12021-07-28 Release Manager 2 3 * GCC 11.2.0 released. 4 52021-07-02 David Malcolm <dmalcolm@redhat.com> 6 7 * store.cc (binding_cluster::get_any_binding): Make symbolic reads 8 from a cluster with concrete bindings return unknown. 9 102021-07-02 David Malcolm <dmalcolm@redhat.com> 11 12 * region-model-manager.cc 13 (region_model_manager::get_or_create_int_cst): New. 14 (region_model_manager::maybe_undo_optimize_bit_field_compare): Use 15 it to simplify away a local tree. 16 * region-model.cc (region_model::on_setjmp): Likewise. 17 (region_model::on_longjmp): Likewise. 18 * region-model.h (region_model_manager::get_or_create_int_cst): 19 New decl. 20 * store.cc (binding_cluster::zero_fill_region): Use it to simplify 21 away a local tree. 22 232021-07-02 David Malcolm <dmalcolm@redhat.com> 24 25 PR analyzer/99212 26 PR analyzer/101082 27 * engine.cc: Include "target.h". 28 (impl_run_checkers): Log BITS_BIG_ENDIAN, BYTES_BIG_ENDIAN, and 29 WORDS_BIG_ENDIAN. 30 * region-model-manager.cc 31 (region_model_manager::maybe_fold_binop): Move support for masking 32 via ARG0 & CST into... 33 (region_model_manager::maybe_undo_optimize_bit_field_compare): 34 ...this new function. Flatten by converting from nested 35 conditionals to a series of early return statements to reject 36 failures. Reject if type is not unsigned_char_type_node. 37 Handle BYTES_BIG_ENDIAN when determining which bits are bound 38 in the binding_map. 39 * region-model.h 40 (region_model_manager::maybe_undo_optimize_bit_field_compare): 41 New decl. 42 * store.cc (bit_range::dump): New function. 43 * store.h (bit_range::dump): New decl. 44 452021-07-02 David Malcolm <dmalcolm@redhat.com> 46 47 * engine.cc (worklist::key_t::cmp): Move sort by call_string to 48 before SCC. 49 502021-07-02 David Malcolm <dmalcolm@redhat.com> 51 52 * region-model.cc (region_model::get_lvalue_1): Make const. 53 (region_model::get_lvalue): Likewise. 54 (region_model::get_rvalue_1): Likewise. 55 (region_model::get_rvalue): Likewise. 56 (region_model::deref_rvalue): Likewise. 57 (region_model::get_rvalue_for_bits): Likewise. 58 * region-model.h (region_model::get_lvalue): Likewise. 59 (region_model::get_rvalue): Likewise. 60 (region_model::deref_rvalue): Likewise. 61 (region_model::get_rvalue_for_bits): Likewise. 62 (region_model::get_lvalue_1): Likewise. 63 (region_model::get_rvalue_1): Likewise. 64 652021-07-02 David Malcolm <dmalcolm@redhat.com> 66 67 PR analyzer/99212 68 * region-model-manager.cc 69 (region_model_manager::maybe_fold_binop): Add support for folding 70 BIT_AND_EXPR of compound_svalue and a mask constant. 71 * region-model.cc (region_model::get_rvalue_1): Implement 72 BIT_FIELD_REF in terms of... 73 (region_model::get_rvalue_for_bits): New function. 74 * region-model.h (region_model::get_rvalue_for_bits): New decl. 75 * store.cc (bit_range::from_mask): New function. 76 (selftest::test_bit_range_intersects_p): New selftest. 77 (selftest::assert_bit_range_from_mask_eq): New. 78 (ASSERT_BIT_RANGE_FROM_MASK_EQ): New macro. 79 (selftest::assert_no_bit_range_from_mask_eq): New. 80 (ASSERT_NO_BIT_RANGE_FROM_MASK): New macro. 81 (selftest::test_bit_range_from_mask): New selftest. 82 (selftest::analyzer_store_cc_tests): Call the new selftests. 83 * store.h (bit_range::intersects_p): New. 84 (bit_range::from_mask): New decl. 85 (concrete_binding::get_bit_range): New accessor. 86 (store_manager::get_concrete_binding): New overload taking 87 const bit_range &. 88 892021-07-02 David Malcolm <dmalcolm@redhat.com> 90 91 * analyzer.h (int_size_in_bits): New decl. 92 * region.cc (int_size_in_bits): New function. 93 (region::get_bit_size): Reimplement in terms of the above. 94 952021-07-02 David Malcolm <dmalcolm@redhat.com> 96 97 * store.cc (concrete_binding::dump_to_pp): Move bulk of 98 implementation to... 99 (bit_range::dump_to_pp): ...this new function. 100 (bit_range::cmp): New. 101 (concrete_binding::overlaps_p): Update for use of bit_range. 102 (concrete_binding::cmp_ptr_ptr): Likewise. 103 * store.h (struct bit_range): New. 104 (class concrete_binding): Replace fields m_start_bit_offset and 105 m_size_in_bits with new field m_bit_range. 106 1072021-07-02 David Malcolm <dmalcolm@redhat.com> 108 109 * svalue.h (conjured_svalue::iterator_t): Delete. 110 1112021-07-02 David Malcolm <dmalcolm@redhat.com> 112 113 * store.h (store::get_direct_binding): Remove unused decl. 114 (store::get_default_binding): Likewise. 115 1162021-07-02 David Malcolm <dmalcolm@redhat.com> 117 118 * svalue.cc (poisoned_svalue::dump_to_pp): Dump type. 119 (compound_svalue::dump_to_pp): Dump any type. 120 1212021-07-02 David Malcolm <dmalcolm@redhat.com> 122 123 PR analyzer/100615 124 * sm-malloc.cc: Include "analyzer/function-set.h". 125 (malloc_state_machine::on_stmt): Call unaffected_by_call_p and 126 bail on the functions it recognizes. 127 (malloc_state_machine::unaffected_by_call_p): New. 128 1292021-07-02 David Malcolm <dmalcolm@redhat.com> 130 131 PR analyzer/100244 132 * sm-malloc.cc (free_of_non_heap::describe_state_change): 133 Bulletproof against change.m_expr being NULL. 134 1352021-04-27 Release Manager 136 137 * GCC 11.1.0 released. 138 1392021-04-13 David Malcolm <dmalcolm@redhat.com> 140 141 PR analyzer/98599 142 * supergraph.cc (saved_uids::make_uid_unique): New. 143 (saved_uids::restore_uids): New. 144 (supergraph::supergraph): Replace assignments to stmt->uid with 145 calls to m_stmt_uids.make_uid_unique. 146 (supergraph::~supergraph): New. 147 * supergraph.h (class saved_uids): New. 148 (supergraph::~supergraph): New decl. 149 (supergraph::m_stmt_uids): New field. 150 1512021-04-10 David Malcolm <dmalcolm@redhat.com> 152 153 PR analyzer/100011 154 * region-model.cc (region_model::on_assignment): Avoid NULL 155 dereference if ctxt is NULL when assigning from a STRING_CST. 156 1572021-04-08 David Malcolm <dmalcolm@redhat.com> 158 159 PR analyzer/99042 160 PR analyzer/99774 161 * engine.cc 162 (impl_region_model_context::impl_region_model_context): Add 163 uncertainty param and use it to initialize m_uncertainty. 164 (impl_region_model_context::get_uncertainty): New. 165 (impl_sm_context::get_fndecl_for_call): Add NULL for new 166 uncertainty param when constructing impl_region_model_context. 167 (impl_sm_context::get_state): Likewise. 168 (impl_sm_context::set_next_state): Likewise. 169 (impl_sm_context::warn): Likewise. 170 (exploded_node::on_stmt): Add uncertainty param 171 and use it when constructing impl_region_model_context. 172 (exploded_node::on_edge): Add uncertainty param and pass 173 to on_edge call. 174 (exploded_node::detect_leaks): Create uncertainty_t and pass to 175 impl_region_model_context. 176 (exploded_graph::get_or_create_node): Create uncertainty_t and 177 pass to prune_for_point. 178 (maybe_process_run_of_before_supernode_enodes): Create 179 uncertainty_t and pass to impl_region_model_context. 180 (exploded_graph::process_node): Create uncertainty_t instances and 181 pass around as needed. 182 * exploded-graph.h 183 (impl_region_model_context::impl_region_model_context): Add 184 uncertainty param. 185 (impl_region_model_context::get_uncertainty): New decl. 186 (impl_region_model_context::m_uncertainty): New field. 187 (exploded_node::on_stmt): Add uncertainty param. 188 (exploded_node::on_edge): Likewise. 189 * program-state.cc (sm_state_map::on_liveness_change): Get 190 uncertainty from context and use it to unset sm-state from 191 svalues as appropriate. 192 (program_state::on_edge): Add uncertainty param and use it when 193 constructing impl_region_model_context. Fix indentation. 194 (program_state::prune_for_point): Add uncertainty param and use it 195 when constructing impl_region_model_context. 196 (program_state::detect_leaks): Get any uncertainty from ctxt and 197 use it to get maybe-live svalues for dest_state, rather than 198 definitely-live ones; use this when determining which svalues 199 have leaked. 200 (selftest::test_program_state_merging): Create uncertainty_t and 201 pass to impl_region_model_context. 202 * program-state.h (program_state::on_edge): Add uncertainty param. 203 (program_state::prune_for_point): Likewise. 204 * region-model-impl-calls.cc (call_details::get_uncertainty): New. 205 (region_model::impl_call_memcpy): Pass uncertainty to 206 mark_region_as_unknown call. 207 (region_model::impl_call_memset): Likewise. 208 (region_model::impl_call_strcpy): Likewise. 209 * region-model-reachability.cc (reachable_regions::handle_sval): 210 Also add sval to m_mutable_svals. 211 * region-model.cc (region_model::on_assignment): Pass any 212 uncertainty from ctxt to the store::set_value call. 213 (region_model::handle_unrecognized_call): Get any uncertainty from 214 ctxt and use it to record mutable svalues at the unknown call. 215 (region_model::get_reachable_svalues): Add uncertainty param and 216 use it to mark any maybe-bound svalues as being reachable. 217 (region_model::set_value): Pass any uncertainty from ctxt to the 218 store::set_value call. 219 (region_model::mark_region_as_unknown): Add uncertainty param and 220 pass it on to the store::mark_region_as_unknown call. 221 (region_model::update_for_call_summary): Add uncertainty param and 222 pass it on to the region_model::mark_region_as_unknown call. 223 * region-model.h (call_details::get_uncertainty): New decl. 224 (region_model::get_reachable_svalues): Add uncertainty param. 225 (region_model::mark_region_as_unknown): Add uncertainty param. 226 (region_model_context::get_uncertainty): New vfunc. 227 (noop_region_model_context::get_uncertainty): New vfunc 228 implementation. 229 * store.cc (dump_svalue_set): New. 230 (uncertainty_t::dump_to_pp): New. 231 (uncertainty_t::dump): New. 232 (binding_cluster::clobber_region): Pass NULL for uncertainty to 233 remove_overlapping_bindings. 234 (binding_cluster::mark_region_as_unknown): Add uncertainty param 235 and pass it to remove_overlapping_bindings. 236 (binding_cluster::remove_overlapping_bindings): Add uncertainty param. 237 Use it to record any svalues that were in clobbered bindings. 238 (store::set_value): Add uncertainty param. Pass it to 239 binding_cluster::mark_region_as_unknown when handling symbolic 240 regions. 241 (store::mark_region_as_unknown): Add uncertainty param and pass it 242 to binding_cluster::mark_region_as_unknown. 243 (store::remove_overlapping_bindings): Add uncertainty param and 244 pass it to binding_cluster::remove_overlapping_bindings. 245 * store.h (binding_cluster::mark_region_as_unknown): Add 246 uncertainty param. 247 (binding_cluster::remove_overlapping_bindings): Likewise. 248 (store::set_value): Likewise. 249 (store::mark_region_as_unknown): Likewise. 250 2512021-04-05 David Malcolm <dmalcolm@redhat.com> 252 253 PR analyzer/99906 254 * analyzer.cc (maybe_reconstruct_from_def_stmt): Fix NULL 255 dereference on calls with zero arguments. 256 * sm-malloc.cc (malloc_state_machine::on_stmt): When handling 257 __attribute__((nonnull)), only call get_diagnostic_tree if the 258 result will be used. 259 2602021-04-05 David Malcolm <dmalcolm@redhat.com> 261 262 PR analyzer/99886 263 * diagnostic-manager.cc 264 (diagnostic_manager::prune_interproc_events): Use signed integers 265 when subtracting one from path->num_events (). 266 (diagnostic_manager::consolidate_conditions): Likewise. Convert 267 next_idx to a signed int. 268 2692021-04-01 David Malcolm <dmalcolm@redhat.com> 270 271 * diagnostic-manager.cc (diagnostic_manager::add_diagnostic): Make 272 enode param non-constant, and call add_diagnostic on it. Add 273 enode index to log message. 274 (diagnostic_manager::add_diagnostic): Make enode param 275 non-constant. 276 * diagnostic-manager.h (diagnostic_manager::add_diagnostic): 277 Likewise for both decls. 278 * engine.cc 279 (impl_region_model_context::impl_region_model_context): Likewise 280 for enode_for_diag. 281 (impl_sm_context::impl_sm_context): Likewise. 282 (impl_sm_context::m_enode_for_diag): Likewise. 283 (exploded_node::dump_dot): Don't pass the diagnostic manager 284 to dump_saved_diagnostics. 285 (exploded_node::dump_saved_diagnostics): Drop param. Iterate 286 directly through all saved diagnostics for the enode, rather 287 than all saved diagnostics in the diagnostic_manager and 288 filtering. 289 (exploded_node::on_stmt): Make non-const. 290 (exploded_node::on_edge): Likewise. 291 (exploded_node::on_longjmp): Likewise. 292 (exploded_node::detect_leaks): Likewise. 293 (exploded_graph::get_or_create_node): Make enode_for_diag param 294 non-const. 295 (exploded_graph_annotator::print_enode): Iterate 296 directly through all saved diagnostics for the enode, rather 297 than all saved diagnostics in the diagnostic_manager and 298 filtering. 299 * exploded-graph.h 300 (impl_region_model_context::impl_region_model_context): Make 301 enode_for_diag param non-constant. 302 (impl_region_model_context::m_enode_for_diag): Likewise. 303 (exploded_node::dump_saved_diagnostics): Drop param. 304 (exploded_node::on_stmt): Make non-const. 305 (exploded_node::on_edge): Likewise. 306 (exploded_node::on_longjmp): Likewise. 307 (exploded_node::detect_leaks): Likewise. 308 (exploded_node::add_diagnostic): New. 309 (exploded_node::get_num_diagnostics): New. 310 (exploded_node::get_saved_diagnostic): New. 311 (exploded_node::m_saved_diagnostics): New. 312 (exploded_graph::get_or_create_node): Make enode_for_diag param 313 non-constant. 314 * feasible-graph.cc (feasible_node::dump_dot): Drop 315 diagnostic_manager from call to dump_saved_diagnostics. 316 * program-state.cc (program_state::on_edge): Convert enode param 317 to non-const pointer. 318 (program_state::prune_for_point): Likewise for enode_for_diag 319 param. 320 * program-state.h (program_state::on_edge): Convert enode param 321 to non-const pointer. 322 (program_state::prune_for_point): Likewise for enode_for_diag 323 param. 324 3252021-03-31 David Malcolm <dmalcolm@redhat.com> 326 327 PR analyzer/99771 328 * analyzer.cc (maybe_reconstruct_from_def_stmt): New. 329 (fixup_tree_for_diagnostic_1): New. 330 (fixup_tree_for_diagnostic): New. 331 * analyzer.h (fixup_tree_for_diagnostic): New decl. 332 * checker-path.cc (call_event::get_desc): Call 333 fixup_tree_for_diagnostic and use it for the call_with_state call. 334 (warning_event::get_desc): Likewise for the final_event and 335 make_label_text calls. 336 * engine.cc (impl_region_model_context::on_state_leak): Likewise 337 for the on_leak and add_diagnostic calls. 338 * region-model.cc (region_model::get_representative_tree): 339 Likewise for the result. 340 3412021-03-30 David Malcolm <dmalcolm@redhat.com> 342 343 * region.h (region::dump_to_pp): Remove old decl. 344 3452021-03-30 David Malcolm <dmalcolm@redhat.com> 346 347 * sm-file.cc (fileptr_state_machine::on_stmt): Only call 348 get_diagnostic_tree if the result will be used. 349 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise. 350 (malloc_state_machine::on_deallocator_call): Likewise. 351 (malloc_state_machine::on_realloc_call): Likewise. 352 (malloc_state_machine::on_realloc_call): Likewise. 353 * sm-sensitive.cc 354 (sensitive_state_machine::warn_for_any_exposure): Likewise. 355 * sm-taint.cc (taint_state_machine::on_stmt): Likewise. 356 3572021-03-25 David Malcolm <dmalcolm@redhat.com> 358 359 PR analyzer/93695 360 PR analyzer/99044 361 PR analyzer/99716 362 * engine.cc (exploded_node::on_stmt): Clear sm-state involving 363 an SSA name at the def-stmt of that SSA name. 364 * program-state.cc (sm_state_map::purge_state_involving): New. 365 * program-state.h (sm_state_map::purge_state_involving): New decl. 366 * region-model.cc (selftest::test_involves_p): New. 367 (selftest::analyzer_region_model_cc_tests): Call it. 368 * svalue.cc (class involvement_visitor): New class 369 (svalue::involves_p): New. 370 * svalue.h (svalue::involves_p): New decl. 371 3722021-03-19 David Malcolm <dmalcolm@redhat.com> 373 374 PR analyzer/99614 375 * diagnostic-manager.cc (class epath_finder): Add 376 DISABLE_COPY_AND_ASSIGN. 377 3782021-03-15 Martin Liska <mliska@suse.cz> 379 380 * sm-file.cc (get_file_using_fns): Add missing comma in initializer. 381 3822021-03-11 David Malcolm <dmalcolm@redhat.com> 383 384 PR analyzer/96374 385 * analyzer.opt (-param=analyzer-max-infeasible-edges=): New param. 386 (fdump-analyzer-feasibility): New flag. 387 * diagnostic-manager.cc: Include "analyzer/trimmed-graph.h" and 388 "analyzer/feasible-graph.h". 389 (epath_finder::epath_finder): Convert m_sep to a pointer and 390 only create it if !flag_analyzer_feasibility. 391 (epath_finder::~epath_finder): New. 392 (epath_finder::m_sep): Convert to a pointer. 393 (epath_finder::get_best_epath): Add param "diag_idx" and use it 394 when logging. Rather than finding the shortest path and then 395 checking feasibility, instead use explore_feasible_paths unless 396 !flag_analyzer_feasibility, in which case simply use the shortest 397 path, and note if it is infeasible. Update for m_sep becoming a 398 pointer. 