1 /* Classes for modeling the state of memory.
2 Copyright (C) 2019-2022 Free Software Foundation, Inc.
3 Contributed by David Malcolm <dmalcolm@redhat.com>.
5 This file is part of GCC.
7 GCC is free software; you can redistribute it and/or modify it
8 under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3, or (at your option)
12 GCC is distributed in the hope that it will be useful, but
13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with GCC; see the file COPYING3. If not see
19 <http://www.gnu.org/licenses/>. */
21 #ifndef GCC_ANALYZER_REGION_MODEL_H
22 #define GCC_ANALYZER_REGION_MODEL_H
24 /* Implementation of the region-based ternary model described in:
25 "A Memory Model for Static Analysis of C Programs"
26 (Zhongxing Xu, Ted Kremenek, and Jian Zhang)
27 http://lcs.ios.ac.cn/~xuzb/canalyze/memmodel.pdf */
31 #include "analyzer/svalue.h"
32 #include "analyzer/region.h"
33 #include "analyzer/known-function-manager.h"
34 #include "analyzer/region-model-manager.h"
35 #include "analyzer/pending-diagnostic.h"
41 extern void add_path_var (path_var pv
, hash
&hstate
);
42 } // namespace inchash
50 one_way_id_map (int num_ids
);
51 void put (T src
, T dst
);
52 T
get_dst_for_src (T src
) const;
53 void dump_to_pp (pretty_printer
*pp
) const;
55 void update (T
*) const;
58 auto_vec
<T
> m_src_to_dst
;
61 /* class one_way_id_map. */
63 /* one_way_id_map's ctor, which populates the map with dummy null values. */
66 inline one_way_id_map
<T
>::one_way_id_map (int num_svalues
)
67 : m_src_to_dst (num_svalues
)
69 for (int i
= 0; i
< num_svalues
; i
++)
70 m_src_to_dst
.quick_push (T::null ());
73 /* Record that SRC is to be mapped to DST. */
77 one_way_id_map
<T
>::put (T src
, T dst
)
79 m_src_to_dst
[src
.as_int ()] = dst
;
82 /* Get the new value for SRC within the map. */
86 one_way_id_map
<T
>::get_dst_for_src (T src
) const
90 return m_src_to_dst
[src
.as_int ()];
93 /* Dump this map to PP. */
97 one_way_id_map
<T
>::dump_to_pp (pretty_printer
*pp
) const
99 pp_string (pp
, "src to dst: {");
102 FOR_EACH_VEC_ELT (m_src_to_dst
, i
, dst
)
105 pp_string (pp
, ", ");
106 T
src (T::from_int (i
));
108 pp_string (pp
, " -> ");
115 /* Dump this map to stderr. */
117 template <typename T
>
118 DEBUG_FUNCTION
inline void
119 one_way_id_map
<T
>::dump () const
122 pp
.buffer
->stream
= stderr
;
127 /* Update *ID from the old value to its new value in this map. */
129 template <typename T
>
131 one_way_id_map
<T
>::update (T
*id
) const
133 *id
= get_dst_for_src (*id
);
136 /* A mapping from region to svalue for use when tracking state. */
138 class region_to_value_map
141 typedef hash_map
<const region
*, const svalue
*> hash_map_t
;
142 typedef hash_map_t::iterator iterator
;
144 region_to_value_map () : m_hash_map () {}
145 region_to_value_map (const region_to_value_map
&other
)
146 : m_hash_map (other
.m_hash_map
) {}
147 region_to_value_map
&operator= (const region_to_value_map
&other
);
149 bool operator== (const region_to_value_map
&other
) const;
150 bool operator!= (const region_to_value_map
&other
) const
152 return !(*this == other
);
155 iterator
begin () const { return m_hash_map
.begin (); }
156 iterator
end () const { return m_hash_map
.end (); }
158 const svalue
* const *get (const region
*reg
) const
160 return const_cast <hash_map_t
&> (m_hash_map
).get (reg
);
162 void put (const region
*reg
, const svalue
*sval
)
164 m_hash_map
.put (reg
, sval
);
166 void remove (const region
*reg
)
168 m_hash_map
.remove (reg
);
171 bool is_empty () const { return m_hash_map
.is_empty (); }
173 void dump_to_pp (pretty_printer
*pp
, bool simple
, bool multiline
) const;
174 void dump (bool simple
) const;
176 bool can_merge_with_p (const region_to_value_map
&other
,
177 region_to_value_map
*out
) const;
179 void purge_state_involving (const svalue
*sval
);
182 hash_map_t m_hash_map
;
185 /* Various operations delete information from a region_model.
