.cc (exploded_node::on_stmt_pre): Handle
3395 __analyzer_dump_state.
3396 * program-state.cc (extrinsic_state::get_sm_idx_by_name): New.
3397 (program_state::impl_call_analyzer_dump_state): New.
3398 * program-state.h (extrinsic_state::get_sm_idx_by_name): New decl.
3399 (program_state::impl_call_analyzer_dump_state): New decl.
3400 * region-model-impl-calls.cc
3401 (call_details::get_arg_string_literal): New.
3402 * region-model.h (call_details::get_arg_string_literal): New decl.
3404 2021-07-16 David Malcolm <dmalcolm@redhat.com>
3406 * program-state.cc (program_state::detect_leaks): Simplify using
3407 svalue::maybe_get_region.
3408 * region-model-impl-calls.cc (region_model::impl_call_fgets): Likewise.
3409 (region_model::impl_call_fread): Likewise.
3410 (region_model::impl_call_free): Likewise.
3411 (region_model::impl_call_operator_delete): Likewise.
3412 * region-model.cc (selftest::test_stack_frames): Likewise.
3413 (selftest::test_state_merging): Likewise.
3414 * svalue.cc (svalue::maybe_get_region): New.
3415 * svalue.h (svalue::maybe_get_region): New decl.
3417 2021-07-15 David Malcolm <dmalcolm@redhat.com>
3419 * svalue.h (is_a_helper <placeholder_svalue *>::test): Make
3420 param and template param const.
3421 (is_a_helper <widening_svalue *>::test): Likewise.
3422 (is_a_helper <compound_svalue *>::test): Likewise.
3423 (is_a_helper <conjured_svalue *>::test): Likewise.
3425 2021-07-15 David Malcolm <dmalcolm@redhat.com>
3430 * analyzer.cc (maybe_reconstruct_from_def_stmt): Split out
3431 GIMPLE_ASSIGN case into...
3432 (get_diagnostic_tree_for_gassign_1): New.
3433 (get_diagnostic_tree_for_gassign): New.
3434 * analyzer.h (get_diagnostic_tree_for_gassign): New decl.
3435 * analyzer.opt (Wanalyzer-write-to-string-literal): New.
3436 * constraint-manager.cc (class svalue_purger): New.
3437 (constraint_manager::purge_state_involving): New.
3438 * constraint-manager.h
3439 (constraint_manager::purge_state_involving): New.
3440 * diagnostic-manager.cc (saved_diagnostic::supercedes_p): New.
3441 (dedupe_winners::handle_interactions): New.
3442 (diagnostic_manager::emit_saved_diagnostics): Call it.
3443 * diagnostic-manager.h (saved_diagnostic::supercedes_p): New decl.
3444 * engine.cc (impl_region_model_context::warn): Convert return type
3445 to bool. Return false if the diagnostic isn't saved.
3446 (impl_region_model_context::purge_state_involving): New.
3447 (impl_sm_context::get_state): Use NULL ctxt when querying old
3449 (impl_sm_context::set_next_state): Use new sval when querying old
3451 (class dump_path_diagnostic): Move to region-model.cc
3452 (exploded_node::on_stmt): Move to on_stmt_pre and on_stmt_post.
3453 Remove call to purge_state_involving.
3454 (exploded_node::on_stmt_pre): New, based on the above. Move most
3455 of it to region_model::on_stmt_pre.
3456 (exploded_node::on_stmt_post): Likewise, moving to
3457 region_model::on_stmt_post.
3458 (class stale_jmp_buf): Fix parent class to use curiously recurring
3460 (feasibility_state::maybe_update_for_edge): Call on_call_pre and
3461 on_call_post on gcalls.
3462 * exploded-graph.h (impl_region_model_context::warn): Return bool.
3463 (impl_region_model_context::purge_state_involving): New decl.
3464 (exploded_node::on_stmt_pre): New decl.
3465 (exploded_node::on_stmt_post): New decl.
3466 * pending-diagnostic.h (pending_diagnostic::use_of_uninit_p): New.
3467 (pending_diagnostic::supercedes_p): New.
3468 * program-state.cc (sm_state_map::get_state): Inherit state for
3469 conjured_svalue as well as initial_svalue.
3470 (sm_state_map::purge_state_involving): Also support SK_CONJURED.
3471 * region-model-impl-calls.cc (call_details::get_uncertainty):
3472 Handle m_ctxt being NULL.
3473 (call_details::get_or_create_conjured_svalue): New.
3474 (region_model::impl_call_fgets): New.
3475 (region_model::impl_call_fread): New.
3476 * region-model-manager.cc
3477 (region_model_manager::get_or_create_initial_value): Return an
3478 uninitialized poisoned value for regions that can't have initial
3480 * region-model-reachability.cc
3481 (reachable_regions::mark_escaped_clusters): Handle ctxt being
3483 * region-model.cc (region_to_value_map::purge_state_involving): New.
3484 (poisoned_value_diagnostic::use_of_uninit_p): New.
3485 (poisoned_value_diagnostic::emit): Handle POISON_KIND_UNINIT.
3486 (poisoned_value_diagnostic::describe_final_event): Likewise.
3487 (region_model::check_for_poison): New.
3488 (region_model::on_assignment): Call it.
3489 (class dump_path_diagnostic): Move here from engine.cc.
3490 (region_model::on_stmt_pre): New, based on exploded_node::on_stmt.
3491 (region_model::on_call_pre): Move the setting of the LHS to a
3492 conjured svalue to before the checks for specific functions.
3493 Handle "fgets", "fgets_unlocked", and "fread".
3494 (region_model::purge_state_involving): New.
3495 (region_model::handle_unrecognized_call): Handle ctxt being NULL.
3496 (region_model::get_rvalue): Call check_for_poison.
3497 (selftest::test_stack_frames): Use NULL for context when getting
3498 uninitialized rvalue.
3499 (selftest::test_alloca): Likewise.
3500 * region-model.h (region_to_value_map::purge_state_involving): New
3502 (call_details::get_or_create_conjured_svalue): New decl.
3503 (region_model::on_stmt_pre): New decl.
3504 (region_model::purge_state_involving): New decl.
3505 (region_model::impl_call_fgets): New decl.
3506 (region_model::impl_call_fread): New decl.
3507 (region_model::check_for_poison): New decl.
3508 (region_model_context::warn): Return bool.
3509 (region_model_context::purge_state_involving): New.
3510 (noop_region_model_context::warn): Return bool.
3511 (noop_region_model_context::purge_state_involving): New.
3512 (test_region_model_context:: warn): Return bool.
3513 * region.cc (region::get_memory_space): New.
3514 (region::can_have_initial_svalue_p): New.
3515 (region::involves_p): New.
3516 * region.h (enum memory_space): New.
3517 (region::get_memory_space): New decl.
3518 (region::can_have_initial_svalue_p): New decl.
3519 (region::involves_p): New decl.
3520 * sm-malloc.cc (use_after_free::supercedes_p): New.
3521 * store.cc (binding_cluster::purge_state_involving): New.
3522 (store::purge_state_involving): New.
3523 * store.h (class symbolic_binding): New forward decl.
3524 (binding_key::dyn_cast_symbolic_binding): New.
3525 (symbolic_binding::dyn_cast_symbolic_binding): New.
3526 (binding_cluster::purge_state_involving): New.
3527 (store::purge_state_involving): New.
3528 * svalue.cc (svalue::can_merge_p): Reject attempts to merge
3529 poisoned svalues with other svalues, so that we identify
3530 paths in which a variable is conditionally uninitialized.
3531 (involvement_visitor::visit_conjured_svalue): New.
3532 (svalue::involves_p): Also handle SK_CONJURED.
3533 (poison_kind_to_str): Handle POISON_KIND_UNINIT.
3534 (poisoned_svalue::maybe_fold_bits_within): New.
3535 * svalue.h (enum poison_kind): Add POISON_KIND_UNINIT.
3536 (poisoned_svalue::maybe_fold_bits_within): New decl.
3538 2021-07-15 David Malcolm <dmalcolm@redhat.com>
3540 * analyzer.opt (fdump-analyzer-exploded-paths): New.
3541 * diagnostic-manager.cc
3542 (diagnostic_manager::emit_saved_diagnostic): Implement it.
3543 * engine.cc (exploded_path::dump_to_pp): Add ext_state param and
3544 use it to dump states if non-NULL.
3545 (exploded_path::dump): Likewise.
3546 (exploded_path::dump_to_file): New.
3547 * exploded-graph.h (exploded_path::dump_to_pp): Add ext_state
3549 (exploded_path::dump): Likewise.
3550 (exploded_path::dump): Likewise.
3551 (exploded_path::dump_to_file): New.
3553 2021-07-15 David Malcolm <dmalcolm@redhat.com>
3555 * analyzer.cc (fixup_tree_for_diagnostic_1): Use DECL_DEBUG_EXPR
3557 * engine.cc (readability): Likewise.
3559 2021-07-15 David Malcolm <dmalcolm@redhat.com>
3561 * state-purge.cc (self_referential_phi_p): New.
3562 (state_purge_per_ssa_name::process_point): Don't purge an SSA name
3563 at its def-stmt if the def-stmt is self-referential.
3565 2021-07-07 David Malcolm <dmalcolm@redhat.com>
3567 * diagnostic-manager.cc (null_assignment_sm_context::get_state):
3569 (null_assignment_sm_context::set_next_state): New overload.
3570 (null_assignment_sm_context::get_diagnostic_tree): New.
3571 * engine.cc (impl_sm_context::get_state): New overload.
3572 (impl_sm_context::set_next_state): New overload.
3573 (impl_sm_context::get_diagnostic_tree): New overload.
3574 (impl_region_model_context::on_condition): Convert params from
3575 tree to const svalue *.
3576 * exploded-graph.h (impl_region_model_context::on_condition):
3578 * region-model.cc (region_model::on_call_pre): Move handling of
3579 internal calls to before checking for get_fndecl_for_call.
3580 (region_model::add_constraints_from_binop): New.
3581 (region_model::add_constraint): Split out into a new overload
3582 working on const svalue * rather than tree. Call
3583 add_constraints_from_binop. Drop call to
3584 add_any_constraints_from_ssa_def_stmt.
3585 (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
3586 (region_model::add_any_constraints_from_gassign): Delete.
3587 (region_model::add_any_constraints_from_gcall): Delete.
3589 (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
3590 (region_model::add_any_constraints_from_gassign): Delete.
3591 (region_model::add_any_constraints_from_gcall): Delete.
3592 (region_model::add_constraint): Add overload decl.
3593 (region_model::add_constraints_from_binop): New decl.
3594 (region_model_context::on_condition): Convert params from tree to
3596 (noop_region_model_context::on_condition): Likewise.
3597 * sm-file.cc (fileptr_state_machine::condition): Likewise.
3598 * sm-malloc.cc (malloc_state_machine::on_condition): Likewise.
3599 * sm-pattern-test.cc: Include tristate.h, selftest.h,
3600 analyzer/call-string.h, analyzer/program-point.h,
3601 analyzer/store.h, and analyzer/region-model.h.
3602 (pattern_test_state_machine::on_condition): Convert params from tree to
3604 * sm-sensitive.cc (sensitive_state_machine::on_condition): Delete.
3605 * sm-signal.cc (signal_state_machine::on_condition): Delete.
3606 * sm-taint.cc (taint_state_machine::on_condition): Convert params
3607 from tree to const svalue *.
3608 * sm.cc: Include tristate.h, selftest.h, analyzer/call-string.h,
3609 analyzer/program-point.h, analyzer/store.h, and
3610 analyzer/region-model.h.
3611 (any_pointer_p): Add overload taking const svalue *sval.
3612 * sm.h (any_pointer_p): Add overload taking const svalue *sval.
3613 (state_machine::on_condition): Convert params from tree to
3614 const svalue *. Provide no-op default implementation.
3615 (sm_context::get_state): Add overload taking const svalue *sval.
3616 (sm_context::set_next_state): Likewise.
3617 (sm_context::on_transition): Likewise.
3618 (sm_context::get_diagnostic_tree): Likewise.
3619 * svalue.cc (svalue::all_zeroes_p): New.
3620 (constant_svalue::all_zeroes_p): New.
3621 (repeated_svalue::all_zeroes_p): Convert to vfunc.
3622 * svalue.h (svalue::all_zeroes_p): New decl.
3623 (constant_svalue::all_zeroes_p): New decl.
3624 (repeated_svalue::all_zeroes_p): Convert decl to vfunc.
3626 2021-06-30 David Malcolm <dmalcolm@redhat.com>
3629 * analyzer.h (class repeated_svalue): New forward decl.
3630 (class bits_within_svalue): New forward decl.
3631 (class sized_region): New forward decl.
3632 (get_field_at_bit_offset): New forward decl.
3633 * engine.cc (exploded_graph::get_or_create_node): Validate the
3635 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
3636 Validate the states at each stage.
3637 * program-state.cc (program_state::validate): Validate
3639 * region-model-impl-calls.cc (region_model::impl_call_memset):
3640 Replace special-case logic for handling constant sizes with
3641 a call to fill_region of a sized_region with the given fill value.
3642 * region-model-manager.cc (maybe_undo_optimize_bit_field_compare):
3644 (region_model_manager::maybe_fold_sub_svalue): Fold element-based
3645 subregions of an initial value into initial values of an element.
3646 Fold subvalues of repeated svalues.
3647 (region_model_manager::maybe_fold_repeated_svalue): New.
3648 (region_model_manager::get_or_create_repeated_svalue): New.
3649 (get_bit_range_for_field): New.
3650 (get_byte_range_for_field): New.
3651 (get_field_at_byte_range): New.
3652 (region_model_manager::maybe_fold_bits_within_svalue): New.
3653 (region_model_manager::get_or_create_bits_within): New.
3654 (region_model_manager::get_sized_region): New.
3655 (region_model_manager::log_stats): Update for addition of
3656 m_repeated_values_map, m_bits_within_values_map, and
3658 * region-model.cc (region_model::validate): New.
3659 (region_model::on_assignment): Drop enum binding_kind.
3660 (region_model::get_initial_value_for_global): Likewise.
3661 (region_model::get_rvalue_for_bits): Replace body with call to
3662 get_or_create_bits_within.
3663 (region_model::get_capacity): Handle RK_SIZED.
3664 (region_model::set_value): Drop enum binding_kind.
3665 (region_model::fill_region): New.
3666 (region_model::get_representative_path_var_1): Handle RK_SIZED.
3667 * region-model.h (visitor::visit_repeated_svalue): New.
3668 (visitor::visit_bits_within_svalue): New.
3669 (region_model_manager::get_or_create_repeated_svalue): New decl.
3670 (region_model_manager::get_or_create_bits_within): New decl.
3671 (region_model_manager::get_sized_region): New decl.
3672 (region_model_manager::maybe_fold_repeated_svalue): New decl.
3673 (region_model_manager::maybe_fold_bits_within_svalue): New decl.
3674 (region_model_manager::repeated_values_map_t): New typedef.
3675 (region_model_manager::m_repeated_values_map): New field.
3676 (region_model_manager::bits_within_values_map_t): New typedef.
3677 (region_model_manager::m_bits_within_values_map): New field.
3678 (region_model_manager::m_sized_regions): New field.
3679 (region_model::fill_region): New decl.
3680 * region.cc (region::get_base_region): Handle RK_SIZED.
3681 (region::base_region_p): Likewise.
3682 (region::get_byte_size_sval): New.
3683 (get_field_at_bit_offset): Make non-static.
3684 (region::calc_offset): Move implementation of cases to
3685 get_relative_concrete_offset vfunc implementations. Handle
3687 (region::get_relative_concrete_offset): New.
3688 (decl_region::get_svalue_for_initializer): Drop enum binding_kind.
3689 (field_region::get_relative_concrete_offset): New, from
3690 region::calc_offset.
3691 (element_region::get_relative_concrete_offset): Likewise.
3692 (offset_region::get_relative_concrete_offset): Likewise.
3693 (sized_region::accept): New.
3694 (sized_region::dump_to_pp): New.
3695 (sized_region::get_byte_size): New.
3696 (sized_region::get_bit_size): New.
3697 * region.h (enum region_kind): Add RK_SIZED.
3698 (region::dyn_cast_sized_region): New.
3699 (region::get_byte_size): Make virtual.
3700 (region::get_bit_size): Likewise.
3701 (region::get_byte_size_sval): New decl.
3702 (region::get_relative_concrete_offset): New decl.
3703 (field_region::get_relative_concrete_offset): New decl.
3704 (element_region::get_relative_concrete_offset): Likewise.
3705 (offset_region::get_relative_concrete_offset): Likewise.
3706 (class sized_region): New.
3707 * store.cc (binding_kind_to_string): Delete.
3708 (binding_key::make): Drop enum binding_kind.
3709 (binding_key::dump_to_pp): Delete.
3710 (binding_key::cmp_ptrs): Drop enum binding_kind.
3711 (bit_range::contains_p): New.
3712 (byte_range::dump): New.
3713 (byte_range::contains_p): New.
3714 (byte_range::cmp): New.
3715 (concrete_binding::dump_to_pp): Drop enum binding_kind.
3716 (concrete_binding::cmp_ptr_ptr): Likewise.
3717 (symbolic_binding::dump_to_pp): Likewise.
3718 (symbolic_binding::cmp_ptr_ptr): Likewise.
3719 (binding_map::apply_ctor_val_to_range): Likewise.
3720 (binding_map::apply_ctor_pair_to_child_region): Likewise.
3721 (binding_map::get_overlapping_bindings): New.
3722 (binding_map::remove_overlapping_bindings): New.
3723 (binding_cluster::validate): New.
3724 (binding_cluster::bind): Drop enum binding_kind.
3725 (binding_cluster::bind_compound_sval): Likewise.
3726 (binding_cluster::purge_region): Likewise.
3727 (binding_cluster::zero_fill_region): Reimplement in terms of...
3728 (binding_cluster::fill_region): New.
3729 (binding_cluster::mark_region_as_unknown): Drop enum binding_kind.
3730 (binding_cluster::get_binding): Likewise.
3731 (binding_cluster::get_binding_recursive): Likewise.
3732 (binding_cluster::get_any_binding): Likewise.
3733 (binding_cluster::maybe_get_compound_binding): Reimplement.
3734 (binding_cluster::get_overlapping_bindings): Delete.
3735 (binding_cluster::remove_overlapping_bindings): Reimplement in
3736 terms of binding_map::remove_overlapping_bindings.
3737 (binding_cluster::can_merge_p): Update for removal of
3739 (binding_cluster::on_unknown_fncall): Drop enum binding_kind.
3740 (binding_cluster::maybe_get_simple_value): Likewise.
3741 (store_manager::get_concrete_binding): Likewise.
3742 (store_manager::get_symbolic_binding): Likewise.
3743 (store::validate): New.
3744 (store::set_value): Drop enum binding_kind.
3745 (store::zero_fill_region): Reimplement in terms of...
3746 (store::fill_region): New.
3747 (selftest::test_binding_key_overlap): Drop enum binding_kind.
3748 * store.h (enum binding_kind): Delete.
3749 (binding_kind_to_string): Delete decl.
3750 (binding_key::make): Drop enum binding_kind.
3751 (binding_key::dump_to_pp): Make pure virtual.
3752 (binding_key::get_kind): Delete.
3753 (binding_key::mark_deleted): Delete.
3754 (binding_key::mark_empty): Delete.
3755 (binding_key::is_deleted): Delete.
3756 (binding_key::is_empty): Delete.
3757 (binding_key::binding_key): Delete.
3758 (binding_key::impl_hash): Delete.
3759 (binding_key::impl_eq): Delete.
3760 (binding_key::m_kind): Delete.
3761 (bit_range::get_last_bit_offset): New.
3762 (bit_range::contains_p): New.
3763 (byte_range::contains_p): New.
3764 (byte_range::operator==): New.
3765 (byte_range::get_start_byte_offset): New.
3766 (byte_range::get_next_byte_offset): New.
3767 (byte_range::get_last_byte_offset): New.
3768 (byte_range::as_bit_range): New.
3769 (byte_range::cmp): New.
3770 (concrete_binding::concrete_binding): Drop enum binding_kind.
3771 (concrete_binding::hash): Likewise.
3772 (concrete_binding::operator==): Likewise.
3773 (concrete_binding::mark_deleted): New.
3774 (concrete_binding::mark_empty): New.
3775 (concrete_binding::is_deleted): New.
3776 (concrete_binding::is_empty): New.
3777 (default_hash_traits<ana::concrete_binding>::empty_zero_p): Make false.
3778 (symbolic_binding::symbolic_binding): Drop enum binding_kind.
3779 (symbolic_binding::hash): Likewise.
3780 (symbolic_binding::operator==): Likewise.
3781 (symbolic_binding::mark_deleted): New.
3782 (symbolic_binding::mark_empty): New.
3783 (symbolic_binding::is_deleted): New.
3784 (symbolic_binding::is_empty): New.
3785 (binding_map::remove_overlapping_bindings): New decl.
3786 (binding_map::get_overlapping_bindings): New decl.
3787 (binding_cluster::validate): New decl.
3788 (binding_cluster::bind): Drop enum binding_kind.
3789 (binding_cluster::fill_region): New decl.
3790 (binding_cluster::get_binding): Drop enum binding_kind.
3791 (binding_cluster::get_binding_recursive): Likewise.
3792 (binding_cluster::get_overlapping_bindings): Delete.
3793 (store::validate): New decl.
3794 (store::set_value): Drop enum binding_kind.
3795 (store::fill_region): New decl.
3796 (store_manager::get_concrete_binding): Drop enum binding_kind.
3797 (store_manager::get_symbolic_binding): Likewise.
3798 * svalue.cc (svalue::cmp_ptr): Handle SK_REPEATED and
3800 (svalue::extract_bit_range): New.
3801 (svalue::maybe_fold_bits_within): New.
3802 (constant_svalue::maybe_fold_bits_within): New.
3803 (unknown_svalue::maybe_fold_bits_within): New.
3804 (unaryop_svalue::maybe_fold_bits_within): New.
3805 (repeated_svalue::repeated_svalue): New.
3806 (repeated_svalue::dump_to_pp): New.
3807 (repeated_svalue::accept): New.
3808 (repeated_svalue::all_zeroes_p): New.
3809 (repeated_svalue::maybe_fold_bits_within): New.
3810 (bits_within_svalue::bits_within_svalue): New.
3811 (bits_within_svalue::dump_to_pp): New.
3812 (bits_within_svalue::maybe_fold_bits_within): New.
3813 (bits_within_svalue::accept): New.
3814 (bits_within_svalue::implicitly_live_p): New.
3815 (compound_svalue::maybe_fold_bits_within): New.
3816 * svalue.h (enum svalue_kind): Add SK_REPEATED and SK_BITS_WITHIN.
3817 (svalue::dyn_cast_repeated_svalue): New.
3818 (svalue::dyn_cast_bits_within_svalue): New.
3819 (svalue::extract_bit_range): New decl.
3820 (svalue::maybe_fold_bits_within): New vfunc decl.
3821 (region_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
3822 (region_svalue::key_t::is_empty): Likewise.
3823 (default_hash_traits<region_svalue::key_t>::empty_zero_p): Make false.
3824 (constant_svalue::maybe_fold_bits_within): New.
3825 (unknown_svalue::maybe_fold_bits_within): New.
3826 (poisoned_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
3827 (poisoned_svalue::key_t::is_empty): Likewise.
3828 (default_hash_traits<poisoned_svalue::key_t>::empty_zero_p): Make
3830 (setjmp_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
3831 (setjmp_svalue::key_t::is_empty): Likewise.
3832 (default_hash_traits<setjmp_svalue::key_t>::empty_zero_p): Make
3834 (unaryop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
3835 (unaryop_svalue::key_t::is_empty): Likewise.
3836 (unaryop_svalue::maybe_fold_bits_within): New.
3837 (default_hash_traits<unaryop_svalue::key_t>::empty_zero_p): Make
3839 (binop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
3840 (binop_svalue::key_t::is_empty): Likewise.
3841 (default_hash_traits<binop_svalue::key_t>::empty_zero_p): Make
3843 (sub_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
3844 (sub_svalue::key_t::is_empty): Likewise.
3845 (default_hash_traits<sub_svalue::key_t>::empty_zero_p): Make
3847 (class repeated_svalue): New.
3848 (is_a_helper <const repeated_svalue *>::test): New.
3849 (struct default_hash_traits<repeated_svalue::key_t>): New.
3850 (class bits_within_svalue): New.
3851 (is_a_helper <const bits_within_svalue *>::test): New.
3852 (struct default_hash_traits<bits_within_svalue::key_t>): New.
3853 (widening_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
3854 (widening_svalue::key_t::is_empty): Likewise.
3855 (default_hash_traits<widening_svalue::key_t>::empty_zero_p): Make
3857 (compound_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
3858 (compound_svalue::key_t::is_empty): Likewise.
3859 (compound_svalue::maybe_fold_bits_within): New.
3860 (default_hash_traits<compound_svalue::key_t>::empty_zero_p): Make
3863 2021-06-28 David Malcolm <dmalcolm@redhat.com>
3865 * analyzer.h (byte_offset_t): New typedef.
3866 * store.cc (bit_range::dump_to_pp): Dump as a byte range if
3868 (bit_range::as_byte_range): New.
3869 (byte_range::dump_to_pp): New.
3870 * store.h (class byte_range): New forward decl.
3871 (struct bit_range): Add comment.
3872 (bit_range::as_byte_range): New decl.
3873 (struct byte_range): New.
3875 2021-06-22 David Malcolm <dmalcolm@redhat.com>
3878 * region-model.cc (compat_types_p): New function.
3879 (region_model::create_region_for_heap_alloc): Convert assertion to
3881 (region_model::create_region_for_alloca): Likewise.
3883 2021-06-18 David Malcolm <dmalcolm@redhat.com>
3885 * store.cc (binding_cluster::get_any_binding): Make symbolic reads
3886 from a cluster with concrete bindings return unknown.
3888 2021-06-18 David Malcolm <dmalcolm@redhat.com>
3890 * region-model-manager.cc
3891 (region_model_manager::get_or_create_int_cst): New.
3892 (region_model_manager::maybe_undo_optimize_bit_field_compare): Use
3893 it to simplify away a local tree.
3894 * region-model.cc (region_model::on_setjmp): Likewise.
3895 (region_model::on_longjmp): Likewise.
3896 * region-model.h (region_model_manager::get_or_create_int_cst):
3898 * store.cc (binding_cluster::zero_fill_region): Use it to simplify
3901 2021-06-18 David Malcolm <dmalcolm@redhat.com>
3903 * checker-path.cc (class custom_event): Make abstract to allow for
3904 custom vfuncs, splitting existing implementation into...
3905 (class precanned_custom_event): New subclass.
3906 (custom_event::get_desc): Move to...
3907 (precanned_custom_event::get_desc): ...subclass.
3908 * checker-path.h (class custom_event): Make abstract to allow for
3909 custom vfuncs, splitting existing implementation into...
3910 (class precanned_custom_event): New subclass.
3911 * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
3912 Use precanned_custom_event.
3914 (stale_jmp_buf::maybe_add_custom_events_for_superedge): Likewise.
3915 * sm-signal.cc (signal_delivery_edge_info_t::add_events_to_path):
3918 2021-06-15 David Malcolm <dmalcolm@redhat.com>
3922 * engine.cc: Include "target.h".
3923 (impl_run_checkers): Log BITS_BIG_ENDIAN, BYTES_BIG_ENDIAN, and
3925 * region-model-manager.cc
3926 (region_model_manager::maybe_fold_binop): Move support for masking
3927 via ARG0 & CST into...
3928 (region_model_manager::maybe_undo_optimize_bit_field_compare):
3929 ...this new function. Flatten by converting from nested
3930 conditionals to a series of early return statements to reject
3931 failures. Reject if type is not unsigned_char_type_node.
3932 Handle BYTES_BIG_ENDIAN when determining which bits are bound
3935 (region_model_manager::maybe_undo_optimize_bit_field_compare):
3937 * store.cc (bit_range::dump): New function.
3938 * store.h (bit_range::dump): New decl.
3940 2021-06-15 David Malcolm <dmalcolm@redhat.com>
3942 * engine.cc (exploded_node::on_stmt): Handle __analyzer_dump_capacity.
3943 (exploded_node::on_stmt): Drop m_sm_changes from on_stmt_flags.
3944 (state_change_requires_new_enode_p): New function...
3945 (exploded_graph::process_node): Call it, rather than querying
3946 flags.m_sm_changes, so that dynamic-extent differences can also
3947 trigger the splitting of nodes.
3948 * exploded-graph.h (struct on_stmt_flags): Drop field m_sm_changes.
3949 * program-state.cc (program_state::detect_leaks): Purge dead
3950 heap-allocated regions from dynamic extents.
3951 (selftest::test_program_state_1): Fix type of "size_in_bytes".
3952 (selftest::test_program_state_merging): Likewise.
3953 * region-model-impl-calls.cc
3954 (region_model::impl_call_analyzer_dump_capacity): New.
3955 (region_model::impl_call_free): Remove dynamic extents from the
3957 * region-model-reachability.h
3958 (reachable_regions::begin_mutable_base_regs): New.
3959 (reachable_regions::end_mutable_base_regs): New.
3960 * region-model.cc: Include "tree-object-size.h".
3961 (region_model::region_model): Support new field m_dynamic_extents.
3962 (region_model::operator=): Likewise.
3963 (region_model::operator==): Likewise.
3964 (region_model::dump_to_pp): Dump sizes of dynamic regions.
3965 (region_model::handle_unrecognized_call): Purge dynamic extents
3966 from any regions that have escaped mutably:.
3967 (region_model::get_capacity): New function.
3968 (region_model::add_constraint): Unset dynamic extents when a
3969 heap-allocated region's address is NULL.
3970 (region_model::unbind_region_and_descendents): Purge dynamic
3971 extents of unbound regions.
3972 (region_model::can_merge_with_p): Call
3973 m_dynamic_extents.can_merge_with_p.
3974 (region_model::create_region_for_heap_alloc): Assert that
3975 size_in_bytes's type is compatible with size_type_node. Update
3976 for renaming of record_dynamic_extents to set_dynamic_extents.
3977 (region_model::create_region_for_alloca): Likewise.
3978 (region_model::record_dynamic_extents): Rename to...
3979 (region_model::set_dynamic_extents): ...this. Assert that
3980 size_in_bytes's type is compatible with size_type_node. Add it
3981 to the m_dynamic_extents map.
3982 (region_model::get_dynamic_extents): New.
3983 (region_model::unset_dynamic_extents): New.
3984 (selftest::test_state_merging): Fix type of "size".
3985 (selftest::test_malloc_constraints): Likewise.
3986 (selftest::test_malloc): Verify dynamic extents.
3987 (selftest::test_alloca): Likewise.
3988 * region-model.h (region_to_value_map::is_empty): New.
3989 (region_model::dynamic_extents_t): New typedef.
3990 (region_model::impl_call_analyzer_dump_capacity): New decl.
3991 (region_model::get_dynamic_extents): New function.
3992 (region_model::get_dynamic_extents): New decl.
3993 (region_model::set_dynamic_extents): New decl.
3994 (region_model::unset_dynamic_extents): New decl.
3995 (region_model::get_capacity): New decl.
3996 (region_model::record_dynamic_extents): Rename to set_dynamic_extents.
3997 (region_model::m_dynamic_extents): New field.
3999 2021-06-15 David Malcolm <dmalcolm@redhat.com>
4001 * region-model.cc (region_to_value_map::operator=): New.
4002 (region_to_value_map::operator==): New.
4003 (region_to_value_map::dump_to_pp): New.
4004 (region_to_value_map::dump): New.