399 (class feasible_worklist): New. 400 (epath_finder::explore_feasible_paths): New. 401 (epath_finder::process_worklist_item): New. 402 (class dump_eg_with_shortest_path): New. 403 (epath_finder::dump_trimmed_graph): New. 404 (epath_finder::dump_feasible_graph): New. 405 (saved_diagnostic::saved_diagnostic): Add "idx" param, using it 406 on new field m_idx. 407 (saved_diagnostic::to_json): Dump m_idx. 408 (saved_diagnostic::calc_best_epath): Pass m_idx to get_best_epath. 409 Remove assertion that m_problem was set when m_best_epath is NULL. 410 (diagnostic_manager::add_diagnostic): Pass an index when created 411 saved_diagnostic instances. 412 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add 413 "idx" param. 414 (saved_diagnostic::get_index): New accessor. 415 (saved_diagnostic::m_idx): New field. 416 * engine.cc (exploded_node::dump_dot): Call args.dump_extra_info. 417 Move code to... 418 (exploded_node::dump_processed_stmts): ...this new function and... 419 (exploded_node::dump_saved_diagnostics): ...this new function. 420 Add index of each diagnostic. 421 (exploded_edge::dump_dot): Move bulk of code to... 422 (exploded_edge::dump_dot_label): ...this new function. 423 * exploded-graph.h (eg_traits::dump_args_t::dump_extra_info): New 424 vfunc. 425 (exploded_node::dump_processed_stmts): New decl. 426 (exploded_node::dump_saved_diagnostics): New decl. 427 (exploded_edge::dump_dot_label): New decl. 428 * feasible-graph.cc: New file. 429 * feasible-graph.h: New file. 430 * trimmed-graph.cc: New file. 431 * trimmed-graph.h: New file. 432 4332021-03-11 David Malcolm <dmalcolm@redhat.com> 434 435 * diagnostic-manager.cc (epath_finder::epath_finder): 436 Update shortest_paths init for new param. 437 4382021-03-10 David Malcolm <dmalcolm@redhat.com> 439 440 PR analyzer/96374 441 * engine.cc (exploded_path::feasible_p): Move "snodes_visited" and 442 "model" locals into a new class feasibility_state. Move heart 443 of per-edge processing into 444 feasibility_state::maybe_update_for_edge. 445 (feasibility_state::feasibility_state): New. 446 (feasibility_state::maybe_update_for_edge): New, based on loop 447 body in exploded_path::feasible_p. 448 * exploded-graph.h (class feasibility_state): New. 449 4502021-03-10 David Malcolm <dmalcolm@redhat.com> 451 452 * supergraph.h 453 (callgraph_superedge::dyn_cast_callgraph_superedge): New. 454 (call_superedge::dyn_cast_callgraph_superedge): Delete. 455 (return_superedge::dyn_cast_callgraph_superedge): Delete. 456 4572021-03-02 Martin Liska <mliska@suse.cz> 458 459 * diagnostic-manager.cc (diagnostic_manager::emit_saved_diagnostics): 460 Do not pass engine. 461 4622021-02-26 David Malcolm <dmalcolm@redhat.com> 463 464 * engine.cc (exploded_path::exploded_path): New copy-ctor. 465 * exploded-graph.h (exploded_path::operator=): Drop decl. 466 4672021-02-26 David Malcolm <dmalcolm@redhat.com> 468 469 PR analyzer/96374 470 * diagnostic-manager.cc (class epath_finder): New. 471 (epath_finder::get_best_epath): New. 472 (saved_diagnostic::saved_diagnostic): Update for replacement of 473 m_state and m_epath_length with m_best_epath. 474 (saved_diagnostic::~saved_diagnostic): Delete m_best_epath. 475 (saved_diagnostic::to_json): Update "path_length" to be optional. 476 (saved_diagnostic::calc_best_epath): New, based on 477 dedupe_winners::add and parts of dedupe_key::dedupe_key. 478 (saved_diagnostic::get_epath_length): New. 479 (saved_diagnostic::add_duplicate): New. 480 (dedupe_key::dedupe_key): Drop epath param. Move invocation of 481 stmt_finder to saved_diagnostic::calc_best_epath. 482 (class dedupe_candidate): Delete. 483 (class dedupe_hash_map_traits): Update to use saved_diagnotic * 484 rather than dedupe_candidate * as the value_type/compare_type. 485 (dedupe_winners::~dedupe_winners): Don't delete the values. 486 (dedupe_winners::add): Convert param from shortest_exploded_paths to 487 epath_finder. Drop "eg" param. Drop dedupe_candidate, moving 488 path generation and feasiblity checking to 489 epath_finder::get_best_epath. Update winner-selection for move 490 of epaths from dedupe_candidate to saved_diagnostic. 491 (dedupe_winners::emit_best): Update for removal of class 492 dedupe_candidate. 493 (dedupe_winners::map_t): Update to use saved_diagnotic * rather 494 than dedupe_candidate * as the value_type/compare_type. 495 (diagnostic_manager::emit_saved_diagnostics): Move 496 shortest_exploded_paths instance into epath_finder and pass that 497 around instead. 498 (diagnostic_manager::emit_saved_diagnostic): Drop epath, stmt 499 and num_dupes params, instead getting these from the 500 saved_diagnostic. Use correct location in inform_n call. 501 * diagnostic-manager.h (class epath_finder): New forward decl. 502 (saved_diagnostic::status): Drop enum. 503 (saved_diagnostic::set_feasible): Drop. 504 (saved_diagnostic::set_infeasible): Drop. 505 (saved_diagnostic::get_status): Drop. 506 (saved_diagnostic::calc_best_epath): New decl. 507 (saved_diagnostic::get_best_epath): New decl. 508 (saved_diagnostic::get_epath_length): New decl. 509 (saved_diagnostic::set_epath_length): Drop. 510 (saved_diagnostic::get_epath_length): Drop inline implementation. 511 (saved_diagnostic::add_duplicate): New. 512 (saved_diagnostic::get_num_dupes): New. 513 (saved_diagnostic::m_d): Document ownership. 514 (saved_diagnostic::m_trailing_eedge): Make const. 515 (saved_diagnostic::m_status): Drop field. 516 (saved_diagnostic::m_epath_length): Drop field. 517 (saved_diagnostic::m_best_epath): New field. 518 (saved_diagnostic::m_problem): Document ownership. 519 (saved_diagnostic::m_duplicates): New field. 520 (diagnostic_manager::emit_saved_diagnostic): Drop params epath, 521 stmt, and num_dupes. 522 * engine.cc (exploded_graph_annotator::print_saved_diagnostic): 523 Update for changes to saved_diagnostic class. 524 * exploded-graph.h (exploded_path::feasible_p): Drop unused 525 overloaded decl. 526 5272021-02-25 David Malcolm <dmalcolm@redhat.com> 528 529 PR analyzer/99193 530 * region-model-impl-calls.cc (region_model::impl_call_realloc): New. 531 * region-model.cc (region_model::on_call_pre): Call it. 532 * region-model.h (region_model::impl_call_realloc): New decl. 533 * sm-malloc.cc (enum wording): Add WORDING_REALLOCATED. 534 (malloc_state_machine::m_realloc): New field. 535 (use_after_free::describe_state_change): Add case for 536 WORDING_REALLOCATED. 537 (use_after_free::describe_final_event): Likewise. 538 (malloc_state_machine::malloc_state_machine): Initialize 539 m_realloc. 540 (malloc_state_machine::on_stmt): Handle realloc by calling... 541 (malloc_state_machine::on_realloc_call): New. 542 5432021-02-22 David Malcolm <dmalcolm@redhat.com> 544 545 PR analyzer/99196 546 * engine.cc (exploded_node::on_stmt): Provide terminate_path 547 flag as a way for on_call_pre to terminate the current analysis 548 path. 549 * region-model-impl-calls.cc (call_details::num_args): New. 550 (region_model::impl_call_error): New. 551 * region-model.cc (region_model::on_call_pre): Add param 552 "out_terminate_path". Handle "error" and "error_at_line". 553 * region-model.h (call_details::num_args): New decl. 554 (region_model::on_call_pre): Add param "out_terminate_path". 555 (region_model::impl_call_error): New decl. 556 5572021-02-17 David Malcolm <dmalcolm@redhat.com> 558 559 PR analyzer/98969 560 * constraint-manager.cc (dead_svalue_purger::should_purge_p): 561 Update for change to svalue::live_p. 562 * program-state.cc (sm_state_map::on_liveness_change): Likewise. 563 (program_state::detect_leaks): Likewise. 564 * region-model-reachability.cc (reachable_regions::init_cluster): 565 When dealing with a symbolic region, if the underlying pointer is 566 implicitly live, add the region to the reachable regions. 567 * region-model.cc (region_model::compare_initial_and_pointer): 568 Move logic for detecting initial values of params to 569 initial_svalue::initial_value_of_param_p. 570 * svalue.cc (svalue::live_p): Convert "live_svalues" from a 571 reference to a pointer; support it being NULL. 572 (svalue::implicitly_live_p): Convert first param from a 573 refererence to a pointer. 574 (region_svalue::implicitly_live_p): Likewise. 575 (constant_svalue::implicitly_live_p): Likewise. 576 (initial_svalue::implicitly_live_p): Likewise. Treat the initial 577 values of params for the top level frame as still live. 578 (initial_svalue::initial_value_of_param_p): New function, taken 579 from a test in region_model::compare_initial_and_pointer. 580 (unaryop_svalue::implicitly_live_p): Convert first param from a 581 refererence to a pointer. 582 (binop_svalue::implicitly_live_p): Likewise. 583 (sub_svalue::implicitly_live_p): Likewise. 584 (unmergeable_svalue::implicitly_live_p): Likewise. 585 * svalue.h (svalue::live_p): Likewise. 586 (svalue::implicitly_live_p): Likewise. 587 (region_svalue::implicitly_live_p): Likewise. 588 (constant_svalue::implicitly_live_p): Likewise. 589 (initial_svalue::implicitly_live_p): Likewise. 590 (initial_svalue::initial_value_of_param_p): New decl. 591 (unaryop_svalue::implicitly_live_p): Convert first param from a 592 refererence to a pointer. 593 (binop_svalue::implicitly_live_p): Likewise. 594 (sub_svalue::implicitly_live_p): Likewise. 595 (unmergeable_svalue::implicitly_live_p): Likewise. 596 5972021-02-12 David Malcolm <dmalcolm@redhat.com> 598 599 PR analyzer/98969 600 * engine.cc (readability): Add names for the various arbitrary 601 values. Handle NOP_EXPR and INTEGER_CST. 602 (readability_comparator): Combine the readability tests for 603 tree and stack depth, rather than performing them sequentially. 604 (impl_region_model_context::on_state_leak): Strip off top-level 605 casts. 606 * region-model.cc (region_model::get_representative_path_var): Add 607 type-checking, moving the bulk of the implementation to... 608 (region_model::get_representative_path_var_1): ...here. Respect 609 types in casts by recursing and re-adding the cast, rather than 610 merely stripping them off. Use the correct type when handling 611 region_svalue. 612 (region_model::get_representative_tree): Strip off any top-level 613 cast. 614 (region_model::get_representative_path_var): Add type-checking, 615 moving the bulk of the implementation to... 616 (region_model::get_representative_path_var_1): ...here. 617 * region-model.h (region_model::get_representative_path_var_1): 618 New decl 619 (region_model::get_representative_path_var_1): New decl. 620 * store.cc (append_pathvar_with_type): New. 621 (binding_cluster::get_representative_path_vars): Cast path_vars 622 to the correct type when adding them to *OUT_PVS. 623 6242021-02-09 David Malcolm <dmalcolm@redhat.com> 625 626 PR analyzer/98575 627 * sm-file.cc (is_file_using_fn_p): Support "_IO_"-prefixed 628 variants. 629 6302021-02-09 David Malcolm <dmalcolm@redhat.com> 631 632 PR analyzer/98575 633 * store.cc (store::set_value): Treat a pointer written to *UNKNOWN 634 as having escaped. 635 6362021-02-02 David Malcolm <dmalcolm@redhat.com> 637 638 PR analyzer/93355 639 PR analyzer/96374 640 * engine.cc (toplevel_function_p): Simplify so that 641 we only reject functions with a "__analyzer_" prefix. 642 (add_any_callbacks): Delete. 643 (exploded_graph::build_initial_worklist): Update for 644 dropped param of toplevel_function_p. 645 (exploded_graph::build_initial_worklist): Don't bother 646 looking for callbacks that are reachable from global 647 initializers. 648 6492021-02-01 David Malcolm <dmalcolm@redhat.com> 650 651 PR analyzer/98918 652 * region-model-manager.cc 653 (region_model_manager::get_or_create_initial_value): 654 Fold the initial value of *UNKNOWN_PTR to an UNKNOWN value. 655 (region_model_manager::get_field_region): Fold the value 656 of UNKNOWN_PTR->FIELD to *UNKNOWN_PTR_OF_&FIELD_TYPE. 657 6582021-01-29 David Malcolm <dmalcolm@redhat.com> 659 660 * checker-path.cc (event_kind_to_string): Handle 661 EK_START_CONSOLIDATED_CFG_EDGES and 662 EK_END_CONSOLIDATED_CFG_EDGES. 663 (start_consolidated_cfg_edges_event::get_desc): New. 664 (checker_path::cfg_edge_pair_at_p): New. 665 * checker-path.h (enum event_kind): Add 666 EK_START_CONSOLIDATED_CFG_EDGES and 667 EK_END_CONSOLIDATED_CFG_EDGES. 668 (class start_consolidated_cfg_edges_event): New class. 669 (class end_consolidated_cfg_edges_event): New class. 670 (checker_path::delete_events): New. 671 (checker_path::replace_event): New. 672 (checker_path::cfg_edge_pair_at_p): New decl. 673 * diagnostic-manager.cc (diagnostic_manager::prune_path): Call 674 consolidate_conditions. 675 (same_line_as_p): New. 676 (diagnostic_manager::consolidate_conditions): New. 677 * diagnostic-manager.h 678 (diagnostic_manager::consolidate_conditions): New decl. 679 6802021-01-18 David Malcolm <dmalcolm@redhat.com> 681 682 * analyzer.h (is_std_named_call_p): New decl. 683 * diagnostic-manager.cc (path_builder::get_sm): New. 684 (state_change_event_creator::state_change_event_creator): Add "pb" 685 param. 686 (state_change_event_creator::on_global_state_change): Don't consider 687 state changes affecting other state_machines. 688 (state_change_event_creator::on_state_change): Likewise. 689 (state_change_event_creator::m_pb): New field. 690 (diagnostic_manager::add_events_for_eedge): Pass pb to visitor 691 ctor. 692 * region-model-impl-calls.cc 693 (region_model::impl_deallocation_call): New. 694 * region-model.cc: Include "attribs.h". 695 (region_model::on_call_post): Handle fndecls referenced by 696 __attribute__((deallocated_by(FOO))). 697 * region-model.h (region_model::impl_deallocation_call): New decl. 698 * sm-malloc.cc: Include "stringpool.h" and "attribs.h". Add 699 leading comment. 700 (class api): Delete. 701 (enum resource_state): Update comment for change from api to 702 deallocator and deallocator_set. 703 (allocation_state::allocation_state): Drop api param. Add 704 "deallocators" and "deallocator". 705 (allocation_state::m_api): Drop field in favor of... 706 (allocation_state::m_deallocators): New field. 707 (allocation_state::m_deallocator): New field. 708 (enum wording): Add WORDING_DEALLOCATED. 709 (struct deallocator): New. 710 (struct standard_deallocator): New. 711 (struct custom_deallocator): New. 712 (struct deallocator_set): New. 713 (struct custom_deallocator_set): New. 714 (struct standard_deallocator_set): New. 715 (struct deallocator_set_map_traits): New. 716 (malloc_state_machine::m_malloc): Drop field 717 (malloc_state_machine::m_scalar_new): Likewise. 718 (malloc_state_machine::m_vector_new): Likewise. 719 (malloc_state_machine::m_free): New field 720 (malloc_state_machine::m_scalar_delete): Likewise. 721 (malloc_state_machine::m_vector_delete): Likewise. 722 (malloc_state_machine::deallocator_map_t): New typedef. 723 (malloc_state_machine::m_deallocator_map): New field. 724 (malloc_state_machine::deallocator_set_cache_t): New typedef. 725 (malloc_state_machine::m_custom_deallocator_set_cache): New field. 726 (malloc_state_machine::custom_deallocator_set_map_t): New typedef. 727 (malloc_state_machine::m_custom_deallocator_set_map): New field. 728 (malloc_state_machine::m_dynamic_sets): New field. 729 (malloc_state_machine::m_dynamic_deallocators): New field. 730 (api::api): Delete. 731 (deallocator::deallocator): New ctor. 732 (deallocator::hash): New. 733 (deallocator::dump_to_pp): New. 734 (deallocator::cmp): New. 735 (deallocator::cmp_ptr_ptr): New. 736 (standard_deallocator::standard_deallocator): New ctor. 737 (deallocator_set::deallocator_set): New ctor. 738 (deallocator_set::dump): New. 739 (custom_deallocator_set::custom_deallocator_set): New ctor. 740 (custom_deallocator_set::contains_p): New. 741 (custom_deallocator_set::maybe_get_single): New. 742 (custom_deallocator_set::dump_to_pp): New. 743 (standard_deallocator_set::standard_deallocator_set): New ctor. 744 (standard_deallocator_set::contains_p): New. 745 (standard_deallocator_set::maybe_get_single): New. 746 (standard_deallocator_set::dump_to_pp): New. 747 (start_p): New. 748 (class mismatching_deallocation): Update for conversion from api 749 to deallocator_set and deallocator. 750 (double_free::emit): Use %qs. 751 (class use_after_free): Update for conversion from api to 752 deallocator_set and deallocator. 753 (malloc_leak::describe_state_change): Only emit "allocated here" on 754 a start->nonnull transition, rather than on other transitions to 755 nonnull. 756 (allocation_state::dump_to_pp): Update for conversion from api to 757 deallocator_set. 758 (allocation_state::get_nonnull): Likewise. 759 (malloc_state_machine::malloc_state_machine): Likewise. 