187 This struct tracks how many of each kind of entity were purged (e.g.
188 for selftests, and for debugging). */
195 m_num_equiv_classes (0),
196 m_num_constraints (0),
197 m_num_bounded_ranges_constraints (0),
198 m_num_client_items (0)
203 int m_num_equiv_classes
;
204 int m_num_constraints
;
205 int m_num_bounded_ranges_constraints
;
206 int m_num_client_items
;
209 /* A base class for visiting regions and svalues, with do-nothing
210 base implementations of the per-subclass vfuncs. */
215 virtual void visit_region_svalue (const region_svalue
*) {}
216 virtual void visit_constant_svalue (const constant_svalue
*) {}
217 virtual void visit_unknown_svalue (const unknown_svalue
*) {}
218 virtual void visit_poisoned_svalue (const poisoned_svalue
*) {}
219 virtual void visit_setjmp_svalue (const setjmp_svalue
*) {}
220 virtual void visit_initial_svalue (const initial_svalue
*) {}
221 virtual void visit_unaryop_svalue (const unaryop_svalue
*) {}
222 virtual void visit_binop_svalue (const binop_svalue
*) {}
223 virtual void visit_sub_svalue (const sub_svalue
*) {}
224 virtual void visit_repeated_svalue (const repeated_svalue
*) {}
225 virtual void visit_bits_within_svalue (const bits_within_svalue
*) {}
226 virtual void visit_unmergeable_svalue (const unmergeable_svalue
*) {}
227 virtual void visit_placeholder_svalue (const placeholder_svalue
*) {}
228 virtual void visit_widening_svalue (const widening_svalue
*) {}
229 virtual void visit_compound_svalue (const compound_svalue
*) {}
230 virtual void visit_conjured_svalue (const conjured_svalue
*) {}
231 virtual void visit_asm_output_svalue (const asm_output_svalue
*) {}
232 virtual void visit_const_fn_result_svalue (const const_fn_result_svalue
*) {}
234 virtual void visit_region (const region
*) {}
237 struct append_regions_cb_data
;
239 /* A region_model encapsulates a representation of the state of memory, with
240 a tree of regions, along with their associated values.
241 The representation is graph-like because values can be pointers to
244 - a constraint_manager, capturing relationships between the values, and
245 - dynamic extents, mapping dynamically-allocated regions to svalues (their
251 typedef region_to_value_map dynamic_extents_t
;
253 region_model (region_model_manager
*mgr
);
254 region_model (const region_model
&other
);
256 region_model
&operator= (const region_model
&other
);
258 bool operator== (const region_model
&other
) const;
259 bool operator!= (const region_model
&other
) const
261 return !(*this == other
);
264 hashval_t
hash () const;
266 void print (pretty_printer
*pp
) const;
268 void dump_to_pp (pretty_printer
*pp
, bool simple
, bool multiline
) const;
269 void dump (FILE *fp
, bool simple
, bool multiline
) const;
270 void dump (bool simple
) const;
274 void validate () const;
276 void canonicalize ();
277 bool canonicalized_p () const;
280 on_stmt_pre (const gimple
*stmt
,
281 bool *out_unknown_side_effects
,
282 region_model_context
*ctxt
);
284 void on_assignment (const gassign
*stmt
, region_model_context
*ctxt
);
285 const svalue
*get_gassign_result (const gassign
*assign
,
286 region_model_context
*ctxt
);
287 void on_asm_stmt (const gasm
*asm_stmt
, region_model_context
*ctxt
);
288 bool on_call_pre (const gcall
*stmt
, region_model_context
*ctxt
);
289 void on_call_post (const gcall
*stmt
,
290 bool unknown_side_effects
,
291 region_model_context
*ctxt
);
293 void purge_state_involving (const svalue
*sval
, region_model_context
*ctxt
);
295 void impl_deallocation_call (const call_details
&cd
);
297 const svalue
*maybe_get_copy_bounds (const region
*src_reg
,
298 const svalue
*num_bytes_sval
);
299 void update_for_int_cst_return (const call_details
&cd
,
302 void update_for_zero_return (const call_details
&cd
,
304 void update_for_nonzero_return (const call_details
&cd
);
306 void handle_unrecognized_call (const gcall
*call
,
307 region_model_context
*ctxt
);
308 void get_reachable_svalues (svalue_set
*out
,
309 const svalue
*extra_sval
,
310 const uncertainty_t
*uncertainty
);
312 void on_return (const greturn
*stmt
, region_model_context
*ctxt
);
313 void on_setjmp (const gcall
*stmt
, const exploded_node
*enode
,
314 region_model_context
*ctxt
);
315 void on_longjmp (const gcall
*longjmp_call
, const gcall
*setjmp_call
,
316 int setjmp_stack_depth
, region_model_context
*ctxt
);
318 void update_for_phis (const supernode
*snode
,
319 const cfg_superedge
*last_cfg_superedge
,
320 region_model_context
*ctxt
);
322 void handle_phi (const gphi
*phi
, tree lhs