4005 (region_to_value_map::can_merge_with_p): New.
4006 * region-model.h (class region_to_value_map): New class.
4008 2021-06-13 Trevor Saunders <tbsaunde@tbsaunde.org>
4010 * call-string.cc (call_string::call_string): Use range based for
4011 to iterate over vec<>.
4012 (call_string::to_json): Likewise.
4013 (call_string::hash): Likewise.
4014 (call_string::calc_recursion_depth): Likewise.
4015 * checker-path.cc (checker_path::fixup_locations): Likewise.
4016 * constraint-manager.cc (equiv_class::equiv_class): Likewise.
4017 (equiv_class::to_json): Likewise.
4018 (equiv_class::hash): Likewise.
4019 (constraint_manager::to_json): Likewise.
4020 * engine.cc (impl_region_model_context::on_svalue_leak):
4022 (on_liveness_change): Likewise.
4023 (impl_region_model_context::on_unknown_change): Likewise.
4024 * program-state.cc (sm_state_map::set_state): Likewise.
4025 * region-model.cc (test_canonicalization_4): Likewise.
4027 2021-06-11 David Malcolm <dmalcolm@redhat.com>
4029 * engine.cc (worklist::key_t::cmp): Move sort by call_string to
4032 2021-06-09 David Malcolm <dmalcolm@redhat.com>
4034 * region-model.cc (region_model::get_lvalue_1): Make const.
4035 (region_model::get_lvalue): Likewise.
4036 (region_model::get_rvalue_1): Likewise.
4037 (region_model::get_rvalue): Likewise.
4038 (region_model::deref_rvalue): Likewise.
4039 (region_model::get_rvalue_for_bits): Likewise.
4040 * region-model.h (region_model::get_lvalue): Likewise.
4041 (region_model::get_rvalue): Likewise.
4042 (region_model::deref_rvalue): Likewise.
4043 (region_model::get_rvalue_for_bits): Likewise.
4044 (region_model::get_lvalue_1): Likewise.
4045 (region_model::get_rvalue_1): Likewise.
4047 2021-06-08 David Malcolm <dmalcolm@redhat.com>
4050 * region-model-manager.cc
4051 (region_model_manager::maybe_fold_binop): Add support for folding
4052 BIT_AND_EXPR of compound_svalue and a mask constant.
4053 * region-model.cc (region_model::get_rvalue_1): Implement
4054 BIT_FIELD_REF in terms of...
4055 (region_model::get_rvalue_for_bits): New function.
4056 * region-model.h (region_model::get_rvalue_for_bits): New decl.
4057 * store.cc (bit_range::from_mask): New function.
4058 (selftest::test_bit_range_intersects_p): New selftest.
4059 (selftest::assert_bit_range_from_mask_eq): New.
4060 (ASSERT_BIT_RANGE_FROM_MASK_EQ): New macro.
4061 (selftest::assert_no_bit_range_from_mask_eq): New.
4062 (ASSERT_NO_BIT_RANGE_FROM_MASK): New macro.
4063 (selftest::test_bit_range_from_mask): New selftest.
4064 (selftest::analyzer_store_cc_tests): Call the new selftests.
4065 * store.h (bit_range::intersects_p): New.
4066 (bit_range::from_mask): New decl.
4067 (concrete_binding::get_bit_range): New accessor.
4068 (store_manager::get_concrete_binding): New overload taking
4071 2021-06-08 David Malcolm <dmalcolm@redhat.com>
4073 * analyzer.h (int_size_in_bits): New decl.
4074 * region.cc (int_size_in_bits): New function.
4075 (region::get_bit_size): Reimplement in terms of the above.
4077 2021-06-08 David Malcolm <dmalcolm@redhat.com>
4079 * store.cc (concrete_binding::dump_to_pp): Move bulk of
4080 implementation to...
4081 (bit_range::dump_to_pp): ...this new function.
4082 (bit_range::cmp): New.
4083 (concrete_binding::overlaps_p): Update for use of bit_range.
4084 (concrete_binding::cmp_ptr_ptr): Likewise.
4085 * store.h (struct bit_range): New.
4086 (class concrete_binding): Replace fields m_start_bit_offset and
4087 m_size_in_bits with new field m_bit_range.
4089 2021-06-08 David Malcolm <dmalcolm@redhat.com>
4091 * svalue.h (conjured_svalue::iterator_t): Delete.
4093 2021-06-03 David Malcolm <dmalcolm@redhat.com>
4095 * store.h (store::get_direct_binding): Remove unused decl.
4096 (store::get_default_binding): Likewise.
4098 2021-06-03 David Malcolm <dmalcolm@redhat.com>
4100 * svalue.cc (poisoned_svalue::dump_to_pp): Dump type.
4101 (compound_svalue::dump_to_pp): Dump any type.
4103 2021-05-18 David Malcolm <dmalcolm@redhat.com>
4106 * sm-malloc.cc: Include "analyzer/function-set.h".
4107 (malloc_state_machine::on_stmt): Call unaffected_by_call_p and
4108 bail on the functions it recognizes.
4109 (malloc_state_machine::unaffected_by_call_p): New.
4111 2021-05-10 Martin Liska <mliska@suse.cz>
4113 * sm-file.cc (is_file_using_fn_p): Use startswith
4114 function instead of strncmp.
4116 2021-05-10 Martin Liska <mliska@suse.cz>
4118 * program-state.cc (program_state::operator=): Remove
4119 __cplusplus >= 201103.
4120 (program_state::program_state): Likewise.
4121 * program-state.h: Likewise.
4122 * region-model.h (class region_model): Remove dead code.
4124 2021-04-24 David Malcolm <dmalcolm@redhat.com>
4127 * sm-malloc.cc (free_of_non_heap::describe_state_change):
4128 Bulletproof against change.m_expr being NULL.
4130 2021-04-13 David Malcolm <dmalcolm@redhat.com>
4133 * supergraph.cc (saved_uids::make_uid_unique): New.
4134 (saved_uids::restore_uids): New.
4135 (supergraph::supergraph): Replace assignments to stmt->uid with
4136 calls to m_stmt_uids.make_uid_unique.
4137 (supergraph::~supergraph): New.
4138 * supergraph.h (class saved_uids): New.
4139 (supergraph::~supergraph): New decl.
4140 (supergraph::m_stmt_uids): New field.
4142 2021-04-10 David Malcolm <dmalcolm@redhat.com>
4145 * region-model.cc (region_model::on_assignment): Avoid NULL
4146 dereference if ctxt is NULL when assigning from a STRING_CST.
4148 2021-04-08 David Malcolm <dmalcolm@redhat.com>
4153 (impl_region_model_context::impl_region_model_context): Add
4154 uncertainty param and use it to initialize m_uncertainty.
4155 (impl_region_model_context::get_uncertainty): New.
4156 (impl_sm_context::get_fndecl_for_call): Add NULL for new
4157 uncertainty param when constructing impl_region_model_context.
4158 (impl_sm_context::get_state): Likewise.
4159 (impl_sm_context::set_next_state): Likewise.
4160 (impl_sm_context::warn): Likewise.
4161 (exploded_node::on_stmt): Add uncertainty param
4162 and use it when constructing impl_region_model_context.
4163 (exploded_node::on_edge): Add uncertainty param and pass
4165 (exploded_node::detect_leaks): Create uncertainty_t and pass to
4166 impl_region_model_context.
4167 (exploded_graph::get_or_create_node): Create uncertainty_t and
4168 pass to prune_for_point.
4169 (maybe_process_run_of_before_supernode_enodes): Create
4170 uncertainty_t and pass to impl_region_model_context.
4171 (exploded_graph::process_node): Create uncertainty_t instances and
4172 pass around as needed.
4174 (impl_region_model_context::impl_region_model_context): Add
4176 (impl_region_model_context::get_uncertainty): New decl.
4177 (impl_region_model_context::m_uncertainty): New field.
4178 (exploded_node::on_stmt): Add uncertainty param.
4179 (exploded_node::on_edge): Likewise.
4180 * program-state.cc (sm_state_map::on_liveness_change): Get
4181 uncertainty from context and use it to unset sm-state from
4182 svalues as appropriate.
4183 (program_state::on_edge): Add uncertainty param and use it when
4184 constructing impl_region_model_context. Fix indentation.
4185 (program_state::prune_for_point): Add uncertainty param and use it
4186 when constructing impl_region_model_context.
4187 (program_state::detect_leaks): Get any uncertainty from ctxt and
4188 use it to get maybe-live svalues for dest_state, rather than
4189 definitely-live ones; use this when determining which svalues
4191 (selftest::test_program_state_merging): Create uncertainty_t and
4192 pass to impl_region_model_context.
4193 * program-state.h (program_state::on_edge): Add uncertainty param.
4194 (program_state::prune_for_point): Likewise.
4195 * region-model-impl-calls.cc (call_details::get_uncertainty): New.
4196 (region_model::impl_call_memcpy): Pass uncertainty to
4197 mark_region_as_unknown call.
4198 (region_model::impl_call_memset): Likewise.
4199 (region_model::impl_call_strcpy): Likewise.
4200 * region-model-reachability.cc (reachable_regions::handle_sval):
4201 Also add sval to m_mutable_svals.
4202 * region-model.cc (region_model::on_assignment): Pass any
4203 uncertainty from ctxt to the store::set_value call.
4204 (region_model::handle_unrecognized_call): Get any uncertainty from
4205 ctxt and use it to record mutable svalues at the unknown call.
4206 (region_model::get_reachable_svalues): Add uncertainty param and
4207 use it to mark any maybe-bound svalues as being reachable.
4208 (region_model::set_value): Pass any uncertainty from ctxt to the
4209 store::set_value call.
4210 (region_model::mark_region_as_unknown): Add uncertainty param and
4211 pass it on to the store::mark_region_as_unknown call.
4212 (region_model::update_for_call_summary): Add uncertainty param and
4213 pass it on to the region_model::mark_region_as_unknown call.
4214 * region-model.h (call_details::get_uncertainty): New decl.
4215 (region_model::get_reachable_svalues): Add uncertainty param.
4216 (region_model::mark_region_as_unknown): Add uncertainty param.
4217 (region_model_context::get_uncertainty): New vfunc.
4218 (noop_region_model_context::get_uncertainty): New vfunc
4220 * store.cc (dump_svalue_set): New.
4221 (uncertainty_t::dump_to_pp): New.
4222 (uncertainty_t::dump): New.
4223 (binding_cluster::clobber_region): Pass NULL for uncertainty to
4224 remove_overlapping_bindings.
4225 (binding_cluster::mark_region_as_unknown): Add uncertainty param
4226 and pass it to remove_overlapping_bindings.
4227 (binding_cluster::remove_overlapping_bindings): Add uncertainty param.
4228 Use it to record any svalues that were in clobbered bindings.
4229 (store::set_value): Add uncertainty param. Pass it to
4230 binding_cluster::mark_region_as_unknown when handling symbolic
4232 (store::mark_region_as_unknown): Add uncertainty param and pass it
4233 to binding_cluster::mark_region_as_unknown.
4234 (store::remove_overlapping_bindings): Add uncertainty param and
4235 pass it to binding_cluster::remove_overlapping_bindings.
4236 * store.h (binding_cluster::mark_region_as_unknown): Add
4238 (binding_cluster::remove_overlapping_bindings): Likewise.
4239 (store::set_value): Likewise.
4240 (store::mark_region_as_unknown): Likewise.
4242 2021-04-05 David Malcolm <dmalcolm@redhat.com>
4245 * analyzer.cc (maybe_reconstruct_from_def_stmt): Fix NULL
4246 dereference on calls with zero arguments.
4247 * sm-malloc.cc (malloc_state_machine::on_stmt): When handling
4248 __attribute__((nonnull)), only call get_diagnostic_tree if the
4249 result will be used.
4251 2021-04-05 David Malcolm <dmalcolm@redhat.com>
4254 * diagnostic-manager.cc
4255 (diagnostic_manager::prune_interproc_events): Use signed integers
4256 when subtracting one from path->num_events ().
4257 (diagnostic_manager::consolidate_conditions): Likewise. Convert
4258 next_idx to a signed int.
4260 2021-04-01 David Malcolm <dmalcolm@redhat.com>
4262 * diagnostic-manager.cc (diagnostic_manager::add_diagnostic): Make
4263 enode param non-constant, and call add_diagnostic on it. Add
4264 enode index to log message.
4265 (diagnostic_manager::add_diagnostic): Make enode param
4267 * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
4268 Likewise for both decls.
4270 (impl_region_model_context::impl_region_model_context): Likewise
4272 (impl_sm_context::impl_sm_context): Likewise.
4273 (impl_sm_context::m_enode_for_diag): Likewise.
4274 (exploded_node::dump_dot): Don't pass the diagnostic manager
4275 to dump_saved_diagnostics.
4276 (exploded_node::dump_saved_diagnostics): Drop param. Iterate
4277 directly through all saved diagnostics for the enode, rather
4278 than all saved diagnostics in the diagnostic_manager and
4280 (exploded_node::on_stmt): Make non-const.
4281 (exploded_node::on_edge): Likewise.
4282 (exploded_node::on_longjmp): Likewise.
4283 (exploded_node::detect_leaks): Likewise.
4284 (exploded_graph::get_or_create_node): Make enode_for_diag param
4286 (exploded_graph_annotator::print_enode): Iterate
4287 directly through all saved diagnostics for the enode, rather
4288 than all saved diagnostics in the diagnostic_manager and
4291 (impl_region_model_context::impl_region_model_context): Make
4292 enode_for_diag param non-constant.
4293 (impl_region_model_context::m_enode_for_diag): Likewise.
4294 (exploded_node::dump_saved_diagnostics): Drop param.
4295 (exploded_node::on_stmt): Make non-const.
4296 (exploded_node::on_edge): Likewise.
4297 (exploded_node::on_longjmp): Likewise.
4298 (exploded_node::detect_leaks): Likewise.
4299 (exploded_node::add_diagnostic): New.
4300 (exploded_node::get_num_diagnostics): New.
4301 (exploded_node::get_saved_diagnostic): New.
4302 (exploded_node::m_saved_diagnostics): New.
4303 (exploded_graph::get_or_create_node): Make enode_for_diag param
4305 * feasible-graph.cc (feasible_node::dump_dot): Drop
4306 diagnostic_manager from call to dump_saved_diagnostics.
4307 * program-state.cc (program_state::on_edge): Convert enode param
4308 to non-const pointer.
4309 (program_state::prune_for_point): Likewise for enode_for_diag
4311 * program-state.h (program_state::on_edge): Convert enode param
4312 to non-const pointer.
4313 (program_state::prune_for_point): Likewise for enode_for_diag
4316 2021-03-31 David Malcolm <dmalcolm@redhat.com>
4319 * analyzer.cc (maybe_reconstruct_from_def_stmt): New.
4320 (fixup_tree_for_diagnostic_1): New.
4321 (fixup_tree_for_diagnostic): New.
4322 * analyzer.h (fixup_tree_for_diagnostic): New decl.
4323 * checker-path.cc (call_event::get_desc): Call
4324 fixup_tree_for_diagnostic and use it for the call_with_state call.
4325 (warning_event::get_desc): Likewise for the final_event and
4326 make_label_text calls.
4327 * engine.cc (impl_region_model_context::on_state_leak): Likewise
4328 for the on_leak and add_diagnostic calls.
4329 * region-model.cc (region_model::get_representative_tree):
4330 Likewise for the result.
4332 2021-03-30 David Malcolm <dmalcolm@redhat.com>
4334 * region.h (region::dump_to_pp): Remove old decl.
4336 2021-03-30 David Malcolm <dmalcolm@redhat.com>
4338 * sm-file.cc (fileptr_state_machine::on_stmt): Only call
4339 get_diagnostic_tree if the result will be used.
4340 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
4341 (malloc_state_machine::on_deallocator_call): Likewise.
4342 (malloc_state_machine::on_realloc_call): Likewise.
4343 (malloc_state_machine::on_realloc_call): Likewise.
4345 (sensitive_state_machine::warn_for_any_exposure): Likewise.
4346 * sm-taint.cc (taint_state_machine::on_stmt): Likewise.
4348 2021-03-25 David Malcolm <dmalcolm@redhat.com>
4353 * engine.cc (exploded_node::on_stmt): Clear sm-state involving
4354 an SSA name at the def-stmt of that SSA name.
4355 * program-state.cc (sm_state_map::purge_state_involving): New.
4356 * program-state.h (sm_state_map::purge_state_involving): New decl.
4357 * region-model.cc (selftest::test_involves_p): New.
4358 (selftest::analyzer_region_model_cc_tests): Call it.
4359 * svalue.cc (class involvement_visitor): New class
4360 (svalue::involves_p): New.
4361 * svalue.h (svalue::involves_p): New decl.
4363 2021-03-19 David Malcolm <dmalcolm@redhat.com>
4366 * diagnostic-manager.cc (class epath_finder): Add
4367 DISABLE_COPY_AND_ASSIGN.
4369 2021-03-15 Martin Liska <mliska@suse.cz>
4371 * sm-file.cc (get_file_using_fns): Add missing comma in initializer.
4373 2021-03-11 David Malcolm <dmalcolm@redhat.com>
4376 * analyzer.opt (-param=analyzer-max-infeasible-edges=): New param.
4377 (fdump-analyzer-feasibility): New flag.
4378 * diagnostic-manager.cc: Include "analyzer/trimmed-graph.h" and
4379 "analyzer/feasible-graph.h".
4380 (epath_finder::epath_finder): Convert m_sep to a pointer and
4381 only create it if !flag_analyzer_feasibility.
4382 (epath_finder::~epath_finder): New.
4383 (epath_finder::m_sep): Convert to a pointer.
4384 (epath_finder::get_best_epath): Add param "diag_idx" and use it
4385 when logging. Rather than finding the shortest path and then
4386 checking feasibility, instead use explore_feasible_paths unless
4387 !flag_analyzer_feasibility, in which case simply use the shortest
4388 path, and note if it is infeasible. Update for m_sep becoming a
4390 (class feasible_worklist): New.
4391 (epath_finder::explore_feasible_paths): New.
4392 (epath_finder::process_worklist_item): New.
4393 (class dump_eg_with_shortest_path): New.
4394 (epath_finder::dump_trimmed_graph): New.
4395 (epath_finder::dump_feasible_graph): New.
4396 (saved_diagnostic::saved_diagnostic): Add "idx" param, using it
4398 (saved_diagnostic::to_json): Dump m_idx.
4399 (saved_diagnostic::calc_best_epath): Pass m_idx to get_best_epath.
4400 Remove assertion that m_problem was set when m_best_epath is NULL.
4401 (diagnostic_manager::add_diagnostic): Pass an index when created
4402 saved_diagnostic instances.
4403 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add
4405 (saved_diagnostic::get_index): New accessor.
4406 (saved_diagnostic::m_idx): New field.
4407 * engine.cc (exploded_node::dump_dot): Call args.dump_extra_info.
4409 (exploded_node::dump_processed_stmts): ...this new function and...
4410 (exploded_node::dump_saved_diagnostics): ...this new function.
4411 Add index of each diagnostic.
4412 (exploded_edge::dump_dot): Move bulk of code to...
4413 (exploded_edge::dump_dot_label): ...this new function.
4414 * exploded-graph.h (eg_traits::dump_args_t::dump_extra_info): New
4416 (exploded_node::dump_processed_stmts): New decl.
4417 (exploded_node::dump_saved_diagnostics): New decl.
4418 (exploded_edge::dump_dot_label): New decl.
4419 * feasible-graph.cc: New file.
4420 * feasible-graph.h: New file.
4421 * trimmed-graph.cc: New file.
4422 * trimmed-graph.h: New file.
4424 2021-03-11 David Malcolm <dmalcolm@redhat.com>
4426 * diagnostic-manager.cc (epath_finder::epath_finder):
4427 Update shortest_paths init for new param.
4429 2021-03-10 David Malcolm <dmalcolm@redhat.com>
4432 * engine.cc (exploded_path::feasible_p): Move "snodes_visited" and
4433 "model" locals into a new class feasibility_state. Move heart
4434 of per-edge processing into
4435 feasibility_state::maybe_update_for_edge.
4436 (feasibility_state::feasibility_state): New.
4437 (feasibility_state::maybe_update_for_edge): New, based on loop
4438 body in exploded_path::feasible_p.
4439 * exploded-graph.h (class feasibility_state): New.
4441 2021-03-10 David Malcolm <dmalcolm@redhat.com>
4444 (callgraph_superedge::dyn_cast_callgraph_superedge): New.
4445 (call_superedge::dyn_cast_callgraph_superedge): Delete.
4446 (return_superedge::dyn_cast_callgraph_superedge): Delete.
4448 2021-03-02 Martin Liska <mliska@suse.cz>
4450 * diagnostic-manager.cc (diagnostic_manager::emit_saved_diagnostics):
4453 2021-02-26 David Malcolm <dmalcolm@redhat.com>
4455 * engine.cc (exploded_path::exploded_path): New copy-ctor.
4456 * exploded-graph.h (exploded_path::operator=): Drop decl.
4458 2021-02-26 David Malcolm <dmalcolm@redhat.com>
4461 * diagnostic-manager.cc (class epath_finder): New.
4462 (epath_finder::get_best_epath): New.
4463 (saved_diagnostic::saved_diagnostic): Update for replacement of
4464 m_state and m_epath_length with m_best_epath.
4465 (saved_diagnostic::~saved_diagnostic): Delete m_best_epath.
4466 (saved_diagnostic::to_json): Update "path_length" to be optional.
4467 (saved_diagnostic::calc_best_epath): New, based on
4468 dedupe_winners::add and parts of dedupe_key::dedupe_key.
4469 (saved_diagnostic::get_epath_length): New.
4470 (saved_diagnostic::add_duplicate): New.
4471 (dedupe_key::dedupe_key): Drop epath param. Move invocation of
4472 stmt_finder to saved_diagnostic::calc_best_epath.
4473 (class dedupe_candidate): Delete.
4474 (class dedupe_hash_map_traits): Update to use saved_diagnotic *
4475 rather than dedupe_candidate * as the value_type/compare_type.
4476 (dedupe_winners::~dedupe_winners): Don't delete the values.
4477 (dedupe_winners::add): Convert param from shortest_exploded_paths to
4478 epath_finder. Drop "eg" param. Drop dedupe_candidate, moving
4479 path generation and feasiblity checking to
4480 epath_finder::get_best_epath. Update winner-selection for move
4481 of epaths from dedupe_candidate to saved_diagnostic.
4482 (dedupe_winners::emit_best): Update for removal of class
4484 (dedupe_winners::map_t): Update to use saved_diagnotic * rather
4485 than dedupe_candidate * as the value_type/compare_type.
4486 (diagnostic_manager::emit_saved_diagnostics): Move
4487 shortest_exploded_paths instance into epath_finder and pass that
4489 (diagnostic_manager::emit_saved_diagnostic): Drop epath, stmt
4490 and num_dupes params, instead getting these from the
4491 saved_diagnostic. Use correct location in inform_n call.
4492 * diagnostic-manager.h (class epath_finder): New forward decl.
4493 (saved_diagnostic::status): Drop enum.
4494 (saved_diagnostic::set_feasible): Drop.
4495 (saved_diagnostic::set_infeasible): Drop.
4496 (saved_diagnostic::get_status): Drop.
4497 (saved_diagnostic::calc_best_epath): New decl.
4498 (saved_diagnostic::get_best_epath): New decl.
4499 (saved_diagnostic::get_epath_length): New decl.
4500 (saved_diagnostic::set_epath_length): Drop.
4501 (saved_diagnostic::get_epath_length): Drop inline implementation.
4502 (saved_diagnostic::add_duplicate): New.
4503 (saved_diagnostic::get_num_dupes): New.
4504 (saved_diagnostic::m_d): Document ownership.
4505 (saved_diagnostic::m_trailing_eedge): Make const.
4506 (saved_diagnostic::m_status): Drop field.
4507 (saved_diagnostic::m_epath_length): Drop field.
4508 (saved_diagnostic::m_best_epath): New field.
4509 (saved_diagnostic::m_problem): Document ownership.
4510 (saved_diagnostic::m_duplicates): New field.
4511 (diagnostic_manager::emit_saved_diagnostic): Drop params epath,
4512 stmt, and num_dupes.
4513 * engine.cc (exploded_graph_annotator::print_saved_diagnostic):
4514 Update for changes to saved_diagnostic class.
4515 * exploded-graph.h (exploded_path::feasible_p): Drop unused
4518 2021-02-25 David Malcolm <dmalcolm@redhat.com>
4521 * region-model-impl-calls.cc (region_model::impl_call_realloc): New.
4522 * region-model.cc (region_model::on_call_pre): Call it.
4523 * region-model.h (region_model::impl_call_realloc): New decl.
4524 * sm-malloc.cc (enum wording): Add WORDING_REALLOCATED.
4525 (malloc_state_machine::m_realloc): New field.
4526 (use_after_free::describe_state_change): Add case for
4527 WORDING_REALLOCATED.
4528 (use_after_free::describe_final_event): Likewise.
4529 (malloc_state_machine::malloc_state_machine): Initialize
4531 (malloc_state_machine::on_stmt): Handle realloc by calling...
4532 (malloc_state_machine::on_realloc_call): New.
4534 2021-02-22 David Malcolm <dmalcolm@redhat.com>
4537 * engine.cc (exploded_node::on_stmt): Provide terminate_path
4538 flag as a way for on_call_pre to terminate the current analysis
4540 * region-model-impl-calls.cc (call_details::num_args): New.
4541 (region_model::impl_call_error): New.
4542 * region-model.cc (region_model::on_call_pre): Add param
4543 "out_terminate_path". Handle "error" and "error_at_line".
4544 * region-model.h (call_details::num_args): New decl.
4545 (region_model::on_call_pre): Add param "out_terminate_path".
4546 (region_model::impl_call_error): New decl.
4548 2021-02-17 David Malcolm <dmalcolm@redhat.com>
4551 * constraint-manager.cc (dead_svalue_purger::should_purge_p):
4552 Update for change to svalue::live_p.
4553 * program-state.cc (sm_state_map::on_liveness_change): Likewise.
4554 (program_state::detect_leaks): Likewise.
4555 * region-model-reachability.cc (reachable_regions::init_cluster):
4556 When dealing with a symbolic region, if the underlying pointer is
4557 implicitly live, add the region to the reachable regions.
4558 * region-model.cc (region_model::compare_initial_and_pointer):
4559 Move logic for detecting initial values of params to
4560 initial_svalue::initial_value_of_param_p.
4561 * svalue.cc (svalue::live_p): Convert "live_svalues" from a
4562 reference to a pointer; support it being NULL.
4563 (svalue::implicitly_live_p): Convert first param from a
4564 refererence to a pointer.
4565 (region_svalue::implicitly_live_p): Likewise.
4566 (constant_svalue::implicitly_live_p): Likewise.
4567 (initial_svalue::implicitly_live_p): Likewise. Treat the initial
4568 values of params for the top level frame as still live.
4569 (initial_svalue::initial_value_of_param_p): New function, taken
4570 from a test in region_model::compare_initial_and_pointer.
4571 (unaryop_svalue::implicitly_live_p): Convert first param from a
4572 refererence to a pointer.
4573 (binop_svalue::implicitly_live_p): Likewise.
4574 (sub_svalue::implicitly_live_p): Likewise.
4575 (unmergeable_svalue::implicitly_live_p): Likewise.
4576 * svalue.h (svalue::live_p): Likewise.
4577 (svalue::implicitly_live_p): Likewise.
4578 (region_svalue::implicitly_live_p): Likewise.
4579 (constant_svalue::implicitly_live_p): Likewise.
4580 (initial_svalue::implicitly_live_p): Likewise.
4581 (initial_svalue::initial_value_of_param_p): New decl.
4582 (unaryop_svalue::implicitly_live_p): Convert first param from a
4583 refererence to a pointer.
4584 (binop_svalue::implicitly_live_p): Likewise.
4585 (sub_svalue::implicitly_live_p): Likewise.
4586 (unmergeable_svalue::implicitly_live_p): Likewise.
4588 2021-02-12 David Malcolm <dmalcolm@redhat.com>
4591 * engine.cc (readability): Add names for the various arbitrary
4592 values. Handle NOP_EXPR and INTEGER_CST.
4593 (readability_comparator): Combine the readability tests for
4594 tree and stack depth, rather than performing them sequentially.
4595 (impl_region_model_context::on_state_leak): Strip off top-level
4597 * region-model.cc (region_model::get_representative_path_var): Add
4598 type-checking, moving the bulk of the implementation to...
4599 (region_model::get_representative_path_var_1): ...here. Respect
4600 types in casts by recursing and re-adding the cast, rather than
4601 merely stripping them off. Use the correct type when handling
4603 (region_model::get_representative_tree): Strip off any top-level
4605 (region_model::get_representative_path_var): Add type-checking,
4606 moving the bulk of the implementation to...
4607 (region_model::get_representative_path_var_1): ...here.
4608 * region-model.h (region_model::get_representative_path_var_1):
4610 (region_model::get_representative_path_var_1): New decl.
4611 * store.cc (append_pathvar_with_type): New.
4612 (binding_cluster::get_representative_path_vars): Cast path_vars
4613 to the correct type when adding them to *OUT_PVS.
4615 2021-02-09 David Malcolm <dmalcolm@redhat.com>
4618 * sm-file.cc (is_file_using_fn_p): Support "_IO_"-prefixed
4621 2021-02-09 David Malcolm <dmalcolm@redhat.com>
4624 * store.cc (store::set_value): Treat a pointer written to *UNKNOWN
4627 2021-02-02 David Malcolm <dmalcolm@redhat.com>
4631 * engine.cc (toplevel_function_p): Simplify so that
4632 we only reject functions with a "__analyzer_" prefix.
4633 (add_any_callbacks): Delete.
4634 (exploded_graph::build_initial_worklist): Update for
4635 dropped param of toplevel_function_p.
4636 (exploded_graph::build_initial_worklist): Don't bother
4637 looking for callbacks that are reachable from global
4640 2021-02-01 David Malcolm <dmalcolm@redhat.com>
4643 * region-model-manager.cc
4644 (region_model_manager::get_or_create_initial_value):
4645 Fold the initial value of *UNKNOWN_PTR to an UNKNOWN value.
4646 (region_model_manager::get_field_region): Fold the value
4647 of UNKNOWN_PTR->FIELD to *UNKNOWN_PTR_OF_&FIELD_TYPE.
4649 2021-01-29 David Malcolm <dmalcolm@redhat.com>
4651 * checker-path.cc (event_kind_to_string): Handle
4652 EK_START_CONSOLIDATED_CFG_EDGES and
4653 EK_END_CONSOLIDATED_CFG_EDGES.
4654 (start_consolidated_cfg_edges_event::get_desc): New.
4655 (checker_path::cfg_edge_pair_at_p): New.
4656 * checker-path.h (enum event_kind): Add
4657 EK_START_CONSOLIDATED_CFG_EDGES and
4658 EK_END_CONSOLIDATED_CFG_EDGES.
4659 (class start_consolidated_cfg_edges_event): New class.
4660 (class end_consolidated_cfg_edges_event): New class.
4661 (checker_path::delete_events): New.
4662 (checker_path::replace_event): New.
4663 (checker_path::cfg_edge_pair_at_p): New decl.
4664 * diagnostic-manager.cc (diagnostic_manager::prune_path): Call
4665 consolidate_conditions.
4666 (same_line_as_p): New.
4667 (diagnostic_manager::consolidate_conditions): New.
4668 * diagnostic-manager.h
4669 (diagnostic_manager::consolidate_conditions): New decl.
4671 2021-01-18 David Malcolm <dmalcolm@redhat.com>
4673 * analyzer.h (is_std_named_call_p): New decl.