760 (malloc_state_machine::~malloc_state_machine): New. 761 (malloc_state_machine::add_state): Update for conversion from api 762 to deallocator_set. 763 (malloc_state_machine::get_or_create_custom_deallocator_set): New. 764 (malloc_state_machine::maybe_create_custom_deallocator_set): New. 765 (malloc_state_machine::get_or_create_deallocator): New. 766 (malloc_state_machine::on_stmt): Update for conversion from api 767 to deallocator_set. Handle "__attribute__((malloc(FOO)))", and 768 the special attribute set on FOO. 769 (malloc_state_machine::on_allocator_call): Update for conversion 770 from api to deallocator_set. Add "returns_nonnull" param and use 771 it to affect which state to transition to. 772 (malloc_state_machine::on_deallocator_call): Update for conversion 773 from api to deallocator_set. 774 7752021-01-14 David Malcolm <dmalcolm@redhat.com> 776 777 * engine.cc (strongly_connected_components::to_json): New. 778 (worklist::to_json): New. 779 (exploded_graph::to_json): JSON-ify the worklist. 780 * exploded-graph.h (strongly_connected_components::to_json): New 781 decl. 782 (worklist::to_json): New decl. 783 * store.cc (store::to_json): Fix comment. 784 * supergraph.cc (supernode::to_json): Fix reference to 785 "returning_call" in comment. Add optional "fun" to JSON. 786 (edge_kind_to_string): New. 787 (superedge::to_json): Add "kind" to JSON. 788 7892021-01-14 David Malcolm <dmalcolm@redhat.com> 790 791 PR analyzer/98679 792 * analyzer.h (region_offset::operator==): Make const. 793 * pending-diagnostic.h (pending_diagnostic::equal_p): Likewise. 794 * store.h (binding_cluster::for_each_value): Likewise. 795 (binding_cluster::for_each_binding): Likewise. 796 7972021-01-12 David Malcolm <dmalcolm@redhat.com> 798 799 PR analyzer/98628 800 * store.cc (binding_cluster::make_unknown_relative_to): Don't mark 801 dereferenced unknown pointers as having escaped. 802 8032021-01-07 David Malcolm <dmalcolm@redhat.com> 804 805 PR analyzer/98580 806 * region.cc (decl_region::get_svalue_for_initializer): Gracefully 807 handle when LTO writes out DECL_INITIAL as error_mark_node. 808 8092021-01-07 David Malcolm <dmalcolm@redhat.com> 810 811 PR analyzer/97074 812 * store.cc (binding_cluster::can_merge_p): Add "out_store" param 813 and pass to calls to binding_cluster::make_unknown_relative_to. 814 (binding_cluster::make_unknown_relative_to): Add "out_store" 815 param. Use it to mark base regions that are pointed to by 816 pointers that become unknown as having escaped. 817 (store::can_merge_p): Pass out_store to 818 binding_cluster::can_merge_p. 819 * store.h (binding_cluster::can_merge_p): Add "out_store" param. 820 (binding_cluster::make_unknown_relative_to): Likewise. 821 * svalue.cc (region_svalue::implicitly_live_p): New vfunc. 822 * svalue.h (region_svalue::implicitly_live_p): New vfunc decl. 823 8242021-01-07 David Malcolm <dmalcolm@redhat.com> 825 826 PR analyzer/98564 827 * engine.cc (exploded_path::feasible_p): Add missing call to 828 bitmap_clear. 829 8302021-01-06 David Malcolm <dmalcolm@redhat.com> 831 832 PR analyzer/97072 833 * region-model-reachability.cc (reachable_regions::init_cluster): 834 Convert symbolic region handling to a switch statement. Add cases 835 to handle SK_UNKNOWN and SK_CONJURED. 836 8372021-01-05 David Malcolm <dmalcolm@redhat.com> 838 839 PR analyzer/98293 840 * store.cc (binding_map::apply_ctor_to_region): When "index" is 841 NULL, iterate through the fields for RECORD_TYPEs, rather than 842 creating an INTEGER_CST index. 843 8442020-11-30 David Malcolm <dmalcolm@redhat.com> 845 846 * analyzer-pass.cc: Include "analyzer/analyzer.h" for the 847 declaration of sorry_no_analyzer; include "tree.h" and 848 "function.h" as these are needed by it. 849 8502020-11-30 David Malcolm <dmalcolm@redhat.com> 851 852 * analyzer-pass.cc (pass_analyzer::execute): Move sorry call to... 853 (sorry_no_analyzer): New. 854 * analyzer.h (class state_machine): New forward decl. 855 (class logger): New forward decl. 856 (class plugin_analyzer_init_iface): New. 857 (sorry_no_analyzer): New decl. 858 * checker-path.cc (checker_path::fixup_locations): New. 859 * checker-path.h (checker_event::set_location): New. 860 (checker_path::fixup_locations): New decl. 861 * diagnostic-manager.cc 862 (diagnostic_manager::emit_saved_diagnostic): Call 863 checker_path::fixup_locations, and call fixup_location 864 on the primary location. 865 * engine.cc: Include "plugin.h". 866 (class plugin_analyzer_init_impl): New. 867 (impl_run_checkers): Invoke PLUGIN_ANALYZER_INIT callbacks. 868 * pending-diagnostic.h (pending_diagnostic::fixup_location): New 869 vfunc. 870 8712020-11-18 David Malcolm <dmalcolm@redhat.com> 872 873 PR analyzer/97893 874 * sm-malloc.cc (null_deref::emit): Use CWE-476 rather than 875 CWE-690, as this isn't due to an unchecked return value. 876 (null_arg::emit): Likewise. 877 8782020-11-12 David Malcolm <dmalcolm@redhat.com> 879 880 * checker-path.h (checker_event::get_id_ptr): New. 881 * diagnostic-manager.cc (path_builder::path_builder): Add "sd" 882 param and use it to initialize new field "m_sd". 883 (path_builder::get_pending_diagnostic): New. 884 (path_builder::m_sd): New field. 885 (diagnostic_manager::emit_saved_diagnostic): Pass sd to 886 path_builder ctor. 887 (diagnostic_manager::add_events_for_superedge): Call new 888 maybe_add_custom_events_for_superedge vfunc. 889 * engine.cc (stale_jmp_buf::stale_jmp_buf): Add "setjmp_point" 890 param and use it to initialize new field "m_setjmp_point". 891 Initialize new field "m_stack_pop_event". 892 (stale_jmp_buf::maybe_add_custom_events_for_superedge): New vfunc 893 implementation. 894 (stale_jmp_buf::describe_final_event): New vfunc implementation. 895 (stale_jmp_buf::m_setjmp_point): New field. 896 (stale_jmp_buf::m_stack_pop_event): New field. 897 (exploded_node::on_longjmp): Pass setjmp_point to stale_jmp_buf 898 ctor. 899 * pending-diagnostic.h 900 (pending_diagnostic::maybe_add_custom_events_for_superedge): New 901 vfunc. 902 9032020-11-12 David Malcolm <dmalcolm@redhat.com> 904 905 PR tree-optimization/97424 906 * analyzer.opt (Wanalyzer-shift-count-negative): New. 907 (Wanalyzer-shift-count-overflow): New. 908 * region-model.cc (class shift_count_negative_diagnostic): New. 909 (class shift_count_overflow_diagnostic): New. 910 (region_model::get_gassign_result): Complain about shift counts that 911 are negative or are >= the operand's type's width. 912 9132020-11-10 Martin Liska <mliska@suse.cz> 914 915 * constraint-manager.cc (constraint_manager::merge): Remove 916 unused code. 917 * constraint-manager.h: Likewise. 918 * program-state.cc (sm_state_map::sm_state_map): Likewise. 919 (program_state::program_state): Likewise. 920 (test_sm_state_map): Likewise. 921 * program-state.h: Likewise. 922 * region-model-reachability.cc (reachable_regions::reachable_regions): Likewise. 923 * region-model-reachability.h: Likewise. 924 * region-model.cc (region_model::handle_unrecognized_call): Likewise. 925 (region_model::get_reachable_svalues): Likewise. 926 (region_model::can_merge_with_p): Likewise. 927 9282020-11-05 David Malcolm <dmalcolm@redhat.com> 929 930 PR analyzer/97668 931 * svalue.cc (cmp_cst): Handle COMPLEX_CST. 932 9332020-10-29 David Malcolm <dmalcolm@redhat.com> 934 935 * program-state.cc (sm_state_map::on_liveness_change): Sort the 936 leaking svalues before calling on_state_leak. 937 (program_state::detect_leaks): Likewise when calling 938 on_svalue_leak. 939 * region-model-reachability.cc 940 (reachable_regions::mark_escaped_clusters): Likewise when 941 calling on_escaped_function. 942 9432020-10-29 David Malcolm <dmalcolm@redhat.com> 944 945 PR analyzer/97608 946 * region-model-reachability.cc (reachable_regions::handle_sval): 947 Operands of reachable reversible operations are reachable. 948 9492020-10-29 David Malcolm <dmalcolm@redhat.com> 950 951 * analyzer.h (class state_machine): New forward decl. 952 (class logger): Likewise. 953 (class visitor): Likewise. 954 * complexity.cc: New file, taken from svalue.cc. 955 * complexity.h: New file, taken from region-model.h. 956 * region-model.h: Include "analyzer/svalue.h" and 957 "analyzer/region.h". Move struct complexity to complexity.h. 958 Move svalue, its subclasses and supporting decls to svalue.h. 959 Move region, its subclasses and supporting decls to region.h. 960 * region.cc: Include "analyzer/region.h". 961 (symbolic_region::symbolic_region): Move here from region-model.h. 962 * region.h: New file, based on material from region-model.h. 963 * svalue.cc: Include "analyzer/svalue.h". 964 (complexity::complexity): Move to complexity.cc. 965 (complexity::from_pair): Likewise. 966 * svalue.h: New file, based on material from region-model.h. 967 9682020-10-29 David Malcolm <dmalcolm@redhat.com> 969 970 * program-state.cc (sm_state_map::print): Guard the printing of 971 the origin pointer with !flag_dump_noaddr. 972 * region.cc (string_region::dump_to_pp): Likewise for 973 m_string_cst. 974 9752020-10-27 David Malcolm <dmalcolm@redhat.com> 976 977 PR analyzer/97568 978 * region-model.cc (region_model::get_initial_value_for_global): 979 Move check that !DECL_EXTERNAL from here to... 980 * region.cc (decl_region::get_svalue_for_initializer): ...here, 981 using it to reject zero initialization. 982 9832020-10-27 Markus Böck <markus.boeck02@gmail.com> 984 985 PR analyzer/96608 986 * store.h (hash): Cast to intptr_t instead of long 987 9882020-10-27 David Malcolm <dmalcolm@redhat.com> 989 990 * constraint-manager.cc (svalue_cmp_by_ptr): Delete. 991 (equiv_class::canonicalize): Use svalue::cmp_ptr_ptr instead. 992 (equiv_class_cmp): Eliminate pointer comparison. 993 * diagnostic-manager.cc (dedupe_key::comparator): If they are at 994 the same location, also compare epath ength and pending_diagnostic 995 kind. 996 * engine.cc (readability_comparator): If two path_vars have the 997 same readability, then impose an arbitrary ordering on them. 998 (worklist::key_t::cmp): If two points have the same plan ordering, 999 continue the comparison. Call sm_state_map::cmp rather than 1000 comparing hash values. 1001 * program-state.cc (sm_state_map::entry_t::cmp): New. 1002 (sm_state_map::cmp): New. 1003 * program-state.h (sm_state_map::entry_t::cmp): New decl. 1004 (sm_state_map::elements): New. 1005 (sm_state_map::cmp): New. 1006 10072020-10-27 David Malcolm <dmalcolm@redhat.com> 1008 1009 * engine.cc (setjmp_record::cmp): New. 1010 (supernode_cluster::dump_dot): Avoid embedding pointer in cluster 1011 name. 1012 (supernode_cluster::cmp_ptr_ptr): New. 1013 (function_call_string_cluster::dump_dot): Avoid embedding pointer 1014 in cluster name. Sort m_map when dumping child clusters. 1015 (function_call_string_cluster::cmp_ptr_ptr): New. 1016 (root_cluster::dump_dot): Sort m_map when dumping child clusters. 1017 * program-point.cc (function_point::cmp): New. 1018 (function_point::cmp_ptr): New. 1019 * program-point.h (function_point::cmp): New decl. 1020 (function_point::cmp_ptr): New decl. 1021 * program-state.cc (sm_state_map::print): Sort the values. Guard 1022 the printing of pointers with !flag_dump_noaddr. 1023 (program_state::prune_for_point): Sort the regions. 1024 (log_set_of_svalues): Sort the values. Guard the printing of 1025 pointers with !flag_dump_noaddr. 1026 * region-model-manager.cc (log_uniq_map): Sort the values. 1027 * region-model-reachability.cc (dump_set): New function template. 1028 (reachable_regions::dump_to_pp): Use it. 1029 * region-model.h (svalue::cmp_ptr): New decl. 1030 (svalue::cmp_ptr_ptr): New decl. 1031 (setjmp_record::cmp): New decl. 1032 (placeholder_svalue::get_name): New accessor. 1033 (widening_svalue::get_point): New accessor. 1034 (compound_svalue::get_map): New accessor. 1035 (conjured_svalue::get_stmt): New accessor. 1036 (conjured_svalue::get_id_region): New accessor. 1037 (region::cmp_ptrs): Rename to... 1038 (region::cmp_ptr_ptr): ...this. 1039 * region.cc (region::cmp_ptrs): Rename to... 1040 (region::cmp_ptr_ptr): ...this. 1041 * state-purge.cc 1042 (state_purge_per_ssa_name::state_purge_per_ssa_name): Sort 1043 m_points_needing_name when dumping. 1044 * store.cc (concrete_binding::cmp_ptr_ptr): New. 1045 (symbolic_binding::cmp_ptr_ptr): New. 1046 (binding_map::cmp): New. 1047 (get_sorted_parent_regions): Update for renaming of 1048 region::cmp_ptrs to region::cmp_ptr_ptr. 1049 (store::dump_to_pp): Likewise. 1050 (store::to_json): Likewise. 1051 (store::can_merge_p): Sort the base regions before considering 1052 them. 1053 * store.h (concrete_binding::cmp_ptr_ptr): New decl. 1054 (symbolic_binding::cmp_ptr_ptr): New decl. 1055 (binding_map::cmp): New decl. 1056 * supergraph.cc (supergraph::supergraph): Assign UIDs to the 1057 gimple stmts. 1058 * svalue.cc (cmp_cst): New. 1059 (svalue::cmp_ptr): New. 1060 (svalue::cmp_ptr_ptr): New. 1061 10622020-10-27 David Malcolm <dmalcolm@redhat.com> 1063 1064 * engine.cc (exploded_graph::get_or_create_node): Fix off-by-one 1065 when imposing param_analyzer_max_enodes_per_program_point limit. 1066 10672020-10-27 David Malcolm <dmalcolm@redhat.com> 1068 1069 * region-model.cc (region_model::get_representative_path_var): 1070 Implement case RK_LABEL. 1071 * region-model.h (label_region::get_label): New accessor. 1072 10732020-10-22 David Malcolm <dmalcolm@redhat.com> 1074 1075 PR analyzer/97514 1076 * engine.cc (exploded_graph::add_function_entry): Handle failure 1077 to create an enode, rather than asserting. 1078 10792020-10-22 David Malcolm <dmalcolm@redhat.com> 1080 1081 PR analyzer/97489 1082 * engine.cc (exploded_graph::add_function_entry): Assert that we 1083 have a function body. 1084 (exploded_graph::on_escaped_function): Reject fndecls that don't 1085 have a function body. 1086 10872020-10-14 David Malcolm <dmalcolm@redhat.com> 1088 1089 PR analyzer/93388 1090 * region-model.cc (region_model::get_initial_value_for_global): 1091 Fall back to returning an initial_svalue if 1092 decl_region::get_svalue_for_initializer fails. 1093 * region.cc (decl_region::get_svalue_for_initializer): Don't 1094 attempt to create a compound_svalue if the region has an unknown 1095 size. 1096 10972020-10-14 David Malcolm <dmalcolm@redhat.com> 1098 1099 PR analyzer/93723 1100 * store.cc (binding_map::apply_ctor_to_region): Remove redundant 1101 assertion. 1102 11032020-10-12 David Malcolm <dmalcolm@redhat.com> 1104 1105 PR analyzer/97258 1106 * engine.cc (impl_region_model_context::on_escaped_function): New 1107 vfunc. 1108 (exploded_graph::add_function_entry): Use m_functions_with_enodes 1109 to implement idempotency. 1110 (add_any_callbacks): New. 1111 (exploded_graph::build_initial_worklist): Use the above to find 1112 callbacks that are reachable from global initializers. 1113 (exploded_graph::on_escaped_function): New. 1114 * exploded-graph.h 1115 (impl_region_model_context::on_escaped_function): New decl. 1116 (exploded_graph::on_escaped_function): New decl. 1117 (exploded_graph::m_functions_with_enodes): New field. 1118 * region-model-reachability.cc 1119 (reachable_regions::reachable_regions): Replace "store" param with 1120 "model" param; use it to initialize m_model. 1121 (reachable_regions::add): When getting the svalue for the region, 1122 call get_store_value on the model rather than using an initial 1123 value. 1124 (reachable_regions::mark_escaped_clusters): Add ctxt param and 1125 use it to call on_escaped_function when a function_region escapes. 1126 * region-model-reachability.h 1127 (reachable_regions::reachable_regions): Replace "store" param with 1128 "model" param. 1129 (reachable_regions::mark_escaped_clusters): Add ctxt param. 1130 (reachable_regions::m_model): New field. 1131 * region-model.cc (region_model::handle_unrecognized_call): Update 1132 for change in reachable_regions ctor. 1133 (region_model::handle_unrecognized_call): Pass ctxt to 1134 mark_escaped_clusters. 1135 (region_model::get_reachable_svalues): Update for change in 1136 reachable_regions ctor. 1137 (region_model::get_initial_value_for_global): Read-only variables 1138 keep their initial values. 1139 * region-model.h (region_model_context::on_escaped_function): New 1140 vfunc. 1141 (noop_region_model_context::on_escaped_function): New. 1142 11432020-10-12 David Malcolm <dmalcolm@redhat.com> 1144 1145 * analyzer.opt (Wanalyzer-write-to-const): New. 1146 (Wanalyzer-write-to-string-literal): New. 1147 * region-model-impl-calls.cc (region_model::impl_call_memcpy): 1148 Call check_for_writable_region. 1149 (region_model::impl_call_memset): Likewise. 1150 (region_model::impl_call_strcpy): Likewise. 1151 * region-model.cc (class write_to_const_diagnostic): New. 1152 (class write_to_string_literal_diagnostic): New. 1153 (region_model::check_for_writable_region): New. 1154 (region_model::set_value): Call check_for_writable_region. 1155 * region-model.h (region_model::check_for_writable_region): New 1156 decl. 1157 11582020-10-07 David Malcolm <dmalcolm@redhat.com> 1159 1160 PR analyzer/97116 1161 * sm-malloc.cc (method_p): New. 1162 (describe_argument_index): New. 1163 (inform_nonnull_attribute): Use describe_argument_index. 1164 (possible_null_arg::describe_final_event): Likewise. 1165 (null_arg::describe_final_event): Likewise. 1166 11672020-09-29 David Malcolm <dmalcolm@redhat.com> 1168 1169 PR analyzer/95188 1170 * engine.cc (stmt_requires_new_enode_p): Split enodes before 1171 "signal" calls. 