, tree rhs
,
323 const region_model
&old_state
,
324 region_model_context
*ctxt
);
326 bool maybe_update_for_edge (const superedge
&edge
,
327 const gimple
*last_stmt
,
328 region_model_context
*ctxt
,
329 rejected_constraint
**out
);
331 void update_for_gcall (const gcall
*call_stmt
,
332 region_model_context
*ctxt
,
333 function
*callee
= NULL
);
335 void update_for_return_gcall (const gcall
*call_stmt
,
336 region_model_context
*ctxt
);
338 const region
*push_frame (function
*fun
, const vec
<const svalue
*> *arg_sids
,
339 region_model_context
*ctxt
);
340 const frame_region
*get_current_frame () const { return m_current_frame
; }
341 function
* get_current_function () const;
342 void pop_frame (tree result_lvalue
,
343 const svalue
**out_result
,
344 region_model_context
*ctxt
);
345 int get_stack_depth () const;
346 const frame_region
*get_frame_at_index (int index
) const;
348 const region
*get_lvalue (path_var pv
, region_model_context
*ctxt
) const;
349 const region
*get_lvalue (tree expr
, region_model_context
*ctxt
) const;
350 const svalue
*get_rvalue (path_var pv
, region_model_context
*ctxt
) const;
351 const svalue
*get_rvalue (tree expr
, region_model_context
*ctxt
) const;
353 const region
*deref_rvalue (const svalue
*ptr_sval
, tree ptr_tree
,
354 region_model_context
*ctxt
) const;
356 const svalue
*get_rvalue_for_bits (tree type
,
358 const bit_range
&bits
,
359 region_model_context
*ctxt
) const;
361 void set_value (const region
*lhs_reg
, const svalue
*rhs_sval
,
362 region_model_context
*ctxt
);
363 void set_value (tree lhs
, tree rhs
, region_model_context
*ctxt
);
364 void clobber_region (const region
*reg
);
365 void purge_region (const region
*reg
);
366 void fill_region (const region
*reg
, const svalue
*sval
);
367 void zero_fill_region (const region
*reg
);
368 void mark_region_as_unknown (const region
*reg
, uncertainty_t
*uncertainty
);
370 tristate
eval_condition (const svalue
*lhs
,
372 const svalue
*rhs
) const;
373 tristate
compare_initial_and_pointer (const initial_svalue
*init
,
374 const region_svalue
*ptr
) const;
375 tristate
symbolic_greater_than (const binop_svalue
*a
,
376 const svalue
*b
) const;
377 tristate
structural_equality (const svalue
*a
, const svalue
*b
) const;
378 tristate
eval_condition (tree lhs
,
381 region_model_context
*ctxt
) const;
382 bool add_constraint (tree lhs
, enum tree_code op
, tree rhs
,
383 region_model_context
*ctxt
);
384 bool add_constraint (tree lhs
, enum tree_code op
, tree rhs
,
385 region_model_context
*ctxt
,
386 rejected_constraint
**out
);
389 get_or_create_region_for_heap_alloc (const svalue
*size_in_bytes
,
390 region_model_context
*ctxt
);
391 const region
*create_region_for_alloca (const svalue
*size_in_bytes
,
392 region_model_context
*ctxt
);
393 void get_referenced_base_regions (auto_sbitmap
&out_ids
) const;
395 tree
get_representative_tree (const svalue
*sval
) const;
396 tree
get_representative_tree (const region
*reg
) const;
398 get_representative_path_var (const svalue
*sval
,
399 svalue_set
*visited
) const;
401 get_representative_path_var (const region
*reg
,
402 svalue_set
*visited
) const;
405 constraint_manager
*get_constraints ()
407 return m_constraints
;
410 store
*get_store () { return &m_store
; }
411 const store
*get_store () const { return &m_store
; }
413 const dynamic_extents_t
&
414 get_dynamic_extents () const
416 return m_dynamic_extents
;
418 const svalue
*get_dynamic_extents (const region
*reg
) const;
419 void set_dynamic_extents (const region
*reg
,
420 const svalue
*size_in_bytes
,
421 region_model_context
*ctxt
);
422 void unset_dynamic_extents (const region
*reg
);
424 region_model_manager
*get_manager () const { return m_mgr
; }
425 bounded_ranges_manager
*get_range_manager () const
427 return m_mgr
->get_range_manager ();
430 void unbind_region_and_descendents (const region
*reg
,
431 enum poison_kind pkind
);
433 bool can_merge_with_p (const region_model
&other_model
,
434 const program_point
&point
,
435 region_model
*out_model
,
436 const extrinsic_state
*ext_state
= NULL
,
437 const program_state
*state_a
= NULL
,
438 const program_state
*state_b
= NULL
) const;
440 tree
get_fndecl_for_call (const gcall
*call
,
441 region_model_context
*ctxt
);
443 void get_regions_for_current_frame (auto_vec
<const decl_region
*> *out
) const;
444 static void append_regions_cb (const region
*base_reg
,
445 struct append_regions_cb_data
*data
);
447 const svalue
*get_store_value (const region
*reg
,
448 region_model_context
*ctxt