4674 * diagnostic-manager.cc (path_builder::get_sm): New.
4675 (state_change_event_creator::state_change_event_creator): Add "pb"
4677 (state_change_event_creator::on_global_state_change): Don't consider
4678 state changes affecting other state_machines.
4679 (state_change_event_creator::on_state_change): Likewise.
4680 (state_change_event_creator::m_pb): New field.
4681 (diagnostic_manager::add_events_for_eedge): Pass pb to visitor
4683 * region-model-impl-calls.cc
4684 (region_model::impl_deallocation_call): New.
4685 * region-model.cc: Include "attribs.h".
4686 (region_model::on_call_post): Handle fndecls referenced by
4687 __attribute__((deallocated_by(FOO))).
4688 * region-model.h (region_model::impl_deallocation_call): New decl.
4689 * sm-malloc.cc: Include "stringpool.h" and "attribs.h". Add
4691 (class api): Delete.
4692 (enum resource_state): Update comment for change from api to
4693 deallocator and deallocator_set.
4694 (allocation_state::allocation_state): Drop api param. Add
4695 "deallocators" and "deallocator".
4696 (allocation_state::m_api): Drop field in favor of...
4697 (allocation_state::m_deallocators): New field.
4698 (allocation_state::m_deallocator): New field.
4699 (enum wording): Add WORDING_DEALLOCATED.
4700 (struct deallocator): New.
4701 (struct standard_deallocator): New.
4702 (struct custom_deallocator): New.
4703 (struct deallocator_set): New.
4704 (struct custom_deallocator_set): New.
4705 (struct standard_deallocator_set): New.
4706 (struct deallocator_set_map_traits): New.
4707 (malloc_state_machine::m_malloc): Drop field
4708 (malloc_state_machine::m_scalar_new): Likewise.
4709 (malloc_state_machine::m_vector_new): Likewise.
4710 (malloc_state_machine::m_free): New field
4711 (malloc_state_machine::m_scalar_delete): Likewise.
4712 (malloc_state_machine::m_vector_delete): Likewise.
4713 (malloc_state_machine::deallocator_map_t): New typedef.
4714 (malloc_state_machine::m_deallocator_map): New field.
4715 (malloc_state_machine::deallocator_set_cache_t): New typedef.
4716 (malloc_state_machine::m_custom_deallocator_set_cache): New field.
4717 (malloc_state_machine::custom_deallocator_set_map_t): New typedef.
4718 (malloc_state_machine::m_custom_deallocator_set_map): New field.
4719 (malloc_state_machine::m_dynamic_sets): New field.
4720 (malloc_state_machine::m_dynamic_deallocators): New field.
4722 (deallocator::deallocator): New ctor.
4723 (deallocator::hash): New.
4724 (deallocator::dump_to_pp): New.
4725 (deallocator::cmp): New.
4726 (deallocator::cmp_ptr_ptr): New.
4727 (standard_deallocator::standard_deallocator): New ctor.
4728 (deallocator_set::deallocator_set): New ctor.
4729 (deallocator_set::dump): New.
4730 (custom_deallocator_set::custom_deallocator_set): New ctor.
4731 (custom_deallocator_set::contains_p): New.
4732 (custom_deallocator_set::maybe_get_single): New.
4733 (custom_deallocator_set::dump_to_pp): New.
4734 (standard_deallocator_set::standard_deallocator_set): New ctor.
4735 (standard_deallocator_set::contains_p): New.
4736 (standard_deallocator_set::maybe_get_single): New.
4737 (standard_deallocator_set::dump_to_pp): New.
4739 (class mismatching_deallocation): Update for conversion from api
4740 to deallocator_set and deallocator.
4741 (double_free::emit): Use %qs.
4742 (class use_after_free): Update for conversion from api to
4743 deallocator_set and deallocator.
4744 (malloc_leak::describe_state_change): Only emit "allocated here" on
4745 a start->nonnull transition, rather than on other transitions to
4747 (allocation_state::dump_to_pp): Update for conversion from api to
4749 (allocation_state::get_nonnull): Likewise.
4750 (malloc_state_machine::malloc_state_machine): Likewise.
4751 (malloc_state_machine::~malloc_state_machine): New.
4752 (malloc_state_machine::add_state): Update for conversion from api
4754 (malloc_state_machine::get_or_create_custom_deallocator_set): New.
4755 (malloc_state_machine::maybe_create_custom_deallocator_set): New.
4756 (malloc_state_machine::get_or_create_deallocator): New.
4757 (malloc_state_machine::on_stmt): Update for conversion from api
4758 to deallocator_set. Handle "__attribute__((malloc(FOO)))", and
4759 the special attribute set on FOO.
4760 (malloc_state_machine::on_allocator_call): Update for conversion
4761 from api to deallocator_set. Add "returns_nonnull" param and use
4762 it to affect which state to transition to.
4763 (malloc_state_machine::on_deallocator_call): Update for conversion
4764 from api to deallocator_set.
4766 2021-01-14 David Malcolm <dmalcolm@redhat.com>
4768 * engine.cc (strongly_connected_components::to_json): New.
4769 (worklist::to_json): New.
4770 (exploded_graph::to_json): JSON-ify the worklist.
4771 * exploded-graph.h (strongly_connected_components::to_json): New
4773 (worklist::to_json): New decl.
4774 * store.cc (store::to_json): Fix comment.
4775 * supergraph.cc (supernode::to_json): Fix reference to
4776 "returning_call" in comment. Add optional "fun" to JSON.
4777 (edge_kind_to_string): New.
4778 (superedge::to_json): Add "kind" to JSON.
4780 2021-01-14 David Malcolm <dmalcolm@redhat.com>
4783 * analyzer.h (region_offset::operator==): Make const.
4784 * pending-diagnostic.h (pending_diagnostic::equal_p): Likewise.
4785 * store.h (binding_cluster::for_each_value): Likewise.
4786 (binding_cluster::for_each_binding): Likewise.
4788 2021-01-12 David Malcolm <dmalcolm@redhat.com>
4791 * store.cc (binding_cluster::make_unknown_relative_to): Don't mark
4792 dereferenced unknown pointers as having escaped.
4794 2021-01-07 David Malcolm <dmalcolm@redhat.com>
4797 * region.cc (decl_region::get_svalue_for_initializer): Gracefully
4798 handle when LTO writes out DECL_INITIAL as error_mark_node.
4800 2021-01-07 David Malcolm <dmalcolm@redhat.com>
4803 * store.cc (binding_cluster::can_merge_p): Add "out_store" param
4804 and pass to calls to binding_cluster::make_unknown_relative_to.
4805 (binding_cluster::make_unknown_relative_to): Add "out_store"
4806 param. Use it to mark base regions that are pointed to by
4807 pointers that become unknown as having escaped.
4808 (store::can_merge_p): Pass out_store to
4809 binding_cluster::can_merge_p.
4810 * store.h (binding_cluster::can_merge_p): Add "out_store" param.
4811 (binding_cluster::make_unknown_relative_to): Likewise.
4812 * svalue.cc (region_svalue::implicitly_live_p): New vfunc.
4813 * svalue.h (region_svalue::implicitly_live_p): New vfunc decl.
4815 2021-01-07 David Malcolm <dmalcolm@redhat.com>
4818 * engine.cc (exploded_path::feasible_p): Add missing call to
4821 2021-01-06 David Malcolm <dmalcolm@redhat.com>
4824 * region-model-reachability.cc (reachable_regions::init_cluster):
4825 Convert symbolic region handling to a switch statement. Add cases
4826 to handle SK_UNKNOWN and SK_CONJURED.
4828 2021-01-05 David Malcolm <dmalcolm@redhat.com>
4831 * store.cc (binding_map::apply_ctor_to_region): When "index" is
4832 NULL, iterate through the fields for RECORD_TYPEs, rather than
4833 creating an INTEGER_CST index.
4835 2020-11-30 David Malcolm <dmalcolm@redhat.com>
4837 * analyzer-pass.cc: Include "analyzer/analyzer.h" for the
4838 declaration of sorry_no_analyzer; include "tree.h" and
4839 "function.h" as these are needed by it.
4841 2020-11-30 David Malcolm <dmalcolm@redhat.com>
4843 * analyzer-pass.cc (pass_analyzer::execute): Move sorry call to...
4844 (sorry_no_analyzer): New.
4845 * analyzer.h (class state_machine): New forward decl.
4846 (class logger): New forward decl.
4847 (class plugin_analyzer_init_iface): New.
4848 (sorry_no_analyzer): New decl.
4849 * checker-path.cc (checker_path::fixup_locations): New.
4850 * checker-path.h (checker_event::set_location): New.
4851 (checker_path::fixup_locations): New decl.
4852 * diagnostic-manager.cc
4853 (diagnostic_manager::emit_saved_diagnostic): Call
4854 checker_path::fixup_locations, and call fixup_location
4855 on the primary location.
4856 * engine.cc: Include "plugin.h".
4857 (class plugin_analyzer_init_impl): New.
4858 (impl_run_checkers): Invoke PLUGIN_ANALYZER_INIT callbacks.
4859 * pending-diagnostic.h (pending_diagnostic::fixup_location): New
4862 2020-11-18 David Malcolm <dmalcolm@redhat.com>
4865 * sm-malloc.cc (null_deref::emit): Use CWE-476 rather than
4866 CWE-690, as this isn't due to an unchecked return value.
4867 (null_arg::emit): Likewise.
4869 2020-11-12 David Malcolm <dmalcolm@redhat.com>
4871 * checker-path.h (checker_event::get_id_ptr): New.
4872 * diagnostic-manager.cc (path_builder::path_builder): Add "sd"
4873 param and use it to initialize new field "m_sd".
4874 (path_builder::get_pending_diagnostic): New.
4875 (path_builder::m_sd): New field.
4876 (diagnostic_manager::emit_saved_diagnostic): Pass sd to
4878 (diagnostic_manager::add_events_for_superedge): Call new
4879 maybe_add_custom_events_for_superedge vfunc.
4880 * engine.cc (stale_jmp_buf::stale_jmp_buf): Add "setjmp_point"
4881 param and use it to initialize new field "m_setjmp_point".
4882 Initialize new field "m_stack_pop_event".
4883 (stale_jmp_buf::maybe_add_custom_events_for_superedge): New vfunc
4885 (stale_jmp_buf::describe_final_event): New vfunc implementation.
4886 (stale_jmp_buf::m_setjmp_point): New field.
4887 (stale_jmp_buf::m_stack_pop_event): New field.
4888 (exploded_node::on_longjmp): Pass setjmp_point to stale_jmp_buf
4890 * pending-diagnostic.h
4891 (pending_diagnostic::maybe_add_custom_events_for_superedge): New
4894 2020-11-12 David Malcolm <dmalcolm@redhat.com>
4896 PR tree-optimization/97424
4897 * analyzer.opt (Wanalyzer-shift-count-negative): New.
4898 (Wanalyzer-shift-count-overflow): New.
4899 * region-model.cc (class shift_count_negative_diagnostic): New.
4900 (class shift_count_overflow_diagnostic): New.
4901 (region_model::get_gassign_result): Complain about shift counts that
4902 are negative or are >= the operand's type's width.
4904 2020-11-10 Martin Liska <mliska@suse.cz>
4906 * constraint-manager.cc (constraint_manager::merge): Remove
4908 * constraint-manager.h: Likewise.
4909 * program-state.cc (sm_state_map::sm_state_map): Likewise.
4910 (program_state::program_state): Likewise.
4911 (test_sm_state_map): Likewise.
4912 * program-state.h: Likewise.
4913 * region-model-reachability.cc (reachable_regions::reachable_regions): Likewise.
4914 * region-model-reachability.h: Likewise.
4915 * region-model.cc (region_model::handle_unrecognized_call): Likewise.
4916 (region_model::get_reachable_svalues): Likewise.
4917 (region_model::can_merge_with_p): Likewise.
4919 2020-11-05 David Malcolm <dmalcolm@redhat.com>
4922 * svalue.cc (cmp_cst): Handle COMPLEX_CST.
4924 2020-10-29 David Malcolm <dmalcolm@redhat.com>
4926 * program-state.cc (sm_state_map::on_liveness_change): Sort the
4927 leaking svalues before calling on_state_leak.
4928 (program_state::detect_leaks): Likewise when calling
4930 * region-model-reachability.cc
4931 (reachable_regions::mark_escaped_clusters): Likewise when
4932 calling on_escaped_function.
4934 2020-10-29 David Malcolm <dmalcolm@redhat.com>
4937 * region-model-reachability.cc (reachable_regions::handle_sval):
4938 Operands of reachable reversible operations are reachable.
4940 2020-10-29 David Malcolm <dmalcolm@redhat.com>
4942 * analyzer.h (class state_machine): New forward decl.
4943 (class logger): Likewise.
4944 (class visitor): Likewise.
4945 * complexity.cc: New file, taken from svalue.cc.
4946 * complexity.h: New file, taken from region-model.h.
4947 * region-model.h: Include "analyzer/svalue.h" and
4948 "analyzer/region.h". Move struct complexity to complexity.h.
4949 Move svalue, its subclasses and supporting decls to svalue.h.
4950 Move region, its subclasses and supporting decls to region.h.
4951 * region.cc: Include "analyzer/region.h".
4952 (symbolic_region::symbolic_region): Move here from region-model.h.
4953 * region.h: New file, based on material from region-model.h.
4954 * svalue.cc: Include "analyzer/svalue.h".
4955 (complexity::complexity): Move to complexity.cc.
4956 (complexity::from_pair): Likewise.
4957 * svalue.h: New file, based on material from region-model.h.
4959 2020-10-29 David Malcolm <dmalcolm@redhat.com>
4961 * program-state.cc (sm_state_map::print): Guard the printing of
4962 the origin pointer with !flag_dump_noaddr.
4963 * region.cc (string_region::dump_to_pp): Likewise for
4966 2020-10-27 David Malcolm <dmalcolm@redhat.com>
4969 * region-model.cc (region_model::get_initial_value_for_global):
4970 Move check that !DECL_EXTERNAL from here to...
4971 * region.cc (decl_region::get_svalue_for_initializer): ...here,
4972 using it to reject zero initialization.
4974 2020-10-27 Markus Böck <markus.boeck02@gmail.com>
4977 * store.h (hash): Cast to intptr_t instead of long
4979 2020-10-27 David Malcolm <dmalcolm@redhat.com>
4981 * constraint-manager.cc (svalue_cmp_by_ptr): Delete.
4982 (equiv_class::canonicalize): Use svalue::cmp_ptr_ptr instead.
4983 (equiv_class_cmp): Eliminate pointer comparison.
4984 * diagnostic-manager.cc (dedupe_key::comparator): If they are at
4985 the same location, also compare epath ength and pending_diagnostic
4987 * engine.cc (readability_comparator): If two path_vars have the
4988 same readability, then impose an arbitrary ordering on them.
4989 (worklist::key_t::cmp): If two points have the same plan ordering,
4990 continue the comparison. Call sm_state_map::cmp rather than
4991 comparing hash values.
4992 * program-state.cc (sm_state_map::entry_t::cmp): New.
4993 (sm_state_map::cmp): New.
4994 * program-state.h (sm_state_map::entry_t::cmp): New decl.
4995 (sm_state_map::elements): New.
4996 (sm_state_map::cmp): New.
4998 2020-10-27 David Malcolm <dmalcolm@redhat.com>
5000 * engine.cc (setjmp_record::cmp): New.
5001 (supernode_cluster::dump_dot): Avoid embedding pointer in cluster
5003 (supernode_cluster::cmp_ptr_ptr): New.
5004 (function_call_string_cluster::dump_dot): Avoid embedding pointer
5005 in cluster name. Sort m_map when dumping child clusters.
5006 (function_call_string_cluster::cmp_ptr_ptr): New.
5007 (root_cluster::dump_dot): Sort m_map when dumping child clusters.
5008 * program-point.cc (function_point::cmp): New.
5009 (function_point::cmp_ptr): New.
5010 * program-point.h (function_point::cmp): New decl.
5011 (function_point::cmp_ptr): New decl.
5012 * program-state.cc (sm_state_map::print): Sort the values. Guard
5013 the printing of pointers with !flag_dump_noaddr.
5014 (program_state::prune_for_point): Sort the regions.
5015 (log_set_of_svalues): Sort the values. Guard the printing of
5016 pointers with !flag_dump_noaddr.
5017 * region-model-manager.cc (log_uniq_map): Sort the values.
5018 * region-model-reachability.cc (dump_set): New function template.
5019 (reachable_regions::dump_to_pp): Use it.
5020 * region-model.h (svalue::cmp_ptr): New decl.
5021 (svalue::cmp_ptr_ptr): New decl.
5022 (setjmp_record::cmp): New decl.
5023 (placeholder_svalue::get_name): New accessor.
5024 (widening_svalue::get_point): New accessor.
5025 (compound_svalue::get_map): New accessor.
5026 (conjured_svalue::get_stmt): New accessor.
5027 (conjured_svalue::get_id_region): New accessor.
5028 (region::cmp_ptrs): Rename to...
5029 (region::cmp_ptr_ptr): ...this.
5030 * region.cc (region::cmp_ptrs): Rename to...
5031 (region::cmp_ptr_ptr): ...this.
5033 (state_purge_per_ssa_name::state_purge_per_ssa_name): Sort
5034 m_points_needing_name when dumping.
5035 * store.cc (concrete_binding::cmp_ptr_ptr): New.
5036 (symbolic_binding::cmp_ptr_ptr): New.
5037 (binding_map::cmp): New.
5038 (get_sorted_parent_regions): Update for renaming of
5039 region::cmp_ptrs to region::cmp_ptr_ptr.
5040 (store::dump_to_pp): Likewise.
5041 (store::to_json): Likewise.
5042 (store::can_merge_p): Sort the base regions before considering
5044 * store.h (concrete_binding::cmp_ptr_ptr): New decl.
5045 (symbolic_binding::cmp_ptr_ptr): New decl.
5046 (binding_map::cmp): New decl.
5047 * supergraph.cc (supergraph::supergraph): Assign UIDs to the
5049 * svalue.cc (cmp_cst): New.
5050 (svalue::cmp_ptr): New.
5051 (svalue::cmp_ptr_ptr): New.
5053 2020-10-27 David Malcolm <dmalcolm@redhat.com>
5055 * engine.cc (exploded_graph::get_or_create_node): Fix off-by-one
5056 when imposing param_analyzer_max_enodes_per_program_point limit.
5058 2020-10-27 David Malcolm <dmalcolm@redhat.com>
5060 * region-model.cc (region_model::get_representative_path_var):
5061 Implement case RK_LABEL.
5062 * region-model.h (label_region::get_label): New accessor.
5064 2020-10-22 David Malcolm <dmalcolm@redhat.com>
5067 * engine.cc (exploded_graph::add_function_entry): Handle failure
5068 to create an enode, rather than asserting.
5070 2020-10-22 David Malcolm <dmalcolm@redhat.com>
5073 * engine.cc (exploded_graph::add_function_entry): Assert that we
5074 have a function body.
5075 (exploded_graph::on_escaped_function): Reject fndecls that don't
5076 have a function body.
5078 2020-10-14 David Malcolm <dmalcolm@redhat.com>
5081 * region-model.cc (region_model::get_initial_value_for_global):
5082 Fall back to returning an initial_svalue if
5083 decl_region::get_svalue_for_initializer fails.
5084 * region.cc (decl_region::get_svalue_for_initializer): Don't
5085 attempt to create a compound_svalue if the region has an unknown
5088 2020-10-14 David Malcolm <dmalcolm@redhat.com>
5091 * store.cc (binding_map::apply_ctor_to_region): Remove redundant
5094 2020-10-12 David Malcolm <dmalcolm@redhat.com>
5097 * engine.cc (impl_region_model_context::on_escaped_function): New
5099 (exploded_graph::add_function_entry): Use m_functions_with_enodes
5100 to implement idempotency.
5101 (add_any_callbacks): New.
5102 (exploded_graph::build_initial_worklist): Use the above to find
5103 callbacks that are reachable from global initializers.
5104 (exploded_graph::on_escaped_function): New.
5106 (impl_region_model_context::on_escaped_function): New decl.
5107 (exploded_graph::on_escaped_function): New decl.
5108 (exploded_graph::m_functions_with_enodes): New field.
5109 * region-model-reachability.cc
5110 (reachable_regions::reachable_regions): Replace "store" param with
5111 "model" param; use it to initialize m_model.
5112 (reachable_regions::add): When getting the svalue for the region,
5113 call get_store_value on the model rather than using an initial
5115 (reachable_regions::mark_escaped_clusters): Add ctxt param and
5116 use it to call on_escaped_function when a function_region escapes.
5117 * region-model-reachability.h
5118 (reachable_regions::reachable_regions): Replace "store" param with
5120 (reachable_regions::mark_escaped_clusters): Add ctxt param.
5121 (reachable_regions::m_model): New field.
5122 * region-model.cc (region_model::handle_unrecognized_call): Update
5123 for change in reachable_regions ctor.
5124 (region_model::handle_unrecognized_call): Pass ctxt to
5125 mark_escaped_clusters.
5126 (region_model::get_reachable_svalues): Update for change in
5127 reachable_regions ctor.
5128 (region_model::get_initial_value_for_global): Read-only variables
5129 keep their initial values.
5130 * region-model.h (region_model_context::on_escaped_function): New
5132 (noop_region_model_context::on_escaped_function): New.
5134 2020-10-12 David Malcolm <dmalcolm@redhat.com>
5136 * analyzer.opt (Wanalyzer-write-to-const): New.
5137 (Wanalyzer-write-to-string-literal): New.
5138 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
5139 Call check_for_writable_region.
5140 (region_model::impl_call_memset): Likewise.
5141 (region_model::impl_call_strcpy): Likewise.
5142 * region-model.cc (class write_to_const_diagnostic): New.
5143 (class write_to_string_literal_diagnostic): New.
5144 (region_model::check_for_writable_region): New.
5145 (region_model::set_value): Call check_for_writable_region.
5146 * region-model.h (region_model::check_for_writable_region): New
5149 2020-10-07 David Malcolm <dmalcolm@redhat.com>
5152 * sm-malloc.cc (method_p): New.
5153 (describe_argument_index): New.
5154 (inform_nonnull_attribute): Use describe_argument_index.
5155 (possible_null_arg::describe_final_event): Likewise.
5156 (null_arg::describe_final_event): Likewise.
5158 2020-09-29 David Malcolm <dmalcolm@redhat.com>
5161 * engine.cc (stmt_requires_new_enode_p): Split enodes before
5164 2020-09-29 David Malcolm <dmalcolm@redhat.com>
5166 * constraint-manager.cc
5167 (constraint_manager::add_constraint_internal): Whitespace fixes.
5168 Silence -Wsign-compare warning.
5169 * engine.cc (maybe_process_run_of_before_supernode_enodes):
5170 Silence -Wsign-compare warning.
5172 2020-09-28 David Malcolm <dmalcolm@redhat.com>
5174 * region-model.h (binop_svalue::dyn_cast_binop_svalue): Remove
5175 redundant "virtual". Add FINAL OVERRIDE.
5176 (widening_svalue::dyn_cast_widening_svalue): Add FINAL OVERRIDE.
5177 (compound_svalue::dyn_cast_compound_svalue): Likewise.
5178 (conjured_svalue::dyn_cast_conjured_svalue): Likewise.
5180 2020-09-28 David Malcolm <dmalcolm@redhat.com>
5182 * diagnostic-manager.cc (null_assignment_sm_context::m_visitor):
5183 Remove unused field.
5185 2020-09-28 David Malcolm <dmalcolm@redhat.com>
5188 * analyzer.cc (is_longjmp_call_p): Require the initial argument
5190 * engine.cc (exploded_node::on_longjmp): Likewise.
5192 2020-09-28 David Malcolm <dmalcolm@redhat.com>
5194 * program-state.cc (sm_state_map::print): Update check
5195 for m_global_state being the start state.
5197 2020-09-26 David Malcolm <dmalcolm@redhat.com>
5201 * region-model.cc (region_model::get_representative_path_var):
5202 When handling offset_region, wrap the MEM_REF's first argument in
5203 an ADDR_EXPR of pointer type, rather than simply using the tree
5204 for the parent region. Require the MEM_REF's second argument to
5205 be an integer constant.
5207 2020-09-24 David Malcolm <dmalcolm@redhat.com>
5209 * analyzer.h (struct rejected_constraint): New decl.
5210 * analyzer.opt (fanalyzer-feasibility): New option.
5211 * diagnostic-manager.cc (path_builder::path_builder): Add
5212 "problem" param and use it to initialize new field.
5213 (path_builder::get_feasibility_problem): New accessor.
5214 (path_builder::m_feasibility_problem): New field.
5215 (dedupe_winners::add): Remove inversion of logic in "if" clause,
5216 swapping if/else suites. In the !feasible_p suite, inspect
5217 flag_analyzer_feasibility and add code to handle when this
5218 is off, accepting the infeasible path, but recording the
5219 feasibility_problem.
5220 (diagnostic_manager::emit_saved_diagnostic): Pass the
5221 feasibility_problem to the path_builder.
5222 (diagnostic_manager::add_events_for_eedge): If we have
5223 a feasibility_problem at this edge, use it to add a custom event.
5224 * engine.cc (exploded_path::feasible_p): Pass a
5225 rejected_constraint ** to model.maybe_update_for_edge and transfer
5226 ownership of any created instance to any feasibility_problem.
5227 (feasibility_problem::dump_to_pp): New.
5228 * exploded-graph.h (feasibility_problem::feasibility_problem):
5229 Drop "model" param; add rejected_constraint * param.
5230 (feasibility_problem::~feasibility_problem): New.
5231 (feasibility_problem::dump_to_pp): New decl.
5232 (feasibility_problem::m_model): Drop field.
5233 (feasibility_problem::m_rc): New field.
5234 * program-point.cc (function_point::get_location): Handle
5235 PK_BEFORE_SUPERNODE and PK_AFTER_SUPERNODE.
5236 * program-state.cc (program_state::on_edge): Pass NULL to new
5237 param of region_model::maybe_update_for_edge.
5238 * region-model.cc (region_model::add_constraint): New overload
5239 adding a rejected_constraint ** param.
5240 (region_model::maybe_update_for_edge): Add rejected_constraint **
5241 param and pass it to the various apply_constraints_for_ calls.
5242 (region_model::apply_constraints_for_gcond): Add
5243 rejected_constraint ** param and pass it to add_constraint calls.
5244 (region_model::apply_constraints_for_gswitch): Likewise.
5245 (region_model::apply_constraints_for_exception): Likewise.
5246 (rejected_constraint::dump_to_pp): New.
5247 * region-model.h (region_model::maybe_update_for_edge):
5248 Add rejected_constraint ** param.
5249 (region_model::add_constraint): New overload adding a
5250 rejected_constraint ** param.
5251 (region_model::apply_constraints_for_gcond): Add
5252 rejected_constraint ** param.
5253 (region_model::apply_constraints_for_gswitch): Likewise.
5254 (region_model::apply_constraints_for_exception): Likewise.
5255 (struct rejected_constraint): New.
5257 2020-09-23 David Malcolm <dmalcolm@redhat.com>
5260 * engine.cc (impl_run_checkers): Update for change to ext_state
5262 * program-state.cc (selftest::test_sm_state_map): Pass an engine
5263 instance to ext_state ctor.
5264 (selftest::test_program_state_1): Likewise.
5265 (selftest::test_program_state_2): Likewise.
5266 (selftest::test_program_state_merging): Likewise.
5267 (selftest::test_program_state_merging_2): Likewise.
5268 * program-state.h (extrinsic_state::extrinsic_state): Remove NULL
5269 default value for "eng" param.
5271 2020-09-23 Tobias Burnus <tobias@codesourcery.com>
5273 * analyzer-logging.cc: Guard '#pragma ... ignored "-Wformat-diag"'
5274 by '#if __GNUC__ >= 10'
5275 * analyzer.h: Likewise.
5276 * call-string.cc: Likewise.
5278 2020-09-23 David Malcolm <dmalcolm@redhat.com>
5280 * engine.cc (exploded_node::on_stmt): Replace sequence of dyn_cast
5283 2020-09-22 David Malcolm <dmalcolm@redhat.com>
5285 * analysis-plan.cc: Include "json.h".
5286 * analyzer.opt (fdump-analyzer-json): New.
5287 * call-string.cc: Include "json.h".
5288 (call_string::to_json): New.
5289 * call-string.h (call_string::to_json): New decl.
5290 * checker-path.cc: Include "json.h".
5291 * constraint-manager.cc: Include "json.h".
5292 (equiv_class::to_json): New.
5293 (constraint::to_json): New.
5294 (constraint_manager::to_json): New.
5295 * constraint-manager.h (equiv_class::to_json): New decl.
5296 (constraint::to_json): New decl.
5297 (constraint_manager::to_json): New decl.
5298 * diagnostic-manager.cc: Include "json.h".
5299 (saved_diagnostic::to_json): New.
5300 (diagnostic_manager::to_json): New.
5301 * diagnostic-manager.h (saved_diagnostic::to_json): New decl.
5302 (diagnostic_manager::to_json): New decl.
5303 * engine.cc: Include "json.h", <zlib.h>.
5304 (exploded_node::status_to_str): New.
5305 (exploded_node::to_json): New.
5306 (exploded_edge::to_json): New.
5307 (exploded_graph::to_json): New.
5308 (dump_analyzer_json): New.
5309 (impl_run_checkers): Call it.
5310 * exploded-graph.h (exploded_node::status_to_str): New decl.
5311 (exploded_node::to_json): New.
5312 (exploded_edge::to_json): New.
5313 (exploded_graph::to_json): New.
5314 * pending-diagnostic.cc: Include "json.h".
5315 * program-point.cc: Include "json.h".
5316 (program_point::to_json): New.
5317 * program-point.h (program_point::to_json): New decl.
5318 * program-state.cc: Include "json.h".
5319 (extrinsic_state::to_json): New.
5320 (sm_state_map::to_json): New.
5321 (program_state::to_json): New.
5322 * program-state.h (extrinsic_state::to_json): New decl.
5323 (sm_state_map::to_json): New decl.
5324 (program_state::to_json): New decl.
5325 * region-model-impl-calls.cc: Include "json.h".
5326 * region-model-manager.cc: Include "json.h".
5327 * region-model-reachability.cc: Include "json.h".
5328 * region-model.cc: Include "json.h".
5329 * region-model.h (svalue::to_json): New decl.
5330 (region::to_json): New decl.
5331 * region.cc: Include "json.h".
5332 (region::to_json: New.
5333 * sm-file.cc: Include "json.h".
5334 * sm-malloc.cc: Include "json.h".
5335 * sm-pattern-test.cc: Include "json.h".
5336 * sm-sensitive.cc: Include "json.h".
5337 * sm-signal.cc: Include "json.h".
5338 (signal_delivery_edge_info_t::to_json): New.
5339 * sm-taint.cc: Include "json.h".
5340 * sm.cc: Include "diagnostic.h", "tree-diagnostic.h", and
5342 (state_machine::state::to_json): New.
5343 (state_machine::to_json): New.
5344 * sm.h (state_machine::state::to_json): New.
5345 (state_machine::to_json): New.
5346 * state-purge.cc: Include "json.h".
5347 * store.cc: Include "json.h".
5348 (binding_key::get_desc): New.
5349 (binding_map::to_json): New.
5350 (binding_cluster::to_json): New.
5351 (store::to_json): New.
5352 * store.h (binding_key::get_desc): New decl.
5353 (binding_map::to_json): New decl.
5354 (binding_cluster::to_json): New decl.
5355 (store::to_json): New decl.
5356 * supergraph.cc: Include "json.h".
5357 (supergraph::to_json): New.