1172 11732020-09-29 David Malcolm <dmalcolm@redhat.com> 1174 1175 * constraint-manager.cc 1176 (constraint_manager::add_constraint_internal): Whitespace fixes. 1177 Silence -Wsign-compare warning. 1178 * engine.cc (maybe_process_run_of_before_supernode_enodes): 1179 Silence -Wsign-compare warning. 1180 11812020-09-28 David Malcolm <dmalcolm@redhat.com> 1182 1183 * region-model.h (binop_svalue::dyn_cast_binop_svalue): Remove 1184 redundant "virtual". Add FINAL OVERRIDE. 1185 (widening_svalue::dyn_cast_widening_svalue): Add FINAL OVERRIDE. 1186 (compound_svalue::dyn_cast_compound_svalue): Likewise. 1187 (conjured_svalue::dyn_cast_conjured_svalue): Likewise. 1188 11892020-09-28 David Malcolm <dmalcolm@redhat.com> 1190 1191 * diagnostic-manager.cc (null_assignment_sm_context::m_visitor): 1192 Remove unused field. 1193 11942020-09-28 David Malcolm <dmalcolm@redhat.com> 1195 1196 PR analyzer/97233 1197 * analyzer.cc (is_longjmp_call_p): Require the initial argument 1198 to be a pointer. 1199 * engine.cc (exploded_node::on_longjmp): Likewise. 1200 12012020-09-28 David Malcolm <dmalcolm@redhat.com> 1202 1203 * program-state.cc (sm_state_map::print): Update check 1204 for m_global_state being the start state. 1205 12062020-09-26 David Malcolm <dmalcolm@redhat.com> 1207 1208 PR analyzer/96646 1209 PR analyzer/96841 1210 * region-model.cc (region_model::get_representative_path_var): 1211 When handling offset_region, wrap the MEM_REF's first argument in 1212 an ADDR_EXPR of pointer type, rather than simply using the tree 1213 for the parent region. Require the MEM_REF's second argument to 1214 be an integer constant. 1215 12162020-09-24 David Malcolm <dmalcolm@redhat.com> 1217 1218 * analyzer.h (struct rejected_constraint): New decl. 1219 * analyzer.opt (fanalyzer-feasibility): New option. 1220 * diagnostic-manager.cc (path_builder::path_builder): Add 1221 "problem" param and use it to initialize new field. 1222 (path_builder::get_feasibility_problem): New accessor. 1223 (path_builder::m_feasibility_problem): New field. 1224 (dedupe_winners::add): Remove inversion of logic in "if" clause, 1225 swapping if/else suites. In the !feasible_p suite, inspect 1226 flag_analyzer_feasibility and add code to handle when this 1227 is off, accepting the infeasible path, but recording the 1228 feasibility_problem. 1229 (diagnostic_manager::emit_saved_diagnostic): Pass the 1230 feasibility_problem to the path_builder. 1231 (diagnostic_manager::add_events_for_eedge): If we have 1232 a feasibility_problem at this edge, use it to add a custom event. 1233 * engine.cc (exploded_path::feasible_p): Pass a 1234 rejected_constraint ** to model.maybe_update_for_edge and transfer 1235 ownership of any created instance to any feasibility_problem. 1236 (feasibility_problem::dump_to_pp): New. 1237 * exploded-graph.h (feasibility_problem::feasibility_problem): 1238 Drop "model" param; add rejected_constraint * param. 1239 (feasibility_problem::~feasibility_problem): New. 1240 (feasibility_problem::dump_to_pp): New decl. 1241 (feasibility_problem::m_model): Drop field. 1242 (feasibility_problem::m_rc): New field. 1243 * program-point.cc (function_point::get_location): Handle 1244 PK_BEFORE_SUPERNODE and PK_AFTER_SUPERNODE. 1245 * program-state.cc (program_state::on_edge): Pass NULL to new 1246 param of region_model::maybe_update_for_edge. 1247 * region-model.cc (region_model::add_constraint): New overload 1248 adding a rejected_constraint ** param. 1249 (region_model::maybe_update_for_edge): Add rejected_constraint ** 1250 param and pass it to the various apply_constraints_for_ calls. 1251 (region_model::apply_constraints_for_gcond): Add 1252 rejected_constraint ** param and pass it to add_constraint calls. 1253 (region_model::apply_constraints_for_gswitch): Likewise. 1254 (region_model::apply_constraints_for_exception): Likewise. 1255 (rejected_constraint::dump_to_pp): New. 1256 * region-model.h (region_model::maybe_update_for_edge): 1257 Add rejected_constraint ** param. 1258 (region_model::add_constraint): New overload adding a 1259 rejected_constraint ** param. 1260 (region_model::apply_constraints_for_gcond): Add 1261 rejected_constraint ** param. 1262 (region_model::apply_constraints_for_gswitch): Likewise. 1263 (region_model::apply_constraints_for_exception): Likewise. 1264 (struct rejected_constraint): New. 1265 12662020-09-23 David Malcolm <dmalcolm@redhat.com> 1267 1268 PR analyzer/97178 1269 * engine.cc (impl_run_checkers): Update for change to ext_state 1270 ctor. 1271 * program-state.cc (selftest::test_sm_state_map): Pass an engine 1272 instance to ext_state ctor. 1273 (selftest::test_program_state_1): Likewise. 1274 (selftest::test_program_state_2): Likewise. 1275 (selftest::test_program_state_merging): Likewise. 1276 (selftest::test_program_state_merging_2): Likewise. 1277 * program-state.h (extrinsic_state::extrinsic_state): Remove NULL 1278 default value for "eng" param. 1279 12802020-09-23 Tobias Burnus <tobias@codesourcery.com> 1281 1282 * analyzer-logging.cc: Guard '#pragma ... ignored "-Wformat-diag"' 1283 by '#if __GNUC__ >= 10' 1284 * analyzer.h: Likewise. 1285 * call-string.cc: Likewise. 1286 12872020-09-23 David Malcolm <dmalcolm@redhat.com> 1288 1289 * engine.cc (exploded_node::on_stmt): Replace sequence of dyn_cast 1290 with switch. 1291 12922020-09-22 David Malcolm <dmalcolm@redhat.com> 1293 1294 * analysis-plan.cc: Include "json.h". 1295 * analyzer.opt (fdump-analyzer-json): New. 1296 * call-string.cc: Include "json.h". 1297 (call_string::to_json): New. 1298 * call-string.h (call_string::to_json): New decl. 1299 * checker-path.cc: Include "json.h". 1300 * constraint-manager.cc: Include "json.h". 1301 (equiv_class::to_json): New. 1302 (constraint::to_json): New. 1303 (constraint_manager::to_json): New. 1304 * constraint-manager.h (equiv_class::to_json): New decl. 1305 (constraint::to_json): New decl. 1306 (constraint_manager::to_json): New decl. 1307 * diagnostic-manager.cc: Include "json.h". 1308 (saved_diagnostic::to_json): New. 1309 (diagnostic_manager::to_json): New. 1310 * diagnostic-manager.h (saved_diagnostic::to_json): New decl. 1311 (diagnostic_manager::to_json): New decl. 1312 * engine.cc: Include "json.h", <zlib.h>. 1313 (exploded_node::status_to_str): New. 1314 (exploded_node::to_json): New. 1315 (exploded_edge::to_json): New. 1316 (exploded_graph::to_json): New. 1317 (dump_analyzer_json): New. 1318 (impl_run_checkers): Call it. 1319 * exploded-graph.h (exploded_node::status_to_str): New decl. 1320 (exploded_node::to_json): New. 1321 (exploded_edge::to_json): New. 1322 (exploded_graph::to_json): New. 1323 * pending-diagnostic.cc: Include "json.h". 1324 * program-point.cc: Include "json.h". 1325 (program_point::to_json): New. 1326 * program-point.h (program_point::to_json): New decl. 1327 * program-state.cc: Include "json.h". 1328 (extrinsic_state::to_json): New. 1329 (sm_state_map::to_json): New. 1330 (program_state::to_json): New. 1331 * program-state.h (extrinsic_state::to_json): New decl. 1332 (sm_state_map::to_json): New decl. 1333 (program_state::to_json): New decl. 1334 * region-model-impl-calls.cc: Include "json.h". 1335 * region-model-manager.cc: Include "json.h". 1336 * region-model-reachability.cc: Include "json.h". 1337 * region-model.cc: Include "json.h". 1338 * region-model.h (svalue::to_json): New decl. 1339 (region::to_json): New decl. 1340 * region.cc: Include "json.h". 1341 (region::to_json: New. 1342 * sm-file.cc: Include "json.h". 1343 * sm-malloc.cc: Include "json.h". 1344 * sm-pattern-test.cc: Include "json.h". 1345 * sm-sensitive.cc: Include "json.h". 1346 * sm-signal.cc: Include "json.h". 1347 (signal_delivery_edge_info_t::to_json): New. 1348 * sm-taint.cc: Include "json.h". 1349 * sm.cc: Include "diagnostic.h", "tree-diagnostic.h", and 1350 "json.h". 1351 (state_machine::state::to_json): New. 1352 (state_machine::to_json): New. 1353 * sm.h (state_machine::state::to_json): New. 1354 (state_machine::to_json): New. 1355 * state-purge.cc: Include "json.h". 1356 * store.cc: Include "json.h". 1357 (binding_key::get_desc): New. 1358 (binding_map::to_json): New. 1359 (binding_cluster::to_json): New. 1360 (store::to_json): New. 1361 * store.h (binding_key::get_desc): New decl. 1362 (binding_map::to_json): New decl. 1363 (binding_cluster::to_json): New decl. 1364 (store::to_json): New decl. 1365 * supergraph.cc: Include "json.h". 1366 (supergraph::to_json): New. 1367 (supernode::to_json): New. 1368 (superedge::to_json): New. 1369 * supergraph.h (supergraph::to_json): New decl. 1370 (supernode::to_json): New decl. 1371 (superedge::to_json): New decl. 1372 * svalue.cc: Include "json.h". 1373 (svalue::to_json): New. 1374 13752020-09-21 David Malcolm <dmalcolm@redhat.com> 1376 1377 PR analyzer/97130 1378 * region-model-impl-calls.cc (call_details::get_arg_type): New. 1379 * region-model.cc (region_model::on_call_pre): Check that the 1380 initial arg is a pointer before calling impl_call_memset and 1381 impl_call_strlen. 1382 * region-model.h (call_details::get_arg_type): New decl. 1383 13842020-09-21 David Malcolm <dmalcolm@redhat.com> 1385 1386 PR analyzer/93355 1387 * sm-malloc.cc (malloc_state_machine::get_default_state): Look at 1388 the base region when considering pointers. Treat pointers to 1389 decls as being non-heap. 1390 13912020-09-18 David Malcolm <dmalcolm@redhat.com> 1392 1393 * checker-path.cc (warning_event::get_desc): Handle global state 1394 changes. 1395 13962020-09-18 David Malcolm <dmalcolm@redhat.com> 1397 1398 * sm-malloc.cc (malloc_state_machine::on_stmt): Handle strdup and 1399 strndup as being malloc-like allocators. 1400 14012020-09-16 David Malcolm <dmalcolm@redhat.com> 1402 1403 * engine.cc (strongly_connected_components::strong_connect): Only 1404 consider intraprocedural edges when creating SCCs. 1405 (worklist::key_t::cmp): Add comment. Treat call_string 1406 differences as more important than differences of program_point 1407 within a supernode. 1408 14092020-09-16 David Malcolm <dmalcolm@redhat.com> 1410 1411 * engine.cc (supernode_cluster::dump_dot): Show the SCC id 1412 in the per-supernode clusters in FILENAME.eg.dot output. 1413 (exploded_graph_annotator::add_node_annotations): 1414 Show the SCC of the supernode in FILENAME.supernode.eg.dot output. 1415 * exploded-graph.h (worklist::scc_id): New. 1416 (exploded_graph::get_scc_id): New. 1417 14182020-09-16 David Malcolm <dmalcolm@redhat.com> 1419 1420 * engine.cc (exploded_node::dump_dot): Show STATUS_BULK_MERGED. 1421 (exploded_graph::process_worklist): Call 1422 maybe_process_run_of_before_supernode_enodes. 1423 (exploded_graph::maybe_process_run_of_before_supernode_enodes): 1424 New. 1425 (exploded_graph_annotator::print_enode): Show STATUS_BULK_MERGED. 1426 * exploded-graph.h (enum exploded_node::status): Add 1427 STATUS_BULK_MERGED. 1428 14292020-09-16 David Malcolm <dmalcolm@redhat.com> 1430 1431 * engine.cc 1432 (exploded_graph::process_node) <case PK_BEFORE_SUPERNODE>: 1433 Simplify by using program_point::get_next. 1434 * program-point.cc (program_point::get_next): New. 1435 * program-point.h (program_point::get_next): New decl. 1436 14372020-09-16 David Malcolm <dmalcolm@redhat.com> 1438 1439 * engine.cc (exploded_graph::get_or_create_node): Show the 1440 program point when issuing -Wanalyzer-too-complex due to hitting 1441 the per-program-point limit. 1442 14432020-09-16 David Malcolm <dmalcolm@redhat.com> 1444 1445 * region-model.cc (region_model::on_call_pre): Treat getchar as 1446 having no side-effects. 1447 14482020-09-15 David Malcolm <dmalcolm@redhat.com> 1449 1450 PR analyzer/96650 1451 * constraint-manager.cc (merger_fact_visitor::on_fact): Replace 1452 assertion that add_constraint succeeded with an assertion that 1453 if it fails, -fanalyzer-transitivity is off. 1454 14552020-09-14 David Malcolm <dmalcolm@redhat.com> 1456 1457 * analyzer.opt (-param=analyzer-max-constraints=): New param. 1458 * constraint-manager.cc 1459 (constraint_manager::add_constraint_internal): Silently reject 1460 attempts to add constraints when the above limit is reached. 1461 14622020-09-14 David Malcolm <dmalcolm@redhat.com> 1463 1464 PR analyzer/96653 1465 * constraint-manager.cc 1466 (constraint_manager::get_or_add_equiv_class): Don't accumulate 1467 transitive closure of all constraints on constants. 1468 14692020-09-14 David Malcolm <dmalcolm@redhat.com> 1470 1471 PR analyzer/97029 1472 * analyzer.cc (is_setjmp_call_p): Require the initial arg to be a 1473 pointer. 1474 * region-model.cc (region_model::deref_rvalue): Assert that the 1475 svalue is of pointer type. 1476 14772020-09-11 David Malcolm <dmalcolm@redhat.com> 1478 1479 PR analyzer/96798 1480 * region-model-impl-calls.cc (region_model::impl_call_memcpy): 1481 New. 1482 (region_model::impl_call_strcpy): New. 1483 * region-model.cc (region_model::on_call_pre): Flag unhandled 1484 builtins that are non-pure as having unknown side-effects. 1485 Implement BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_STRCPY, 1486 BUILT_IN_STRCPY_CHK, BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED, 1487 BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_FPUTC, 1488 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED, 1489 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF, 1490 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR, 1491 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED, 1492 BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF. 1493 * region-model.h (region_model::impl_call_memcpy): New decl. 1494 (region_model::impl_call_strcpy): New decl. 1495 14962020-09-09 David Malcolm <dmalcolm@redhat.com> 1497 1498 PR analyzer/94355 1499 * analyzer.opt (Wanalyzer-mismatching-deallocation): New warning. 1500 * region-model-impl-calls.cc 1501 (region_model::impl_call_operator_new): New. 1502 (region_model::impl_call_operator_delete): New. 1503 * region-model.cc (region_model::on_call_pre): Detect operator new 1504 and operator delete. 1505 (region_model::on_call_post): Likewise. 1506 (region_model::maybe_update_for_edge): Detect EH edges and call... 1507 (region_model::apply_constraints_for_exception): New function. 1508 * region-model.h (region_model::impl_call_operator_new): New decl. 1509 (region_model::impl_call_operator_delete): New decl. 1510 (region_model::apply_constraints_for_exception): New decl. 1511 * sm-malloc.cc (enum resource_state): New. 1512 (struct allocation_state): New state subclass. 1513 (enum wording): New. 1514 (struct api): New. 1515 (malloc_state_machine::custom_data_t): New typedef. 1516 (malloc_state_machine::add_state): New decl. 1517 (malloc_state_machine::m_unchecked) 1518 (malloc_state_machine::m_nonnull) 1519 (malloc_state_machine::m_freed): Delete these states in favor 1520 of... 1521 (malloc_state_machine::m_malloc) 1522 (malloc_state_machine::m_scalar_new) 1523 (malloc_state_machine::m_vector_new): ...this new api instances, 1524 which own their own versions of these states. 1525 (malloc_state_machine::on_allocator_call): New decl. 1526 (malloc_state_machine::on_deallocator_call): New decl. 1527 (api::api): New ctor. 1528 (dyn_cast_allocation_state): New. 1529 (as_a_allocation_state): New. 1530 (get_rs): New. 1531 (unchecked_p): New. 1532 (nonnull_p): New. 1533 (freed_p): New. 1534 (malloc_diagnostic::describe_state_change): Use unchecked_p and 1535 nonnull_p. 1536 (class mismatching_deallocation): New. 1537 (double_free::double_free): Add funcname param for initializing 1538 m_funcname. 1539 (double_free::emit): Use m_funcname in warning message rather 1540 than hardcoding "free". 1541 (double_free::describe_state_change): Likewise. Use freed_p. 1542 (double_free::describe_call_with_state): Use freed_p. 1543 (double_free::describe_final_event): Use m_funcname in message 1544 rather than hardcoding "free". 1545 (double_free::m_funcname): New field. 1546 (possible_null::describe_state_change): Use unchecked_p. 1547 (possible_null::describe_return_of_state): Likewise. 1548 (use_after_free::use_after_free): Add param for initializing m_api. 1549 (use_after_free::emit): Use m_api->m_dealloc_funcname in message 1550 rather than hardcoding "free". 1551 (use_after_free::describe_state_change): Use freed_p. Change the 1552 wording of the message based on the API. 1553 (use_after_free::describe_final_event): Use 1554 m_api->m_dealloc_funcname in message rather than hardcoding 1555 "free". Change the wording of the message based on the API. 1556 (use_after_free::m_api): New field. 1557 (malloc_leak::describe_state_change): Use unchecked_p. Update 1558 for renaming of m_malloc_event to m_alloc_event. 1559 (malloc_leak::describe_final_event): Update for renaming of 1560 m_malloc_event to m_alloc_event. 1561 (malloc_leak::m_malloc_event): Rename... 1562 (malloc_leak::m_alloc_event): ...to this. 1563 (free_of_non_heap::free_of_non_heap): Add param for initializing 1564 m_funcname. 1565 (free_of_non_heap::emit): Use m_funcname in message rather than 1566 hardcoding "free". 