) const;
450 bool region_exists_p (const region
*reg
) const;
452 void loop_replay_fixup (const region_model
*dst_state
);
454 const svalue
*get_capacity (const region
*reg
) const;
456 const svalue
*get_string_size (const svalue
*sval
) const;
457 const svalue
*get_string_size (const region
*reg
) const;
459 bool replay_call_summary (call_summary_replay
&r
,
460 const region_model
&summary
);
462 void maybe_complain_about_infoleak (const region
*dst_reg
,
463 const svalue
*copied_sval
,
464 const region
*src_reg
,
465 region_model_context
*ctxt
);
467 void set_errno (const call_details
&cd
);
469 /* Implemented in sm-fd.cc */
470 void mark_as_valid_fd (const svalue
*sval
, region_model_context
*ctxt
);
472 /* Implemented in sm-malloc.cc */
473 void on_realloc_with_move (const call_details
&cd
,
474 const svalue
*old_ptr_sval
,
475 const svalue
*new_ptr_sval
);
477 /* Implemented in sm-taint.cc. */
478 void mark_as_tainted (const svalue
*sval
,
479 region_model_context
*ctxt
);
481 bool add_constraint (const svalue
*lhs
,
484 region_model_context
*ctxt
);
486 const svalue
*check_for_poison (const svalue
*sval
,
488 region_model_context
*ctxt
) const;
490 void check_region_for_write (const region
*dest_reg
,
491 region_model_context
*ctxt
) const;
494 const region
*get_lvalue_1 (path_var pv
, region_model_context
*ctxt
) const;
495 const svalue
*get_rvalue_1 (path_var pv
, region_model_context
*ctxt
) const;
498 get_representative_path_var_1 (const svalue
*sval
,
499 svalue_set
*visited
) const;
501 get_representative_path_var_1 (const region
*reg
,
502 svalue_set
*visited
) const;
504 const known_function
*get_known_function (tree fndecl
,
505 const call_details
&cd
) const;
506 const known_function
*get_known_function (enum internal_fn
) const;
508 bool add_constraints_from_binop (const svalue
*outer_lhs
,
509 enum tree_code outer_op
,
510 const svalue
*outer_rhs
,
512 region_model_context
*ctxt
);
514 void update_for_call_superedge (const call_superedge
&call_edge
,
515 region_model_context
*ctxt
);
516 void update_for_return_superedge (const return_superedge
&return_edge
,
517 region_model_context
*ctxt
);
518 bool apply_constraints_for_gcond (const cfg_superedge
&edge
,
519 const gcond
*cond_stmt
,
520 region_model_context
*ctxt
,
521 rejected_constraint
**out
);
522 bool apply_constraints_for_gswitch (const switch_cfg_superedge
&edge
,
523 const gswitch
*switch_stmt
,
524 region_model_context
*ctxt
,
525 rejected_constraint
**out
);
526 bool apply_constraints_for_exception (const gimple
*last_stmt
,
527 region_model_context
*ctxt
,
528 rejected_constraint
**out
);
530 int poison_any_pointers_to_descendents (const region
*reg
,
531 enum poison_kind pkind
);
533 void on_top_level_param (tree param
, region_model_context
*ctxt
);
535 bool called_from_main_p () const;
536 const svalue
*get_initial_value_for_global (const region
*reg
) const;
538 const region
* get_region_for_poisoned_expr (tree expr
) const;
540 void check_dynamic_size_for_taint (enum memory_space mem_space
,
541 const svalue
*size_in_bytes
,
542 region_model_context
*ctxt
) const;
543 void check_dynamic_size_for_floats (const svalue
*size_in_bytes
,
544 region_model_context
*ctxt
) const;
546 void check_region_for_taint (const region
*reg
,
547 enum access_direction dir
,
548 region_model_context
*ctxt
) const;
550 void check_for_writable_region (const region
* dest_reg
,
551 region_model_context
*ctxt
) const;
552 void check_region_access (const region
*reg
,
553 enum access_direction dir
,
554 region_model_context
*ctxt
) const;
555 void check_region_for_read (const region
*src_reg
,
556 region_model_context
*ctxt
) const;
557 void check_region_size (const region
*lhs_reg
, const svalue
*rhs_sval
,
558 region_model_context
*ctxt
) const;
560 /* Implemented in bounds-checking.cc */
561 void check_symbolic_bounds (const region
*base_reg
,
562 const svalue
*sym_byte_offset
,
563 const svalue
*num_bytes_sval
,
564 const svalue
*capacity
,
565 enum access_direction dir
,
566 region_model_context
*ctxt
) const;
567 void check_region_bounds (const region
*reg
, enum access_direction dir
,
568 region_model_context
*ctxt
) const;
570 void check_call_args (const call_details
&cd
) const;
571 void check_external_function_for_access_attr (const gcall
*call
,
573 region_model_context
*ctxt
) const;
575 /* Storing this here to avoid passing it around everywhere. */
576 region_model_manager
*const m_mgr
;
580 constraint_manager
*m_constraints
; // TODO: embed, rather than dynalloc?