5358 (supernode::to_json): New.
5359 (superedge::to_json): New.
5360 * supergraph.h (supergraph::to_json): New decl.
5361 (supernode::to_json): New decl.
5362 (superedge::to_json): New decl.
5363 * svalue.cc: Include "json.h".
5364 (svalue::to_json): New.
5366 2020-09-21 David Malcolm <dmalcolm@redhat.com>
5369 * region-model-impl-calls.cc (call_details::get_arg_type): New.
5370 * region-model.cc (region_model::on_call_pre): Check that the
5371 initial arg is a pointer before calling impl_call_memset and
5373 * region-model.h (call_details::get_arg_type): New decl.
5375 2020-09-21 David Malcolm <dmalcolm@redhat.com>
5378 * sm-malloc.cc (malloc_state_machine::get_default_state): Look at
5379 the base region when considering pointers. Treat pointers to
5380 decls as being non-heap.
5382 2020-09-18 David Malcolm <dmalcolm@redhat.com>
5384 * checker-path.cc (warning_event::get_desc): Handle global state
5387 2020-09-18 David Malcolm <dmalcolm@redhat.com>
5389 * sm-malloc.cc (malloc_state_machine::on_stmt): Handle strdup and
5390 strndup as being malloc-like allocators.
5392 2020-09-16 David Malcolm <dmalcolm@redhat.com>
5394 * engine.cc (strongly_connected_components::strong_connect): Only
5395 consider intraprocedural edges when creating SCCs.
5396 (worklist::key_t::cmp): Add comment. Treat call_string
5397 differences as more important than differences of program_point
5400 2020-09-16 David Malcolm <dmalcolm@redhat.com>
5402 * engine.cc (supernode_cluster::dump_dot): Show the SCC id
5403 in the per-supernode clusters in FILENAME.eg.dot output.
5404 (exploded_graph_annotator::add_node_annotations):
5405 Show the SCC of the supernode in FILENAME.supernode.eg.dot output.
5406 * exploded-graph.h (worklist::scc_id): New.
5407 (exploded_graph::get_scc_id): New.
5409 2020-09-16 David Malcolm <dmalcolm@redhat.com>
5411 * engine.cc (exploded_node::dump_dot): Show STATUS_BULK_MERGED.
5412 (exploded_graph::process_worklist): Call
5413 maybe_process_run_of_before_supernode_enodes.
5414 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
5416 (exploded_graph_annotator::print_enode): Show STATUS_BULK_MERGED.
5417 * exploded-graph.h (enum exploded_node::status): Add
5420 2020-09-16 David Malcolm <dmalcolm@redhat.com>
5423 (exploded_graph::process_node) <case PK_BEFORE_SUPERNODE>:
5424 Simplify by using program_point::get_next.
5425 * program-point.cc (program_point::get_next): New.
5426 * program-point.h (program_point::get_next): New decl.
5428 2020-09-16 David Malcolm <dmalcolm@redhat.com>
5430 * engine.cc (exploded_graph::get_or_create_node): Show the
5431 program point when issuing -Wanalyzer-too-complex due to hitting
5432 the per-program-point limit.
5434 2020-09-16 David Malcolm <dmalcolm@redhat.com>
5436 * region-model.cc (region_model::on_call_pre): Treat getchar as
5437 having no side-effects.
5439 2020-09-15 David Malcolm <dmalcolm@redhat.com>
5442 * constraint-manager.cc (merger_fact_visitor::on_fact): Replace
5443 assertion that add_constraint succeeded with an assertion that
5444 if it fails, -fanalyzer-transitivity is off.
5446 2020-09-14 David Malcolm <dmalcolm@redhat.com>
5448 * analyzer.opt (-param=analyzer-max-constraints=): New param.
5449 * constraint-manager.cc
5450 (constraint_manager::add_constraint_internal): Silently reject
5451 attempts to add constraints when the above limit is reached.
5453 2020-09-14 David Malcolm <dmalcolm@redhat.com>
5456 * constraint-manager.cc
5457 (constraint_manager::get_or_add_equiv_class): Don't accumulate
5458 transitive closure of all constraints on constants.
5460 2020-09-14 David Malcolm <dmalcolm@redhat.com>
5463 * analyzer.cc (is_setjmp_call_p): Require the initial arg to be a
5465 * region-model.cc (region_model::deref_rvalue): Assert that the
5466 svalue is of pointer type.
5468 2020-09-11 David Malcolm <dmalcolm@redhat.com>
5471 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
5473 (region_model::impl_call_strcpy): New.
5474 * region-model.cc (region_model::on_call_pre): Flag unhandled
5475 builtins that are non-pure as having unknown side-effects.
5476 Implement BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_STRCPY,
5477 BUILT_IN_STRCPY_CHK, BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED,
5478 BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_FPUTC,
5479 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
5480 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
5481 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR,
5482 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED,
5483 BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF.
5484 * region-model.h (region_model::impl_call_memcpy): New decl.
5485 (region_model::impl_call_strcpy): New decl.
5487 2020-09-09 David Malcolm <dmalcolm@redhat.com>
5490 * analyzer.opt (Wanalyzer-mismatching-deallocation): New warning.
5491 * region-model-impl-calls.cc
5492 (region_model::impl_call_operator_new): New.
5493 (region_model::impl_call_operator_delete): New.
5494 * region-model.cc (region_model::on_call_pre): Detect operator new
5495 and operator delete.
5496 (region_model::on_call_post): Likewise.
5497 (region_model::maybe_update_for_edge): Detect EH edges and call...
5498 (region_model::apply_constraints_for_exception): New function.
5499 * region-model.h (region_model::impl_call_operator_new): New decl.
5500 (region_model::impl_call_operator_delete): New decl.
5501 (region_model::apply_constraints_for_exception): New decl.
5502 * sm-malloc.cc (enum resource_state): New.
5503 (struct allocation_state): New state subclass.
5504 (enum wording): New.
5506 (malloc_state_machine::custom_data_t): New typedef.
5507 (malloc_state_machine::add_state): New decl.
5508 (malloc_state_machine::m_unchecked)
5509 (malloc_state_machine::m_nonnull)
5510 (malloc_state_machine::m_freed): Delete these states in favor
5512 (malloc_state_machine::m_malloc)
5513 (malloc_state_machine::m_scalar_new)
5514 (malloc_state_machine::m_vector_new): ...this new api instances,
5515 which own their own versions of these states.
5516 (malloc_state_machine::on_allocator_call): New decl.
5517 (malloc_state_machine::on_deallocator_call): New decl.
5518 (api::api): New ctor.
5519 (dyn_cast_allocation_state): New.
5520 (as_a_allocation_state): New.
5525 (malloc_diagnostic::describe_state_change): Use unchecked_p and
5527 (class mismatching_deallocation): New.
5528 (double_free::double_free): Add funcname param for initializing
5530 (double_free::emit): Use m_funcname in warning message rather
5531 than hardcoding "free".
5532 (double_free::describe_state_change): Likewise. Use freed_p.
5533 (double_free::describe_call_with_state): Use freed_p.
5534 (double_free::describe_final_event): Use m_funcname in message
5535 rather than hardcoding "free".
5536 (double_free::m_funcname): New field.
5537 (possible_null::describe_state_change): Use unchecked_p.
5538 (possible_null::describe_return_of_state): Likewise.
5539 (use_after_free::use_after_free): Add param for initializing m_api.
5540 (use_after_free::emit): Use m_api->m_dealloc_funcname in message
5541 rather than hardcoding "free".
5542 (use_after_free::describe_state_change): Use freed_p. Change the
5543 wording of the message based on the API.
5544 (use_after_free::describe_final_event): Use
5545 m_api->m_dealloc_funcname in message rather than hardcoding
5546 "free". Change the wording of the message based on the API.
5547 (use_after_free::m_api): New field.
5548 (malloc_leak::describe_state_change): Use unchecked_p. Update
5549 for renaming of m_malloc_event to m_alloc_event.
5550 (malloc_leak::describe_final_event): Update for renaming of
5551 m_malloc_event to m_alloc_event.
5552 (malloc_leak::m_malloc_event): Rename...
5553 (malloc_leak::m_alloc_event): ...to this.
5554 (free_of_non_heap::free_of_non_heap): Add param for initializing
5556 (free_of_non_heap::emit): Use m_funcname in message rather than
5558 (free_of_non_heap::describe_final_event): Likewise.
5559 (free_of_non_heap::m_funcname): New field.
5560 (allocation_state::dump_to_pp): New.
5561 (allocation_state::get_nonnull): New.
5562 (malloc_state_machine::malloc_state_machine): Update for changes
5563 to state fields and new api fields.
5564 (malloc_state_machine::add_state): New.
5565 (malloc_state_machine::on_stmt): Move malloc/calloc handling to
5566 on_allocator_call and call it, passing in the API pointer.
5567 Likewise for free, moving it to on_deallocator_call. Handle calls
5568 to operator new and delete in an analogous way. Use unchecked_p
5569 when testing for possibly-null-arg and possibly-null-deref, and
5570 transition to the non-null for the correct API. Remove redundant
5571 node param from call to on_zero_assignment. Use freed_p for
5572 use-after-free check, and pass in API.
5573 (malloc_state_machine::on_allocator_call): New, based on code in
5575 (malloc_state_machine::on_deallocator_call): Likewise.
5576 (malloc_state_machine::on_phi): Mark node param with
5577 ATTRIBUTE_UNUSED; don't pass it to on_zero_assignment.
5578 (malloc_state_machine::on_condition): Mark node param with
5579 ATTRIBUTE_UNUSED. Replace on_transition calls with get_state and
5580 set_next_state pairs, transitioning to the non-null state for the
5582 (malloc_state_machine::can_purge_p): Port to new state approach.
5583 (malloc_state_machine::on_zero_assignment): Replace on_transition
5584 calls with get_state and set_next_state pairs. Drop redundant
5586 * sm.h (state_machine::add_custom_state): New.
5588 2020-09-09 David Malcolm <dmalcolm@redhat.com>
5590 * diagnostic-manager.cc
5591 (null_assignment_sm_context::warn_for_state): Replace with...
5592 (null_assignment_sm_context::warn): ...this.
5593 * engine.cc (impl_sm_context::warn_for_state): Replace with...
5594 (impl_sm_context::warn): ...this.
5595 * sm-file.cc (fileptr_state_machine::on_stmt): Replace
5596 warn_for_state and on_transition calls with a get_state
5597 test guarding warn and set_next_state calls.
5598 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
5599 * sm-pattern-test.cc (pattern_test_state_machine::on_condition):
5600 Replace warn_for_state call with warn call.
5602 (sensitive_state_machine::warn_for_any_exposure): Replace
5603 warn_for_state call with a get_state test guarding a warn call.
5604 * sm-signal.cc (signal_state_machine::on_stmt): Likewise.
5605 * sm-taint.cc (taint_state_machine::on_stmt): Replace
5606 warn_for_state and on_transition calls with a get_state
5607 test guarding warn and set_next_state calls.
5608 * sm.h (sm_context::warn_for_state): Replace with...
5609 (sm_context::warn): ...this.
5611 2020-09-09 David Malcolm <dmalcolm@redhat.com>
5613 * diagnostic-manager.cc
5614 (null_assignment_sm_context::null_assignment_sm_context): Add old_state
5615 and ext_state params, initializing m_old_state and m_ext_state.
5616 (null_assignment_sm_context::on_transition): Split into...
5617 (null_assignment_sm_context::get_state): ...this new vfunc
5618 implementation and...
5619 (null_assignment_sm_context::set_next_state): ...this new vfunc
5621 (null_assignment_sm_context::m_old_state): New field.
5622 (null_assignment_sm_context::m_ext_state): New field.
5623 (diagnostic_manager::add_events_for_eedge): Pass in old state and
5624 ext_state when creating sm_ctxt.
5625 * engine.cc (impl_sm_context::on_transition): Split into...
5626 (impl_sm_context::get_state): ...this new vfunc
5627 implementation and...
5628 (impl_sm_context::set_next_state): ...this new vfunc
5630 * sm.h (sm_context::get_state): New pure virtual function.
5631 (sm_context::set_next_state): Likewise.
5632 (sm_context::on_transition): Convert from a pure virtual function
5633 to a regular function implemented in terms of get_state and
5636 2020-09-09 David Malcolm <dmalcolm@redhat.com>
5638 * checker-path.cc (state_change_event::get_desc): Update
5639 state_machine::get_state_name calls to state::get_name.
5640 (warning_event::get_desc): Likewise.
5641 * diagnostic-manager.cc
5642 (null_assignment_sm_context::on_transition): Update comparison
5643 against 0 with comparison with m_sm.get_start_state.
5644 (diagnostic_manager::prune_for_sm_diagnostic): Update
5645 state_machine::get_state_name calls to state::get_name.
5646 * engine.cc (impl_sm_context::on_transition): Likewise.
5647 (exploded_node::get_dot_fillcolor): Use get_id when summing
5649 * program-state.cc (sm_state_map::sm_state_map): Don't hardcode
5650 0 as the start state when initializing m_global_state.
5651 (sm_state_map::print): Use dump_to_pp rather than get_state_name
5652 when dumping states.
5653 (sm_state_map::is_empty_p): Don't hardcode 0 as the start state
5654 when examining m_global_state.
5655 (sm_state_map::hash): Use get_id when hashing states.
5656 (selftest::test_sm_state_map): Use state objects rather than
5657 arbitrary hardcoded integers.
5658 (selftest::test_program_state_merging): Likewise.
5659 (selftest::test_program_state_merging_2): Likewise.
5660 * sm-file.cc (fileptr_state_machine::m_start): Move to base class.
5661 (file_diagnostic::describe_state_change): Use get_start_state.
5662 (fileptr_state_machine::fileptr_state_machine): Drop m_start
5664 * sm-malloc.cc (malloc_state_machine::m_start): Move to base
5666 (malloc_diagnostic::describe_state_change): Use get_start_state.
5667 (possible_null::describe_state_change): Likewise.
5668 (malloc_state_machine::malloc_state_machine): Drop m_start
5670 * sm-pattern-test.cc (pattern_test_state_machine::m_start): Move
5672 (pattern_test_state_machine::pattern_test_state_machine): Drop
5673 m_start initialization.
5674 * sm-sensitive.cc (sensitive_state_machine::m_start): Move to base
5676 (sensitive_state_machine::sensitive_state_machine): Drop m_start
5678 * sm-signal.cc (signal_state_machine::m_start): Move to base
5680 (signal_state_machine::signal_state_machine): Drop m_start
5682 * sm-taint.cc (taint_state_machine::m_start): Move to base class.
5683 (taint_state_machine::taint_state_machine): Drop m_start
5685 * sm.cc (state_machine::state::dump_to_pp): New.
5686 (state_machine::state_machine): Move here from sm.h. Initialize
5687 m_next_state_id and m_start.
5688 (state_machine::add_state): Reimplement in terms of state objects.
5689 (state_machine::get_state_name): Delete.
5690 (state_machine::get_state_by_name): Reimplement in terms of state
5691 objects. Make const.
5692 (state_machine::validate): Delete.
5693 (state_machine::dump_to_pp): Reimplement in terms of state
5695 * sm.h (state_machine::state): New class.
5696 (state_machine::state_t): Convert typedef from "unsigned" to
5697 "const state_machine::state *".
5698 (state_machine::state_machine): Move to sm.cc.
5699 (state_machine::get_default_state): Use m_start rather than
5701 (state_machine::get_state_name): Delete.
5702 (state_machine::get_state_by_name): Make const.
5703 (state_machine::get_start_state): New accessor.
5704 (state_machine::alloc_state_id): New.
5705 (state_machine::m_state_names): Drop in favor of...
5706 (state_machine::m_states): New field
5707 (state_machine::m_start): New field
5708 (start_start_p): Delete.
5710 2020-09-08 David Malcolm <dmalcolm@redhat.com>
5713 * store.cc (binding_map::apply_ctor_val_to_range): Add
5714 error-handling for the cases where we have symbolic offsets.
5716 2020-09-08 David Malcolm <dmalcolm@redhat.com>
5719 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
5720 where min_index == max_index.
5721 (binding_map::apply_ctor_val_to_range): Replace assertion that we
5722 don't have a CONSTRUCTOR value with error-handling.
5724 2020-09-08 David Malcolm <dmalcolm@redhat.com>
5727 * region-model.cc (region_model::on_call_pre): Fix guard on switch
5728 on built-ins to only consider BUILT_IN_NORMAL, rather than other
5731 2020-09-01 David Malcolm <dmalcolm@redhat.com>
5734 * region-model.cc (region_model::deref_rvalue): Add the constraint
5735 that PTR_SVAL is non-NULL.
5737 2020-08-31 David Malcolm <dmalcolm@redhat.com>
5740 * region-model.cc (region_model::on_call_pre): Handle
5741 BUILT_IN_MEMSET_CHK.
5743 2020-08-31 David Malcolm <dmalcolm@redhat.com>
5745 * region-model.cc (region_model::on_call_pre): Gather handling of
5746 builtins and of internal fns into switch statements. Handle
5747 "alloca" and BUILT_IN_ALLOCA_WITH_ALIGN.
5749 2020-08-31 David Malcolm <dmalcolm@redhat.com>
5752 * region.cc (decl_region::get_svalue_for_constructor): Support
5753 apply_ctor_to_region failing.
5754 * store.cc (binding_map::apply_ctor_to_region): Add failure
5756 (binding_map::apply_ctor_val_to_range): Likewise.
5757 (binding_map::apply_ctor_pair_to_child_region): Likewise. Replace
5758 assertion that child_base_offset is not symbolic with error
5760 * store.h (binding_map::apply_ctor_to_region): Convert return type
5762 (binding_map::apply_ctor_val_to_range): Likewise.
5763 (binding_map::apply_ctor_pair_to_child_region): Likewise.
5765 2020-08-31 David Malcolm <dmalcolm@redhat.com>
5768 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
5769 by calling a new binding_map::apply_ctor_val_to_range subroutine.
5770 Split out the existing non-CONSTRUCTOR-handling code to a new
5771 apply_ctor_pair_to_child_region subroutine.
5772 (binding_map::apply_ctor_val_to_range): New.
5773 (binding_map::apply_ctor_pair_to_child_region): New, split out
5774 from binding_map::apply_ctor_to_region as noted above.
5775 * store.h (binding_map::apply_ctor_val_to_range): New decl.
5776 (binding_map::apply_ctor_pair_to_child_region): New decl.
5778 2020-08-31 David Malcolm <dmalcolm@redhat.com>
5781 * region-model-manager.cc
5782 (region_model_manager::maybe_fold_unaryop): Handle VIEW_CONVERT_EXPR.
5783 (region_model_manager::get_or_create_cast): Move logic for
5784 real->integer casting to...
5785 (get_code_for_cast): ...this new function, and add logic for
5786 real->non-integer casts.
5787 (region_model_manager::maybe_fold_sub_svalue): Handle
5790 (region_model::add_any_constraints_from_gassign): Likewise.
5791 * svalue.cc (svalue::maybe_undo_cast): Likewise.
5792 (unaryop_svalue::dump_to_pp): Likewise.
5794 2020-08-26 David Malcolm <dmalcolm@redhat.com>
5797 * region-model-manager.cc
5798 (region_model_manager::get_or_create_widening_svalue): Assert that
5799 neither of the inputs are themselves widenings.
5800 * store.cc (store::eval_alias_1): The initial value of a pointer
5801 can't point to a region that was allocated on the heap after the
5802 beginning of the path. A widened pointer value can't alias anything
5803 that the initial pointer value can't alias.
5804 * svalue.cc (svalue::can_merge_p): Merge BINOP (X, OP, CST) with X
5805 to a widening svalue. Merge
5806 BINOP(WIDENING(BASE, BINOP(BASE, X)), X) and BINOP(BASE, X) to
5807 to the LHS of the first BINOP.
5809 2020-08-26 David Malcolm <dmalcolm@redhat.com>
5812 * region-model.h (class compound_svalue): Document that all keys
5814 (compound_svalue::compound_svalue): Move definition to svalue.cc.
5815 * store.cc (binding_map::apply_ctor_to_region): Handle
5816 initializers for trailing arrays with incomplete size.
5817 * svalue.cc (compound_svalue::compound_svalue): Move definition
5818 here from region-model.h. Add assertion that all keys are
5821 2020-08-22 David Malcolm <dmalcolm@redhat.com>
5824 * region-model-manager.cc
5825 (region_model_manager::maybe_fold_binop): Fold bitwise "& 0" to 0.
5827 2020-08-22 David Malcolm <dmalcolm@redhat.com>
5829 * store.cc (store::eval_alias): Make const. Split out 2nd half
5830 into store::eval_alias_1 and call it twice for symmetry, avoiding
5832 (store::eval_alias_1): New function, split out from the above.
5833 * store.h (store::eval_alias): Make const.
5834 (store::eval_alias_1): New decl.
5836 2020-08-22 David Malcolm <dmalcolm@redhat.com>
5838 * region-model.cc (region_model::push_frame): Bind the default
5839 SSA name for each parm if it exists, falling back to the parm
5840 itself otherwise, rather than doing both.
5842 2020-08-20 David Malcolm <dmalcolm@redhat.com>
5845 * region-model-manager.cc
5846 (region_model_manager::get_field_region): Assert that field is a
5848 * region.cc (region::get_subregions_for_binding): In
5849 union-handling, filter the TYPE_FIELDS traversal to just FIELD_DECLs.
5851 2020-08-20 David Malcolm <dmalcolm@redhat.com>
5854 * region-model.cc (region_model::get_gassign_result): For
5855 comparisons, only use eval_condition when the lhs has boolean
5856 type, and use get_or_create_constant_svalue on the boolean
5857 constants directly rather than via get_rvalue.
5859 2020-08-19 David Malcolm <dmalcolm@redhat.com>
5862 * region-model.cc (region_model::deref_rvalue): Rather than
5863 attempting to handle all svalue kinds in the switch, only cover
5864 the special cases, and move symbolic-region handling to after
5865 the switch, thus implicitly handling the missing case SK_COMPOUND.
5867 2020-08-19 David Malcolm <dmalcolm@redhat.com>
5870 * region-model-manager.cc
5871 (region_model_manager::maybe_fold_binop): Check that we have an
5872 integral type before calling build_int_cst.
5874 2020-08-19 David Malcolm <dmalcolm@redhat.com>
5877 * region-model-manager.cc
5878 (region_model_manager::get_or_create_cast): Use FIX_TRUNC_EXPR for
5879 casting from REAL_TYPE to INTEGER_TYPE.
5881 2020-08-19 David Malcolm <dmalcolm@redhat.com>
5884 * region-model.cc (region_model::called_from_main_p): New.
5885 (region_model::get_store_value): Move handling for globals into...
5886 (region_model::get_initial_value_for_global): ...this new
5887 function, and add logic for extracting values from decl
5889 * region-model.h (decl_region::get_svalue_for_constructor): New
5891 (decl_region::get_svalue_for_initializer): New decl.
5892 (region_model::called_from_main_p): New decl.
5893 (region_model::get_initial_value_for_global): New.
5894 * region.cc (decl_region::maybe_get_constant_value): Move logic
5895 for getting an svalue from a CONSTRUCTOR node to...
5896 (decl_region::get_svalue_for_constructor): ...this new function.
5897 (decl_region::get_svalue_for_initializer): New.
5898 * store.cc (get_svalue_for_ctor_val): Rewrite in terms of
5899 region_model::get_rvalue.
5900 * store.h (binding_cluster::get_map): New accessor.
5902 2020-08-19 David Malcolm <dmalcolm@redhat.com>
5905 * region.cc (get_field_at_bit_offset): Gracefully handle negative
5906 values for bit_offset.
5908 2020-08-18 David Malcolm <dmalcolm@redhat.com>
5910 * region-model.cc (region_model::get_rvalue_1): Fix name of local.
5912 2020-08-18 David Malcolm <dmalcolm@redhat.com>
5915 * region-model.cc (region_model::get_rvalue_1): Handle
5916 unrecognized tree codes by returning "UNKNOWN.
5918 2020-08-18 David Malcolm <dmalcolm@redhat.com>
5921 * region-model.cc (region_model::get_gassign_result): Handle various
5922 VEC_* tree codes by returning UNKNOWN.
5923 (region_model::on_assignment): Handle unrecognized tree codes by
5924 setting lhs to an unknown value, rather than issuing a "sorry" and
5927 2020-08-17 David Malcolm <dmalcolm@redhat.com>
5930 * region-model-manager.cc (get_region_for_unexpected_tree_code):
5931 Handle ctxt being NULL.
5933 2020-08-17 David Malcolm <dmalcolm@redhat.com>
5936 * region.cc (region::get_subregions_for_binding): Check for "type"
5939 2020-08-17 David Malcolm <dmalcolm@redhat.com>
5942 * store.cc (get_svalue_for_ctor_val): New.
5943 (binding_map::apply_ctor_to_region): Call it.
5945 2020-08-14 David Malcolm <dmalcolm@redhat.com>
5949 * region-model.cc (region_model::get_store_value): Call
5950 maybe_get_constant_value on decl_regions first.
5951 * region-model.h (decl_region::maybe_get_constant_value): New decl.
5952 * region.cc (decl_region::get_stack_depth): Likewise.
5953 (decl_region::maybe_get_constant_value): New.
5954 * store.cc (get_subregion_within_ctor): New.
5955 (binding_map::apply_ctor_to_region): New.
5956 * store.h (binding_map::apply_ctor_to_region): New decl.
5958 2020-08-14 David Malcolm <dmalcolm@redhat.com>
5961 * store.cc (store::mark_as_escaped): Reject attempts to
5962 get a cluster for an unknown pointer.
5964 2020-08-13 David Malcolm <dmalcolm@redhat.com>
5980 * analyzer-logging.cc: Ignore "-Wformat-diag".
5981 (logger::enter_scope): Use inc_indent in both overloads.
5982 (logger::exit_scope): Use dec_indent.
5983 * analyzer-logging.h (logger::inc_indent): New.
5984 (logger::dec_indent): New.
5985 * analyzer-selftests.cc (run_analyzer_selftests): Call
5986 analyzer_store_cc_tests.
5987 * analyzer-selftests.h (analyzer_store_cc_tests): New decl.
5988 * analyzer.cc (get_stmt_location): New function.
5989 * analyzer.h (class initial_svalue): New forward decl.
5990 (class unaryop_svalue): New forward decl.
5991 (class binop_svalue): New forward decl.
5992 (class sub_svalue): New forward decl.
5993 (class unmergeable_svalue): New forward decl.
5994 (class placeholder_svalue): New forward decl.
5995 (class widening_svalue): New forward decl.
5996 (class compound_svalue): New forward decl.
5997 (class conjured_svalue): New forward decl.
5998 (svalue_set): New typedef.
5999 (class map_region): Delete.
6000 (class array_region): Delete.
6001 (class frame_region): New forward decl.
6002 (class function_region): New forward decl.
6003 (class label_region): New forward decl.
6004 (class decl_region): New forward decl.
6005 (class element_region): New forward decl.
6006 (class offset_region): New forward decl.
6007 (class cast_region): New forward decl.
6008 (class field_region): New forward decl.
6009 (class string_region): New forward decl.
6010 (class region_model_manager): New forward decl.
6011 (class store_manager): New forward decl.
6012 (class store): New forward decl.
6013 (class call_details): New forward decl.
6014 (struct svalue_id_merger_mapping): Delete.
6015 (struct canonicalization): Delete.
6016 (class function_point): New forward decl.
6017 (class engine): New forward decl.
6018 (dump_tree): New function decl.
6019 (print_quoted_type): New function decl.
6020 (readability_comparator): New function decl.
6021 (tree_cmp): New function decl.
6022 (class path_var): Move here from region-model.h
6023 (bit_offset_t, bit_size_t, byte_size_t): New typedefs.
6024 (class region_offset): New class.
6025 (get_stmt_location): New decl.
6026 (struct member_function_hash_traits): New struct.
6027 (class consolidation_map): New class.
6028 Ignore "-Wformat-diag".
6029 * analyzer.opt (-param=analyzer-max-svalue-depth=): New param.
6030 (-param=analyzer-max-enodes-for-full-dump=): New param.
6031 * call-string.cc: Ignore -Wformat-diag.
6032 * checker-path.cc: Move includes of "analyzer/call-string.h" and
6033 "analyzer/program-point.h" to before "analyzer/region-model.h",
6034 and also include "analyzer/store.h" before it.
6035 (state_change_event::state_change_event): Replace "tree var" param
6036 with "const svalue *sval". Convert "origin" param from tree to
6038 (state_change_event::get_desc): Call get_representative_tree to
6039 convert the var and origin from const svalue * to tree. Use
6040 svalue::get_desc rather than %qE when describing state changes.
6041 (checker_path::add_final_event): Use get_stmt_location.
6042 * checker-path.h (state_change_event::state_change_event): Port
6043 from tree to const svalue *.
6044 (state_change_event::get_lvalue): Delete.
6045 (state_change_event::get_dest_function): New.
6046 (state_change_event::m_var): Replace with...
6047 (state_change_event::m_sval): ...this.
6048 (state_change_event::m_origin): Convert from tree to
6050 * constraint-manager.cc: Include "analyzer/call-string.h",
6051 "analyzer/program-point.h", and "analyzer/store.h" before
6052 "analyzer/region-model.h".
6053 (struct bound, struct range): Move to constraint-manager.h.
6054 (compare_constants): New function.
6055 (range::dump): Rename to...
6056 (range::dump_to_pp): ...this. Support NULL constants.
6057 (range::dump): Reintroduce for dumping to stderr.
6058 (range::constrained_to_single_element): Return result, rather than
6060 (range::eval_condition): New.
6061 (range::below_lower_bound): New.
6062 (range::above_upper_bound): New.
6063 (equiv_class::equiv_class): Port from svalue_id to const svalue *.
6064 (equiv_class::print): Likewise.
6065 (equiv_class::hash): Likewise.
6066 (equiv_class::operator==): Port from svalue_id to const svalue *.
6067 (equiv_class::add): Port from svalue_id to const svalue *. Drop
6069 (equiv_class::del): Port from svalue_id to const svalue *.
6070 (equiv_class::get_representative): Likewise.
6071 (equiv_class::remap_svalue_ids): Delete.
6072 (svalue_id_cmp_by_id): Rename to...
6073 (svalue_cmp_by_ptr): ...this, porting from svalue_id to
6075 (equiv_class::canonicalize): Update qsort comparator.
6076 (constraint::implied_by): New.
6077 (constraint_manager::constraint_manager): Copy m_mgr in copy ctor.
6078 (constraint_manager::dump_to_pp): Add "multiline" param
6079 (constraint_manager::dump): Pass "true" for "multiline".
6080 (constraint_manager::add_constraint): Port from svalue_id to
6081 const svalue *. Split out second part into...
6082 (constraint_manager::add_unknown_constraint): ...this new
6083 function. Remove self-constraints when merging equivalence
6085 (constraint_manager::add_constraint_internal): Remove constraints
6086 that would be implied by the new constraint. Port from svalue_id
6088 (constraint_manager::get_equiv_class_by_sid): Rename to...
6089 (constraint_manager::get_equiv_class_by_svalue): ...this, porting
6090 from svalue_id to const svalue *.
6091 (constraint_manager::get_or_add_equiv_class): Port from svalue_id
6093 (constraint_manager::eval_condition): Make const. Call
6094 compare_constants and return early if it provides a known result.
6095 (constraint_manager::get_ec_bounds): New.
6096 (constraint_manager::eval_condition): New overloads. Make
6097 existing one const, and use compare_constants.
6098 (constraint_manager::purge): Convert "p" param to a template
6099 rather that an abstract base class. Port from svalue_id to
6101 (class dead_svalue_purger): New class.