1567 (free_of_non_heap::describe_final_event): Likewise. 1568 (free_of_non_heap::m_funcname): New field. 1569 (allocation_state::dump_to_pp): New. 1570 (allocation_state::get_nonnull): New. 1571 (malloc_state_machine::malloc_state_machine): Update for changes 1572 to state fields and new api fields. 1573 (malloc_state_machine::add_state): New. 1574 (malloc_state_machine::on_stmt): Move malloc/calloc handling to 1575 on_allocator_call and call it, passing in the API pointer. 1576 Likewise for free, moving it to on_deallocator_call. Handle calls 1577 to operator new and delete in an analogous way. Use unchecked_p 1578 when testing for possibly-null-arg and possibly-null-deref, and 1579 transition to the non-null for the correct API. Remove redundant 1580 node param from call to on_zero_assignment. Use freed_p for 1581 use-after-free check, and pass in API. 1582 (malloc_state_machine::on_allocator_call): New, based on code in 1583 on_stmt. 1584 (malloc_state_machine::on_deallocator_call): Likewise. 1585 (malloc_state_machine::on_phi): Mark node param with 1586 ATTRIBUTE_UNUSED; don't pass it to on_zero_assignment. 1587 (malloc_state_machine::on_condition): Mark node param with 1588 ATTRIBUTE_UNUSED. Replace on_transition calls with get_state and 1589 set_next_state pairs, transitioning to the non-null state for the 1590 appropriate API. 1591 (malloc_state_machine::can_purge_p): Port to new state approach. 1592 (malloc_state_machine::on_zero_assignment): Replace on_transition 1593 calls with get_state and set_next_state pairs. Drop redundant 1594 node param. 1595 * sm.h (state_machine::add_custom_state): New. 1596 15972020-09-09 David Malcolm <dmalcolm@redhat.com> 1598 1599 * diagnostic-manager.cc 1600 (null_assignment_sm_context::warn_for_state): Replace with... 1601 (null_assignment_sm_context::warn): ...this. 1602 * engine.cc (impl_sm_context::warn_for_state): Replace with... 1603 (impl_sm_context::warn): ...this. 1604 * sm-file.cc (fileptr_state_machine::on_stmt): Replace 1605 warn_for_state and on_transition calls with a get_state 1606 test guarding warn and set_next_state calls. 1607 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise. 1608 * sm-pattern-test.cc (pattern_test_state_machine::on_condition): 1609 Replace warn_for_state call with warn call. 1610 * sm-sensitive.cc 1611 (sensitive_state_machine::warn_for_any_exposure): Replace 1612 warn_for_state call with a get_state test guarding a warn call. 1613 * sm-signal.cc (signal_state_machine::on_stmt): Likewise. 1614 * sm-taint.cc (taint_state_machine::on_stmt): Replace 1615 warn_for_state and on_transition calls with a get_state 1616 test guarding warn and set_next_state calls. 1617 * sm.h (sm_context::warn_for_state): Replace with... 1618 (sm_context::warn): ...this. 1619 16202020-09-09 David Malcolm <dmalcolm@redhat.com> 1621 1622 * diagnostic-manager.cc 1623 (null_assignment_sm_context::null_assignment_sm_context): Add old_state 1624 and ext_state params, initializing m_old_state and m_ext_state. 1625 (null_assignment_sm_context::on_transition): Split into... 1626 (null_assignment_sm_context::get_state): ...this new vfunc 1627 implementation and... 1628 (null_assignment_sm_context::set_next_state): ...this new vfunc 1629 implementation. 1630 (null_assignment_sm_context::m_old_state): New field. 1631 (null_assignment_sm_context::m_ext_state): New field. 1632 (diagnostic_manager::add_events_for_eedge): Pass in old state and 1633 ext_state when creating sm_ctxt. 1634 * engine.cc (impl_sm_context::on_transition): Split into... 1635 (impl_sm_context::get_state): ...this new vfunc 1636 implementation and... 1637 (impl_sm_context::set_next_state): ...this new vfunc 1638 implementation. 1639 * sm.h (sm_context::get_state): New pure virtual function. 1640 (sm_context::set_next_state): Likewise. 1641 (sm_context::on_transition): Convert from a pure virtual function 1642 to a regular function implemented in terms of get_state and 1643 set_next_state. 1644 16452020-09-09 David Malcolm <dmalcolm@redhat.com> 1646 1647 * checker-path.cc (state_change_event::get_desc): Update 1648 state_machine::get_state_name calls to state::get_name. 1649 (warning_event::get_desc): Likewise. 1650 * diagnostic-manager.cc 1651 (null_assignment_sm_context::on_transition): Update comparison 1652 against 0 with comparison with m_sm.get_start_state. 1653 (diagnostic_manager::prune_for_sm_diagnostic): Update 1654 state_machine::get_state_name calls to state::get_name. 1655 * engine.cc (impl_sm_context::on_transition): Likewise. 1656 (exploded_node::get_dot_fillcolor): Use get_id when summing 1657 the sm states. 1658 * program-state.cc (sm_state_map::sm_state_map): Don't hardcode 1659 0 as the start state when initializing m_global_state. 1660 (sm_state_map::print): Use dump_to_pp rather than get_state_name 1661 when dumping states. 1662 (sm_state_map::is_empty_p): Don't hardcode 0 as the start state 1663 when examining m_global_state. 1664 (sm_state_map::hash): Use get_id when hashing states. 1665 (selftest::test_sm_state_map): Use state objects rather than 1666 arbitrary hardcoded integers. 1667 (selftest::test_program_state_merging): Likewise. 1668 (selftest::test_program_state_merging_2): Likewise. 1669 * sm-file.cc (fileptr_state_machine::m_start): Move to base class. 1670 (file_diagnostic::describe_state_change): Use get_start_state. 1671 (fileptr_state_machine::fileptr_state_machine): Drop m_start 1672 initialization. 1673 * sm-malloc.cc (malloc_state_machine::m_start): Move to base 1674 class. 1675 (malloc_diagnostic::describe_state_change): Use get_start_state. 1676 (possible_null::describe_state_change): Likewise. 1677 (malloc_state_machine::malloc_state_machine): Drop m_start 1678 initialization. 1679 * sm-pattern-test.cc (pattern_test_state_machine::m_start): Move 1680 to base class. 1681 (pattern_test_state_machine::pattern_test_state_machine): Drop 1682 m_start initialization. 1683 * sm-sensitive.cc (sensitive_state_machine::m_start): Move to base 1684 class. 1685 (sensitive_state_machine::sensitive_state_machine): Drop m_start 1686 initialization. 1687 * sm-signal.cc (signal_state_machine::m_start): Move to base 1688 class. 1689 (signal_state_machine::signal_state_machine): Drop m_start 1690 initialization. 1691 * sm-taint.cc (taint_state_machine::m_start): Move to base class. 1692 (taint_state_machine::taint_state_machine): Drop m_start 1693 initialization. 1694 * sm.cc (state_machine::state::dump_to_pp): New. 1695 (state_machine::state_machine): Move here from sm.h. Initialize 1696 m_next_state_id and m_start. 1697 (state_machine::add_state): Reimplement in terms of state objects. 1698 (state_machine::get_state_name): Delete. 1699 (state_machine::get_state_by_name): Reimplement in terms of state 1700 objects. Make const. 1701 (state_machine::validate): Delete. 1702 (state_machine::dump_to_pp): Reimplement in terms of state 1703 objects. 1704 * sm.h (state_machine::state): New class. 1705 (state_machine::state_t): Convert typedef from "unsigned" to 1706 "const state_machine::state *". 1707 (state_machine::state_machine): Move to sm.cc. 1708 (state_machine::get_default_state): Use m_start rather than 1709 hardcoding 0. 1710 (state_machine::get_state_name): Delete. 1711 (state_machine::get_state_by_name): Make const. 1712 (state_machine::get_start_state): New accessor. 1713 (state_machine::alloc_state_id): New. 1714 (state_machine::m_state_names): Drop in favor of... 1715 (state_machine::m_states): New field 1716 (state_machine::m_start): New field 1717 (start_start_p): Delete. 1718 17192020-09-08 David Malcolm <dmalcolm@redhat.com> 1720 1721 PR analyzer/96949 1722 * store.cc (binding_map::apply_ctor_val_to_range): Add 1723 error-handling for the cases where we have symbolic offsets. 1724 17252020-09-08 David Malcolm <dmalcolm@redhat.com> 1726 1727 PR analyzer/96950 1728 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR 1729 where min_index == max_index. 1730 (binding_map::apply_ctor_val_to_range): Replace assertion that we 1731 don't have a CONSTRUCTOR value with error-handling. 1732 17332020-09-08 David Malcolm <dmalcolm@redhat.com> 1734 1735 PR analyzer/96962 1736 * region-model.cc (region_model::on_call_pre): Fix guard on switch 1737 on built-ins to only consider BUILT_IN_NORMAL, rather than other 1738 kinds of build-ins. 1739 17402020-09-01 David Malcolm <dmalcolm@redhat.com> 1741 1742 PR analyzer/96792 1743 * region-model.cc (region_model::deref_rvalue): Add the constraint 1744 that PTR_SVAL is non-NULL. 1745 17462020-08-31 David Malcolm <dmalcolm@redhat.com> 1747 1748 PR analyzer/96798 1749 * region-model.cc (region_model::on_call_pre): Handle 1750 BUILT_IN_MEMSET_CHK. 1751 17522020-08-31 David Malcolm <dmalcolm@redhat.com> 1753 1754 * region-model.cc (region_model::on_call_pre): Gather handling of 1755 builtins and of internal fns into switch statements. Handle 1756 "alloca" and BUILT_IN_ALLOCA_WITH_ALIGN. 1757 17582020-08-31 David Malcolm <dmalcolm@redhat.com> 1759 1760 PR analyzer/96860 1761 * region.cc (decl_region::get_svalue_for_constructor): Support 1762 apply_ctor_to_region failing. 1763 * store.cc (binding_map::apply_ctor_to_region): Add failure 1764 handling. 1765 (binding_map::apply_ctor_val_to_range): Likewise. 1766 (binding_map::apply_ctor_pair_to_child_region): Likewise. Replace 1767 assertion that child_base_offset is not symbolic with error 1768 handling. 1769 * store.h (binding_map::apply_ctor_to_region): Convert return type 1770 from void to bool. 1771 (binding_map::apply_ctor_val_to_range): Likewise. 1772 (binding_map::apply_ctor_pair_to_child_region): Likewise. 1773 17742020-08-31 David Malcolm <dmalcolm@redhat.com> 1775 1776 PR analyzer/96763 1777 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR 1778 by calling a new binding_map::apply_ctor_val_to_range subroutine. 1779 Split out the existing non-CONSTRUCTOR-handling code to a new 1780 apply_ctor_pair_to_child_region subroutine. 1781 (binding_map::apply_ctor_val_to_range): New. 1782 (binding_map::apply_ctor_pair_to_child_region): New, split out 1783 from binding_map::apply_ctor_to_region as noted above. 1784 * store.h (binding_map::apply_ctor_val_to_range): New decl. 1785 (binding_map::apply_ctor_pair_to_child_region): New decl. 1786 17872020-08-31 David Malcolm <dmalcolm@redhat.com> 1788 1789 PR analyzer/96764 1790 * region-model-manager.cc 1791 (region_model_manager::maybe_fold_unaryop): Handle VIEW_CONVERT_EXPR. 1792 (region_model_manager::get_or_create_cast): Move logic for 1793 real->integer casting to... 1794 (get_code_for_cast): ...this new function, and add logic for 1795 real->non-integer casts. 1796 (region_model_manager::maybe_fold_sub_svalue): Handle 1797 VIEW_CONVERT_EXPR. 1798 * region-model.cc 1799 (region_model::add_any_constraints_from_gassign): Likewise. 1800 * svalue.cc (svalue::maybe_undo_cast): Likewise. 1801 (unaryop_svalue::dump_to_pp): Likewise. 1802 18032020-08-26 David Malcolm <dmalcolm@redhat.com> 1804 1805 PR analyzer/94858 1806 * region-model-manager.cc 1807 (region_model_manager::get_or_create_widening_svalue): Assert that 1808 neither of the inputs are themselves widenings. 1809 * store.cc (store::eval_alias_1): The initial value of a pointer 1810 can't point to a region that was allocated on the heap after the 1811 beginning of the path. A widened pointer value can't alias anything 1812 that the initial pointer value can't alias. 1813 * svalue.cc (svalue::can_merge_p): Merge BINOP (X, OP, CST) with X 1814 to a widening svalue. Merge 1815 BINOP(WIDENING(BASE, BINOP(BASE, X)), X) and BINOP(BASE, X) to 1816 to the LHS of the first BINOP. 1817 18182020-08-26 David Malcolm <dmalcolm@redhat.com> 1819 1820 PR analyzer/96777 1821 * region-model.h (class compound_svalue): Document that all keys 1822 must be concrete. 1823 (compound_svalue::compound_svalue): Move definition to svalue.cc. 1824 * store.cc (binding_map::apply_ctor_to_region): Handle 1825 initializers for trailing arrays with incomplete size. 1826 * svalue.cc (compound_svalue::compound_svalue): Move definition 1827 here from region-model.h. Add assertion that all keys are 1828 concrete. 1829 18302020-08-22 David Malcolm <dmalcolm@redhat.com> 1831 1832 PR analyzer/94851 1833 * region-model-manager.cc 1834 (region_model_manager::maybe_fold_binop): Fold bitwise "& 0" to 0. 1835 18362020-08-22 David Malcolm <dmalcolm@redhat.com> 1837 1838 * store.cc (store::eval_alias): Make const. Split out 2nd half 1839 into store::eval_alias_1 and call it twice for symmetry, avoiding 1840 test duplication. 1841 (store::eval_alias_1): New function, split out from the above. 1842 * store.h (store::eval_alias): Make const. 1843 (store::eval_alias_1): New decl. 1844 18452020-08-22 David Malcolm <dmalcolm@redhat.com> 1846 1847 * region-model.cc (region_model::push_frame): Bind the default 1848 SSA name for each parm if it exists, falling back to the parm 1849 itself otherwise, rather than doing both. 1850 18512020-08-20 David Malcolm <dmalcolm@redhat.com> 1852 1853 PR analyzer/96723 1854 * region-model-manager.cc 1855 (region_model_manager::get_field_region): Assert that field is a 1856 FIELD_DECL. 1857 * region.cc (region::get_subregions_for_binding): In 1858 union-handling, filter the TYPE_FIELDS traversal to just FIELD_DECLs. 1859 18602020-08-20 David Malcolm <dmalcolm@redhat.com> 1861 1862 PR analyzer/96713 1863 * region-model.cc (region_model::get_gassign_result): For 1864 comparisons, only use eval_condition when the lhs has boolean 1865 type, and use get_or_create_constant_svalue on the boolean 1866 constants directly rather than via get_rvalue. 1867 18682020-08-19 David Malcolm <dmalcolm@redhat.com> 1869 1870 PR analyzer/96643 1871 * region-model.cc (region_model::deref_rvalue): Rather than 1872 attempting to handle all svalue kinds in the switch, only cover 1873 the special cases, and move symbolic-region handling to after 1874 the switch, thus implicitly handling the missing case SK_COMPOUND. 1875 18762020-08-19 David Malcolm <dmalcolm@redhat.com> 1877 1878 PR analyzer/96705 1879 * region-model-manager.cc 1880 (region_model_manager::maybe_fold_binop): Check that we have an 1881 integral type before calling build_int_cst. 1882 18832020-08-19 David Malcolm <dmalcolm@redhat.com> 1884 1885 PR analyzer/96699 1886 * region-model-manager.cc 1887 (region_model_manager::get_or_create_cast): Use FIX_TRUNC_EXPR for 1888 casting from REAL_TYPE to INTEGER_TYPE. 1889 18902020-08-19 David Malcolm <dmalcolm@redhat.com> 1891 1892 PR analyzer/96651 1893 * region-model.cc (region_model::called_from_main_p): New. 1894 (region_model::get_store_value): Move handling for globals into... 1895 (region_model::get_initial_value_for_global): ...this new 1896 function, and add logic for extracting values from decl 1897 initializers. 1898 * region-model.h (decl_region::get_svalue_for_constructor): New 1899 decl. 1900 (decl_region::get_svalue_for_initializer): New decl. 1901 (region_model::called_from_main_p): New decl. 1902 (region_model::get_initial_value_for_global): New. 1903 * region.cc (decl_region::maybe_get_constant_value): Move logic 1904 for getting an svalue from a CONSTRUCTOR node to... 1905 (decl_region::get_svalue_for_constructor): ...this new function. 1906 (decl_region::get_svalue_for_initializer): New. 1907 * store.cc (get_svalue_for_ctor_val): Rewrite in terms of 1908 region_model::get_rvalue. 1909 * store.h (binding_cluster::get_map): New accessor. 1910 19112020-08-19 David Malcolm <dmalcolm@redhat.com> 1912 1913 PR analyzer/96648 1914 * region.cc (get_field_at_bit_offset): Gracefully handle negative 1915 values for bit_offset. 1916 19172020-08-18 David Malcolm <dmalcolm@redhat.com> 1918 1919 * region-model.cc (region_model::get_rvalue_1): Fix name of local. 1920 19212020-08-18 David Malcolm <dmalcolm@redhat.com> 1922 1923 PR analyzer/96641 1924 * region-model.cc (region_model::get_rvalue_1): Handle 1925 unrecognized tree codes by returning "UNKNOWN. 1926 19272020-08-18 David Malcolm <dmalcolm@redhat.com> 1928 1929 PR analyzer/96640 1930 * region-model.cc (region_model::get_gassign_result): Handle various 1931 VEC_* tree codes by returning UNKNOWN. 1932 (region_model::on_assignment): Handle unrecognized tree codes by 1933 setting lhs to an unknown value, rather than issuing a "sorry" and 1934 asserting. 1935 19362020-08-17 David Malcolm <dmalcolm@redhat.com> 1937 1938 PR analyzer/96644 1939 * region-model-manager.cc (get_region_for_unexpected_tree_code): 1940 Handle ctxt being NULL. 1941 19422020-08-17 David Malcolm <dmalcolm@redhat.com> 1943 1944 PR analyzer/96639 1945 * region.cc (region::get_subregions_for_binding): Check for "type" 1946 being NULL. 1947 19482020-08-17 David Malcolm <dmalcolm@redhat.com> 1949 1950 PR analyzer/96642 1951 * store.cc (get_svalue_for_ctor_val): New. 1952 (binding_map::apply_ctor_to_region): Call it. 1953 19542020-08-14 David Malcolm <dmalcolm@redhat.com> 1955 1956 PR testsuite/96609 1957 PR analyzer/96616 1958 * region-model.cc (region_model::get_store_value): Call 1959 maybe_get_constant_value on decl_regions first. 