582 const frame_region
*m_current_frame
;
584 /* Map from base region to size in bytes, for tracking the sizes of
585 dynamically-allocated regions.
586 This is part of the region_model rather than the region to allow for
587 memory regions to be resized (e.g. by realloc). */
588 dynamic_extents_t m_dynamic_extents
;
591 /* Some region_model activity could lead to warnings (e.g. attempts to use an
592 uninitialized value). This abstract base class encapsulates an interface
593 for the region model to use when emitting such warnings.
595 Having this as an abstract base class allows us to support the various
596 operations needed by program_state in the analyzer within region_model,
597 whilst keeping them somewhat modularized. */
599 class region_model_context
602 /* Hook for clients to store pending diagnostics.
603 Return true if the diagnostic was stored, or false if it was deleted. */
604 virtual bool warn (std::unique_ptr
<pending_diagnostic
> d
) = 0;
606 /* Hook for clients to add a note to the last previously stored
607 pending diagnostic. */
608 virtual void add_note (std::unique_ptr
<pending_note
> pn
) = 0;
610 /* Hook for clients to be notified when an SVAL that was reachable
611 in a previous state is no longer live, so that clients can emit warnings
613 virtual void on_svalue_leak (const svalue
*sval
) = 0;
615 /* Hook for clients to be notified when the set of explicitly live
616 svalues changes, so that they can purge state relating to dead
618 virtual void on_liveness_change (const svalue_set
&live_svalues
,
619 const region_model
*model
) = 0;
621 virtual logger
*get_logger () = 0;
623 /* Hook for clients to be notified when the condition
624 "LHS OP RHS" is added to the region model.
625 This exists so that state machines can detect tests on edges,
626 and use them to trigger sm-state transitions (e.g. transitions due
627 to ptrs becoming known to be NULL or non-NULL, rather than just
629 virtual void on_condition (const svalue
*lhs
,
631 const svalue
*rhs
) = 0;