6102 (constraint_manager::remap_svalue_ids): Delete.
6103 (constraint_manager::on_liveness_change): New.
6104 (equiv_class_cmp): Port from svalue_id to const svalue *.
6105 (constraint_manager::canonicalize): Likewise. Combine with
6106 purging of redundant equivalence classes and constraints.
6107 (class cleaned_constraint_manager): Delete.
6108 (class merger_fact_visitor): Make "m_cm_b" const. Add "m_merger"
6110 (merger_fact_visitor::fact): Port from svalue_id to const svalue *.
6111 Add special case for widening.
6112 (constraint_manager::merge): Port from svalue_id to const svalue *.
6113 (constraint_manager::clean_merger_input): Delete.
6114 (constraint_manager::for_each_fact): Port from svalue_id to
6116 (constraint_manager::validate): Likewise.
6117 (selftest::test_constraint_conditions): Provide a
6118 region_model_manager when creating region_model instances.
6119 Add test for self-equality not creating equivalence classes.
6120 (selftest::test_transitivity): Provide a region_model_manager when
6121 creating region_model instances. Verify that EC-merging happens
6122 when constraints are implied.
6123 (selftest::test_constant_comparisons): Provide a
6124 region_model_manager when creating region_model instances.
6125 (selftest::test_constraint_impl): Likewise. Remove over-specified
6127 (selftest::test_equality): Provide a region_model_manager when
6128 creating region_model instances.
6129 (selftest::test_many_constants): Likewise. Provide a
6130 program_point when testing merging.
6131 (selftest::run_constraint_manager_tests): Move call to
6132 test_constant_comparisons to outside the transitivity guard.
6133 * constraint-manager.h (struct bound): Move here from
6134 constraint-manager.cc.
6135 (struct range): Likewise.
6136 (struct::eval_condition): New decl.
6137 (struct::below_lower_bound): New decl.
6138 (struct::above_upper_bound): New decl.
6139 (equiv_class::add): Port from svalue_id to const svalue *.
6140 (equiv_class::del): Likewise.
6141 (equiv_class::get_representative): Likewise.
6142 (equiv_class::remap_svalue_ids): Drop.
6143 (equiv_class::m_cst_sid): Convert to..
6144 (equiv_class::m_cst_sval): ...this.
6145 (equiv_class::m_vars): Port from svalue_id to const svalue *.
6146 (constraint::bool implied_by): New decl.
6147 (fact_visitor::on_fact): Port from svalue_id to const svalue *.
6148 (constraint_manager::constraint_manager): Add mgr param.
6149 (constraint_manager::clone): Delete.
6150 (constraint_manager::maybe_get_constant): Delete.
6151 (constraint_manager::get_sid_for_constant): Delete.
6152 (constraint_manager::get_num_svalues): Delete.
6153 (constraint_manager::dump_to_pp): Add "multiline" param.
6154 (constraint_manager::get_equiv_class): Port from svalue_id to
6156 (constraint_manager::add_constraint): Likewise.
6157 (constraint_manager::get_equiv_class_by_sid): Rename to...
6158 (constraint_manager::get_equiv_class_by_svalue): ...this, porting
6159 from svalue_id to const svalue *.
6160 (constraint_manager::add_unknown_constraint): New decl.
6161 (constraint_manager::get_or_add_equiv_class): Port from svalue_id
6163 (constraint_manager::eval_condition): Likewise. Add overloads.
6164 (constraint_manager::get_ec_bounds): New decl.
6165 (constraint_manager::purge): Convert to template.
6166 (constraint_manager::remap_svalue_ids): Delete.
6167 (constraint_manager::on_liveness_change): New decl.
6168 (constraint_manager::canonicalize): Drop param.
6169 (constraint_manager::clean_merger_input): Delete.
6170 (constraint_manager::m_mgr): New field.
6171 * diagnostic-manager.cc: Move includes of
6172 "analyzer/call-string.h" and "analyzer/program-point.h" to before
6173 "analyzer/region-model.h", and also include "analyzer/store.h"
6175 (saved_diagnostic::saved_diagnostic): Add "sval" param.
6176 (diagnostic_manager::diagnostic_manager): Add engine param.
6177 (diagnostic_manager::add_diagnostic): Add "sval" param, passing it
6178 to saved_diagnostic ctor. Update overload to pass NULL for it.
6179 (dedupe_winners::dedupe_winners): Add engine param.
6180 (dedupe_winners::add): Add "eg" param. Pass m_engine to
6182 (dedupe_winner::m_engine): New field.
6183 (diagnostic_manager::emit_saved_diagnostics): Pass engine to
6184 dedupe_winners. Pass &eg when adding candidates. Pass svalue
6185 rather than tree to prune_path. Use get_stmt_location to get
6186 primary location of diagnostic.
6187 (diagnostic_manager::emit_saved_diagnostic): Likewise.
6188 (get_any_origin): Drop.
6189 (state_change_event_creator::on_global_state_change): Pass NULL
6190 const svalue * rather than NULL_TREE trees to state_change_event
6192 (state_change_event_creator::on_state_change): Port from tree and
6193 svalue_id to const svalue *.
6194 (for_each_state_change): Port from svalue_id to const svalue *.
6195 (struct null_assignment_sm_context): New.
6196 (diagnostic_manager::add_events_for_eedge): Add state change
6197 events for assignment to NULL.
6198 (diagnostic_manager::prune_path): Update param from tree to
6200 (diagnostic_manager::prune_for_sm_diagnostic): Port from tracking
6201 by tree to by const svalue *.
6202 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add sval
6204 (saved_diagnostic::m_sval): New field.
6205 (diagnostic_manager::diagnostic_manager): Add engine param.
6206 (diagnostic_manager::get_engine): New.
6207 (diagnostic_manager::add_diagnostic): Add "sval" param.
6208 (diagnostic_manager::prune_path): Likewise.
6209 (diagnostic_manager::prune_for_sm_diagnostic): New overload.
6210 (diagnostic_manager::m_eng): New field.
6211 * engine.cc: Move includes of "analyzer/call-string.h" and
6212 "analyzer/program-point.h" to before "analyzer/region-model.h",
6213 and also include "analyzer/store.h" before it.
6214 (impl_region_model_context::impl_region_model_context): Update for
6215 removal of m_change field.
6216 (impl_region_model_context::remap_svalue_ids): Delete.
6217 (impl_region_model_context::on_svalue_leak): New.
6218 (impl_region_model_context::on_svalue_purge): Delete.
6219 (impl_region_model_context::on_liveness_change): New.
6220 (impl_region_model_context::on_unknown_change): Update param
6221 from svalue_id to const svalue *. Add is_mutable param.
6222 (setjmp_svalue::compare_fields): Delete.
6223 (setjmp_svalue::accept): New.
6224 (setjmp_svalue::add_to_hash): Delete.
6225 (setjmp_svalue::dump_to_pp): New.
6226 (setjmp_svalue::print_details): Delete.
6227 (impl_sm_context::impl_sm_context): Drop "change" param.
6228 (impl_sm_context::get_fndecl_for_call): Drop "m_change".
6229 (impl_sm_context::on_transition): Drop ATTRIBUTE_UNUSED from
6230 "stmt" param. Drop m_change. Port from svalue_id to
6232 (impl_sm_context::warn_for_state): Drop m_change. Port from
6233 svalue_id to const svalue *.
6234 (impl_sm_context::get_readable_tree): Rename to...
6235 (impl_sm_context::get_diagnostic_tree): ...this. Port from
6236 svalue_id to const svalue *.
6237 (impl_sm_context::is_zero_assignment): New.
6238 (impl_sm_context::m_change): Delete field.
6239 (leak_stmt_finder::find_stmt): Handle m_var being NULL.
6240 (readability): Increase penalty for MEM_REF. For SSA_NAMEs,
6241 slightly favor the underlying var over the SSA name. Heavily
6242 penalize temporaries. Handle RESULT_DECL.
6243 (readability_comparator): Make non-static. Consider stack depths.
6244 (impl_region_model_context::on_state_leak): Convert from svalue_id
6245 to const svalue *, updating for region_model changes. Use
6247 (impl_region_model_context::on_inherited_svalue): Delete.
6248 (impl_region_model_context::on_cast): Delete.
6249 (impl_region_model_context::on_condition): Drop m_change.
6250 (impl_region_model_context::on_phi): Likewise.
6251 (impl_region_model_context::on_unexpected_tree_code): Handle t
6253 (point_and_state::validate): Update stack checking for
6254 region_model changes.
6255 (eg_traits::dump_args_t::show_enode_details_p): New.
6256 (exploded_node::exploded_node): Initialize m_num_processed_stmts.
6257 (exploded_node::get_processed_stmt): New function.
6258 (exploded_node::get_dot_fillcolor): Add more colors.
6259 (exploded_node::dump_dot): Guard the printing of the point and
6260 state with show_enode_details_p. Print the processed stmts for
6261 this enode after the initial state.
6262 (exploded_node::dump_to_pp): Pass true for new multiline param
6263 of program_state::dump_to_pp.
6264 (exploded_node::on_stmt): Drop "change" param. Log the stmt.
6265 Set input_location. Implement __analyzer_describe. Update
6266 implementation of __analyzer_dump and __analyzer_eval.
6267 Remove purging of sm-state for unknown fncalls from here.
6268 (exploded_node::on_edge): Drop "change" param.
6269 (exploded_node::on_longjmp): Port from region_id/svalue_id to
6270 const region */const svalue *. Call program_state::detect_leaks.
6272 (exploded_node::detect_leaks): Update for changes to region_model.
6273 Call program_state::detect_leaks.
6274 (exploded_edge::exploded_edge): Drop ext_state and change params.
6275 (exploded_edge::dump_dot): "args" is no longer used. Drop dumping
6277 (exploded_graph::exploded_graph): Pass engine to
6278 m_diagnostic_manager ctor. Use program_point::origin.
6279 (exploded_graph::add_function_entry): Drop ctxt. Use
6280 program_state::push_frame. Drop state_change.
6281 (exploded_graph::get_or_create_node): Drop "change" param. Add
6282 "enode_for_diag" param. Update dumping calls for API changes.
6283 Pass point to can_merge_with_p. Show enode indices
6284 within -Wanalyzer-too-complex diagnostic for hitting the per-point
6286 (exploded_graph::add_edge): Drop "change" param. Log which nodes
6287 are being connected. Update for changes to exploded_edge ctor.
6288 (exploded_graph::get_per_program_point_data): New.
6289 (exploded_graph::process_worklist): Pass point to
6290 can_merge_with_p. Drop state_change. Update dumping call for API
6292 (exploded_graph::process_node): Drop state_change. Split the
6293 node in-place if an sm-state-change occurs. Update
6294 m_num_processed_stmts. Update dumping calls for API change.
6295 (exploded_graph::log_stats): Call engine::log_stats.
6296 (exploded_graph::dump_states_for_supernode): Update dumping
6298 (exploded_path::feasible_p): Add "eng" and "eg" params.
6299 Rename "i" to "end_idx". Pass the manager to the region_model
6300 ctor. Update for every processed stmt in the enode, not just the
6301 first. Keep track of which snodes have been visited, and call
6302 loop_replay_fixup when revisiting one.
6303 (enode_label::get_text): Update dump call for new param.
6304 (exploded_graph::dump_exploded_nodes): Likewise.
6305 (exploded_graph::get_node_by_index): New.
6306 (impl_run_checkers): Create engine instance and pass its address
6307 to extrinsic_state ctor.
6309 (impl_region_model_context::impl_region_model_context): Drop
6311 (impl_region_model_context::void remap_svalue_ids): Delete.
6312 (impl_region_model_context::on_svalue_purge): Delete.
6313 (impl_region_model_context::on_svalue_leak): New.
6314 (impl_region_model_context::on_liveness_change): New.
6315 (impl_region_model_context::on_state_leak): Update signature.
6316 (impl_region_model_context::on_inherited_svalue): Delete.
6317 (impl_region_model_context::on_cast): Delete.
6318 (impl_region_model_context::on_unknown_change): Update signature.
6319 (impl_region_model_context::m_change): Delete.
6320 (eg_traits::dump_args_t::show_enode_details_p): New.
6321 (exploded_node::on_stmt): Drop "change" param.
6322 (exploded_node::on_edge): Likewise.
6323 (exploded_node::get_processed_stmt): New decl.
6324 (exploded_node::m_num_processed_stmts): New field.
6325 (exploded_edge::exploded_edge): Drop ext_state and change params.
6326 (exploded_edge::m_change): Delete.
6327 (exploded_graph::get_engine): New accessor.
6328 (exploded_graph::get_or_create_node): Drop "change" param. Add
6329 "enode_for_diag" param.
6330 (exploded_graph::add_edge): Drop "change" param.
6331 (exploded_graph::get_per_program_point_data): New decl.
6332 (exploded_graph::get_node_by_index): New decl.
6333 (exploded_path::feasible_p): Add "eng" and "eg" params.
6334 * program-point.cc: Include "analyzer/store.h" before including
6335 "analyzer/region-model.h".
6336 (function_point::function_point): Move here from
6338 (function_point::get_function): Likewise.
6339 (function_point::from_function_entry): Likewise.
6340 (function_point::before_supernode): Likewise.
6341 (function_point::next_stmt): New function.
6342 * program-point.h (function_point::function_point): Move
6343 implementation from here to program-point.cc.
6344 (function_point::get_function): Likewise.
6345 (function_point::from_function_entry): Likewise.
6346 (function_point::before_supernode): Likewise.
6347 (function_point::next_stmt): New decl.
6348 (program_point::operator!=): New.
6349 (program_point::origin): New.
6350 (program_point::next_stmt): New.
6351 (program_point::m_function_point): Make non-const.
6352 * program-state.cc: Move includes of "analyzer/call-string.h" and
6353 "analyzer/program-point.h" to before "analyzer/region-model.h",
6354 and also include "analyzer/store.h" before it.
6355 (extrinsic_state::get_model_manager): New.
6356 (sm_state_map::sm_state_map): Pass in sm and sm_idx to ctor,
6357 rather than pass the around.
6358 (sm_state_map::clone_with_remapping): Delete.
6359 (sm_state_map::print): Remove "sm" param in favor of "m_sm". Add
6360 "simple" and "multiline" params and support multiline vs single
6362 (sm_state_map::dump): Remove "sm" param in favor of "m_sm". Add
6364 (sm_state_map::hash): Port from svalue_id to const svalue *.
6365 (sm_state_map::operator==): Likewise.
6366 (sm_state_map::get_state): Likewise. Call canonicalize_svalue on
6367 input. Handle inheritance of sm-state. Call get_default_state.
6368 (sm_state_map::get_origin): Port from svalue_id to const svalue *.
6369 (sm_state_map::set_state): Likewise. Pass in ext_state. Reject
6370 attempts to set state on UNKNOWN.
6371 (sm_state_map::impl_set_state): Port from svalue_id to
6372 const svalue *. Pass in ext_state. Call canonicalize_svalue on
6374 (sm_state_map::purge_for_unknown_fncall): Delete.
6375 (sm_state_map::on_svalue_leak): New.
6376 (sm_state_map::remap_svalue_ids): Delete.
6377 (sm_state_map::on_liveness_change): New.
6378 (sm_state_map::on_unknown_change): Reimplement.
6379 (sm_state_map::on_svalue_purge): Delete.
6380 (sm_state_map::on_inherited_svalue): Delete.
6381 (sm_state_map::on_cast): Delete.
6382 (sm_state_map::validate): Delete.
6383 (sm_state_map::canonicalize_svalue): New.
6384 (program_state::program_state): Update to pass manager to
6385 region_model's ctor. Constify num_states and pass state machine
6386 and index to sm_state_map ctor.
6387 (program_state::print): Update for changes to dump API.
6388 (program_state::dump_to_pp): Ignore the summarize param. Add
6390 (program_state::dump_to_file): Add "multiline" param.
6391 (program_state::dump): Pass "true" for new "multiline" param.
6392 (program_state::push_frame): New.
6393 (program_state::on_edge): Drop "change" param. Call
6394 program_state::detect_leaks.
6395 (program_state::prune_for_point): Add enode_for_diag param.
6396 Reimplement based on store class. Call detect_leaks
6397 (program_state::remap_svalue_ids): Delete.
6398 (program_state::get_representative_tree): Port from svalue_id to
6400 (program_state::can_merge_with_p): Add "point" param. Add early
6401 reject for sm-differences. Drop id remapping.
6402 (program_state::validate): Drop region model and sm_state_map
6404 (state_change::sm_change::dump): Delete.
6405 (state_change::sm_change::remap_svalue_ids): Delete.
6406 (state_change::sm_change::on_svalue_purge): Delete.
6407 (log_set_of_svalues): New.
6408 (state_change::sm_change::validate): Delete.
6409 (state_change::state_change): Delete.
6410 (state_change::add_sm_change): Delete.
6411 (state_change::affects_p): Delete.
6412 (state_change::dump): Delete.
6413 (state_change::remap_svalue_ids): Delete.
6414 (state_change::on_svalue_purge): Delete.
6415 (state_change::validate): Delete.
6416 (selftest::assert_dump_eq): Delete.
6417 (ASSERT_DUMP_EQ): Delete.
6418 (selftest::test_sm_state_map): Update for changes to region_model
6419 and sm_state_map, porting from svalue_id to const svalue *.
6420 (selftest::test_program_state_dumping): Likewise. Drop test of
6421 dumping, renaming to...
6422 (selftest::test_program_state_1): ...this.
6423 (selftest::test_program_state_dumping_2): Likewise, renaming to...
6424 (selftest::test_program_state_2): ...this.
6425 (selftest::test_program_state_merging): Update for changes to
6427 (selftest::test_program_state_merging_2): Likewise.
6428 (selftest::analyzer_program_state_cc_tests): Update for renamed
6430 * program-state.h (extrinsic_state::extrinsic_state): Add logger
6432 (extrinsic_state::get_logger): New accessor.
6433 (extrinsic_state::get_engine): New accessor.
6434 (extrinsic_state::get_model_manager): New accessor.
6435 (extrinsic_state::m_logger): New field.
6436 (extrinsic_state::m_engine): New field.
6437 (struct default_hash_traits<svalue_id>): Delete.
6438 (pod_hash_traits<svalue_id>::hash): Delete.
6439 (pod_hash_traits<svalue_id>::equal): Delete.
6440 (pod_hash_traits<svalue_id>::mark_deleted): Delete.
6441 (pod_hash_traits<svalue_id>::mark_empty): Delete.
6442 (pod_hash_traits<svalue_id>::is_deleted): Delete.
6443 (pod_hash_traits<svalue_id>::is_empty): Delete.
6444 (sm_state_map::entry_t::entry_t): Port from svalue_id to
6446 (sm_state_map::entry_t::m_origin): Likewise.
6447 (sm_state_map::map_t): Likewise.
6448 (sm_state_map::sm_state_map): Add state_machine and index params.
6449 (sm_state_map::clone_with_remapping): Delete.
6450 (sm_state_map::print): Drop sm param; add simple and multiline
6452 (sm_state_map::dump): Drop sm param; add simple param.
6453 (sm_state_map::get_state): Port from svalue_id to const svalue *.
6454 Add ext_state param.
6455 (sm_state_map::get_origin): Likewise.
6456 (sm_state_map::set_state): Likewise.
6457 (sm_state_map::impl_set_state): Likewise.
6458 (sm_state_map::purge_for_unknown_fncall): Delete.
6459 (sm_state_map::remap_svalue_ids): Delete.
6460 (sm_state_map::on_svalue_purge): Delete.
6461 (sm_state_map::on_svalue_leak): New.
6462 (sm_state_map::on_liveness_change): New.
6463 (sm_state_map::on_inherited_svalue): Delete.
6464 (sm_state_map::on_cast): Delete.
6465 (sm_state_map::validate): Delete.
6466 (sm_state_map::on_unknown_change): Port from svalue_id to
6467 const svalue *. Add is_mutable and ext_state params.
6468 (sm_state_map::canonicalize_svalue): New.
6469 (sm_state_map::m_sm): New field.
6470 (sm_state_map::m_sm_idx): New field.
6471 (program_state::operator=): Delete.
6472 (program_state::dump_to_pp): Drop "summarize" param, adding
6473 "simple" and "multiline".
6474 (program_state::dump_to_file): Likewise.
6475 (program_state::dump): Rename "summarize" to "simple".
6476 (program_state::push_frame): New.
6477 (program_state::get_current_function): New.
6478 (program_state::on_edge): Drop "change" param.
6479 (program_state::prune_for_point): Likewise. Add enode_for_diag
6481 (program_state::remap_svalue_ids): Delete.
6482 (program_state::get_representative_tree): Port from svalue_id to
6484 (program_state::can_purge_p): Likewise. Pass ext_state to get_state.
6485 (program_state::can_merge_with_p): Add point param.
6486 (program_state::detect_leaks): New.
6487 (state_change_visitor::on_state_change): Port from tree and
6488 svalue_id to a pair of const svalue *.
6489 (class state_change): Delete.
6490 * region.cc: New file.
6491 * region-model-impl-calls.cc: New file.
6492 * region-model-manager.cc: New file.
6493 * region-model-reachability.cc: New file.
6494 * region-model-reachability.h: New file.
6495 * region-model.cc: Include "analyzer/call-string.h",
6496 "analyzer/program-point.h", and "analyzer/store.h" before
6497 "analyzer/region-model.h". Include
6498 "analyzer/region-model-reachability.h".
6499 (dump_tree): Make non-static.
6500 (dump_quoted_tree): Make non-static.
6501 (print_quoted_type): Make non-static.
6502 (path_var::dump): Delete.
6503 (dump_separator): Delete.
6504 (class impl_constraint_manager): Delete.
6505 (svalue_id::print): Delete.
6506 (svalue_id::dump_node_name_to_pp): Delete.
6507 (svalue_id::validate): Delete.
6508 (region_id::print): Delete.
6509 (region_id::dump_node_name_to_pp): Delete.
6510 (region_id::validate): Delete.
6511 (region_id_set::region_id_set): Delete.
6512 (svalue_id_set::svalue_id_set): Delete.
6513 (svalue::operator==): Delete.
6514 (svalue::hash): Delete.
6515 (svalue::print): Delete.
6516 (svalue::dump_dot_to_pp): Delete.
6517 (svalue::remap_region_ids): Delete.
6518 (svalue::walk_for_canonicalization): Delete.
6519 (svalue::get_child_sid): Delete.
6520 (svalue::maybe_get_constant): Delete.
6521 (region_svalue::compare_fields): Delete.
6522 (region_svalue::add_to_hash): Delete.
6523 (region_svalue::print_details): Delete.
6524 (region_svalue::dump_dot_to_pp): Delete.
6525 (region_svalue::remap_region_ids): Delete.
6526 (region_svalue::merge_values): Delete.
6527 (region_svalue::walk_for_canonicalization): Delete.
6528 (region_svalue::eval_condition): Delete.
6529 (constant_svalue::compare_fields): Delete.
6530 (constant_svalue::add_to_hash): Delete.
6531 (constant_svalue::merge_values): Delete.
6532 (constant_svalue::eval_condition): Move to svalue.cc.
6533 (constant_svalue::print_details): Delete.
6534 (constant_svalue::get_child_sid): Delete.
6535 (unknown_svalue::compare_fields): Delete.
6536 (unknown_svalue::add_to_hash): Delete.
6537 (unknown_svalue::print_details): Delete.
6538 (poison_kind_to_str): Move to svalue.cc.
6539 (poisoned_svalue::compare_fields): Delete.
6540 (poisoned_svalue::add_to_hash): Delete.
6541 (poisoned_svalue::print_details): Delete.
6542 (region_kind_to_str): Move to region.cc and reimplement.
6543 (region::operator==): Delete.
6544 (region::get_parent_region): Delete.
6545 (region::set_value): Delete.
6546 (region::become_active_view): Delete.
6547 (region::deactivate_any_active_view): Delete.
6548 (region::deactivate_view): Delete.
6549 (region::get_value): Delete.
6550 (region::get_inherited_child_sid): Delete.
6551 (region_model::copy_region): Delete.
6552 (region_model::copy_struct_region): Delete.
6553 (region_model::copy_union_region): Delete.
6554 (region_model::copy_array_region): Delete.
6555 (region::hash): Delete.
6556 (region::print): Delete.
6557 (region::dump_dot_to_pp): Delete.
6558 (region::dump_to_pp): Delete.
6559 (region::dump_child_label): Delete.
6560 (region::validate): Delete.
6561 (region::remap_svalue_ids): Delete.
6562 (region::remap_region_ids): Delete.
6563 (region::add_view): Delete.
6564 (region::get_view): Delete.
6565 (region::region): Move to region.cc.
6566 (region::add_to_hash): Delete.
6567 (region::print_fields): Delete.
6568 (region::non_null_p): Delete.
6569 (primitive_region::clone): Delete.
6570 (primitive_region::walk_for_canonicalization): Delete.
6571 (map_region::map_region): Delete.
6572 (map_region::compare_fields): Delete.
6573 (map_region::print_fields): Delete.
6574 (map_region::validate): Delete.
6575 (map_region::dump_dot_to_pp): Delete.
6576 (map_region::dump_child_label): Delete.
6577 (map_region::get_or_create): Delete.
6578 (map_region::get): Delete.
6579 (map_region::add_to_hash): Delete.
6580 (map_region::remap_region_ids): Delete.
6581 (map_region::unbind): Delete.
6582 (map_region::get_tree_for_child_region): Delete.
6583 (map_region::get_tree_for_child_region): Delete.
6584 (tree_cmp): Move to region.cc.
6585 (map_region::can_merge_p): Delete.
6586 (map_region::walk_for_canonicalization): Delete.
6587 (map_region::get_value_by_name): Delete.
6588 (struct_or_union_region::valid_key_p): Delete.
6589 (struct_or_union_region::compare_fields): Delete.
6590 (struct_region::clone): Delete.
6591 (struct_region::compare_fields): Delete.
6592 (union_region::clone): Delete.
6593 (union_region::compare_fields): Delete.
6594 (frame_region::compare_fields): Delete.
6595 (frame_region::clone): Delete.
6596 (frame_region::valid_key_p): Delete.
6597 (frame_region::print_fields): Delete.
6598 (frame_region::add_to_hash): Delete.
6599 (globals_region::compare_fields): Delete.
6600 (globals_region::clone): Delete.
6601 (globals_region::valid_key_p): Delete.
6602 (code_region::compare_fields): Delete.
6603 (code_region::clone): Delete.
6604 (code_region::valid_key_p): Delete.
6605 (array_region::array_region): Delete.
6606 (array_region::get_element): Delete.
6607 (array_region::clone): Delete.
6608 (array_region::compare_fields): Delete.
6609 (array_region::print_fields): Delete.
6610 (array_region::validate): Delete.
6611 (array_region::dump_dot_to_pp): Delete.
6612 (array_region::dump_child_label): Delete.
6613 (array_region::get_or_create): Delete.
6614 (array_region::get): Delete.
6615 (array_region::add_to_hash): Delete.
6616 (array_region::remap_region_ids): Delete.
6617 (array_region::get_key_for_child_region): Delete.
6618 (array_region::key_cmp): Delete.
6619 (array_region::walk_for_canonicalization): Delete.
6620 (array_region::key_from_constant): Delete.
6621 (array_region::constant_from_key): Delete.
6622 (function_region::compare_fields): Delete.
6623 (function_region::clone): Delete.
6624 (function_region::valid_key_p): Delete.
6625 (stack_region::stack_region): Delete.
6626 (stack_region::compare_fields): Delete.
6627 (stack_region::clone): Delete.
6628 (stack_region::print_fields): Delete.
6629 (stack_region::dump_child_label): Delete.
6630 (stack_region::validate): Delete.
6631 (stack_region::push_frame): Delete.
6632 (stack_region::get_current_frame_id): Delete.
6633 (stack_region::pop_frame): Delete.
6634 (stack_region::add_to_hash): Delete.
6635 (stack_region::remap_region_ids): Delete.
6636 (stack_region::can_merge_p): Delete.
6637 (stack_region::walk_for_canonicalization): Delete.
6638 (stack_region::get_value_by_name): Delete.
6639 (heap_region::heap_region): Delete.
6640 (heap_region::compare_fields): Delete.
6641 (heap_region::clone): Delete.
6642 (heap_region::walk_for_canonicalization): Delete.
6643 (root_region::root_region): Delete.
6644 (root_region::compare_fields): Delete.
6645 (root_region::clone): Delete.
6646 (root_region::print_fields): Delete.
6647 (root_region::validate): Delete.
6648 (root_region::dump_child_label): Delete.
6649 (root_region::push_frame): Delete.
6650 (root_region::get_current_frame_id): Delete.
6651 (root_region::pop_frame): Delete.
6652 (root_region::ensure_stack_region): Delete.
6653 (root_region::get_stack_region): Delete.
6654 (root_region::ensure_globals_region): Delete.
6655 (root_region::get_code_region): Delete.
6656 (root_region::ensure_code_region): Delete.
6657 (root_region::get_globals_region): Delete.
6658 (root_region::ensure_heap_region): Delete.
6659 (root_region::get_heap_region): Delete.
6660 (root_region::remap_region_ids): Delete.
6661 (root_region::can_merge_p): Delete.
6662 (root_region::add_to_hash): Delete.
6663 (root_region::walk_for_canonicalization): Delete.
6664 (root_region::get_value_by_name): Delete.
6665 (symbolic_region::symbolic_region): Delete.
6666 (symbolic_region::compare_fields): Delete.
6667 (symbolic_region::clone): Delete.
6668 (symbolic_region::walk_for_canonicalization): Delete.
6669 (symbolic_region::print_fields): Delete.
6670 (region_model::region_model): Add region_model_manager * param.
6671 Reimplement in terms of store, dropping impl_constraint_manager
6673 (region_model::operator=): Reimplement in terms of store
6674 (region_model::operator==): Likewise.
6675 (region_model::hash): Likewise.
6676 (region_model::print): Delete.
6677 (region_model::print_svalue): Delete.
6678 (region_model::dump_dot_to_pp): Delete.
6679 (region_model::dump_dot_to_file): Delete.
6680 (region_model::dump_dot): Delete.
6681 (region_model::dump_to_pp): Replace "summarize" param with
6682 "simple" and "multiline". Port to store-based implementation.
6683 (region_model::dump): Replace "summarize" param with "simple" and
6685 (dump_vec_of_tree): Delete.
6686 (region_model::dump_summary_of_rep_path_vars): Delete.
6687 (region_model::validate): Delete.
6688 (svalue_id_cmp_by_constant_svalue_model): Delete.
6689 (svalue_id_cmp_by_constant_svalue): Delete.
6690 (region_model::canonicalize): Drop "ctxt" param. Reimplement in
6691 terms of store and constraints.
6692 (region_model::canonicalized_p): Remove NULL arg to canonicalize.
6693 (region_model::loop_replay_fixup): New.
6694 (poisoned_value_diagnostic::emit): Tweak wording of warnings.
6695 (region_model::check_for_poison): Delete.
6696 (region_model::get_gassign_result): New.
6697 (region_model::on_assignment): Port to store-based implementation.
6698 (region_model::on_call_pre): Delete calls to check_for_poison.
6699 Move implementations to region-model-impl-calls.c and port to
6700 store-based implementation.
6701 (region_model::on_call_post): Likewise.
6702 (class reachable_regions): Move to region-model-reachability.h/cc
6703 and port to store-based implementation.
6704 (region_model::handle_unrecognized_call): Port to store-based
6706 (region_model::get_reachable_svalues): New.
6707 (region_model::on_setjmp): Port to store-based implementation.
6708 (region_model::on_longjmp): Likewise.