1960 * region-model.h (decl_region::maybe_get_constant_value): New decl. 1961 * region.cc (decl_region::get_stack_depth): Likewise. 1962 (decl_region::maybe_get_constant_value): New. 1963 * store.cc (get_subregion_within_ctor): New. 1964 (binding_map::apply_ctor_to_region): New. 1965 * store.h (binding_map::apply_ctor_to_region): New decl. 1966 19672020-08-14 David Malcolm <dmalcolm@redhat.com> 1968 1969 PR analyzer/96611 1970 * store.cc (store::mark_as_escaped): Reject attempts to 1971 get a cluster for an unknown pointer. 1972 19732020-08-13 David Malcolm <dmalcolm@redhat.com> 1974 1975 PR analyzer/93032 1976 PR analyzer/93938 1977 PR analyzer/94011 1978 PR analyzer/94099 1979 PR analyzer/94399 1980 PR analyzer/94458 1981 PR analyzer/94503 1982 PR analyzer/94640 1983 PR analyzer/94688 1984 PR analyzer/94689 1985 PR analyzer/94839 1986 PR analyzer/95026 1987 PR analyzer/95042 1988 PR analyzer/95240 1989 * analyzer-logging.cc: Ignore "-Wformat-diag". 1990 (logger::enter_scope): Use inc_indent in both overloads. 1991 (logger::exit_scope): Use dec_indent. 1992 * analyzer-logging.h (logger::inc_indent): New. 1993 (logger::dec_indent): New. 1994 * analyzer-selftests.cc (run_analyzer_selftests): Call 1995 analyzer_store_cc_tests. 1996 * analyzer-selftests.h (analyzer_store_cc_tests): New decl. 1997 * analyzer.cc (get_stmt_location): New function. 1998 * analyzer.h (class initial_svalue): New forward decl. 1999 (class unaryop_svalue): New forward decl. 2000 (class binop_svalue): New forward decl. 2001 (class sub_svalue): New forward decl. 2002 (class unmergeable_svalue): New forward decl. 2003 (class placeholder_svalue): New forward decl. 2004 (class widening_svalue): New forward decl. 2005 (class compound_svalue): New forward decl. 2006 (class conjured_svalue): New forward decl. 2007 (svalue_set): New typedef. 2008 (class map_region): Delete. 2009 (class array_region): Delete. 2010 (class frame_region): New forward decl. 2011 (class function_region): New forward decl. 2012 (class label_region): New forward decl. 2013 (class decl_region): New forward decl. 2014 (class element_region): New forward decl. 2015 (class offset_region): New forward decl. 2016 (class cast_region): New forward decl. 2017 (class field_region): New forward decl. 2018 (class string_region): New forward decl. 2019 (class region_model_manager): New forward decl. 2020 (class store_manager): New forward decl. 2021 (class store): New forward decl. 2022 (class call_details): New forward decl. 2023 (struct svalue_id_merger_mapping): Delete. 2024 (struct canonicalization): Delete. 2025 (class function_point): New forward decl. 2026 (class engine): New forward decl. 2027 (dump_tree): New function decl. 2028 (print_quoted_type): New function decl. 2029 (readability_comparator): New function decl. 2030 (tree_cmp): New function decl. 2031 (class path_var): Move here from region-model.h 2032 (bit_offset_t, bit_size_t, byte_size_t): New typedefs. 2033 (class region_offset): New class. 2034 (get_stmt_location): New decl. 2035 (struct member_function_hash_traits): New struct. 2036 (class consolidation_map): New class. 2037 Ignore "-Wformat-diag". 2038 * analyzer.opt (-param=analyzer-max-svalue-depth=): New param. 2039 (-param=analyzer-max-enodes-for-full-dump=): New param. 2040 * call-string.cc: Ignore -Wformat-diag. 2041 * checker-path.cc: Move includes of "analyzer/call-string.h" and 2042 "analyzer/program-point.h" to before "analyzer/region-model.h", 2043 and also include "analyzer/store.h" before it. 2044 (state_change_event::state_change_event): Replace "tree var" param 2045 with "const svalue *sval". Convert "origin" param from tree to 2046 "const svalue *". 2047 (state_change_event::get_desc): Call get_representative_tree to 2048 convert the var and origin from const svalue * to tree. Use 2049 svalue::get_desc rather than %qE when describing state changes. 2050 (checker_path::add_final_event): Use get_stmt_location. 2051 * checker-path.h (state_change_event::state_change_event): Port 2052 from tree to const svalue *. 2053 (state_change_event::get_lvalue): Delete. 2054 (state_change_event::get_dest_function): New. 2055 (state_change_event::m_var): Replace with... 2056 (state_change_event::m_sval): ...this. 2057 (state_change_event::m_origin): Convert from tree to 2058 const svalue *. 2059 * constraint-manager.cc: Include "analyzer/call-string.h", 2060 "analyzer/program-point.h", and "analyzer/store.h" before 2061 "analyzer/region-model.h". 2062 (struct bound, struct range): Move to constraint-manager.h. 2063 (compare_constants): New function. 2064 (range::dump): Rename to... 2065 (range::dump_to_pp): ...this. Support NULL constants. 2066 (range::dump): Reintroduce for dumping to stderr. 2067 (range::constrained_to_single_element): Return result, rather than 2068 writing to *OUT. 2069 (range::eval_condition): New. 2070 (range::below_lower_bound): New. 2071 (range::above_upper_bound): New. 2072 (equiv_class::equiv_class): Port from svalue_id to const svalue *. 2073 (equiv_class::print): Likewise. 2074 (equiv_class::hash): Likewise. 2075 (equiv_class::operator==): Port from svalue_id to const svalue *. 2076 (equiv_class::add): Port from svalue_id to const svalue *. Drop 2077 "cm" param. 2078 (equiv_class::del): Port from svalue_id to const svalue *. 2079 (equiv_class::get_representative): Likewise. 2080 (equiv_class::remap_svalue_ids): Delete. 2081 (svalue_id_cmp_by_id): Rename to... 2082 (svalue_cmp_by_ptr): ...this, porting from svalue_id to 2083 const svalue *. 2084 (equiv_class::canonicalize): Update qsort comparator. 2085 (constraint::implied_by): New. 2086 (constraint_manager::constraint_manager): Copy m_mgr in copy ctor. 2087 (constraint_manager::dump_to_pp): Add "multiline" param 2088 (constraint_manager::dump): Pass "true" for "multiline". 2089 (constraint_manager::add_constraint): Port from svalue_id to 2090 const svalue *. Split out second part into... 2091 (constraint_manager::add_unknown_constraint): ...this new 2092 function. Remove self-constraints when merging equivalence 2093 classes. 2094 (constraint_manager::add_constraint_internal): Remove constraints 2095 that would be implied by the new constraint. Port from svalue_id 2096 to const svalue *. 2097 (constraint_manager::get_equiv_class_by_sid): Rename to... 2098 (constraint_manager::get_equiv_class_by_svalue): ...this, porting 2099 from svalue_id to const svalue *. 2100 (constraint_manager::get_or_add_equiv_class): Port from svalue_id 2101 to const svalue *. 2102 (constraint_manager::eval_condition): Make const. Call 2103 compare_constants and return early if it provides a known result. 2104 (constraint_manager::get_ec_bounds): New. 2105 (constraint_manager::eval_condition): New overloads. Make 2106 existing one const, and use compare_constants. 2107 (constraint_manager::purge): Convert "p" param to a template 2108 rather that an abstract base class. Port from svalue_id to 2109 const svalue *. 2110 (class dead_svalue_purger): New class. 2111 (constraint_manager::remap_svalue_ids): Delete. 2112 (constraint_manager::on_liveness_change): New. 2113 (equiv_class_cmp): Port from svalue_id to const svalue *. 2114 (constraint_manager::canonicalize): Likewise. Combine with 2115 purging of redundant equivalence classes and constraints. 2116 (class cleaned_constraint_manager): Delete. 2117 (class merger_fact_visitor): Make "m_cm_b" const. Add "m_merger" 2118 field. 2119 (merger_fact_visitor::fact): Port from svalue_id to const svalue *. 2120 Add special case for widening. 2121 (constraint_manager::merge): Port from svalue_id to const svalue *. 2122 (constraint_manager::clean_merger_input): Delete. 2123 (constraint_manager::for_each_fact): Port from svalue_id to 2124 const svalue *. 2125 (constraint_manager::validate): Likewise. 2126 (selftest::test_constraint_conditions): Provide a 2127 region_model_manager when creating region_model instances. 2128 Add test for self-equality not creating equivalence classes. 2129 (selftest::test_transitivity): Provide a region_model_manager when 2130 creating region_model instances. Verify that EC-merging happens 2131 when constraints are implied. 2132 (selftest::test_constant_comparisons): Provide a 2133 region_model_manager when creating region_model instances. 2134 (selftest::test_constraint_impl): Likewise. Remove over-specified 2135 assertions. 2136 (selftest::test_equality): Provide a region_model_manager when 2137 creating region_model instances. 2138 (selftest::test_many_constants): Likewise. Provide a 2139 program_point when testing merging. 2140 (selftest::run_constraint_manager_tests): Move call to 2141 test_constant_comparisons to outside the transitivity guard. 2142 * constraint-manager.h (struct bound): Move here from 2143 constraint-manager.cc. 2144 (struct range): Likewise. 2145 (struct::eval_condition): New decl. 2146 (struct::below_lower_bound): New decl. 2147 (struct::above_upper_bound): New decl. 2148 (equiv_class::add): Port from svalue_id to const svalue *. 2149 (equiv_class::del): Likewise. 2150 (equiv_class::get_representative): Likewise. 2151 (equiv_class::remap_svalue_ids): Drop. 2152 (equiv_class::m_cst_sid): Convert to.. 2153 (equiv_class::m_cst_sval): ...this. 2154 (equiv_class::m_vars): Port from svalue_id to const svalue *. 2155 (constraint::bool implied_by): New decl. 2156 (fact_visitor::on_fact): Port from svalue_id to const svalue *. 2157 (constraint_manager::constraint_manager): Add mgr param. 2158 (constraint_manager::clone): Delete. 2159 (constraint_manager::maybe_get_constant): Delete. 2160 (constraint_manager::get_sid_for_constant): Delete. 2161 (constraint_manager::get_num_svalues): Delete. 2162 (constraint_manager::dump_to_pp): Add "multiline" param. 2163 (constraint_manager::get_equiv_class): Port from svalue_id to 2164 const svalue *. 2165 (constraint_manager::add_constraint): Likewise. 2166 (constraint_manager::get_equiv_class_by_sid): Rename to... 2167 (constraint_manager::get_equiv_class_by_svalue): ...this, porting 2168 from svalue_id to const svalue *. 2169 (constraint_manager::add_unknown_constraint): New decl. 2170 (constraint_manager::get_or_add_equiv_class): Port from svalue_id 2171 to const svalue *. 2172 (constraint_manager::eval_condition): Likewise. Add overloads. 2173 (constraint_manager::get_ec_bounds): New decl. 2174 (constraint_manager::purge): Convert to template. 2175 (constraint_manager::remap_svalue_ids): Delete. 2176 (constraint_manager::on_liveness_change): New decl. 2177 (constraint_manager::canonicalize): Drop param. 2178 (constraint_manager::clean_merger_input): Delete. 2179 (constraint_manager::m_mgr): New field. 2180 * diagnostic-manager.cc: Move includes of 2181 "analyzer/call-string.h" and "analyzer/program-point.h" to before 2182 "analyzer/region-model.h", and also include "analyzer/store.h" 2183 before it. 2184 (saved_diagnostic::saved_diagnostic): Add "sval" param. 2185 (diagnostic_manager::diagnostic_manager): Add engine param. 2186 (diagnostic_manager::add_diagnostic): Add "sval" param, passing it 2187 to saved_diagnostic ctor. Update overload to pass NULL for it. 2188 (dedupe_winners::dedupe_winners): Add engine param. 2189 (dedupe_winners::add): Add "eg" param. Pass m_engine to 2190 feasible_p. 2191 (dedupe_winner::m_engine): New field. 2192 (diagnostic_manager::emit_saved_diagnostics): Pass engine to 2193 dedupe_winners. Pass &eg when adding candidates. Pass svalue 2194 rather than tree to prune_path. Use get_stmt_location to get 2195 primary location of diagnostic. 2196 (diagnostic_manager::emit_saved_diagnostic): Likewise. 2197 (get_any_origin): Drop. 2198 (state_change_event_creator::on_global_state_change): Pass NULL 2199 const svalue * rather than NULL_TREE trees to state_change_event 2200 ctor. 2201 (state_change_event_creator::on_state_change): Port from tree and 2202 svalue_id to const svalue *. 2203 (for_each_state_change): Port from svalue_id to const svalue *. 2204 (struct null_assignment_sm_context): New. 2205 (diagnostic_manager::add_events_for_eedge): Add state change 2206 events for assignment to NULL. 2207 (diagnostic_manager::prune_path): Update param from tree to 2208 const svalue *. 2209 (diagnostic_manager::prune_for_sm_diagnostic): Port from tracking 2210 by tree to by const svalue *. 2211 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add sval 2212 param. 2213 (saved_diagnostic::m_sval): New field. 2214 (diagnostic_manager::diagnostic_manager): Add engine param. 2215 (diagnostic_manager::get_engine): New. 2216 (diagnostic_manager::add_diagnostic): Add "sval" param. 2217 (diagnostic_manager::prune_path): Likewise. 2218 (diagnostic_manager::prune_for_sm_diagnostic): New overload. 2219 (diagnostic_manager::m_eng): New field. 2220 * engine.cc: Move includes of "analyzer/call-string.h" and 2221 "analyzer/program-point.h" to before "analyzer/region-model.h", 2222 and also include "analyzer/store.h" before it. 2223 (impl_region_model_context::impl_region_model_context): Update for 2224 removal of m_change field. 2225 (impl_region_model_context::remap_svalue_ids): Delete. 2226 (impl_region_model_context::on_svalue_leak): New. 2227 (impl_region_model_context::on_svalue_purge): Delete. 2228 (impl_region_model_context::on_liveness_change): New. 2229 (impl_region_model_context::on_unknown_change): Update param 2230 from svalue_id to const svalue *. Add is_mutable param. 2231 (setjmp_svalue::compare_fields): Delete. 2232 (setjmp_svalue::accept): New. 2233 (setjmp_svalue::add_to_hash): Delete. 2234 (setjmp_svalue::dump_to_pp): New. 2235 (setjmp_svalue::print_details): Delete. 2236 (impl_sm_context::impl_sm_context): Drop "change" param. 2237 (impl_sm_context::get_fndecl_for_call): Drop "m_change". 2238 (impl_sm_context::on_transition): Drop ATTRIBUTE_UNUSED from 2239 "stmt" param. Drop m_change. Port from svalue_id to 2240 const svalue *. 2241 (impl_sm_context::warn_for_state): Drop m_change. Port from 2242 svalue_id to const svalue *. 2243 (impl_sm_context::get_readable_tree): Rename to... 2244 (impl_sm_context::get_diagnostic_tree): ...this. Port from 2245 svalue_id to const svalue *. 2246 (impl_sm_context::is_zero_assignment): New. 2247 (impl_sm_context::m_change): Delete field. 2248 (leak_stmt_finder::find_stmt): Handle m_var being NULL. 2249 (readability): Increase penalty for MEM_REF. For SSA_NAMEs, 2250 slightly favor the underlying var over the SSA name. Heavily 2251 penalize temporaries. Handle RESULT_DECL. 2252 (readability_comparator): Make non-static. Consider stack depths. 2253 (impl_region_model_context::on_state_leak): Convert from svalue_id 2254 to const svalue *, updating for region_model changes. Use 2255 id_equal. 2256 (impl_region_model_context::on_inherited_svalue): Delete. 2257 (impl_region_model_context::on_cast): Delete. 2258 (impl_region_model_context::on_condition): Drop m_change. 2259 (impl_region_model_context::on_phi): Likewise. 2260 (impl_region_model_context::on_unexpected_tree_code): Handle t 2261 being NULL. 2262 (point_and_state::validate): Update stack checking for 2263 region_model changes. 2264 (eg_traits::dump_args_t::show_enode_details_p): New. 2265 (exploded_node::exploded_node): Initialize m_num_processed_stmts. 2266 (exploded_node::get_processed_stmt): New function. 2267 (exploded_node::get_dot_fillcolor): Add more colors. 2268 (exploded_node::dump_dot): Guard the printing of the point and 2269 state with show_enode_details_p. Print the processed stmts for 2270 this enode after the initial state. 2271 (exploded_node::dump_to_pp): Pass true for new multiline param 2272 of program_state::dump_to_pp. 2273 (exploded_node::on_stmt): Drop "change" param. Log the stmt. 2274 Set input_location. Implement __analyzer_describe. Update 2275 implementation of __analyzer_dump and __analyzer_eval. 2276 Remove purging of sm-state for unknown fncalls from here. 2277 (exploded_node::on_edge): Drop "change" param. 2278 (exploded_node::on_longjmp): Port from region_id/svalue_id to 2279 const region */const svalue *. Call program_state::detect_leaks. 2280 Drop state_change. 2281 (exploded_node::detect_leaks): Update for changes to region_model. 2282 Call program_state::detect_leaks. 2283 (exploded_edge::exploded_edge): Drop ext_state and change params. 2284 (exploded_edge::dump_dot): "args" is no longer used. Drop dumping 2285 of m_change. 2286 (exploded_graph::exploded_graph): Pass engine to 2287 m_diagnostic_manager ctor. Use program_point::origin. 2288 (exploded_graph::add_function_entry): Drop ctxt. Use 2289 program_state::push_frame. Drop state_change. 2290 (exploded_graph::get_or_create_node): Drop "change" param. Add 2291 "enode_for_diag" param. Update dumping calls for API changes. 2292 Pass point to can_merge_with_p. Show enode indices 2293 within -Wanalyzer-too-complex diagnostic for hitting the per-point 2294 limit. 