633 /* Hook for clients to be notified when the condition that
634 SVAL is within RANGES is added to the region model.
635 Similar to on_condition, but for use when handling switch statements.
636 RANGES is non-empty. */
637 virtual void on_bounded_ranges (const svalue
&sval
,
638 const bounded_ranges
&ranges
) = 0;
640 /* Hook for clients to be notified when a frame is popped from the stack. */
641 virtual void on_pop_frame (const frame_region
*) = 0;
643 /* Hooks for clients to be notified when an unknown change happens
644 to SVAL (in response to a call to an unknown function). */
645 virtual void on_unknown_change (const svalue
*sval
, bool is_mutable
) = 0;
647 /* Hooks for clients to be notified when a phi node is handled,
648 where RHS is the pertinent argument. */
649 virtual void on_phi (const gphi
*phi
, tree rhs
) = 0;
651 /* Hooks for clients to be notified when the region model doesn't
652 know how to handle the tree code of T at LOC. */
653 virtual void on_unexpected_tree_code (tree t
,
654 const dump_location_t
&loc
) = 0;
656 /* Hook for clients to be notified when a function_decl escapes. */
657 virtual void on_escaped_function (tree fndecl
) = 0;
659 virtual uncertainty_t
*get_uncertainty () = 0;
661 /* Hook for clients to purge state involving SVAL. */
662 virtual void purge_state_involving (const svalue
*sval
) = 0;
664 /* Hook for clients to split state with a non-standard path. */
665 virtual void bifurcate (std::unique_ptr
<custom_edge_info
> info
) = 0;
667 /* Hook for clients to terminate the standard path. */
668 virtual void terminate_path () = 0;
670 virtual const extrinsic_state
*get_ext_state () const = 0;
672 /* Hook for clients to access the a specific state machine in
673 any underlying program_state. */
675 get_state_map_by_name (const char *name
,
676 sm_state_map
**out_smap
,
677 const state_machine
**out_sm
,
678 unsigned *out_sm_idx
,
679 std::unique_ptr
<sm_context
> *out_sm_context
) = 0;
681 /* Precanned ways for clients to access specific state machines. */
682 bool get_fd_map (sm_state_map
**out_smap
,
683 const state_machine
**out_sm
,
684 unsigned *out_sm_idx
,
685 std::unique_ptr
<sm_context
> *out_sm_context
)
687 return get_state_map_by_name ("file-descriptor", out_smap
, out_sm
,
688 out_sm_idx
, out_sm_context
);
690 bool get_malloc_map (sm_state_map
**out_smap
,
691 const state_machine
**out_sm
,
692 unsigned *out_sm_idx
)
694 return get_state_map_by_name ("malloc", out_smap
, out_sm
, out_sm_idx
, NULL
);
696 bool get_taint_map (sm_state_map
**out_smap
,
697 const state_machine
**out_sm
,
698 unsigned *out_sm_idx
)
700 return get_state_map_by_name ("taint", out_smap
, out_sm
, out_sm_idx
, NULL
);
703 /* Get the current statement, if any. */
704 virtual const gimple
*get_stmt () const = 0;
707 /* A "do nothing" subclass of region_model_context. */
709 class noop_region_model_context
: public region_model_context
712 bool warn (std::unique_ptr
<pending_diagnostic
>) override
{ return false; }
713 void add_note (std::unique_ptr
<pending_note
>) override
;
714 void on_svalue_leak (const svalue
*) override
{}
715 void on_liveness_change (const svalue_set
&,
716 const region_model
*) override
{}
717 logger
*get_logger () override
{ return NULL
; }
718 void on_condition (const svalue
*lhs ATTRIBUTE_UNUSED
,
719 enum tree_code op ATTRIBUTE_UNUSED
,
720 const svalue
*rhs ATTRIBUTE_UNUSED
) override
723 void on_bounded_ranges (const svalue
&,
724 const bounded_ranges
&) override
727 void on_pop_frame (const frame_region
*) override
{}
728 void on_unknown_change (const svalue
*sval ATTRIBUTE_UNUSED
,
729 bool is_mutable ATTRIBUTE_UNUSED
) override
732 void on_phi (const gphi
*phi ATTRIBUTE_UNUSED
,
733 tree rhs ATTRIBUTE_UNUSED
) override
736 void on_unexpected_tree_code (tree
, const dump_location_t
&) override
{}
738 void on_escaped_function (tree
) override
{}
740 uncertainty_t
*get_uncertainty () override
{ return NULL
; }
742 void purge_state_involving (const svalue
*sval ATTRIBUTE_UNUSED
) override
{}
744 void bifurcate (std::unique_ptr
<custom_edge_info
> info
) override
;
745 void terminate_path () override
;
747 const extrinsic_state
*get_ext_state () const override
{ return NULL
; }
749 bool get_state_map_by_name (const char *,
751 const state_machine
**,
753 std::unique_ptr
<sm_context
> *) override
758 const gimple
*get_stmt () const override
{ return NULL
; }