6709 (region_model::handle_phi): Drop is_back_edge param and the logic
6711 (region_model::get_lvalue_1): Port from region_id to const region *.
6712 (region_model::make_region_for_unexpected_tree_code): Delete.
6713 (assert_compat_types): If the check fails, use internal_error to
6715 (region_model::get_lvalue): Port from region_id to const region *.
6716 (region_model::get_rvalue_1): Port from svalue_id to const svalue *.
6717 (region_model::get_rvalue): Likewise.
6718 (region_model::get_or_create_ptr_svalue): Delete.
6719 (region_model::get_or_create_constant_svalue): Delete.
6720 (region_model::get_svalue_for_fndecl): Delete.
6721 (region_model::get_region_for_fndecl): Delete.
6722 (region_model::get_svalue_for_label): Delete.
6723 (region_model::get_region_for_label): Delete.
6724 (build_cast): Delete.
6725 (region_model::maybe_cast_1): Delete.
6726 (region_model::maybe_cast): Delete.
6727 (region_model::get_field_region): Delete.
6728 (region_model::get_store_value): New.
6729 (region_model::region_exists_p): New.
6730 (region_model::deref_rvalue): Port from svalue_id to const svalue *.
6731 (region_model::set_value): Likewise.
6732 (region_model::clobber_region): New.
6733 (region_model::purge_region): New.
6734 (region_model::zero_fill_region): New.
6735 (region_model::mark_region_as_unknown): New.
6736 (region_model::eval_condition): Port from svalue_id to
6738 (region_model::eval_condition_without_cm): Likewise.
6739 (region_model::compare_initial_and_pointer): New.
6740 (region_model::add_constraint): Port from svalue_id to
6742 (region_model::maybe_get_constant): Delete.
6743 (region_model::get_representative_path_var): New.
6744 (region_model::add_new_malloc_region): Delete.
6745 (region_model::get_representative_tree): Port to const svalue *.
6746 (region_model::get_representative_path_var): Port to
6748 (region_model::get_path_vars_for_svalue): Delete.
6749 (region_model::set_to_new_unknown_value): Delete.
6750 (region_model::update_for_phis): Don't pass is_back_edge to handle_phi.
6751 (region_model::update_for_call_superedge): Port from svalue_id to
6753 (region_model::update_for_return_superedge): Port to store-based
6755 (region_model::update_for_call_summary): Replace
6756 set_to_new_unknown_value with mark_region_as_unknown.
6757 (region_model::get_root_region): Delete.
6758 (region_model::get_stack_region_id): Delete.
6759 (region_model::push_frame): Delete.
6760 (region_model::get_current_frame_id): Delete.
6761 (region_model::get_current_function): Delete.
6762 (region_model::pop_frame): Delete.
6763 (region_model::on_top_level_param): New.
6764 (region_model::get_stack_depth): Delete.
6765 (region_model::get_function_at_depth): Delete.
6766 (region_model::get_globals_region_id): Delete.
6767 (region_model::add_svalue): Delete.
6768 (region_model::replace_svalue): Delete.
6769 (region_model::add_region): Delete.
6770 (region_model::get_svalue): Delete.
6771 (region_model::get_region): Delete.
6772 (make_region_for_type): Delete.
6773 (region_model::add_region_for_type): Delete.
6774 (region_model::on_top_level_param): New.
6775 (class restrict_to_used_svalues): Delete.
6776 (region_model::purge_unused_svalues): Delete.
6777 (region_model::push_frame): New.
6778 (region_model::remap_svalue_ids): Delete.
6779 (region_model::remap_region_ids): Delete.
6780 (region_model::purge_regions): Delete.
6781 (region_model::get_descendents): Delete.
6782 (region_model::delete_region_and_descendents): Delete.
6783 (region_model::poison_any_pointers_to_bad_regions): Delete.
6784 (region_model::can_merge_with_p): Delete.
6785 (region_model::get_current_function): New.
6786 (region_model::get_value_by_name): Delete.
6787 (region_model::convert_byte_offset_to_array_index): Delete.
6788 (region_model::pop_frame): New.
6789 (region_model::get_or_create_mem_ref): Delete.
6790 (region_model::get_stack_depth): New.
6791 (region_model::get_frame_at_index): New.
6792 (region_model::unbind_region_and_descendents): New.
6793 (struct bad_pointer_finder): New.
6794 (region_model::get_or_create_pointer_plus_expr): Delete.
6795 (region_model::poison_any_pointers_to_descendents): New.
6796 (region_model::get_or_create_view): Delete.
6797 (region_model::can_merge_with_p): New.
6798 (region_model::get_fndecl_for_call): Port from svalue_id to
6800 (struct append_ssa_names_cb_data): New.
6801 (get_ssa_name_regions_for_current_frame): New.
6802 (region_model::append_ssa_names_cb): New.
6803 (model_merger::dump_to_pp): Add "simple" param. Drop dumping of
6805 (model_merger::dump): Add "simple" param to both overloads.
6806 (model_merger::can_merge_values_p): Delete.
6807 (model_merger::record_regions): Delete.
6808 (model_merger::record_svalues): Delete.
6809 (svalue_id_merger_mapping::svalue_id_merger_mapping): Delete.
6810 (svalue_id_merger_mapping::dump_to_pp): Delete.
6811 (svalue_id_merger_mapping::dump): Delete.
6812 (region_model::create_region_for_heap_alloc): New.
6813 (region_model::create_region_for_alloca): New.
6814 (region_model::record_dynamic_extents): New.
6815 (canonicalization::canonicalization): Delete.
6816 (canonicalization::walk_rid): Delete.
6817 (canonicalization::walk_sid): Delete.
6818 (canonicalization::dump_to_pp): Delete.
6819 (canonicalization::dump): Delete.
6820 (inchash::add): Delete overloads for svalue_id and region_id.
6821 (engine::log_stats): New.
6822 (assert_condition): Add overload comparing svalues.
6823 (assert_dump_eq): Pass "true" for multiline.
6824 (selftest::test_dump): Update for rewrite of region_model.
6825 (selftest::test_dump_2): Rename to...
6826 (selftest::test_struct): ...this. Provide a region_model_manager
6827 when creating region_model instance. Remove dump test. Add
6828 checks for get_offset.
6829 (selftest::test_dump_3): Rename to...
6830 (selftest::test_array_1): ...this. Provide a region_model_manager
6831 when creating region_model instance. Remove dump test.
6832 (selftest::test_get_representative_tree): Port from svalue_id to
6833 new API. Add test coverage for various expressions.
6834 (selftest::test_unique_constants): Provide a region_model_manager
6835 for the region_model. Add test coverage for comparing const vs
6837 (selftest::test_svalue_equality): Delete.
6838 (selftest::test_region_equality): Delete.
6839 (selftest::test_unique_unknowns): New.
6840 (class purge_all_svalue_ids): Delete.
6841 (class purge_one_svalue_id): Delete.
6842 (selftest::test_purging_by_criteria): Delete.
6843 (selftest::test_initial_svalue_folding): New.
6844 (selftest::test_unaryop_svalue_folding): New.
6845 (selftest::test_binop_svalue_folding): New.
6846 (selftest::test_sub_svalue_folding): New.
6847 (selftest::test_purge_unused_svalues): Delete.
6848 (selftest::test_descendent_of_p): New.
6849 (selftest::test_assignment): Provide a region_model_manager for
6850 the region_model. Drop the dump test.
6851 (selftest::test_compound_assignment): Likewise.
6852 (selftest::test_stack_frames): Port to new implementation.
6853 (selftest::test_get_representative_path_var): Likewise.
6854 (selftest::test_canonicalization_1): Rename to...
6855 (selftest::test_equality_1): ...this. Port to new API, and add
6856 (selftest::test_canonicalization_2): Provide a
6857 region_model_manager when creating region_model instances.
6858 Remove redundant canicalization.
6859 (selftest::test_canonicalization_3): Provide a
6860 region_model_manager when creating region_model instances.
6861 Remove param from calls to region_model::canonicalize.
6862 (selftest::test_canonicalization_4): Likewise.
6863 (selftest::assert_region_models_merge): Constify
6864 out_merged_svalue. Port to new API.
6865 (selftest::test_state_merging): Provide a
6866 region_model_manager when creating region_model instances.
6867 Provide a program_point point when merging them. Replace
6868 set_to_new_unknown_value with usage of placeholder_svalues.
6869 Drop get_value_by_name. Port from svalue_id to const svalue *.
6870 Add test of heap allocation.
6871 (selftest::test_constraint_merging): Provide a
6872 region_model_manager when creating region_model instances.
6873 Provide a program_point point when merging them. Eliminate use
6874 of set_to_new_unknown_value.
6875 (selftest::test_widening_constraints): New.
6876 (selftest::test_iteration_1): New.
6877 (selftest::test_malloc_constraints): Port to store-based
6879 (selftest::test_var): New test.
6880 (selftest::test_array_2): New test.
6881 (selftest::test_mem_ref): New test.
6882 (selftest::test_POINTER_PLUS_EXPR_then_MEM_REF): New.
6883 (selftest::test_malloc): New.
6884 (selftest::test_alloca): New.
6885 (selftest::analyzer_region_model_cc_tests): Update for renamings.
6887 * region-model.h (class path_var): Move to analyzer.h.
6888 (class svalue_id): Delete.
6889 (class region_id): Delete.
6890 (class id_map): Delete.
6891 (svalue_id_map): Delete.
6892 (region_id_map): Delete.
6893 (id_map<T>::id_map): Delete.
6894 (id_map<T>::put): Delete.
6895 (id_map<T>::get_dst_for_src): Delete.
6896 (id_map<T>::get_src_for_dst): Delete.
6897 (id_map<T>::dump_to_pp): Delete.
6898 (id_map<T>::dump): Delete.
6899 (id_map<T>::update): Delete.
6900 (one_way_svalue_id_map): Delete.
6901 (one_way_region_id_map): Delete.
6902 (class region_id_set): Delete.
6903 (class svalue_id_set): Delete.
6904 (struct complexity): New.
6905 (class visitor): New.
6906 (enum svalue_kind): Add SK_SETJMP, SK_INITIAL, SK_UNARYOP,
6907 SK_BINOP, SK_SUB,SK_UNMERGEABLE, SK_PLACEHOLDER, SK_WIDENING,
6908 SK_COMPOUND, and SK_CONJURED.
6909 (svalue::operator==): Delete.
6910 (svalue::operator!=): Delete.
6911 (svalue::clone): Delete.
6912 (svalue::hash): Delete.
6913 (svalue::dump_dot_to_pp): Delete.
6914 (svalue::dump_to_pp): New.
6915 (svalue::dump): New.
6916 (svalue::get_desc): New.
6917 (svalue::dyn_cast_initial_svalue): New.
6918 (svalue::dyn_cast_unaryop_svalue): New.
6919 (svalue::dyn_cast_binop_svalue): New.
6920 (svalue::dyn_cast_sub_svalue): New.
6921 (svalue::dyn_cast_unmergeable_svalue): New.
6922 (svalue::dyn_cast_widening_svalue): New.
6923 (svalue::dyn_cast_compound_svalue): New.
6924 (svalue::dyn_cast_conjured_svalue): New.
6925 (svalue::maybe_undo_cast): New.
6926 (svalue::unwrap_any_unmergeable): New.
6927 (svalue::remap_region_ids): Delete
6928 (svalue::can_merge_p): New.
6929 (svalue::walk_for_canonicalization): Delete
6930 (svalue::get_complexity): New.
6931 (svalue::get_child_sid): Delete
6932 (svalue::accept): New.
6933 (svalue::live_p): New.
6934 (svalue::implicitly_live_p): New.
6935 (svalue::svalue): Add complexity param.
6936 (svalue::add_to_hash): Delete
6937 (svalue::print_details): Delete
6938 (svalue::m_complexity): New field.
6939 (region_svalue::key_t): New struct.
6940 (region_svalue::region_svalue): Port from region_id to
6941 const region_id *. Add complexity.
6942 (region_svalue::compare_fields): Delete.
6943 (region_svalue::clone): Delete.
6944 (region_svalue::dump_dot_to_pp): Delete.
6945 (region_svalue::get_pointee): Port from region_id to
6947 (region_svalue::remap_region_ids): Delete.
6948 (region_svalue::merge_values): Delete.
6949 (region_svalue::dump_to_pp): New.
6950 (region_svalue::accept): New.
6951 (region_svalue::walk_for_canonicalization): Delete.
6952 (region_svalue::eval_condition): Make params const.
6953 (region_svalue::add_to_hash): Delete.
6954 (region_svalue::print_details): Delete.
6955 (region_svalue::m_rid): Replace with...
6956 (region_svalue::m_reg): ...this.
6957 (is_a_helper <region_svalue *>::test): Convert to...
6958 (is_a_helper <const region_svalue *>::test): ...this.
6959 (template <> struct default_hash_traits<region_svalue::key_t>):
6961 (constant_svalue::constant_svalue): Add complexity.
6962 (constant_svalue::compare_fields): Delete.
6963 (constant_svalue::clone): Delete.
6964 (constant_svalue::add_to_hash): Delete.
6965 (constant_svalue::dump_to_pp): New.
6966 (constant_svalue::accept): New.
6967 (constant_svalue::implicitly_live_p): New.
6968 (constant_svalue::merge_values): Delete.
6969 (constant_svalue::eval_condition): Make params const.
6970 (constant_svalue::get_child_sid): Delete.
6971 (constant_svalue::print_details): Delete.
6972 (is_a_helper <constant_svalue *>::test): Convert to...
6973 (is_a_helper <const constant_svalue *>::test): ...this.
6974 (class unknown_svalue): Update leading comment.
6975 (unknown_svalue::unknown_svalue): Add complexity.
6976 (unknown_svalue::compare_fields): Delete.
6977 (unknown_svalue::add_to_hash): Delete.
6978 (unknown_svalue::dyn_cast_unknown_svalue): Delete.
6979 (unknown_svalue::print_details): Delete.
6980 (unknown_svalue::dump_to_pp): New.
6981 (unknown_svalue::accept): New.
6982 (poisoned_svalue::key_t): New struct.
6983 (poisoned_svalue::poisoned_svalue): Add complexity.
6984 (poisoned_svalue::compare_fields): Delete.
6985 (poisoned_svalue::clone): Delete.
6986 (poisoned_svalue::add_to_hash): Delete.
6987 (poisoned_svalue::dump_to_pp): New.
6988 (poisoned_svalue::accept): New.
6989 (poisoned_svalue::print_details): Delete.
6990 (is_a_helper <poisoned_svalue *>::test): Convert to...
6991 (is_a_helper <const poisoned_svalue *>::test): ...this.
6992 (template <> struct default_hash_traits<poisoned_svalue::key_t>):
6994 (setjmp_record::add_to_hash): New.
6995 (setjmp_svalue::key_t): New struct.
6996 (setjmp_svalue::compare_fields): Delete.
6997 (setjmp_svalue::clone): Delete.
6998 (setjmp_svalue::add_to_hash): Delete.
6999 (setjmp_svalue::setjmp_svalue): Add complexity.
7000 (setjmp_svalue::dump_to_pp): New.
7001 (setjmp_svalue::accept): New.
7002 (setjmp_svalue::void print_details): Delete.
7003 (is_a_helper <const setjmp_svalue *>::test): New.
7004 (template <> struct default_hash_traits<setjmp_svalue::key_t>): New.
7005 (class initial_svalue : public svalue): New.
7006 (is_a_helper <const initial_svalue *>::test): New.
7007 (class unaryop_svalue): New.
7008 (is_a_helper <const unaryop_svalue *>::test): New.
7009 (template <> struct default_hash_traits<unaryop_svalue::key_t>): New.
7010 (class binop_svalue): New.
7011 (is_a_helper <const binop_svalue *>::test): New.
7012 (template <> struct default_hash_traits<binop_svalue::key_t>): New.
7013 (class sub_svalue): New.
7014 (is_a_helper <const sub_svalue *>::test): New.
7015 (template <> struct default_hash_traits<sub_svalue::key_t>): New.
7016 (class unmergeable_svalue): New.
7017 (is_a_helper <const unmergeable_svalue *>::test): New.
7018 (class placeholder_svalue): New.
7019 (is_a_helper <placeholder_svalue *>::test): New.
7020 (class widening_svalue): New.
7021 (is_a_helper <widening_svalue *>::test): New.
7022 (template <> struct default_hash_traits<widening_svalue::key_t>): New.
7023 (class compound_svalue): New.
7024 (is_a_helper <compound_svalue *>::test): New.
7025 (template <> struct default_hash_traits<compound_svalue::key_t>): New.
7026 (class conjured_svalue): New.
7027 (is_a_helper <conjured_svalue *>::test): New.
7028 (template <> struct default_hash_traits<conjured_svalue::key_t>): New.
7029 (enum region_kind): Delete RK_PRIMITIVE, RK_STRUCT, RK_UNION, and
7030 RK_ARRAY. Add RK_LABEL, RK_DECL, RK_FIELD, RK_ELEMENT, RK_OFFSET,
7031 RK_CAST, RK_HEAP_ALLOCATED, RK_ALLOCA, RK_STRING, and RK_UNKNOWN.
7032 (region_kind_to_str): Delete.
7033 (region::~region): Move implementation to region.cc.
7034 (region::operator==): Delete.
7035 (region::operator!=): Delete.
7036 (region::clone): Delete.
7037 (region::get_id): New.
7038 (region::cmp_ids): New.
7039 (region::dyn_cast_map_region): Delete.
7040 (region::dyn_cast_array_region): Delete.
7041 (region::region_id get_parent): Delete.
7042 (region::get_parent_region): Convert to a simple accessor.
7043 (region::void set_value): Delete.
7044 (region::svalue_id get_value): Delete.
7045 (region::svalue_id get_value_direct): Delete.
7046 (region::svalue_id get_inherited_child_sid): Delete.
7047 (region::dyn_cast_frame_region): New.
7048 (region::dyn_cast_function_region): New.
7049 (region::dyn_cast_decl_region): New.
7050 (region::dyn_cast_field_region): New.
7051 (region::dyn_cast_element_region): New.
7052 (region::dyn_cast_offset_region): New.
7053 (region::dyn_cast_cast_region): New.
7054 (region::dyn_cast_string_region): New.
7055 (region::accept): New.
7056 (region::get_base_region): New.
7057 (region::base_region_p): New.
7058 (region::descendent_of_p): New.
7059 (region::maybe_get_frame_region): New.
7060 (region::maybe_get_decl): New.
7061 (region::hash): Delete.
7062 (region::rint): Delete.
7063 (region::dump_dot_to_pp): Delete.
7064 (region::get_desc): New.
7065 (region::dump_to_pp): Convert to vfunc, changing signature.
7066 (region::dump_child_label): Delete.
7067 (region::remap_svalue_ids): Delete.
7068 (region::remap_region_ids): Delete.
7069 (region::dump): New.
7070 (region::walk_for_canonicalization): Delete.
7071 (region::non_null_p): Drop region_model param.
7072 (region::add_view): Delete.
7073 (region::get_view): Delete.
7074 (region::get_active_view): Delete.
7075 (region::is_view_p): Delete.
7076 (region::cmp_ptrs): New.
7077 (region::validate): Delete.
7078 (region::get_offset): New.
7079 (region::get_byte_size): New.
7080 (region::get_bit_size): New.
7081 (region::get_subregions_for_binding): New.
7082 (region::region): Add complexity param. Convert parent from
7083 region_id to const region *. Drop svalue_id. Drop copy ctor.
7084 (region::symbolic_for_unknown_ptr_p): New.
7085 (region::add_to_hash): Delete.
7086 (region::print_fields): Delete.
7087 (region::get_complexity): New accessor.
7088 (region::become_active_view): Delete.
7089 (region::deactivate_any_active_view): Delete.
7090 (region::deactivate_view): Delete.
7091 (region::calc_offset): New.
7092 (region::m_parent_rid): Delete.
7093 (region::m_sval_id): Delete.
7094 (region::m_complexity): New.
7095 (region::m_id): New.
7096 (region::m_parent): New.
7097 (region::m_view_rids): Delete.
7098 (region::m_is_view): Delete.
7099 (region::m_active_view_rid): Delete.
7100 (region::m_cached_offset): New.
7101 (is_a_helper <region *>::test): Convert to...
7102 (is_a_helper <const region *>::test): ... this.
7103 (class primitive_region): Delete.
7104 (class space_region): New.
7105 (class map_region): Delete.
7106 (is_a_helper <map_region *>::test): Delete.
7107 (class frame_region): Reimplement.
7108 (template <> struct default_hash_traits<frame_region::key_t>):
7110 (class globals_region): Reimplement.
7111 (is_a_helper <globals_region *>::test): Convert to...
7112 (is_a_helper <const globals_region *>::test): ...this.
7113 (class struct_or_union_region): Delete.
7114 (is_a_helper <struct_or_union_region *>::test): Delete.
7115 (class code_region): Reimplement.
7116 (is_a_helper <const code_region *>::test): New.
7117 (class struct_region): Delete.
7118 (is_a_helper <struct_region *>::test): Delete.
7119 (class function_region): Reimplement.
7120 (is_a_helper <function_region *>::test): Convert to...
7121 (is_a_helper <const function_region *>::test): ...this.
7122 (class union_region): Delete.
7123 (is_a_helper <union_region *>::test): Delete.
7124 (class label_region): New.
7125 (is_a_helper <const label_region *>::test): New.
7126 (class scope_region): Delete.
7127 (class stack_region): Reimplement.
7128 (is_a_helper <stack_region *>::test): Convert to...
7129 (is_a_helper <const stack_region *>::test): ...this.
7130 (class heap_region): Reimplement.
7131 (is_a_helper <heap_region *>::test): Convert to...
7132 (is_a_helper <const heap_region *>::test): ...this.
7133 (class root_region): Reimplement.
7134 (is_a_helper <root_region *>::test): Convert to...
7135 (is_a_helper <const root_region *>::test): ...this.
7136 (class symbolic_region): Reimplement.
7137 (is_a_helper <const symbolic_region *>::test): New.
7138 (template <> struct default_hash_traits<symbolic_region::key_t>):
7140 (class decl_region): New.
7141 (is_a_helper <const decl_region *>::test): New.
7142 (class field_region): New.
7143 (template <> struct default_hash_traits<field_region::key_t>): New.
7144 (class array_region): Delete.
7145 (class element_region): New.
7146 (is_a_helper <array_region *>::test): Delete.
7147 (is_a_helper <const element_region *>::test): New.
7148 (template <> struct default_hash_traits<element_region::key_t>):
7150 (class offset_region): New.
7151 (is_a_helper <const offset_region *>::test): New.
7152 (template <> struct default_hash_traits<offset_region::key_t>):
7154 (class cast_region): New.
7155 (is_a_helper <const cast_region *>::test): New.
7156 (template <> struct default_hash_traits<cast_region::key_t>): New.
7157 (class heap_allocated_region): New.
7158 (class alloca_region): New.
7159 (class string_region): New.
7160 (is_a_helper <const string_region *>::test): New.
7161 (class unknown_region): New.
7162 (class region_model_manager): New.
7163 (struct append_ssa_names_cb_data): New.
7164 (class call_details): New.
7165 (region_model::region_model): Add region_model_manager param.
7166 (region_model::print_svalue): Delete.
7167 (region_model::dump_dot_to_pp): Delete.
7168 (region_model::dump_dot_to_file): Delete.
7169 (region_model::dump_dot): Delete.
7170 (region_model::dump_to_pp): Drop summarize param in favor of
7171 simple and multiline.
7172 (region_model::dump): Likewise.
7173 (region_model::summarize_to_pp): Delete.
7174 (region_model::summarize): Delete.
7175 (region_model::void canonicalize): Drop ctxt param.
7176 (region_model::void check_for_poison): Delete.
7177 (region_model::get_gassign_result): New.
7178 (region_model::impl_call_alloca): New.
7179 (region_model::impl_call_analyzer_describe): New.
7180 (region_model::impl_call_analyzer_eval): New.
7181 (region_model::impl_call_builtin_expect): New.
7182 (region_model::impl_call_calloc): New.
7183 (region_model::impl_call_free): New.
7184 (region_model::impl_call_malloc): New.
7185 (region_model::impl_call_memset): New.
7186 (region_model::impl_call_strlen): New.
7187 (region_model::get_reachable_svalues): New.
7188 (region_model::handle_phi): Drop is_back_edge param.
7189 (region_model::region_id get_root_rid): Delete.
7190 (region_model::root_region *get_root_region): Delete.
7191 (region_model::region_id get_stack_region_id): Delete.
7192 (region_model::push_frame): Convert from region_id and svalue_id
7193 to const region * and const svalue *.
7194 (region_model::get_current_frame_id): Replace with...
7195 (region_model::get_current_frame): ...this.
7196 (region_model::pop_frame): Convert from region_id to
7197 const region *. Drop purge and stats param. Add out_result.
7198 (region_model::function *get_function_at_depth): Delete.
7199 (region_model::get_globals_region_id): Delete.
7200 (region_model::add_svalue): Delete.
7201 (region_model::replace_svalue): Delete.
7202 (region_model::add_region): Delete.
7203 (region_model::add_region_for_type): Delete.
7204 (region_model::get_svalue): Delete.
7205 (region_model::get_region): Delete.
7206 (region_model::get_lvalue): Convert from region_id to
7208 (region_model::get_rvalue): Convert from svalue_id to
7210 (region_model::get_or_create_ptr_svalue): Delete.
7211 (region_model::get_or_create_constant_svalue): Delete.
7212 (region_model::get_svalue_for_fndecl): Delete.
7213 (region_model::get_svalue_for_label): Delete.
7214 (region_model::get_region_for_fndecl): Delete.
7215 (region_model::get_region_for_label): Delete.
7216 (region_model::get_frame_at_index (int index) const;): New.
7217 (region_model::maybe_cast): Delete.
7218 (region_model::maybe_cast_1): Delete.
7219 (region_model::get_field_region): Delete.
7220 (region_model::id deref_rvalue): Convert from region_id and
7221 svalue_id to const region * and const svalue *. Drop overload,
7222 passing in both a tree and an svalue.
7223 (region_model::set_value): Convert from region_id and svalue_id to
7224 const region * and const svalue *.
7225 (region_model::set_to_new_unknown_value): Delete.
7226 (region_model::clobber_region (const region *reg);): New.
7227 (region_model::purge_region (const region *reg);): New.
7228 (region_model::zero_fill_region (const region *reg);): New.
7229 (region_model::mark_region_as_unknown (const region *reg);): New.
7230 (region_model::copy_region): Convert from region_id to
7232 (region_model::eval_condition): Convert from svalue_id to
7234 (region_model::eval_condition_without_cm): Likewise.
7235 (region_model::compare_initial_and_pointer): New.
7236 (region_model:maybe_get_constant): Delete.
7237 (region_model::add_new_malloc_region): Delete.
7238 (region_model::get_representative_tree): Convert from svalue_id to
7240 (region_model::get_representative_path_var): Delete decl taking a
7241 region_id in favor of two decls, for svalue vs region, with an
7242 svalue_set to ensure termination.
7243 (region_model::get_path_vars_for_svalue): Delete.
7244 (region_model::create_region_for_heap_alloc): New.
7245 (region_model::create_region_for_alloca): New.
7246 (region_model::purge_unused_svalues): Delete.
7247 (region_model::remap_svalue_ids): Delete.
7248 (region_model::remap_region_ids): Delete.
7249 (region_model::purge_regions): Delete.
7250 (region_model::get_num_svalues): Delete.
7251 (region_model::get_num_regions): Delete.
7252 (region_model::get_descendents): Delete.
7253 (region_model::get_store): New.
7254 (region_model::delete_region_and_descendents): Delete.
7255 (region_model::get_manager): New.
7256 (region_model::unbind_region_and_descendents): New.
7257 (region_model::can_merge_with_p): Add point param. Drop
7258 svalue_id_merger_mapping.
7259 (region_model::get_value_by_name): Delete.
7260 (region_model::convert_byte_offset_to_array_index): Delete.
7261 (region_model::get_or_create_mem_ref): Delete.
7262 (region_model::get_or_create_pointer_plus_expr): Delete.
7263 (region_model::get_or_create_view): Delete.
7264 (region_model::get_lvalue_1): Convert from region_id to
7266 (region_model::get_rvalue_1): Convert from svalue_id to
7268 (region_model::get_ssa_name_regions_for_current_frame): New.
7269 (region_model::append_ssa_names_cb): New.
7270 (region_model::get_store_value): New.
7271 (region_model::copy_struct_region): Delete.
7272 (region_model::copy_union_region): Delete.
7273 (region_model::copy_array_region): Delete.
7274 (region_model::region_exists_p): New.
7275 (region_model::make_region_for_unexpected_tree_code): Delete.
7276 (region_model::loop_replay_fixup): New.
7277 (region_model::poison_any_pointers_to_bad_regions): Delete.
7278 (region_model::poison_any_pointers_to_descendents): New.
7279 (region_model::dump_summary_of_rep_path_vars): Delete.
7280 (region_model::on_top_level_param): New.
7281 (region_model::record_dynamic_extents): New.
7282 (region_model::m_mgr;): New.
7283 (region_model::m_store;): New.
7284 (region_model::m_svalues;): Delete.
7285 (region_model::m_regions;): Delete.
7286 (region_model::m_root_rid;): Delete.
7287 (region_model::m_current_frame;): New.
7288 (region_model_context::remap_svalue_ids): Delete.
7289 (region_model_context::can_purge_p): Delete.
7290 (region_model_context::on_svalue_leak): New.
7291 (region_model_context::on_svalue_purge): Delete.
7292 (region_model_context::on_liveness_change): New.
7293 (region_model_context::on_inherited_svalue): Delete.
7294 (region_model_context::on_cast): Delete.
7295 (region_model_context::on_unknown_change): Convert from svalue_id to
7296 const svalue * and add is_mutable.
7297 (class noop_region_model_context): Update for region_model_context
7299 (model_merger::model_merger): Add program_point. Drop
7300 svalue_id_merger_mapping.
7301 (model_merger::dump_to_pp): Add "simple" param.
7302 (model_merger::dump): Likewise.
7303 (model_merger::get_region_a): Delete.
7304 (model_merger::get_region_b): Delete.
7305 (model_merger::can_merge_values_p): Delete.
7306 (model_merger::record_regions): Delete.
7307 (model_merger::record_svalues): Delete.
7308 (model_merger::m_point): New field.
7309 (model_merger::m_map_regions_from_a_to_m): Delete.
7310 (model_merger::m_map_regions_from_b_to_m): Delete.
7311 (model_merger::m_sid_mapping): Delete.
7312 (struct svalue_id_merger_mapping): Delete.
7313 (class engine): New.
7314 (struct canonicalization): Delete.
7315 (inchash::add): Delete decls for hashing svalue_id and region_id.
7316 (test_region_model_context::on_unexpected_tree_code): Require t to
7318 (selftest::assert_condition): Add overload comparing a pair of
7320 * sm-file.cc: Include "tristate.h", "selftest.h",
7321 "analyzer/call-string.h", "analyzer/program-point.h",
7322 "analyzer/store.h", and "analyzer/region-model.h".
7323 (fileptr_state_machine::get_default_state): New.
7324 (fileptr_state_machine::on_stmt): Remove calls to
7325 get_readable_tree in favor of get_diagnostic_tree.
7326 * sm-malloc.cc: Include "tristate.h", "selftest.h",
7327 "analyzer/call-string.h", "analyzer/program-point.h",
7328 "analyzer/store.h", and "analyzer/region-model.h".
7329 (malloc_state_machine::get_default_state): New.
7330 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New.
7331 (malloc_diagnostic::describe_state_change): Handle change.m_expr
7333 (null_arg::emit): Avoid printing "NULL '0'".
7334 (null_arg::describe_final_event): Avoid printing "(0) NULL".