2295 (exploded_graph::add_edge): Drop "change" param. Log which nodes 2296 are being connected. Update for changes to exploded_edge ctor. 2297 (exploded_graph::get_per_program_point_data): New. 2298 (exploded_graph::process_worklist): Pass point to 2299 can_merge_with_p. Drop state_change. Update dumping call for API 2300 change. 2301 (exploded_graph::process_node): Drop state_change. Split the 2302 node in-place if an sm-state-change occurs. Update 2303 m_num_processed_stmts. Update dumping calls for API change. 2304 (exploded_graph::log_stats): Call engine::log_stats. 2305 (exploded_graph::dump_states_for_supernode): Update dumping 2306 call. 2307 (exploded_path::feasible_p): Add "eng" and "eg" params. 2308 Rename "i" to "end_idx". Pass the manager to the region_model 2309 ctor. Update for every processed stmt in the enode, not just the 2310 first. Keep track of which snodes have been visited, and call 2311 loop_replay_fixup when revisiting one. 2312 (enode_label::get_text): Update dump call for new param. 2313 (exploded_graph::dump_exploded_nodes): Likewise. 2314 (exploded_graph::get_node_by_index): New. 2315 (impl_run_checkers): Create engine instance and pass its address 2316 to extrinsic_state ctor. 2317 * exploded-graph.h 2318 (impl_region_model_context::impl_region_model_context): Drop 2319 "change" params. 2320 (impl_region_model_context::void remap_svalue_ids): Delete. 2321 (impl_region_model_context::on_svalue_purge): Delete. 2322 (impl_region_model_context::on_svalue_leak): New. 2323 (impl_region_model_context::on_liveness_change): New. 2324 (impl_region_model_context::on_state_leak): Update signature. 2325 (impl_region_model_context::on_inherited_svalue): Delete. 2326 (impl_region_model_context::on_cast): Delete. 2327 (impl_region_model_context::on_unknown_change): Update signature. 2328 (impl_region_model_context::m_change): Delete. 2329 (eg_traits::dump_args_t::show_enode_details_p): New. 2330 (exploded_node::on_stmt): Drop "change" param. 2331 (exploded_node::on_edge): Likewise. 2332 (exploded_node::get_processed_stmt): New decl. 2333 (exploded_node::m_num_processed_stmts): New field. 2334 (exploded_edge::exploded_edge): Drop ext_state and change params. 2335 (exploded_edge::m_change): Delete. 2336 (exploded_graph::get_engine): New accessor. 2337 (exploded_graph::get_or_create_node): Drop "change" param. Add 2338 "enode_for_diag" param. 2339 (exploded_graph::add_edge): Drop "change" param. 2340 (exploded_graph::get_per_program_point_data): New decl. 2341 (exploded_graph::get_node_by_index): New decl. 2342 (exploded_path::feasible_p): Add "eng" and "eg" params. 2343 * program-point.cc: Include "analyzer/store.h" before including 2344 "analyzer/region-model.h". 2345 (function_point::function_point): Move here from 2346 program-point.h. 2347 (function_point::get_function): Likewise. 2348 (function_point::from_function_entry): Likewise. 2349 (function_point::before_supernode): Likewise. 2350 (function_point::next_stmt): New function. 2351 * program-point.h (function_point::function_point): Move 2352 implementation from here to program-point.cc. 2353 (function_point::get_function): Likewise. 2354 (function_point::from_function_entry): Likewise. 2355 (function_point::before_supernode): Likewise. 2356 (function_point::next_stmt): New decl. 2357 (program_point::operator!=): New. 2358 (program_point::origin): New. 2359 (program_point::next_stmt): New. 2360 (program_point::m_function_point): Make non-const. 2361 * program-state.cc: Move includes of "analyzer/call-string.h" and 2362 "analyzer/program-point.h" to before "analyzer/region-model.h", 2363 and also include "analyzer/store.h" before it. 2364 (extrinsic_state::get_model_manager): New. 2365 (sm_state_map::sm_state_map): Pass in sm and sm_idx to ctor, 2366 rather than pass the around. 2367 (sm_state_map::clone_with_remapping): Delete. 2368 (sm_state_map::print): Remove "sm" param in favor of "m_sm". Add 2369 "simple" and "multiline" params and support multiline vs single 2370 line dumping. 2371 (sm_state_map::dump): Remove "sm" param in favor of "m_sm". Add 2372 "simple" param. 2373 (sm_state_map::hash): Port from svalue_id to const svalue *. 2374 (sm_state_map::operator==): Likewise. 2375 (sm_state_map::get_state): Likewise. Call canonicalize_svalue on 2376 input. Handle inheritance of sm-state. Call get_default_state. 2377 (sm_state_map::get_origin): Port from svalue_id to const svalue *. 2378 (sm_state_map::set_state): Likewise. Pass in ext_state. Reject 2379 attempts to set state on UNKNOWN. 2380 (sm_state_map::impl_set_state): Port from svalue_id to 2381 const svalue *. Pass in ext_state. Call canonicalize_svalue on 2382 input. 2383 (sm_state_map::purge_for_unknown_fncall): Delete. 2384 (sm_state_map::on_svalue_leak): New. 2385 (sm_state_map::remap_svalue_ids): Delete. 2386 (sm_state_map::on_liveness_change): New. 2387 (sm_state_map::on_unknown_change): Reimplement. 2388 (sm_state_map::on_svalue_purge): Delete. 2389 (sm_state_map::on_inherited_svalue): Delete. 2390 (sm_state_map::on_cast): Delete. 2391 (sm_state_map::validate): Delete. 2392 (sm_state_map::canonicalize_svalue): New. 2393 (program_state::program_state): Update to pass manager to 2394 region_model's ctor. Constify num_states and pass state machine 2395 and index to sm_state_map ctor. 2396 (program_state::print): Update for changes to dump API. 2397 (program_state::dump_to_pp): Ignore the summarize param. Add 2398 "multiline" param. 2399 (program_state::dump_to_file): Add "multiline" param. 2400 (program_state::dump): Pass "true" for new "multiline" param. 2401 (program_state::push_frame): New. 2402 (program_state::on_edge): Drop "change" param. Call 2403 program_state::detect_leaks. 2404 (program_state::prune_for_point): Add enode_for_diag param. 2405 Reimplement based on store class. Call detect_leaks 2406 (program_state::remap_svalue_ids): Delete. 2407 (program_state::get_representative_tree): Port from svalue_id to 2408 const svalue *. 2409 (program_state::can_merge_with_p): Add "point" param. Add early 2410 reject for sm-differences. Drop id remapping. 2411 (program_state::validate): Drop region model and sm_state_map 2412 validation. 2413 (state_change::sm_change::dump): Delete. 2414 (state_change::sm_change::remap_svalue_ids): Delete. 2415 (state_change::sm_change::on_svalue_purge): Delete. 2416 (log_set_of_svalues): New. 2417 (state_change::sm_change::validate): Delete. 2418 (state_change::state_change): Delete. 2419 (state_change::add_sm_change): Delete. 2420 (state_change::affects_p): Delete. 2421 (state_change::dump): Delete. 2422 (state_change::remap_svalue_ids): Delete. 2423 (state_change::on_svalue_purge): Delete. 2424 (state_change::validate): Delete. 2425 (selftest::assert_dump_eq): Delete. 2426 (ASSERT_DUMP_EQ): Delete. 2427 (selftest::test_sm_state_map): Update for changes to region_model 2428 and sm_state_map, porting from svalue_id to const svalue *. 2429 (selftest::test_program_state_dumping): Likewise. Drop test of 2430 dumping, renaming to... 2431 (selftest::test_program_state_1): ...this. 2432 (selftest::test_program_state_dumping_2): Likewise, renaming to... 2433 (selftest::test_program_state_2): ...this. 2434 (selftest::test_program_state_merging): Update for changes to 2435 region_model. 2436 (selftest::test_program_state_merging_2): Likewise. 2437 (selftest::analyzer_program_state_cc_tests): Update for renamed 2438 tests. 2439 * program-state.h (extrinsic_state::extrinsic_state): Add logger 2440 and engine params. 2441 (extrinsic_state::get_logger): New accessor. 2442 (extrinsic_state::get_engine): New accessor. 2443 (extrinsic_state::get_model_manager): New accessor. 2444 (extrinsic_state::m_logger): New field. 2445 (extrinsic_state::m_engine): New field. 2446 (struct default_hash_traits<svalue_id>): Delete. 2447 (pod_hash_traits<svalue_id>::hash): Delete. 2448 (pod_hash_traits<svalue_id>::equal): Delete. 2449 (pod_hash_traits<svalue_id>::mark_deleted): Delete. 2450 (pod_hash_traits<svalue_id>::mark_empty): Delete. 2451 (pod_hash_traits<svalue_id>::is_deleted): Delete. 2452 (pod_hash_traits<svalue_id>::is_empty): Delete. 2453 (sm_state_map::entry_t::entry_t): Port from svalue_id to 2454 const svalue *. 2455 (sm_state_map::entry_t::m_origin): Likewise. 2456 (sm_state_map::map_t): Likewise. 2457 (sm_state_map::sm_state_map): Add state_machine and index params. 2458 (sm_state_map::clone_with_remapping): Delete. 2459 (sm_state_map::print): Drop sm param; add simple and multiline 2460 params. 2461 (sm_state_map::dump): Drop sm param; add simple param. 2462 (sm_state_map::get_state): Port from svalue_id to const svalue *. 2463 Add ext_state param. 2464 (sm_state_map::get_origin): Likewise. 2465 (sm_state_map::set_state): Likewise. 2466 (sm_state_map::impl_set_state): Likewise. 2467 (sm_state_map::purge_for_unknown_fncall): Delete. 2468 (sm_state_map::remap_svalue_ids): Delete. 2469 (sm_state_map::on_svalue_purge): Delete. 2470 (sm_state_map::on_svalue_leak): New. 2471 (sm_state_map::on_liveness_change): New. 2472 (sm_state_map::on_inherited_svalue): Delete. 2473 (sm_state_map::on_cast): Delete. 2474 (sm_state_map::validate): Delete. 2475 (sm_state_map::on_unknown_change): Port from svalue_id to 2476 const svalue *. Add is_mutable and ext_state params. 2477 (sm_state_map::canonicalize_svalue): New. 2478 (sm_state_map::m_sm): New field. 2479 (sm_state_map::m_sm_idx): New field. 2480 (program_state::operator=): Delete. 2481 (program_state::dump_to_pp): Drop "summarize" param, adding 2482 "simple" and "multiline". 2483 (program_state::dump_to_file): Likewise. 2484 (program_state::dump): Rename "summarize" to "simple". 2485 (program_state::push_frame): New. 2486 (program_state::get_current_function): New. 2487 (program_state::on_edge): Drop "change" param. 2488 (program_state::prune_for_point): Likewise. Add enode_for_diag 2489 param. 2490 (program_state::remap_svalue_ids): Delete. 2491 (program_state::get_representative_tree): Port from svalue_id to 2492 const svalue *. 2493 (program_state::can_purge_p): Likewise. Pass ext_state to get_state. 2494 (program_state::can_merge_with_p): Add point param. 2495 (program_state::detect_leaks): New. 2496 (state_change_visitor::on_state_change): Port from tree and 2497 svalue_id to a pair of const svalue *. 2498 (class state_change): Delete. 2499 * region.cc: New file. 2500 * region-model-impl-calls.cc: New file. 2501 * region-model-manager.cc: New file. 2502 * region-model-reachability.cc: New file. 2503 * region-model-reachability.h: New file. 2504 * region-model.cc: Include "analyzer/call-string.h", 2505 "analyzer/program-point.h", and "analyzer/store.h" before 2506 "analyzer/region-model.h". Include 2507 "analyzer/region-model-reachability.h". 2508 (dump_tree): Make non-static. 2509 (dump_quoted_tree): Make non-static. 2510 (print_quoted_type): Make non-static. 2511 (path_var::dump): Delete. 2512 (dump_separator): Delete. 2513 (class impl_constraint_manager): Delete. 2514 (svalue_id::print): Delete. 2515 (svalue_id::dump_node_name_to_pp): Delete. 2516 (svalue_id::validate): Delete. 2517 (region_id::print): Delete. 2518 (region_id::dump_node_name_to_pp): Delete. 2519 (region_id::validate): Delete. 2520 (region_id_set::region_id_set): Delete. 2521 (svalue_id_set::svalue_id_set): Delete. 2522 (svalue::operator==): Delete. 2523 (svalue::hash): Delete. 2524 (svalue::print): Delete. 2525 (svalue::dump_dot_to_pp): Delete. 2526 (svalue::remap_region_ids): Delete. 2527 (svalue::walk_for_canonicalization): Delete. 2528 (svalue::get_child_sid): Delete. 2529 (svalue::maybe_get_constant): Delete. 2530 (region_svalue::compare_fields): Delete. 2531 (region_svalue::add_to_hash): Delete. 2532 (region_svalue::print_details): Delete. 2533 (region_svalue::dump_dot_to_pp): Delete. 2534 (region_svalue::remap_region_ids): Delete. 2535 (region_svalue::merge_values): Delete. 2536 (region_svalue::walk_for_canonicalization): Delete. 2537 (region_svalue::eval_condition): Delete. 2538 (constant_svalue::compare_fields): Delete. 2539 (constant_svalue::add_to_hash): Delete. 2540 (constant_svalue::merge_values): Delete. 2541 (constant_svalue::eval_condition): Move to svalue.cc. 2542 (constant_svalue::print_details): Delete. 2543 (constant_svalue::get_child_sid): Delete. 2544 (unknown_svalue::compare_fields): Delete. 2545 (unknown_svalue::add_to_hash): Delete. 2546 (unknown_svalue::print_details): Delete. 2547 (poison_kind_to_str): Move to svalue.cc. 2548 (poisoned_svalue::compare_fields): Delete. 2549 (poisoned_svalue::add_to_hash): Delete. 2550 (poisoned_svalue::print_details): Delete. 2551 (region_kind_to_str): Move to region.cc and reimplement. 2552 (region::operator==): Delete. 2553 (region::get_parent_region): Delete. 2554 (region::set_value): Delete. 2555 (region::become_active_view): Delete. 2556 (region::deactivate_any_active_view): Delete. 2557 (region::deactivate_view): Delete. 2558 (region::get_value): Delete. 2559 (region::get_inherited_child_sid): Delete. 2560 (region_model::copy_region): Delete. 2561 (region_model::copy_struct_region): Delete. 2562 (region_model::copy_union_region): Delete. 2563 (region_model::copy_array_region): Delete. 2564 (region::hash): Delete. 2565 (region::print): Delete. 2566 (region::dump_dot_to_pp): Delete. 2567 (region::dump_to_pp): Delete. 2568 (region::dump_child_label): Delete. 2569 (region::validate): Delete. 2570 (region::remap_svalue_ids): Delete. 2571 (region::remap_region_ids): Delete. 2572 (region::add_view): Delete. 2573 (region::get_view): Delete. 2574 (region::region): Move to region.cc. 2575 (region::add_to_hash): Delete. 2576 (region::print_fields): Delete. 2577 (region::non_null_p): Delete. 2578 (primitive_region::clone): Delete. 2579 (primitive_region::walk_for_canonicalization): Delete. 2580 (map_region::map_region): Delete. 2581 (map_region::compare_fields): Delete. 2582 (map_region::print_fields): Delete. 2583 (map_region::validate): Delete. 2584 (map_region::dump_dot_to_pp): Delete. 2585 (map_region::dump_child_label): Delete. 2586 (map_region::get_or_create): Delete. 2587 (map_region::get): Delete. 2588 (map_region::add_to_hash): Delete. 2589 (map_region::remap_region_ids): Delete. 2590 (map_region::unbind): Delete. 2591 (map_region::get_tree_for_child_region): Delete. 2592 (map_region::get_tree_for_child_region): Delete. 2593 (tree_cmp): Move to region.cc. 2594 (map_region::can_merge_p): Delete. 2595 (map_region::walk_for_canonicalization): Delete. 2596 (map_region::get_value_by_name): Delete. 2597 (struct_or_union_region::valid_key_p): Delete. 2598 (struct_or_union_region::compare_fields): Delete. 2599 (struct_region::clone): Delete. 2600 (struct_region::compare_fields): Delete. 2601 (union_region::clone): Delete. 2602 (union_region::compare_fields): Delete. 2603 (frame_region::compare_fields): Delete. 2604 (frame_region::clone): Delete. 2605 (frame_region::valid_key_p): Delete. 2606 (frame_region::print_fields): Delete. 2607 (frame_region::add_to_hash): Delete. 2608 (globals_region::compare_fields): Delete. 2609 (globals_region::clone): Delete. 2610 (globals_region::valid_key_p): Delete. 2611 (code_region::compare_fields): Delete. 2612 (code_region::clone): Delete. 2613 (code_region::valid_key_p): Delete. 2614 (array_region::array_region): Delete. 2615 (array_region::get_element): Delete. 2616 (array_region::clone): Delete. 2617 (array_region::compare_fields): Delete. 2618 (array_region::print_fields): Delete. 2619 (array_region::validate): Delete. 2620 (array_region::dump_dot_to_pp): Delete. 2621 (array_region::dump_child_label): Delete. 2622 (array_region::get_or_create): Delete. 2623 (array_region::get): Delete. 2624 (array_region::add_to_hash): Delete. 2625 (array_region::remap_region_ids): Delete. 2626 (array_region::get_key_for_child_region): Delete. 2627 (array_region::key_cmp): Delete. 2628 (array_region::walk_for_canonicalization): Delete. 2629 (array_region::key_from_constant): Delete. 2630 (array_region::constant_from_key): Delete. 2631 (function_region::compare_fields): Delete. 2632 (function_region::clone): Delete. 2633 (function_region::valid_key_p): Delete. 2634 (stack_region::stack_region): Delete. 2635 (stack_region::compare_fields): Delete. 2636 (stack_region::clone): Delete. 2637 (stack_region::print_fields): Delete. 2638 (stack_region::dump_child_label): Delete. 2639 (stack_region::validate): Delete. 2640 (stack_region::push_frame): Delete. 2641 (stack_region::get_current_frame_id): Delete. 2642 (stack_region::pop_frame): Delete. 2643 (stack_region::add_to_hash): Delete. 2644 (stack_region::remap_region_ids): Delete. 2645 (stack_region::can_merge_p): Delete. 2646 (stack_region::walk_for_canonicalization): Delete. 2647 (stack_region::get_value_by_name): Delete. 2648 (heap_region::heap_region): Delete. 2649 (heap_region::compare_fields): Delete. 2650 (heap_region::clone): Delete. 2651 (heap_region::walk_for_canonicalization): Delete. 2652 (root_region::root_region): Delete. 2653 (root_region::compare_fields): Delete. 2654 (root_region::clone): Delete. 2655 (root_region::print_fields): Delete. 2656 (root_region::validate): Delete. 