761 /* A subclass of region_model_context for determining if operations fail
762 e.g. "can we generate a region for the lvalue of EXPR?". */
764 class tentative_region_model_context
: public noop_region_model_context
767 tentative_region_model_context () : m_num_unexpected_codes (0) {}
769 void on_unexpected_tree_code (tree
, const dump_location_t
&)
772 m_num_unexpected_codes
++;
775 bool had_errors_p () const { return m_num_unexpected_codes
> 0; }
778 int m_num_unexpected_codes
;
781 /* Subclass of region_model_context that wraps another context, allowing
782 for extra code to be added to the various hooks. */
784 class region_model_context_decorator
: public region_model_context
787 bool warn (std::unique_ptr
<pending_diagnostic
> d
) override
789 return m_inner
->warn (std::move (d
));
792 void add_note (std::unique_ptr
<pending_note
> pn
) override
794 m_inner
->add_note (std::move (pn
));
797 void on_svalue_leak (const svalue
*sval
) override
799 m_inner
->on_svalue_leak (sval
);
802 void on_liveness_change (const svalue_set
&live_svalues
,
803 const region_model
*model
) override
805 m_inner
->on_liveness_change (live_svalues
, model
);
808 logger
*get_logger () override
810 return m_inner
->get_logger ();
813 void on_condition (const svalue
*lhs
,
815 const svalue
*rhs
) override
817 m_inner
->on_condition (lhs
, op
, rhs
);
820 void on_bounded_ranges (const svalue
&sval
,
821 const bounded_ranges
&ranges
) override
823 m_inner
->on_bounded_ranges (sval
, ranges
);
826 void on_pop_frame (const frame_region
*frame_reg
) override
828 m_inner
->on_pop_frame (frame_reg
);
831 void on_unknown_change (const svalue
*sval
, bool is_mutable
) override
833 m_inner
->on_unknown_change (sval
, is_mutable
);
836 void on_phi (const gphi
*phi
, tree rhs
) override
838 m_inner
->on_phi (phi
, rhs
);
841 void on_unexpected_tree_code (tree t
,
842 const dump_location_t
&loc
) override
844 m_inner
->on_unexpected_tree_code (t
, loc
);
847 void on_escaped_function (tree fndecl
) override
849 m_inner
->on_escaped_function (fndecl
);
852 uncertainty_t
*get_uncertainty () override
854 return m_inner
->get_uncertainty ();
857 void purge_state_involving (const svalue
*sval
) override
859 m_inner
->purge_state_involving (sval
);
862 void bifurcate (std::unique_ptr
<custom_edge_info
> info
) override
864 m_inner
->bifurcate (std::move (info
));
867 void terminate_path () override
869 m_inner
->terminate_path ();
872 const extrinsic_state
*get_ext_state () const override
874 return m_inner
->get_ext_state ();
877 bool get_state_map_by_name (const char *name
,
878 sm_state_map
**out_smap
,
879 const state_machine
**out_sm
,
880 unsigned *out_sm_idx
,
881 std::unique_ptr
<sm_context
> *out_sm_context
)
884 return m_inner
->get_state_map_by_name (name
, out_smap
, out_sm
, out_sm_idx
,
888 const gimple
*get_stmt () const override
890 return m_inner
->get_stmt ();
894 region_model_context_decorator (region_model_context
*inner
)
897 gcc_assert (m_inner
);
900 region_model_context
*m_inner
;
903 /* Subclass of region_model_context_decorator that adds a note
904 when saving diagnostics. */
906 class note_adding_context
: public region_model_context_decorator
909 bool warn (std::unique_ptr
<pending_diagnostic
> d
) override
911 if (m_inner
->warn (std::move (d
)))
913 add_note (make_note ());
920 /* Hook to make the new note. */
921 virtual std::unique_ptr
<pending_note
> make_note () = 0;
924 note_adding_context (region_model_context
*inner
)
925 : region_model_context_decorator (inner
)
930 /* A bundle of data for use when attempting to merge two region_model
931 instances to make a third. */
935 model_merger (const region_model
*model_a
,
936 const region_model
*model_b
,
937 const program_point
&point
,
938 region_model
*merged_model
,
939 const extrinsic_state
*ext_state
,
940 const program_state
*state_a
,
941 const program_state
*state_b
)
942 : m_model_a (model_a
), m_model_b (model_b
),
944 m_merged_model (merged_model
),
945 m_ext_state (ext_state
),
946 m_state_a (state_a
), m_state_b (state_b
)
950 void dump_to_pp (pretty_printer
*pp
, bool simple
) const;
951 void dump (FILE *fp
, bool simple
) const;
952 void dump (bool simple
) const;
954 region_model_manager
*get_manager () const
956 return m_model_a
->get_manager ();
959 bool mergeable_svalue_p (const svalue
*) const;
960 const function_point
&get_function_point () const
962 return m_point
.get_function_point ();