7335 (malloc_leak::emit): Handle m_arg being NULL.
7336 (malloc_leak::describe_final_event): Handle ev.m_expr being NULL.
7337 (malloc_state_machine::on_stmt): Don't call get_readable_tree.
7338 Call get_diagnostic_tree when creating pending diagnostics.
7339 Update for is_zero_assignment becoming a member function of
7341 Don't transition to m_non_heap for ADDR_EXPR(MEM_REF()).
7342 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New
7343 vfunc implementation.
7344 * sm-sensitive.cc (sensitive_state_machine::warn_for_any_exposure): Call
7345 get_diagnostic_tree and pass the result to warn_for_state.
7346 * sm-signal.cc: Move includes of "analyzer/call-string.h" and
7347 "analyzer/program-point.h" to before "analyzer/region-model.h",
7348 and also include "analyzer/store.h" before it.
7349 (signal_unsafe_call::describe_state_change): Use
7350 get_dest_function to get handler.
7351 (update_model_for_signal_handler): Pass manager to region_model
7353 (register_signal_handler::impl_transition): Update for changes to
7354 get_or_create_node and add_edge.
7355 * sm-taint.cc (taint_state_machine::on_stmt): Remove calls to
7356 get_readable_tree, replacing them when calling warn_for_state with
7357 calls to get_diagnostic_tree.
7358 * sm.cc (is_zero_assignment): Delete.
7359 (any_pointer_p): Move to within namespace ana.
7360 * sm.h (is_zero_assignment): Remove decl.
7361 (any_pointer_p): Move decl to within namespace ana.
7362 (state_machine::get_default_state): New vfunc.
7363 (state_machine::reset_when_passed_to_unknown_fn_p): New vfunc.
7364 (sm_context::get_readable_tree): Rename to...
7365 (sm_context::get_diagnostic_tree): ...this.
7366 (sm_context::is_zero_assignment): New vfunc.
7367 * store.cc: New file.
7368 * store.h: New file.
7369 * svalue.cc: New file.
7371 2020-05-22 Mark Wielaard <mark@klomp.org>
7373 * sm-signal.cc(signal_unsafe_call::emit): Possibly add
7374 gcc_rich_location note for replacement.
7375 (signal_unsafe_call::get_replacement_fn): New private function.
7376 (get_async_signal_unsafe_fns): Add "exit".
7378 2020-04-28 David Malcolm <dmalcolm@redhat.com>
7381 * engine.cc (impl_region_model_context::on_unexpected_tree_code):
7383 * region-model.cc (region_model::add_region_for_type): Handle
7386 (test_region_model_context::on_unexpected_tree_code): Handle NULL
7389 2020-04-28 David Malcolm <dmalcolm@redhat.com>
7395 * analyzer.opt (Wanalyzer-use-of-uninitialized-value): Delete.
7396 * program-state.cc (selftest::test_program_state_dumping): Update
7397 expected dump result for removal of "uninit".
7398 * region-model.cc (poison_kind_to_str): Delete POISON_KIND_UNINIT
7400 (root_region::ensure_stack_region): Initialize stack with null
7401 svalue_id rather than with a typeless POISON_KIND_UNINIT value.
7402 (root_region::ensure_heap_region): Likewise for the heap.
7403 (region_model::dump_summary_of_rep_path_vars): Remove
7404 summarization of uninit values.
7405 (region_model::validate): Remove check that the stack has a
7406 POISON_KIND_UNINIT value.
7407 (poisoned_value_diagnostic::emit): Remove POISON_KIND_UNINIT
7409 (poisoned_value_diagnostic::describe_final_event): Likewise.
7410 (selftest::test_dump): Update expected dump result for removal of
7412 (selftest::test_svalue_equality): Remove "uninit" and "freed".
7413 * region-model.h (enum poison_kind): Remove POISON_KIND_UNINIT.
7415 2020-04-01 David Malcolm <dmalcolm@redhat.com>
7418 * checker-path.cc: Include "bitmap.h".
7419 * constraint-manager.cc: Likewise.
7420 * diagnostic-manager.cc: Likewise.
7421 * engine.cc: Likewise.
7422 (exploded_node::detect_leaks): Pass null region_id to pop_frame.
7423 * program-point.cc: Include "bitmap.h".
7424 * program-state.cc: Likewise.
7425 * region-model.cc (id_set<region_id>::id_set): Convert to...
7426 (region_id_set::region_id_set): ...this.
7427 (svalue_id_set::svalue_id_set): New ctor.
7428 (region_model::copy_region): New function.
7429 (region_model::copy_struct_region): New function.
7430 (region_model::copy_union_region): New function.
7431 (region_model::copy_array_region): New function.
7432 (stack_region::pop_frame): Drop return value. Add
7433 "result_dst_rid" param; if it is non-null, use copy_region to copy
7434 the result to it. Rather than capture and pass a single "known
7435 used" return value to be used by purge_unused_values, instead
7436 gather and pass a set of known used return values.
7437 (root_region::pop_frame): Drop return value. Add "result_dst_rid"
7439 (region_model::on_assignment): Use copy_region.
7440 (region_model::on_return): Likewise for the result.
7441 (region_model::on_longjmp): Pass null for pop_frame's
7443 (region_model::update_for_return_superedge): Pass the region for the
7444 return value of the call, if any, to pop_frame, rather than setting
7445 the lvalue for the lhs of the result.
7446 (region_model::pop_frame): Drop return value. Add
7447 "result_dst_rid" param.
7448 (region_model::purge_unused_svalues): Convert third param from an
7449 svalue_id * to an svalue_id_set *, updating the initial populating
7450 of the "used" bitmap accordingly. Don't remap it when done.
7451 (struct selftest::coord_test): New selftest fixture, extracted from...
7452 (selftest::test_dump_2): ...here.
7453 (selftest::test_compound_assignment): New selftest.
7454 (selftest::test_stack_frames): Pass null to new param of pop_frame.
7455 (selftest::analyzer_region_model_cc_tests): Call the new selftest.
7456 * region-model.h (class id_set): Delete template.
7457 (class region_id_set): Reimplement, using old id_set implementation.
7458 (class svalue_id_set): Likewise. Convert from auto_sbitmap to
7460 (region::get_active_view): New accessor.
7461 (stack_region::pop_frame): Drop return value. Add
7462 "result_dst_rid" param.
7463 (root_region::pop_frame): Likewise.
7464 (region_model::pop_frame): Likewise.
7465 (region_model::copy_region): New decl.
7466 (region_model::purge_unused_svalues): Convert third param from an
7467 svalue_id * to an svalue_id_set *.
7468 (region_model::copy_struct_region): New decl.
7469 (region_model::copy_union_region): New decl.
7470 (region_model::copy_array_region): New decl.
7472 2020-03-27 David Malcolm <dmalcolm@redhat.com>
7474 * program-state.cc (selftest::test_program_state_dumping): Update
7475 expected dump to include symbolic_region's possibly_null field.
7476 * region-model.cc (symbolic_region::print_fields): New vfunc
7478 (region_model::add_constraint): Clear m_possibly_null from
7479 symbolic_regions now known to be non-NULL.
7480 (selftest::test_malloc_constraints): New selftest.
7481 (selftest::analyzer_region_model_cc_tests): Call it.
7482 * region-model.h (region::dyn_cast_symbolic_region): Add non-const
7484 (symbolic_region::dyn_cast_symbolic_region): Implement it.
7485 (symbolic_region::print_fields): New vfunc override decl.
7487 2020-03-27 David Malcolm <dmalcolm@redhat.com>
7489 * analyzer.h (class feasibility_problem): New forward decl.
7490 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
7491 Initialize new fields m_status, m_epath_length, and m_problem.
7492 (saved_diagnostic::~saved_diagnostic): Delete m_problem.
7493 (dedupe_candidate::dedupe_candidate): Convert "sd" param from a
7494 const ref to a mutable ptr.
7495 (dedupe_winners::add): Convert "sd" param from a const ref to a
7496 mutable ptr. Record the length of the exploded_path. Record the
7497 feasibility/infeasibility of sd into sd, capturing a
7498 feasibility_problem when feasible_p fails, and storing it in sd.
7499 (diagnostic_manager::emit_saved_diagnostics): Update for pass by
7500 ptr rather than by const ref.
7501 * diagnostic-manager.h (class saved_diagnostic): Add new enum
7502 status. Add fields m_status, m_epath_length and m_problem.
7503 (saved_diagnostic::set_feasible): New member function.
7504 (saved_diagnostic::set_infeasible): New member function.
7505 (saved_diagnostic::get_feasibility_problem): New accessor.
7506 (saved_diagnostic::get_status): New accessor.
7507 (saved_diagnostic::set_epath_length): New member function.
7508 (saved_diagnostic::get_epath_length): New accessor.
7509 * engine.cc: Include "gimple-pretty-print.h".
7510 (exploded_path::feasible_p): Add OUT param and, if non-NULL, write
7511 a new feasibility_problem to it on failure.
7512 (viz_callgraph_node::dump_dot): Convert begin_tr calls to
7513 begin_trtd. Convert end_tr calls to end_tdtr.
7514 (class exploded_graph_annotator): New subclass of dot_annotator.
7515 (impl_run_checkers): Add a second -fdump-analyzer-supergraph dump
7516 after the analysis runs, using exploded_graph_annotator. dumping
7517 to DUMP_BASE_NAME.supergraph-eg.dot.
7518 * exploded-graph.h (exploded_node::get_dot_fillcolor): Make
7520 (exploded_path::feasible_p): Add OUT param.
7521 (class feasibility_problem): New class.
7522 * state-purge.cc (state_purge_annotator::add_node_annotations):
7523 Return a bool, add a "within_table" param.
7524 (print_vec_of_names): Convert begin_tr calls to begin_trtd.
7525 Convert end_tr calls to end_tdtr.
7526 (state_purge_annotator::add_stmt_annotations): Add "within_row"
7528 * state-purge.h ((state_purge_annotator::add_node_annotations):
7529 Return a bool, add a "within_table" param.
7530 (state_purge_annotator::add_stmt_annotations): Add "within_row"
7532 * supergraph.cc (supernode::dump_dot): Call add_node_annotations
7533 twice: as before, passing false for "within_table", then again
7534 with true when within the TABLE element. Convert some begin_tr
7535 calls to begin_trtd, and some end_tr calls to end_tdtr.
7536 Repeat each add_stmt_annotations call, distinguishing between
7537 calls that add TRs and those that add TDs to an existing TR.
7538 Add a call to add_after_node_annotations.
7539 * supergraph.h (dot_annotator::add_node_annotations): Add a
7540 "within_table" param.
7541 (dot_annotator::add_stmt_annotations): Add a "within_row" param.
7542 (dot_annotator::add_after_node_annotations): New vfunc.
7544 2020-03-27 David Malcolm <dmalcolm@redhat.com>
7546 * diagnostic-manager.cc (dedupe_winners::add): Show the
7547 exploded_node index in the log messages.
7548 (diagnostic_manager::emit_saved_diagnostics): Log a summary of
7549 m_saved_diagnostics at entry.
7551 2020-03-27 David Malcolm <dmalcolm@redhat.com>
7553 * supergraph.cc (superedge::dump): Add space before description;
7554 move newline to non-pretty_printer overload.
7556 2020-03-18 David Malcolm <dmalcolm@redhat.com>
7558 * region-model.cc: Include "stor-layout.h".
7559 (region_model::dump_to_pp): Rather than calling
7560 dump_summary_of_map on each of the current frame and the globals,
7561 instead get a vec of representative path_vars for all regions,
7562 and then dump a summary of all of them.
7563 (region_model::dump_summary_of_map): Delete, rewriting into...
7564 (region_model::dump_summary_of_rep_path_vars): ...this new
7565 function, working on a vec of path_vars.
7566 (region_model::set_value): New overload.
7567 (region_model::get_representative_path_var): Rename
7568 "parent_region" local to "parent_reg" and consolidate with other
7569 local. Guard test for grandparent being stack on parent_reg being
7570 non-NULL. Move handling for parent being an array_region to
7571 within guard for parent_reg being non-NULL.
7572 (selftest::make_test_compound_type): New function.
7573 (selftest::test_dump_2): New selftest.
7574 (selftest::test_dump_3): New selftest.
7575 (selftest::test_stack_frames): Update expected output from
7576 simplified dump to show "a" and "b" from parent frame and "y" in
7578 (selftest::analyzer_region_model_cc_tests): Call test_dump_2 and
7580 * region-model.h (region_model::set_value): New overload decl.
7581 (region_model::dump_summary_of_map): Delete.
7582 (region_model::dump_summary_of_rep_path_vars): New.
7584 2020-03-18 David Malcolm <dmalcolm@redhat.com>
7586 * region-model.h (class noop_region_model_context): New subclass
7587 of region_model_context.
7588 (class tentative_region_model_context): Inherit from
7589 noop_region_model_context rather than from region_model_context;
7590 drop redundant vfunc implementations.
7591 (class test_region_model_context): Likewise.
7593 2020-03-18 David Malcolm <dmalcolm@redhat.com>
7595 * engine.cc (exploded_node::exploded_node): Move implementation
7596 here from header; accept point_and_state by const reference rather
7598 * exploded-graph.h (exploded_node::exploded_node): Pass
7599 point_and_state by const reference rather than by value. Move
7602 2020-03-18 Jakub Jelinek <jakub@redhat.com>
7604 * sm-malloc.cc (malloc_state_machine::on_stmt): Fix up duplicated word
7606 * region-model.cc (region_model::make_region_for_unexpected_tree_code,
7607 region_model::delete_region_and_descendents): Likewise.
7608 * engine.cc (class exploded_cluster): Likewise.
7609 * diagnostic-manager.cc (class path_builder): Likewise.
7611 2020-03-13 David Malcolm <dmalcolm@redhat.com>
7615 * diagnostic-manager.cc (for_each_state_change): Bulletproof
7616 against errors in get_rvalue by passing a
7617 tentative_region_model_context and rejecting if there's an error.
7618 * region-model.cc (region_model::get_lvalue_1): When handling
7619 ARRAY_REF, handle results of error-handling. Handle NOP_EXPR.
7621 2020-03-06 David Malcolm <dmalcolm@redhat.com>
7623 * analyzer.h (class array_region): New forward decl.
7624 * program-state.cc (selftest::test_program_state_dumping_2): New.
7625 (selftest::analyzer_program_state_cc_tests): Call it.
7626 * region-model.cc (array_region::constant_from_key): New.
7627 (region_model::get_representative_tree): Handle region_svalue by
7628 generating an ADDR_EXPR.
7629 (region_model::get_representative_path_var): In view handling,
7630 remove erroneous TREE_TYPE when determining the type of the tree.
7631 Handle array regions and STRING_CST.
7632 (selftest::assert_dump_tree_eq): New.
7633 (ASSERT_DUMP_TREE_EQ): New macro.
7634 (selftest::test_get_representative_tree): New selftest.
7635 (selftest::analyzer_region_model_cc_tests): Call it.
7636 * region-model.h (region::dyn_cast_array_region): New vfunc.
7637 (array_region::dyn_cast_array_region): New vfunc implementation.
7638 (array_region::constant_from_key): New decl.
7640 2020-03-06 David Malcolm <dmalcolm@redhat.com>
7642 * analyzer.h (dump_quoted_tree): New decl.
7643 * engine.cc (exploded_node::dump_dot): Pass region model to
7644 sm_state_map::print.
7645 * program-state.cc: Include diagnostic-core.h.
7646 (sm_state_map::print): Add "model" param and use it to print
7647 representative trees. Only print origin information if non-null.
7648 (sm_state_map::dump): Pass NULL for model to print call.
7649 (program_state::print): Pass region model to sm_state_map::print.
7650 (program_state::dump_to_pp): Use spaces rather than newlines when
7651 summarizing. Pass region_model to sm_state_map::print.
7652 (ana::selftest::assert_dump_eq): New function.
7653 (ASSERT_DUMP_EQ): New macro.
7654 (ana::selftest::test_program_state_dumping): New function.
7655 (ana::selftest::analyzer_program_state_cc_tests): Call it.
7656 * program-state.h (program_state::print): Add model param.
7657 * region-model.cc (dump_quoted_tree): New function.
7658 (map_region::print_fields): Use dump_quoted_tree rather than
7659 %qE to avoid lang-dependent output.
7660 (map_region::dump_child_label): Likewise.
7661 (region_model::dump_summary_of_map): For SK_REGION, when
7662 get_representative_path_var fails, print the region id rather than
7663 erroneously printing NULL.
7664 * sm.cc (state_machine::get_state_by_name): New function.
7665 * sm.h (state_machine::get_state_by_name): New decl.
7667 2020-03-04 David Malcolm <dmalcolm@redhat.com>
7669 * region-model.cc (region::validate): Convert model param from ptr
7670 to reference. Update comment to reflect that it's now a vfunc.
7671 (map_region::validate): New vfunc implementation.
7672 (array_region::validate): New vfunc implementation.
7673 (stack_region::validate): New vfunc implementation.
7674 (root_region::validate): New vfunc implementation.
7675 (region_model::validate): Pass a reference rather than a pointer
7676 to the region::validate vfunc.
7677 * region-model.h (region::validate): Make virtual. Convert model
7678 param from ptr to reference.
7679 (map_region::validate): New vfunc decl.
7680 (array_region::validate): New vfunc decl.
7681 (stack_region::validate): New vfunc decl.
7682 (root_region::validate): New vfunc decl.
7684 2020-03-04 David Malcolm <dmalcolm@redhat.com>
7687 * region-model.cc (region_model::on_call_pre): Handle
7688 BUILT_IN_EXPECT and its variants.
7689 (region_model::add_any_constraints_from_ssa_def_stmt): Split out
7690 gassign handling into add_any_constraints_from_gassign; add gcall
7692 (region_model::add_any_constraints_from_gassign): New function,
7693 based on the above. Add handling for NOP_EXPR.
7694 (region_model::add_any_constraints_from_gcall): New function.
7695 (region_model::get_representative_path_var): Handle views.
7697 (region_model::add_any_constraints_from_ssa_def_stmt): New decl.
7698 (region_model::add_any_constraints_from_gassign): New decl.
7700 2020-03-04 David Malcolm <dmalcolm@redhat.com>
7703 * checker-path.h (state_change_event::get_lvalue): Add ctxt param
7704 and pass it to region_model::get_value call.
7705 * diagnostic-manager.cc (get_any_origin): Pass a
7706 tentative_region_model_context to the calls to get_lvalue and reject
7707 the comparison if errors occur.
7708 (can_be_expr_of_interest_p): New function.
7709 (diagnostic_manager::prune_for_sm_diagnostic): Replace checks for
7710 CONSTANT_CLASS_P with calls to update_for_unsuitable_sm_exprs.
7711 Pass a tentative_region_model_context to the calls to
7712 state_change_event::get_lvalue and reject the comparison if errors
7714 (diagnostic_manager::update_for_unsuitable_sm_exprs): New.
7715 * diagnostic-manager.h
7716 (diagnostic_manager::update_for_unsuitable_sm_exprs): New decl.
7717 * region-model.h (class tentative_region_model_context): New class.
7719 2020-03-04 David Malcolm <dmalcolm@redhat.com>
7721 * engine.cc (worklist::worklist): Remove unused field m_eg.
7722 (class viz_callgraph_edge): Remove unused field m_call_sedge.
7723 (class viz_callgraph): Remove unused field m_sg.
7724 * exploded-graph.h (worklist::::m_eg): Remove unused field.
7726 2020-03-02 David Malcolm <dmalcolm@redhat.com>
7728 * analyzer.opt (fanalyzer-show-duplicate-count): New option.
7729 * diagnostic-manager.cc
7730 (diagnostic_manager::emit_saved_diagnostic): Use the above to
7731 guard the printing of the duplicate count.
7733 2020-03-02 David Malcolm <dmalcolm@redhat.com>
7736 * analyzer.cc (is_std_function_p): New function.
7737 (is_std_named_call_p): New functions.
7738 * analyzer.h (is_std_named_call_p): New decl.
7739 * sm-malloc.cc (malloc_state_machine::on_stmt): Check for "std::"
7740 variants when checking for malloc, calloc and free.
7742 2020-02-26 David Malcolm <dmalcolm@redhat.com>
7745 * diagnostic-manager.cc
7746 (diagnostic_manager::prune_for_sm_diagnostic): Assert that var is
7747 either NULL or not a constant. When updating var, bulletproof
7748 against constant values.
7750 2020-02-26 David Malcolm <dmalcolm@redhat.com>
7753 * region-model.cc (region_model::get_fndecl_for_call): Gracefully
7754 fail for fn_decls that don't have a cgraph_node.
7756 2020-02-26 David Malcolm <dmalcolm@redhat.com>
7758 * bar-chart.cc: New file.
7759 * bar-chart.h: New file.
7760 * engine.cc: Include "analyzer/bar-chart.h".
7761 (stats::log): Only log the m_num_nodes kinds that are non-zero.
7762 (stats::dump): Likewise when dumping.
7763 (stats::get_total_enodes): New.
7764 (exploded_graph::get_or_create_node): Increment the per-point-data
7765 m_excess_enodes when hitting the per-program-point limit on
7767 (exploded_graph::print_bar_charts): New.
7768 (exploded_graph::log_stats): Log the number of unprocessed enodes
7769 in the worklist. Call print_bar_charts.
7770 (exploded_graph::dump_stats): Print the number of unprocessed
7771 enodes in the worklist.
7772 * exploded-graph.h (stats::get_total_enodes): New decl.
7773 (struct per_program_point_data): Add field m_excess_enodes.
7774 (exploded_graph::print_bar_charts): New decl.
7775 * supergraph.cc (superedge::dump): New.
7776 (superedge::dump): New.
7777 * supergraph.h (supernode::get_function): New.
7778 (superedge::dump): New decl.
7779 (superedge::dump): New decl.
7781 2020-02-24 David Malcolm <dmalcolm@redhat.com>
7783 * engine.cc (exploded_graph::get_or_create_node): Dump the
7784 program_state to the pp, rather than to stderr.
7786 2020-02-24 David Malcolm <dmalcolm@redhat.com>
7789 * sm.cc (make_checkers): Require the "taint" checker to be
7792 2020-02-24 David Malcolm <dmalcolm@redhat.com>
7796 (impl_region_model_context::impl_region_model_context): Add logger
7798 * engine.cc (exploded_graph::add_function_entry): Create an
7799 impl_region_model_context and pass it to the push_frame call.
7800 Bail if the resulting state is invalid.
7801 (exploded_graph::build_initial_worklist): Likewise.
7802 (exploded_graph::build_initial_worklist): Handle the case where
7803 add_function_entry fails.
7805 (impl_region_model_context::impl_region_model_context): Add logger
7807 * region-model.cc (map_region::get_or_create): Add ctxt param and
7808 pass it to add_region_for_type.
7809 (map_region::can_merge_p): Pass NULL as a ctxt to call to
7811 (array_region::get_element): Pass ctxt to call to get_or_create.
7812 (array_region::get_or_create): Add ctxt param and pass it to
7813 add_region_for_type.
7814 (root_region::push_frame): Pass ctxt to get_or_create calls.
7815 (region_model::get_lvalue_1): Likewise.
7816 (region_model::make_region_for_unexpected_tree_code): Assert that
7818 (region_model::get_rvalue_1): Pass ctxt to get_svalue_for_fndecl
7819 and get_svalue_for_label calls.
7820 (region_model::get_svalue_for_fndecl): Add ctxt param and pass it
7821 to get_region_for_fndecl.
7822 (region_model::get_region_for_fndecl): Add ctxt param and pass it
7824 (region_model::get_svalue_for_label): Add ctxt param and pass it
7825 to get_region_for_label.
7826 (region_model::get_region_for_label): Add ctxt param and pass it
7827 to get_region_for_fndecl and get_or_create.
7828 (region_model::get_field_region): Add ctxt param and pass it to
7829 get_or_create_view and get_or_create.
7830 (make_region_for_type): Replace gcc_unreachable with return NULL.
7831 (region_model::add_region_for_type): Add ctxt param. Handle a
7832 return of NULL from make_region_for_type by calling
7833 make_region_for_unexpected_tree_code.
7834 (region_model::get_or_create_mem_ref): Pass ctxt to calls to
7836 (region_model::get_or_create_view): Add ctxt param and pass it to
7837 add_region_for_type.
7838 (selftest::test_state_merging): Pass ctxt to get_or_create_view.
7839 * region-model.h (region_model::get_or_create): Add ctxt param.
7840 (region_model::add_region_for_type): Likewise.
7841 (region_model::get_svalue_for_fndecl): Likewise.
7842 (region_model::get_svalue_for_label): Likewise.
7843 (region_model::get_region_for_fndecl): Likewise.
7844 (region_model::get_region_for_label): Likewise.
7845 (region_model::get_field_region): Likewise.
7846 (region_model::get_or_create_view): Likewise.
7848 2020-02-24 David Malcolm <dmalcolm@redhat.com>
7850 * checker-path.cc (superedge_event::should_filter_p): Update
7851 filter for empty descriptions to cover verbosity level 3 as well
7853 * diagnostic-manager.cc: Include "analyzer/reachability.h".
7854 (class path_builder): New class.
7855 (diagnostic_manager::emit_saved_diagnostic): Create a path_builder
7856 and pass it to build_emission_path, rather passing eg; similarly
7857 for add_events_for_eedge and ext_state.
7858 (diagnostic_manager::build_emission_path): Replace "eg" param
7859 with a path_builder, pass it to add_events_for_eedge.
7860 (diagnostic_manager::add_events_for_eedge): Replace ext_state
7861 param with path_builder; pass it to add_events_for_superedge.
7862 (diagnostic_manager::significant_edge_p): New.
7863 (diagnostic_manager::add_events_for_superedge): Add path_builder
7864 param. Reject insignificant edges at verbosity levels below 3.
7865 (diagnostic_manager::prune_for_sm_diagnostic): Update highest
7866 verbosity level to 4.
7867 * diagnostic-manager.h (class path_builder): New forward decl.
7868 (diagnostic_manager::build_emission_path): Replace "eg" param
7869 with a path_builder.
7870 (diagnostic_manager::add_events_for_eedge): Replace ext_state
7871 param with path_builder.
7872 (diagnostic_manager::significant_edge_p): New.
7873 (diagnostic_manager::add_events_for_superedge): Add path_builder
7875 * reachability.h: New file.
7877 2020-02-18 David Malcolm <dmalcolm@redhat.com>
7880 * analyzer.opt (fdump-analyzer-callgraph): Rewrite description.
7882 2020-02-18 David Malcolm <dmalcolm@redhat.com>
7885 * region-model.cc (region_model::maybe_cast_1): Replace assertion
7886 that build_cast returns non-NULL with a conditional, falling
7887 through to the logic which returns a new unknown value of the
7888 desired type if it fails.
7890 2020-02-18 David Malcolm <dmalcolm@redhat.com>
7893 * engine.cc (impl_region_model_context::on_unknown_tree_code):
7895 (impl_region_model_context::on_unexpected_tree_code): ...this and
7896 convert first argument from path_var to tree.
7897 (exploded_node::on_stmt): Pass ctxt to purge_for_unknown_fncall.
7898 * exploded-graph.h (region_model_context::on_unknown_tree_code):
7900 (region_model_context::on_unexpected_tree_code): ...this and
7901 convert first argument from path_var to tree.
7902 * program-state.cc (sm_state_map::purge_for_unknown_fncall): Add
7903 ctxt param and pass on to calls to get_rvalue.
7904 * program-state.h (sm_state_map::purge_for_unknown_fncall): Add
7906 * region-model.cc (region_model::handle_unrecognized_call): Pass
7907 ctxt on to call to get_rvalue.
7908 (region_model::get_lvalue_1): Move body of default case to
7909 region_model::make_region_for_unexpected_tree_code and call it.
7910 Within COMPONENT_REF case, reject attempts to handle types other
7911 than RECORD_TYPE and UNION_TYPE.
7912 (region_model::make_region_for_unexpected_tree_code): New
7913 function, based on default case of region_model::get_lvalue_1.
7915 (region_model::make_region_for_unexpected_tree_code): New decl.
7916 (region_model::on_unknown_tree_code): Rename to...
7917 (region_model::on_unexpected_tree_code): ...this and convert first
7918 argument from path_var to tree.
7919 (class test_region_model_context): Update vfunc implementation for
7922 2020-02-18 David Malcolm <dmalcolm@redhat.com>
7926 (region_model::convert_byte_offset_to_array_index): Use
7927 int_size_in_bytes before calling size_in_bytes, to gracefully fail
7928 on incomplete types.
7930 2020-02-17 David Malcolm <dmalcolm@redhat.com>
7933 * region-model.cc (region_model::get_fndecl_for_call): Handle the
7934 case where the code_region's get_tree_for_child_region returns
7937 2020-02-17 David Malcolm <dmalcolm@redhat.com>
7940 * engine.cc (impl_region_model_context::on_unknown_tree_code):
7942 (exploded_graph::get_or_create_node): Reject invalid states.
7944 (impl_region_model_context::on_unknown_tree_code): New decl.
7945 (point_and_state::point_and_state): Assert that the state is
7947 * program-state.cc (program_state::program_state): Initialize
7949 (program_state::operator=): Copy m_valid.
7950 (program_state::program_state): Likewise for move constructor.
7951 (program_state::print): Print m_valid.
7952 (program_state::dump_to_pp): Likewise.
7953 * program-state.h (program_state::m_valid): New field.
7954 * region-model.cc (region_model::get_lvalue_1): Implement the
7955 default case by returning a new symbolic region and calling
7956 the context's on_unknown_tree_code, rather than issuing an
7957 internal_error. Implement VIEW_CONVERT_EXPR.
7958 * region-model.h (region_model_context::on_unknown_tree_code): New
7960 (test_region_model_context::on_unknown_tree_code): New.
7962 2020-02-17 David Malcolm <dmalcolm@redhat.com>
7964 * sm-malloc.cc (malloc_diagnostic::describe_state_change): For
7965 transition to the "null" state, only say "assuming" when
7966 transitioning from the "unchecked" state.
7968 2020-02-17 David Malcolm <dmalcolm@redhat.com>
7970 * diagnostic-manager.h (diagnostic_manager::get_saved_diagnostic):
7972 * engine.cc (exploded_node::dump_dot): Dump saved_diagnostics.
7973 * exploded-graph.h (exploded_graph::get_diagnostic_manager): Add
7976 2020-02-11 David Malcolm <dmalcolm@redhat.com>
7979 * analysis-plan.cc (analysis_plan::use_summary_p): Look through
7980 the ultimate_alias_target when getting the called function.
7981 * engine.cc (exploded_node::on_stmt): Rename second "ctxt" to
7982 "sm_ctxt". Use the region_model's get_fndecl_for_call rather than
7984 * region-model.cc (region_model::get_fndecl_for_call): Use
7985 ultimate_alias_target on fndecl.
7986 * supergraph.cc (get_ultimate_function_for_cgraph_edge): New
7988 (supergraph_call_edge): Use it when rejecting edges without
7990 (supergraph::supergraph): Use it to get the function for the
7991 cgraph_edge when building interprocedural superedges.
7992 (callgraph_superedge::get_callee_function): Use it.
7993 * supergraph.h (supergraph::get_num_snodes): Make param const.
7994 (supergraph::function_to_num_snodes_t): Make first type param
7997 2020-02-11 David Malcolm <dmalcolm@redhat.com>
8000 * engine.cc (exploded_edge::exploded_edge): Add ext_state param
8001 and pass it to change.validate.
8002 (exploded_graph::get_or_create_node): Move purging of change
8003 svalues to also cover the case of reusing an existing enode.