965 const region_model
*m_model_a
;
966 const region_model
*m_model_b
;
967 const program_point
&m_point
;
968 region_model
*m_merged_model
;
970 const extrinsic_state
*m_ext_state
;
971 const program_state
*m_state_a
;
972 const program_state
*m_state_b
;
975 /* A record that can (optionally) be written out when
976 region_model::add_constraint fails. */
978 class rejected_constraint
981 virtual ~rejected_constraint () {}
982 virtual void dump_to_pp (pretty_printer
*pp
) const = 0;
984 const region_model
&get_model () const { return m_model
; }
987 rejected_constraint (const region_model
&model
)
991 region_model m_model
;
994 class rejected_op_constraint
: public rejected_constraint
997 rejected_op_constraint (const region_model
&model
,
998 tree lhs
, enum tree_code op
, tree rhs
)
999 : rejected_constraint (model
),
1000 m_lhs (lhs
), m_op (op
), m_rhs (rhs
)
1003 void dump_to_pp (pretty_printer
*pp
) const final override
;
1006 enum tree_code m_op
;
1010 class rejected_ranges_constraint
: public rejected_constraint
1013 rejected_ranges_constraint (const region_model
&model
,
1014 tree expr
, const bounded_ranges
*ranges
)
1015 : rejected_constraint (model
),
1016 m_expr (expr
), m_ranges (ranges
)
1019 void dump_to_pp (pretty_printer
*pp
) const final override
;
1023 const bounded_ranges
*m_ranges
;
1026 /* A bundle of state. */
1031 engine (const supergraph
*sg
= NULL
, logger
*logger
= NULL
);
1032 const supergraph
*get_supergraph () { return m_sg
; }
1033 region_model_manager
*get_model_manager () { return &m_mgr
; }
1034 known_function_manager
*get_known_function_manager ()
1036 return m_mgr
.get_known_function_manager ();
1039 void log_stats (logger
*logger
) const;
1042 const supergraph
*m_sg
;
1043 region_model_manager m_mgr
;
1048 extern void debug (const region_model
&rmodel
);
1054 namespace selftest
{
1056 using namespace ::selftest
;
1058 /* An implementation of region_model_context for use in selftests, which
1059 stores any pending_diagnostic instances passed to it. */
1061 class test_region_model_context
: public noop_region_model_context
1064 bool warn (std::unique_ptr
<pending_diagnostic
> d
) final override
1066 m_diagnostics
.safe_push (d
.release ());
1070 unsigned get_num_diagnostics () const { return m_diagnostics
.length (); }
1072 void on_unexpected_tree_code (tree t
, const dump_location_t
&)
1075 internal_error ("unhandled tree code: %qs",
1076 get_tree_code_name (TREE_CODE (t
)));
1080 /* Implicitly delete any diagnostics in the dtor. */
1081 auto_delete_vec
<pending_diagnostic
> m_diagnostics
;
1084 /* Attempt to add the constraint (LHS OP RHS) to MODEL.
1085 Verify that MODEL remains satisfiable. */
1087 #define ADD_SAT_CONSTRAINT(MODEL, LHS, OP, RHS) \
1088 SELFTEST_BEGIN_STMT \
1089 bool sat = (MODEL).add_constraint (LHS, OP, RHS, NULL); \
1090 ASSERT_TRUE (sat); \
1093 /* Attempt to add the constraint (LHS OP RHS) to MODEL.
1094 Verify that the result is not satisfiable. */
1096 #define ADD_UNSAT_CONSTRAINT(MODEL, LHS, OP, RHS) \
1097 SELFTEST_BEGIN_STMT \
1098 bool sat = (MODEL).add_constraint (LHS, OP, RHS, NULL); \
1099 ASSERT_FALSE (sat); \
1102 /* Implementation detail of the ASSERT_CONDITION_* macros. */
1104 void assert_condition (const location
&loc
,
1105 region_model
&model
,
1106 const svalue
*lhs
, tree_code op
, const svalue
*rhs
,
1109 void assert_condition (const location
&loc
,
1110 region_model
&model
,
1111 tree lhs
, tree_code op
, tree rhs
,
1114 /* Assert that REGION_MODEL evaluates the condition "LHS OP RHS"
1117 #define ASSERT_CONDITION_TRUE(REGION_MODEL, LHS, OP, RHS) \
1118 SELFTEST_BEGIN_STMT \
1119 assert_condition (SELFTEST_LOCATION, REGION_MODEL, LHS, OP, RHS, \
1120 tristate (tristate::TS_TRUE)); \
1123 /* Assert that REGION_MODEL evaluates the condition "LHS OP RHS"
1126 #define ASSERT_CONDITION_FALSE(REGION_MODEL, LHS, OP, RHS) \
1127 SELFTEST_BEGIN_STMT \
1128 assert_condition (SELFTEST_LOCATION, REGION_MODEL, LHS, OP, RHS, \
1129 tristate (tristate::TS_FALSE)); \
1132 /* Assert that REGION_MODEL evaluates the condition "LHS OP RHS"
1135 #define ASSERT_CONDITION_UNKNOWN(REGION_MODEL, LHS, OP, RHS) \
1136 SELFTEST_BEGIN_STMT \
1137 assert_condition (SELFTEST_LOCATION, REGION_MODEL, LHS, OP, RHS, \
1138 tristate (tristate::TS_UNKNOWN)); \
1141 } /* end of namespace selftest. */
1143 #endif /* #if CHECKING_P */
1147 #endif /* GCC_ANALYZER_REGION_MODEL_H */