8004 (exploded_graph::add_edge): Pass m_ext_state to exploded_edge's
8006 * exploded-graph.h (exploded_edge::exploded_edge): Add ext_state
8008 * program-state.cc (state_change::sm_change::validate): Likewise.
8009 Assert that m_sm_idx is sane. Use ext_state to validate
8010 m_old_state and m_new_state.
8011 (state_change::validate): Add ext_state param and pass it to
8012 the sm_change validate calls.
8013 * program-state.h (state_change::sm_change::validate): Add
8015 (state_change::validate): Likewise.
8017 2020-02-11 David Malcolm <dmalcolm@redhat.com>
8020 * engine.cc (exploded_graph::dump_exploded_nodes): Handle missing
8021 case of STATUS_WORKLIST in implementation of
8022 "__analyzer_dump_exploded_nodes".
8024 2020-02-11 David Malcolm <dmalcolm@redhat.com>
8027 * constraint-manager.cc (constraint_manager::add_constraint): When
8028 merging equivalence classes and updating m_constant, also update
8030 (constraint_manager::validate): If m_constant is non-NULL assert
8031 that m_cst_sid is non-null and is valid.
8033 2020-02-11 David Malcolm <dmalcolm@redhat.com>
8036 * analyzer.opt (fdump-analyzer): Reword description.
8037 (fdump-analyzer-stderr): Likewise.
8039 2020-02-11 David Malcolm <dmalcolm@redhat.com>
8041 * region-model.cc (print_quoted_type): New function.
8042 (svalue::print): Use it to replace %qT.
8043 (region::dump_to_pp): Likewise.
8044 (region::dump_child_label): Likewise.
8045 (region::print_fields): Likewise.
8047 2020-02-10 David Malcolm <dmalcolm@redhat.com>
8050 * analyzer.opt (-param=analyzer-max-recursion-depth=): Fix "tha"
8052 (Wanalyzer-use-of-uninitialized-value): Fix "initialized" ->
8053 "uninitialized" typo.
8055 2020-02-10 David Malcolm <dmalcolm@redhat.com>
8058 * region-model.cc (region_model::get_lvalue_1):
8059 Handle BIT_FIELD_REF.
8060 (make_region_for_type): Handle VECTOR_TYPE.
8062 2020-02-10 David Malcolm <dmalcolm@redhat.com>
8065 * diagnostic-manager.cc
8066 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof against
8068 * region-model.cc (region_model::get_lvalue_1): Provide a better
8069 error message when encountering an unhandled tree code.
8071 2020-02-10 David Malcolm <dmalcolm@redhat.com>
8074 * region-model.cc (region_model::get_lvalue_1): Implement
8077 2020-02-06 David Malcolm <dmalcolm@redhat.com>
8079 * region-model.cc (region_model::maybe_cast_1): Attempt to provide
8080 a region_svalue if either type is a pointer, rather than if both
8083 2020-02-05 David Malcolm <dmalcolm@redhat.com>
8085 * engine.cc (exploded_node::dump_dot): Show merger enodes.
8086 (worklist::add_node): Assert that the node's m_status is
8088 (exploded_graph::process_worklist): Likewise for nodes from the
8089 worklist. Set status of merged nodes to STATUS_MERGER.
8090 (exploded_graph::process_node): Set status of node to
8092 (exploded_graph::dump_exploded_nodes): Rework handling of
8093 "__analyzer_dump_exploded_nodes", splitting enodes by status into
8094 "processed" and "merger", showing the count of just the processed
8095 enodes at the call, rather than the count of all enodes.
8096 * exploded-graph.h (exploded_node::status): New enum.
8097 (exploded_node::exploded_node): Initialize m_status to
8099 (exploded_node::get_status): New getter.
8100 (exploded_node::set_status): New setter.
8102 2020-02-04 David Malcolm <dmalcolm@redhat.com>
8105 * engine.cc (pod_hash_traits<function_call_string>::mark_empty):
8106 Eliminate reinterpret_cast.
8107 (pod_hash_traits<function_call_string>::is_empty): Likewise.
8109 2020-02-03 David Malcolm <dmalcolm@redhat.com>
8111 * constraint-manager.cc (range::constrained_to_single_element):
8112 Replace fold_build2 with fold_binary. Remove unnecessary newline.
8113 (constraint_manager::get_or_add_equiv_class): Replace fold_build2
8114 with fold_binary in two places, and remove out-of-date comment.
8115 (constraint_manager::eval_condition): Replace fold_build2 with
8117 * region-model.cc (constant_svalue::eval_condition): Likewise.
8118 (region_model::on_assignment): Likewise.
8120 2020-02-03 David Malcolm <dmalcolm@redhat.com>
8123 * diagnostic-manager.cc
8124 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof
8125 against bad choices due to bad paths.
8126 * engine.cc (impl_region_model_context::on_phi): New.
8127 * exploded-graph.h (impl_region_model_context::on_phi): New decl.
8128 * region-model.cc (region_model::on_longjmp): Likewise.
8129 (region_model::handle_phi): Add phi param. Call the ctxt's on_phi
8131 (region_model::update_for_phis): Pass phi to handle_phi.
8132 * region-model.h (region_model::handle_phi): Add phi param.
8133 (region_model_context::on_phi): New vfunc.
8134 (test_region_model_context::on_phi): New.
8135 * sm-malloc.cc (malloc_state_machine::on_phi): New.
8136 (malloc_state_machine::on_zero_assignment): New.
8137 * sm.h (state_machine::on_phi): New vfunc.
8139 2020-02-03 David Malcolm <dmalcolm@redhat.com>
8141 * engine.cc (supernode_cluster::dump_dot): Show BB index as
8143 * supergraph.cc (supernode::dump_dot): Likewise.
8145 2020-02-03 David Malcolm <dmalcolm@redhat.com>
8148 * region-model.cc (region_model::on_call_pre): Update for new
8149 param of symbolic_region ctor.
8150 (region_model::deref_rvalue): Likewise.
8151 (region_model::add_new_malloc_region): Likewise.
8152 (make_region_for_type): Likewise, preserving type.
8153 * region-model.h (symbolic_region::symbolic_region): Add "type"
8154 param and pass it to base class ctor.
8156 2020-02-03 David Malcolm <dmalcolm@redhat.com>
8159 * constraint-manager.cc
8160 (constraint_manager::get_or_add_equiv_class): Ensure types are
8161 compatible before comparing constants.
8163 2020-01-31 David Malcolm <dmalcolm@redhat.com>
8166 * region-model.cc (make_region_for_type): Use VOID_TYPE_P rather
8167 than checking against void_type_node.
8169 2020-01-31 David Malcolm <dmalcolm@redhat.com>
8172 * region-model.cc (ASSERT_COMPAT_TYPES): Convert to...
8173 (assert_compat_types): ...this, and bail when either type is NULL,
8174 or when VOID_TYPE_P (dst_type).
8175 (region_model::get_lvalue): Update for above conversion.
8176 (region_model::get_rvalue): Likewise.
8178 2020-01-31 David Malcolm <dmalcolm@redhat.com>
8181 * region-model.cc (region_model::update_for_return_superedge):
8182 Move check for null result so that it also guards setting the
8185 2020-01-31 David Malcolm <dmalcolm@redhat.com>
8188 * region-model.cc (stack_region::can_merge_p): Split into a two
8189 pass approach, creating all stack regions first, then populating
8191 (selftest::test_state_merging): Add test coverage for (a) the case
8192 of self-merging a model in which a local in an older stack frame
8193 points to a local in a more recent stack frame (which previously
8194 would ICE), and (b) the case of self-merging a model in which a
8195 local points to a global (which previously worked OK).
8197 2020-01-31 David Malcolm <dmalcolm@redhat.com>
8199 * analyzer.cc (is_named_call_p): Replace tests for fndecl being
8200 extern at file scope and having a non-NULL DECL_NAME with a call
8201 to maybe_special_function_p.
8202 * function-set.cc (function_set::contains_decl_p): Add call to
8203 maybe_special_function_p.
8205 2020-01-31 David Malcolm <dmalcolm@redhat.com>
8208 * constraint-manager.cc
8209 (constraint_manager::get_or_add_equiv_class): Only compare constants
8210 if their types are compatible.
8211 * region-model.cc (constant_svalue::eval_condition): Replace check
8212 for identical types with call to types_compatible_p.
8214 2020-01-30 David Malcolm <dmalcolm@redhat.com>
8216 * program-state.cc (extrinsic_state::dump_to_pp): New.
8217 (extrinsic_state::dump_to_file): New.
8218 (extrinsic_state::dump): New.
8219 * program-state.h (extrinsic_state::dump_to_pp): New decl.
8220 (extrinsic_state::dump_to_file): New decl.
8221 (extrinsic_state::dump): New decl.
8222 * sm.cc: Include "pretty-print.h".
8223 (state_machine::dump_to_pp): New.
8224 * sm.h (state_machine::dump_to_pp): New decl.
8226 2020-01-30 David Malcolm <dmalcolm@redhat.com>
8228 * diagnostic-manager.cc (for_each_state_change): Use
8229 extrinsic_state::get_num_checkers rather than accessing m_checkers
8231 * program-state.cc (program_state::program_state): Likewise.
8232 * program-state.h (extrinsic_state::m_checkers): Make private.
8234 2020-01-30 David Malcolm <dmalcolm@redhat.com>
8237 * region-model.cc (region_model::eval_condition): In both
8238 overloads, bail out immediately on floating-point types.
8239 (region_model::eval_condition_without_cm): Likewise.
8240 (region_model::add_constraint): Likewise.
8242 2020-01-30 David Malcolm <dmalcolm@redhat.com>
8245 * program-state.cc (sm_state_map::set_state): For the overload
8246 taking an svalue_id, bail out if the set_state on the ec does
8247 nothing. Convert the latter's return type from void to bool,
8248 returning true if anything changed.
8249 (sm_state_map::impl_set_state): Convert the return type from void
8250 to bool, returning true if the state changed.
8251 * program-state.h (sm_state_map::set_state): Convert return type
8253 (sm_state_map::impl_set_state): Likewise.
8254 * region-model.cc (constant_svalue::eval_condition): Only call
8255 fold_build2 if the types are the same.
8257 2020-01-29 Jakub Jelinek <jakub@redhat.com>
8259 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Remove.
8260 * constraint-manager.cc: Include diagnostic-core.h before graphviz.h.
8261 (range::dump, equiv_class::print): Don't use PUSH_IGNORE_WFORMAT or
8263 * state-purge.cc: Include diagnostic-core.h before
8264 gimple-pretty-print.h.
8265 (state_purge_annotator::add_node_annotations, print_vec_of_names):
8266 Don't use PUSH_IGNORE_WFORMAT or POP_IGNORE_WFORMAT.
8267 * region-model.cc: Move diagnostic-core.h include before graphviz.h.
8268 (path_var::dump, svalue::print, constant_svalue::print_details,
8269 region::dump_to_pp, region::dump_child_label, region::print_fields,
8270 map_region::print_fields, map_region::dump_dot_to_pp,
8271 map_region::dump_child_label, array_region::print_fields,
8272 array_region::dump_dot_to_pp): Don't use PUSH_IGNORE_WFORMAT or
8275 2020-01-28 David Malcolm <dmalcolm@redhat.com>
8278 * engine.cc (rewind_info_t::update_model): Get the longjmp call
8279 stmt via get_longjmp_call () rather than assuming it is the last
8280 stmt in the longjmp's supernode.
8281 (rewind_info_t::add_events_to_path): Get the location_t for the
8282 rewind_from_longjmp_event via get_longjmp_call () rather than from
8283 the supernode's get_end_location ().
8285 2020-01-28 David Malcolm <dmalcolm@redhat.com>
8287 * region-model.cc (poisoned_value_diagnostic::emit): Update for
8288 renaming of warning_at overload to warning_meta.
8289 * sm-file.cc (file_leak::emit): Likewise.
8290 * sm-malloc.cc (double_free::emit): Likewise.
8291 (possible_null_deref::emit): Likewise.
8292 (possible_null_arg::emit): Likewise.
8293 (null_deref::emit): Likewise.
8294 (null_arg::emit): Likewise.
8295 (use_after_free::emit): Likewise.
8296 (malloc_leak::emit): Likewise.
8297 (free_of_non_heap::emit): Likewise.
8298 * sm-sensitive.cc (exposure_through_output_file::emit): Likewise.
8299 * sm-signal.cc (signal_unsafe_call::emit): Likewise.
8300 * sm-taint.cc (tainted_array_index::emit): Likewise.
8302 2020-01-27 David Malcolm <dmalcolm@redhat.com>
8305 * region-model.cc (tree_cmp): For the REAL_CST case, impose an
8306 arbitrary order on NaNs relative to other NaNs and to non-NaNs;
8307 const-correctness tweak.
8308 (ana::selftests::build_real_cst_from_string): New function.
8309 (ana::selftests::append_interesting_constants): New function.
8310 (ana::selftests::test_tree_cmp_on_constants): New test.
8311 (ana::selftests::test_canonicalization_4): New test.
8312 (ana::selftests::analyzer_region_model_cc_tests): Call the new
8315 2020-01-27 David Malcolm <dmalcolm@redhat.com>
8318 * engine.cc (run_checkers): Save and restore input_location.
8320 2020-01-27 David Malcolm <dmalcolm@redhat.com>
8322 * call-string.cc (call_string::cmp_1): Delete, moving body to...
8323 (call_string::cmp): ...here.
8324 * call-string.h (call_string::cmp_1): Delete decl.
8325 * engine.cc (worklist::key_t::cmp_1): Delete, moving body to...
8326 (worklist::key_t::cmp): ...here. Implement hash comparisons
8327 via comparison rather than subtraction to avoid overflow issues.
8328 * exploded-graph.h (worklist::key_t::cmp_1): Delete decl.
8329 * region-model.cc (tree_cmp): Eliminate buggy checking for
8332 2020-01-27 David Malcolm <dmalcolm@redhat.com>
8334 * analyzer.cc (is_named_call_p): Check that fndecl is "extern"
8335 and at file scope. Potentially disregard prefix _ or __ in
8336 fndecl's name. Bail if the identifier is NULL.
8337 (is_setjmp_call_p): Expect a gcall rather than plain gimple.
8338 Remove special-case check for leading prefix, and also check for
8340 (is_longjmp_call_p): Also check for siglongjmp.
8341 (get_user_facing_name): New function.
8342 * analyzer.h (is_setjmp_call_p): Expect a gcall rather than plain
8344 (get_user_facing_name): New decl.
8345 * checker-path.cc (setjmp_event::get_desc): Use
8346 get_user_facing_name to avoid hardcoding the function name.
8347 (rewind_event::rewind_event): Add rewind_info param, using it to
8348 initialize new m_rewind_info field, and strengthen the assertion.
8349 (rewind_from_longjmp_event::get_desc): Use get_user_facing_name to
8350 avoid hardcoding the function name.
8351 (rewind_to_setjmp_event::get_desc): Likewise.
8352 * checker-path.h (setjmp_event::setjmp_event): Add setjmp_call
8353 param and use it to initialize...
8354 (setjmp_event::m_setjmp_call): New field.
8355 (rewind_event::rewind_event): Add rewind_info param.
8356 (rewind_event::m_rewind_info): New protected field.
8357 (rewind_from_longjmp_event::rewind_from_longjmp_event): Add
8359 (class rewind_to_setjmp_event): Move rewind_info field to parent
8361 * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
8362 Update setjmp-handling for is_setjmp_call_p requiring a gcall;
8363 pass the call to the new setjmp_event.
8364 * engine.cc (exploded_node::on_stmt): Update for is_setjmp_call_p
8366 (stale_jmp_buf::emit): Use get_user_facing_name to avoid
8367 hardcoding the function names.
8368 (exploded_node::on_longjmp): Pass the longjmp_call when
8369 constructing rewind_info.
8370 (rewind_info_t::add_events_to_path): Pass the rewind_info_t to the
8371 rewind_from_longjmp_event's ctor.
8372 * exploded-graph.h (rewind_info_t::rewind_info_t): Add
8374 (rewind_info_t::get_longjmp_call): New.
8375 (rewind_info_t::m_longjmp_call): New.
8376 * region-model.cc (region_model::on_setjmp): Update comment to
8377 indicate this is also for sigsetjmp.
8378 * region-model.h (struct setjmp_record): Likewise.
8379 (class setjmp_svalue): Likewise.
8381 2020-01-27 David Malcolm <dmalcolm@redhat.com>
8384 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Guard these
8385 macros with GCC_VERSION >= 4006, making them no-op otherwise.
8386 * engine.cc (exploded_edge::exploded_edge): Specify template for
8387 base class initializer.
8388 (exploded_graph::add_edge): Specify template when chaining up to
8389 base class add_edge implementation.
8390 (viz_callgraph_node::dump_dot): Drop redundant "typename".
8391 (viz_callgraph_edge::viz_callgraph_edge): Specify template for
8392 base class initializer.
8393 * program-state.cc (sm_state_map::clone_with_remapping): Drop
8394 redundant "typename".
8395 (sm_state_map::print): Likewise.
8396 (sm_state_map::hash): Likewise.
8397 (sm_state_map::operator==): Likewise.
8398 (sm_state_map::remap_svalue_ids): Likewise.
8399 (sm_state_map::on_svalue_purge): Likewise.
8400 (sm_state_map::validate): Likewise.
8401 * program-state.h (sm_state_map::iterator_t): Likewise.
8402 * supergraph.h (superedge::superedge): Specify template for base
8405 2020-01-23 David Malcolm <dmalcolm@redhat.com>
8408 * supergraph.cc (callgraph_superedge::get_arg_for_parm): Fail
8409 gracefully is the number of parameters at the callee exceeds the
8410 number of arguments at the call stmt.
8411 (callgraph_superedge::get_parm_for_arg): Likewise.
8413 2020-01-22 David Malcolm <dmalcolm@redhat.com>
8416 * program-state.cc (sm_state_map::on_svalue_purge): If the
8417 entry survives, but the origin is being purged, then reset the
8420 2020-01-22 David Malcolm <dmalcolm@redhat.com>
8422 * sm-signal.cc: Fix nesting of CHECKING_P and namespace ana.
8424 2020-01-22 David Malcolm <dmalcolm@redhat.com>
8427 * engine.cc (setjmp_svalue::compare_fields): Update for
8428 replacement of m_enode with m_setjmp_record.
8429 (setjmp_svalue::add_to_hash): Likewise.
8430 (setjmp_svalue::get_index): Rename...
8431 (setjmp_svalue::get_enode_index): ...to this.
8432 (setjmp_svalue::print_details): Update for replacement of m_enode
8433 with m_setjmp_record.
8434 (exploded_node::on_longjmp): Likewise.
8435 * exploded-graph.h (rewind_info_t::m_enode_origin): Replace...
8436 (rewind_info_t::m_setjmp_record): ...with this.
8437 (rewind_info_t::rewind_info_t): Update for replacement of m_enode
8438 with m_setjmp_record.
8439 (rewind_info_t::get_setjmp_point): Likewise.
8440 (rewind_info_t::get_setjmp_call): Likewise.
8441 * region-model.cc (region_model::dump_summary_of_map): Likewise.
8442 (region_model::on_setjmp): Likewise.
8443 * region-model.h (struct setjmp_record): New struct.
8444 (setjmp_svalue::m_enode): Replace...
8445 (setjmp_svalue::m_setjmp_record): ...with this.
8446 (setjmp_svalue::setjmp_svalue): Update for replacement of m_enode
8447 with m_setjmp_record.
8448 (setjmp_svalue::clone): Likewise.
8449 (setjmp_svalue::get_index): Rename...
8450 (setjmp_svalue::get_enode_index): ...to this.
8451 (setjmp_svalue::get_exploded_node): Replace...
8452 (setjmp_svalue::get_setjmp_record): ...with this.
8454 2020-01-22 David Malcolm <dmalcolm@redhat.com>
8457 * analyzer.cc (is_setjmp_call_p): Check for "setjmp" as well as
8460 2020-01-22 David Malcolm <dmalcolm@redhat.com>
8463 * analysis-plan.h: Wrap everything namespace "ana".
8464 * analyzer-logging.cc: Likewise.
8465 * analyzer-logging.h: Likewise.
8466 * analyzer-pass.cc (pass_analyzer::execute): Update for "ana"
8468 * analyzer-selftests.cc: Wrap everything namespace "ana".
8469 * analyzer-selftests.h: Likewise.
8470 * analyzer.h: Likewise for forward decls of types.
8471 * call-string.h: Likewise.
8472 * checker-path.cc: Likewise.
8473 * checker-path.h: Likewise.
8474 * constraint-manager.cc: Likewise.
8475 * constraint-manager.h: Likewise.
8476 * diagnostic-manager.cc: Likewise.
8477 * diagnostic-manager.h: Likewise.
8478 * engine.cc: Likewise.
8479 * engine.h: Likewise.
8480 * exploded-graph.h: Likewise.
8481 * function-set.cc: Likewise.
8482 * function-set.h: Likewise.
8483 * pending-diagnostic.cc: Likewise.
8484 * pending-diagnostic.h: Likewise.
8485 * program-point.cc: Likewise.
8486 * program-point.h: Likewise.
8487 * program-state.cc: Likewise.
8488 * program-state.h: Likewise.
8489 * region-model.cc: Likewise.
8490 * region-model.h: Likewise.
8491 * sm-file.cc: Likewise.
8492 * sm-malloc.cc: Likewise.
8493 * sm-pattern-test.cc: Likewise.
8494 * sm-sensitive.cc: Likewise.
8495 * sm-signal.cc: Likewise.
8496 * sm-taint.cc: Likewise.
8499 * state-purge.h: Likewise.
8500 * supergraph.cc: Likewise.
8501 * supergraph.h: Likewise.
8503 2020-01-21 David Malcolm <dmalcolm@redhat.com>
8506 * region-model.cc (int_cmp): Rename to...
8507 (array_region::key_cmp): ...this, using key_t rather than int.
8508 Rewrite in terms of comparisons rather than subtraction to
8509 ensure qsort is anti-symmetric when handling extreme values.
8510 (array_region::walk_for_canonicalization): Update for above
8512 * region-model.h (array_region::key_cmp): New decl.
8514 2020-01-17 David Malcolm <dmalcolm@redhat.com>
8517 * region-model.cc (region_model::eval_condition_without_cm): Avoid
8518 gcc_unreachable for unexpected operations for the case where
8519 we're comparing an svalue against itself.
8521 2020-01-17 David Malcolm <dmalcolm@redhat.com>
8525 (region_model::convert_byte_offset_to_array_index): Convert to
8526 ssizetype before dividing by byte_size. Use fold_binary rather
8527 than fold_build2 to avoid needlessly constructing a tree for the
8530 2020-01-15 David Malcolm <dmalcolm@redhat.com>
8532 * engine.cc (class impl_region_model_context): Fix comment.
8534 2020-01-14 David Malcolm <dmalcolm@redhat.com>
8537 * region-model.cc (make_region_for_type): Use
8538 FUNC_OR_METHOD_TYPE_P rather than comparing against FUNCTION_TYPE.
8539 * region-model.h (function_region::function_region): Likewise.
8541 2020-01-14 David Malcolm <dmalcolm@redhat.com>
8543 * program-state.cc (sm_state_map::clone_with_remapping): Copy
8545 (selftest::test_program_state_merging_2): New selftest.
8546 (selftest::analyzer_program_state_cc_tests): Call it.
8548 2020-01-14 David Malcolm <dmalcolm@redhat.com>
8550 * checker-path.h (checker_path::get_checker_event): New function.
8551 (checker_path): Add DISABLE_COPY_AND_ASSIGN; make fields private.
8552 * diagnostic-manager.cc
8553 (diagnostic_manager::prune_for_sm_diagnostic): Replace direct
8554 access to checker_path::m_events with accessor functions. Fix
8556 (diagnostic_manager::prune_interproc_events): Replace direct
8557 access to checker_path::m_events with accessor functions.
8558 (diagnostic_manager::finish_pruning): Likewise.
8560 2020-01-14 David Malcolm <dmalcolm@redhat.com>
8562 * checker-path.h (checker_event::clone): Delete vfunc decl.
8563 (debug_event::clone): Delete vfunc impl.
8564 (custom_event::clone): Delete vfunc impl.
8565 (statement_event::clone): Delete vfunc impl.
8566 (function_entry_event::clone): Delete vfunc impl.
8567 (state_change_event::clone): Delete vfunc impl.
8568 (start_cfg_edge_event::clone): Delete vfunc impl.
8569 (end_cfg_edge_event::clone): Delete vfunc impl.
8570 (call_event::clone): Delete vfunc impl.
8571 (return_event::clone): Delete vfunc impl.
8572 (setjmp_event::clone): Delete vfunc impl.
8573 (rewind_from_longjmp_event::clone): Delete vfunc impl.
8574 (rewind_to_setjmp_event::clone): Delete vfunc impl.
8575 (warning_event::clone): Delete vfunc impl.
8577 2020-01-14 David Malcolm <dmalcolm@redhat.com>
8579 * supergraph.cc (supernode::dump_dot): Ensure that the TABLE
8580 element has at least one TR.
8582 2020-01-14 David Malcolm <dmalcolm@redhat.com>
8585 * engine.cc (leak_stmt_finder::find_stmt): Use get_pure_location
8586 when comparing against UNKNOWN_LOCATION.
8587 (stmt_requires_new_enode_p): Likewise.
8588 (exploded_graph::dump_exploded_nodes): Likewise.
8589 * supergraph.cc (supernode::get_start_location): Likewise.
8590 (supernode::get_end_location): Likewise.
8592 2020-01-14 David Malcolm <dmalcolm@redhat.com>
8595 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
8596 selftest::analyzer_sm_file_cc_tests.
8597 * analyzer-selftests.h (selftest::analyzer_sm_file_cc_tests): New
8599 * sm-file.cc: Include "analyzer/function-set.h" and
8600 "analyzer/analyzer-selftests.h".
8601 (get_file_using_fns): New function.
8602 (is_file_using_fn_p): New function.
8603 (fileptr_state_machine::on_stmt): Return true for known functions.
8604 (selftest::analyzer_sm_file_cc_tests): New function.
8606 2020-01-14 David Malcolm <dmalcolm@redhat.com>
8608 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
8609 selftest::analyzer_sm_signal_cc_tests.
8610 * analyzer-selftests.h (selftest::analyzer_sm_signal_cc_tests):
8612 * sm-signal.cc: Include "analyzer/function-set.h" and
8613 "analyzer/analyzer-selftests.h".
8614 (get_async_signal_unsafe_fns): New function.
8615 (signal_unsafe_p): Reimplement in terms of the above.
8616 (selftest::analyzer_sm_signal_cc_tests): New function.
8618 2020-01-14 David Malcolm <dmalcolm@redhat.com>
8620 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
8621 selftest::analyzer_function_set_cc_tests.
8622 * analyzer-selftests.h (selftest::analyzer_function_set_cc_tests):
8624 * function-set.cc: New file.
8625 * function-set.h: New file.
8627 2020-01-14 David Malcolm <dmalcolm@redhat.com>
8629 * analyzer.h (fndecl_has_gimple_body_p): New decl.
8630 * engine.cc (impl_region_model_context::on_unknown_change): New
8632 (fndecl_has_gimple_body_p): Make non-static.
8633 (exploded_node::on_stmt): Treat __analyzer_dump_exploded_nodes as
8634 known. Track whether we have a call with unknown side-effects and
8635 pass it to on_call_post.
8636 * exploded-graph.h (impl_region_model_context::on_unknown_change):
8638 * program-state.cc (sm_state_map::on_unknown_change): New function.
8639 * program-state.h (sm_state_map::on_unknown_change): New decl.
8640 * region-model.cc: Include "bitmap.h".
8641 (region_model::on_call_pre): Return a bool, capturing whether the
8642 call has unknown side effects.
8643 (region_model::on_call_post): Add arg "bool unknown_side_effects"
8644 and if true, call handle_unrecognized_call.
8645 (class reachable_regions): New class.
8646 (region_model::handle_unrecognized_call): New function.
8647 * region-model.h (region_model::on_call_pre): Return a bool.
8648 (region_model::on_call_post): Add arg "bool unknown_side_effects".
8649 (region_model::handle_unrecognized_call): New decl.
8650 (region_model_context::on_unknown_change): New vfunc.
8651 (test_region_model_context::on_unknown_change): New function.
8653 2020-01-14 David Malcolm <dmalcolm@redhat.com>
8655 * diagnostic-manager.cc (saved_diagnostic::operator==): Move here
8656 from header. Replace pointer equality test on m_var with call to
8657 pending_diagnostic::same_tree_p.
8658 * diagnostic-manager.h (saved_diagnostic::operator==): Move to
8659 diagnostic-manager.cc.
8660 * pending-diagnostic.cc (pending_diagnostic::same_tree_p): New.
8661 * pending-diagnostic.h (pending_diagnostic::same_tree_p): New.
8662 * sm-file.cc (file_diagnostic::subclass_equal_p): Replace pointer
8663 equality on m_arg with call to pending_diagnostic::same_tree_p.
8664 * sm-malloc.cc (malloc_diagnostic::subclass_equal_p): Likewise.
8665 (possible_null_arg::subclass_equal_p): Likewise.
8666 (null_arg::subclass_equal_p): Likewise.
8667 (free_of_non_heap::subclass_equal_p): Likewise.
8668 * sm-pattern-test.cc (pattern_match::operator==): Likewise.
8669 * sm-sensitive.cc (exposure_through_output_file::operator==):
8671 * sm-taint.cc (tainted_array_index::operator==): Likewise.
8673 2020-01-14 David Malcolm <dmalcolm@redhat.com>
8675 * diagnostic-manager.cc (dedupe_winners::add): Add logging
8676 of deduplication decisions made.
8678 2020-01-14 David Malcolm <dmalcolm@redhat.com>
8680 * ChangeLog: New file.
8681 * analyzer-selftests.cc: New file.
8682 * analyzer-selftests.h: New file.
8683 * analyzer.opt: New file.
8684 * analysis-plan.cc: New file.
8685 * analysis-plan.h: New file.
8686 * analyzer-logging.cc: New file.
8687 * analyzer-logging.h: New file.
8688 * analyzer-pass.cc: New file.
8689 * analyzer.cc: New file.
8690 * analyzer.h: New file.
8691 * call-string.cc: New file.
8692 * call-string.h: New file.
8693 * checker-path.cc: New file.
8694 * checker-path.h: New file.
8695 * constraint-manager.cc: New file.
8696 * constraint-manager.h: New file.
8697 * diagnostic-manager.cc: New file.
8698 * diagnostic-manager.h: New file.
8699 * engine.cc: New file.
8700 * engine.h: New file.
8701 * exploded-graph.h: New file.
8702 * pending-diagnostic.cc: New file.
8703 * pending-diagnostic.h: New file.
8704 * program-point.cc: New file.
8705 * program-point.h: New file.
8706 * program-state.cc: New file.
8707 * program-state.h: New file.
8708 * region-model.cc: New file.
8709 * region-model.h: New file.
8710 * sm-file.cc: New file.
8711 * sm-malloc.cc: New file.
8712 * sm-malloc.dot: New file.
8713 * sm-pattern-test.cc: New file.
8714 * sm-sensitive.cc: New file.
8715 * sm-signal.cc: New file.
8716 * sm-taint.cc: New file.
8719 * state-purge.cc: New file.
8720 * state-purge.h: New file.
8721 * supergraph.cc: New file.
8722 * supergraph.h: New file.
8724 2019-12-13 David Malcolm <dmalcolm@redhat.com>
8729 Copyright (C) 2019-2022 Free Software Foundation, Inc.
8731 Copying and distribution of this file, with or without modification,
8732 are permitted in any medium without royalty provided the copyright
8733 notice and this notice are preserved.