2657 (root_region::dump_child_label): Delete. 2658 (root_region::push_frame): Delete. 2659 (root_region::get_current_frame_id): Delete. 2660 (root_region::pop_frame): Delete. 2661 (root_region::ensure_stack_region): Delete. 2662 (root_region::get_stack_region): Delete. 2663 (root_region::ensure_globals_region): Delete. 2664 (root_region::get_code_region): Delete. 2665 (root_region::ensure_code_region): Delete. 2666 (root_region::get_globals_region): Delete. 2667 (root_region::ensure_heap_region): Delete. 2668 (root_region::get_heap_region): Delete. 2669 (root_region::remap_region_ids): Delete. 2670 (root_region::can_merge_p): Delete. 2671 (root_region::add_to_hash): Delete. 2672 (root_region::walk_for_canonicalization): Delete. 2673 (root_region::get_value_by_name): Delete. 2674 (symbolic_region::symbolic_region): Delete. 2675 (symbolic_region::compare_fields): Delete. 2676 (symbolic_region::clone): Delete. 2677 (symbolic_region::walk_for_canonicalization): Delete. 2678 (symbolic_region::print_fields): Delete. 2679 (region_model::region_model): Add region_model_manager * param. 2680 Reimplement in terms of store, dropping impl_constraint_manager 2681 subclass. 2682 (region_model::operator=): Reimplement in terms of store 2683 (region_model::operator==): Likewise. 2684 (region_model::hash): Likewise. 2685 (region_model::print): Delete. 2686 (region_model::print_svalue): Delete. 2687 (region_model::dump_dot_to_pp): Delete. 2688 (region_model::dump_dot_to_file): Delete. 2689 (region_model::dump_dot): Delete. 2690 (region_model::dump_to_pp): Replace "summarize" param with 2691 "simple" and "multiline". Port to store-based implementation. 2692 (region_model::dump): Replace "summarize" param with "simple" and 2693 "multiline". 2694 (dump_vec_of_tree): Delete. 2695 (region_model::dump_summary_of_rep_path_vars): Delete. 2696 (region_model::validate): Delete. 2697 (svalue_id_cmp_by_constant_svalue_model): Delete. 2698 (svalue_id_cmp_by_constant_svalue): Delete. 2699 (region_model::canonicalize): Drop "ctxt" param. Reimplement in 2700 terms of store and constraints. 2701 (region_model::canonicalized_p): Remove NULL arg to canonicalize. 2702 (region_model::loop_replay_fixup): New. 2703 (poisoned_value_diagnostic::emit): Tweak wording of warnings. 2704 (region_model::check_for_poison): Delete. 2705 (region_model::get_gassign_result): New. 2706 (region_model::on_assignment): Port to store-based implementation. 2707 (region_model::on_call_pre): Delete calls to check_for_poison. 2708 Move implementations to region-model-impl-calls.c and port to 2709 store-based implementation. 2710 (region_model::on_call_post): Likewise. 2711 (class reachable_regions): Move to region-model-reachability.h/cc 2712 and port to store-based implementation. 2713 (region_model::handle_unrecognized_call): Port to store-based 2714 implementation. 2715 (region_model::get_reachable_svalues): New. 2716 (region_model::on_setjmp): Port to store-based implementation. 2717 (region_model::on_longjmp): Likewise. 2718 (region_model::handle_phi): Drop is_back_edge param and the logic 2719 using it. 2720 (region_model::get_lvalue_1): Port from region_id to const region *. 2721 (region_model::make_region_for_unexpected_tree_code): Delete. 2722 (assert_compat_types): If the check fails, use internal_error to 2723 show the types. 2724 (region_model::get_lvalue): Port from region_id to const region *. 2725 (region_model::get_rvalue_1): Port from svalue_id to const svalue *. 2726 (region_model::get_rvalue): Likewise. 2727 (region_model::get_or_create_ptr_svalue): Delete. 2728 (region_model::get_or_create_constant_svalue): Delete. 2729 (region_model::get_svalue_for_fndecl): Delete. 2730 (region_model::get_region_for_fndecl): Delete. 2731 (region_model::get_svalue_for_label): Delete. 2732 (region_model::get_region_for_label): Delete. 2733 (build_cast): Delete. 2734 (region_model::maybe_cast_1): Delete. 2735 (region_model::maybe_cast): Delete. 2736 (region_model::get_field_region): Delete. 2737 (region_model::get_store_value): New. 2738 (region_model::region_exists_p): New. 2739 (region_model::deref_rvalue): Port from svalue_id to const svalue *. 2740 (region_model::set_value): Likewise. 2741 (region_model::clobber_region): New. 2742 (region_model::purge_region): New. 2743 (region_model::zero_fill_region): New. 2744 (region_model::mark_region_as_unknown): New. 2745 (region_model::eval_condition): Port from svalue_id to 2746 const svalue *. 2747 (region_model::eval_condition_without_cm): Likewise. 2748 (region_model::compare_initial_and_pointer): New. 2749 (region_model::add_constraint): Port from svalue_id to 2750 const svalue *. 2751 (region_model::maybe_get_constant): Delete. 2752 (region_model::get_representative_path_var): New. 2753 (region_model::add_new_malloc_region): Delete. 2754 (region_model::get_representative_tree): Port to const svalue *. 2755 (region_model::get_representative_path_var): Port to 2756 const region *. 2757 (region_model::get_path_vars_for_svalue): Delete. 2758 (region_model::set_to_new_unknown_value): Delete. 2759 (region_model::update_for_phis): Don't pass is_back_edge to handle_phi. 2760 (region_model::update_for_call_superedge): Port from svalue_id to 2761 const svalue *. 2762 (region_model::update_for_return_superedge): Port to store-based 2763 implementation. 2764 (region_model::update_for_call_summary): Replace 2765 set_to_new_unknown_value with mark_region_as_unknown. 2766 (region_model::get_root_region): Delete. 2767 (region_model::get_stack_region_id): Delete. 2768 (region_model::push_frame): Delete. 2769 (region_model::get_current_frame_id): Delete. 2770 (region_model::get_current_function): Delete. 2771 (region_model::pop_frame): Delete. 2772 (region_model::on_top_level_param): New. 2773 (region_model::get_stack_depth): Delete. 2774 (region_model::get_function_at_depth): Delete. 2775 (region_model::get_globals_region_id): Delete. 2776 (region_model::add_svalue): Delete. 2777 (region_model::replace_svalue): Delete. 2778 (region_model::add_region): Delete. 2779 (region_model::get_svalue): Delete. 2780 (region_model::get_region): Delete. 2781 (make_region_for_type): Delete. 2782 (region_model::add_region_for_type): Delete. 2783 (region_model::on_top_level_param): New. 2784 (class restrict_to_used_svalues): Delete. 2785 (region_model::purge_unused_svalues): Delete. 2786 (region_model::push_frame): New. 2787 (region_model::remap_svalue_ids): Delete. 2788 (region_model::remap_region_ids): Delete. 2789 (region_model::purge_regions): Delete. 2790 (region_model::get_descendents): Delete. 2791 (region_model::delete_region_and_descendents): Delete. 2792 (region_model::poison_any_pointers_to_bad_regions): Delete. 2793 (region_model::can_merge_with_p): Delete. 2794 (region_model::get_current_function): New. 2795 (region_model::get_value_by_name): Delete. 2796 (region_model::convert_byte_offset_to_array_index): Delete. 2797 (region_model::pop_frame): New. 2798 (region_model::get_or_create_mem_ref): Delete. 2799 (region_model::get_stack_depth): New. 2800 (region_model::get_frame_at_index): New. 2801 (region_model::unbind_region_and_descendents): New. 2802 (struct bad_pointer_finder): New. 2803 (region_model::get_or_create_pointer_plus_expr): Delete. 2804 (region_model::poison_any_pointers_to_descendents): New. 2805 (region_model::get_or_create_view): Delete. 2806 (region_model::can_merge_with_p): New. 2807 (region_model::get_fndecl_for_call): Port from svalue_id to 2808 const svalue *. 2809 (struct append_ssa_names_cb_data): New. 2810 (get_ssa_name_regions_for_current_frame): New. 2811 (region_model::append_ssa_names_cb): New. 2812 (model_merger::dump_to_pp): Add "simple" param. Drop dumping of 2813 remappings. 2814 (model_merger::dump): Add "simple" param to both overloads. 2815 (model_merger::can_merge_values_p): Delete. 2816 (model_merger::record_regions): Delete. 2817 (model_merger::record_svalues): Delete. 2818 (svalue_id_merger_mapping::svalue_id_merger_mapping): Delete. 2819 (svalue_id_merger_mapping::dump_to_pp): Delete. 2820 (svalue_id_merger_mapping::dump): Delete. 2821 (region_model::create_region_for_heap_alloc): New. 2822 (region_model::create_region_for_alloca): New. 2823 (region_model::record_dynamic_extents): New. 2824 (canonicalization::canonicalization): Delete. 2825 (canonicalization::walk_rid): Delete. 2826 (canonicalization::walk_sid): Delete. 2827 (canonicalization::dump_to_pp): Delete. 2828 (canonicalization::dump): Delete. 2829 (inchash::add): Delete overloads for svalue_id and region_id. 2830 (engine::log_stats): New. 2831 (assert_condition): Add overload comparing svalues. 2832 (assert_dump_eq): Pass "true" for multiline. 2833 (selftest::test_dump): Update for rewrite of region_model. 2834 (selftest::test_dump_2): Rename to... 2835 (selftest::test_struct): ...this. Provide a region_model_manager 2836 when creating region_model instance. Remove dump test. Add 2837 checks for get_offset. 2838 (selftest::test_dump_3): Rename to... 2839 (selftest::test_array_1): ...this. Provide a region_model_manager 2840 when creating region_model instance. Remove dump test. 2841 (selftest::test_get_representative_tree): Port from svalue_id to 2842 new API. Add test coverage for various expressions. 2843 (selftest::test_unique_constants): Provide a region_model_manager 2844 for the region_model. Add test coverage for comparing const vs 2845 non-const. 2846 (selftest::test_svalue_equality): Delete. 2847 (selftest::test_region_equality): Delete. 2848 (selftest::test_unique_unknowns): New. 2849 (class purge_all_svalue_ids): Delete. 2850 (class purge_one_svalue_id): Delete. 2851 (selftest::test_purging_by_criteria): Delete. 2852 (selftest::test_initial_svalue_folding): New. 2853 (selftest::test_unaryop_svalue_folding): New. 2854 (selftest::test_binop_svalue_folding): New. 2855 (selftest::test_sub_svalue_folding): New. 2856 (selftest::test_purge_unused_svalues): Delete. 2857 (selftest::test_descendent_of_p): New. 2858 (selftest::test_assignment): Provide a region_model_manager for 2859 the region_model. Drop the dump test. 2860 (selftest::test_compound_assignment): Likewise. 2861 (selftest::test_stack_frames): Port to new implementation. 2862 (selftest::test_get_representative_path_var): Likewise. 2863 (selftest::test_canonicalization_1): Rename to... 2864 (selftest::test_equality_1): ...this. Port to new API, and add 2865 (selftest::test_canonicalization_2): Provide a 2866 region_model_manager when creating region_model instances. 2867 Remove redundant canicalization. 2868 (selftest::test_canonicalization_3): Provide a 2869 region_model_manager when creating region_model instances. 2870 Remove param from calls to region_model::canonicalize. 2871 (selftest::test_canonicalization_4): Likewise. 2872 (selftest::assert_region_models_merge): Constify 2873 out_merged_svalue. Port to new API. 2874 (selftest::test_state_merging): Provide a 2875 region_model_manager when creating region_model instances. 2876 Provide a program_point point when merging them. Replace 2877 set_to_new_unknown_value with usage of placeholder_svalues. 2878 Drop get_value_by_name. Port from svalue_id to const svalue *. 2879 Add test of heap allocation. 2880 (selftest::test_constraint_merging): Provide a 2881 region_model_manager when creating region_model instances. 2882 Provide a program_point point when merging them. Eliminate use 2883 of set_to_new_unknown_value. 2884 (selftest::test_widening_constraints): New. 2885 (selftest::test_iteration_1): New. 2886 (selftest::test_malloc_constraints): Port to store-based 2887 implementation. 2888 (selftest::test_var): New test. 2889 (selftest::test_array_2): New test. 2890 (selftest::test_mem_ref): New test. 2891 (selftest::test_POINTER_PLUS_EXPR_then_MEM_REF): New. 2892 (selftest::test_malloc): New. 2893 (selftest::test_alloca): New. 2894 (selftest::analyzer_region_model_cc_tests): Update for renamings. 2895 Call new functions. 2896 * region-model.h (class path_var): Move to analyzer.h. 2897 (class svalue_id): Delete. 2898 (class region_id): Delete. 2899 (class id_map): Delete. 2900 (svalue_id_map): Delete. 2901 (region_id_map): Delete. 2902 (id_map<T>::id_map): Delete. 2903 (id_map<T>::put): Delete. 2904 (id_map<T>::get_dst_for_src): Delete. 2905 (id_map<T>::get_src_for_dst): Delete. 2906 (id_map<T>::dump_to_pp): Delete. 2907 (id_map<T>::dump): Delete. 2908 (id_map<T>::update): Delete. 2909 (one_way_svalue_id_map): Delete. 2910 (one_way_region_id_map): Delete. 2911 (class region_id_set): Delete. 2912 (class svalue_id_set): Delete. 2913 (struct complexity): New. 2914 (class visitor): New. 2915 (enum svalue_kind): Add SK_SETJMP, SK_INITIAL, SK_UNARYOP, 2916 SK_BINOP, SK_SUB,SK_UNMERGEABLE, SK_PLACEHOLDER, SK_WIDENING, 2917 SK_COMPOUND, and SK_CONJURED. 2918 (svalue::operator==): Delete. 2919 (svalue::operator!=): Delete. 2920 (svalue::clone): Delete. 2921 (svalue::hash): Delete. 2922 (svalue::dump_dot_to_pp): Delete. 2923 (svalue::dump_to_pp): New. 2924 (svalue::dump): New. 2925 (svalue::get_desc): New. 2926 (svalue::dyn_cast_initial_svalue): New. 2927 (svalue::dyn_cast_unaryop_svalue): New. 2928 (svalue::dyn_cast_binop_svalue): New. 2929 (svalue::dyn_cast_sub_svalue): New. 2930 (svalue::dyn_cast_unmergeable_svalue): New. 2931 (svalue::dyn_cast_widening_svalue): New. 2932 (svalue::dyn_cast_compound_svalue): New. 2933 (svalue::dyn_cast_conjured_svalue): New. 2934 (svalue::maybe_undo_cast): New. 2935 (svalue::unwrap_any_unmergeable): New. 2936 (svalue::remap_region_ids): Delete 2937 (svalue::can_merge_p): New. 2938 (svalue::walk_for_canonicalization): Delete 2939 (svalue::get_complexity): New. 2940 (svalue::get_child_sid): Delete 2941 (svalue::accept): New. 2942 (svalue::live_p): New. 2943 (svalue::implicitly_live_p): New. 2944 (svalue::svalue): Add complexity param. 2945 (svalue::add_to_hash): Delete 2946 (svalue::print_details): Delete 2947 (svalue::m_complexity): New field. 2948 (region_svalue::key_t): New struct. 2949 (region_svalue::region_svalue): Port from region_id to 2950 const region_id *. Add complexity. 2951 (region_svalue::compare_fields): Delete. 2952 (region_svalue::clone): Delete. 2953 (region_svalue::dump_dot_to_pp): Delete. 2954 (region_svalue::get_pointee): Port from region_id to 2955 const region_id *. 2956 (region_svalue::remap_region_ids): Delete. 2957 (region_svalue::merge_values): Delete. 2958 (region_svalue::dump_to_pp): New. 2959 (region_svalue::accept): New. 2960 (region_svalue::walk_for_canonicalization): Delete. 2961 (region_svalue::eval_condition): Make params const. 2962 (region_svalue::add_to_hash): Delete. 2963 (region_svalue::print_details): Delete. 2964 (region_svalue::m_rid): Replace with... 2965 (region_svalue::m_reg): ...this. 2966 (is_a_helper <region_svalue *>::test): Convert to... 2967 (is_a_helper <const region_svalue *>::test): ...this. 2968 (template <> struct default_hash_traits<region_svalue::key_t>): 2969 New. 2970 (constant_svalue::constant_svalue): Add complexity. 2971 (constant_svalue::compare_fields): Delete. 2972 (constant_svalue::clone): Delete. 2973 (constant_svalue::add_to_hash): Delete. 2974 (constant_svalue::dump_to_pp): New. 2975 (constant_svalue::accept): New. 2976 (constant_svalue::implicitly_live_p): New. 2977 (constant_svalue::merge_values): Delete. 2978 (constant_svalue::eval_condition): Make params const. 2979 (constant_svalue::get_child_sid): Delete. 2980 (constant_svalue::print_details): Delete. 2981 (is_a_helper <constant_svalue *>::test): Convert to... 2982 (is_a_helper <const constant_svalue *>::test): ...this. 2983 (class unknown_svalue): Update leading comment. 2984 (unknown_svalue::unknown_svalue): Add complexity. 2985 (unknown_svalue::compare_fields): Delete. 2986 (unknown_svalue::add_to_hash): Delete. 2987 (unknown_svalue::dyn_cast_unknown_svalue): Delete. 2988 (unknown_svalue::print_details): Delete. 2989 (unknown_svalue::dump_to_pp): New. 2990 (unknown_svalue::accept): New. 2991 (poisoned_svalue::key_t): New struct. 2992 (poisoned_svalue::poisoned_svalue): Add complexity. 2993 (poisoned_svalue::compare_fields): Delete. 2994 (poisoned_svalue::clone): Delete. 2995 (poisoned_svalue::add_to_hash): Delete. 2996 (poisoned_svalue::dump_to_pp): New. 2997 (poisoned_svalue::accept): New. 2998 (poisoned_svalue::print_details): Delete. 2999 (is_a_helper <poisoned_svalue *>::test): Convert to... 3000 (is_a_helper <const poisoned_svalue *>::test): ...this. 3001 (template <> struct default_hash_traits<poisoned_svalue::key_t>): 3002 New. 3003 (setjmp_record::add_to_hash): New. 3004 (setjmp_svalue::key_t): New struct. 3005 (setjmp_svalue::compare_fields): Delete. 3006 (setjmp_svalue::clone): Delete. 3007 (setjmp_svalue::add_to_hash): Delete. 3008 (setjmp_svalue::setjmp_svalue): Add complexity. 3009 (setjmp_svalue::dump_to_pp): New. 3010 (setjmp_svalue::accept): New. 3011 (setjmp_svalue::void print_details): Delete. 3012 (is_a_helper <const setjmp_svalue *>::test): New. 3013 (template <> struct default_hash_traits<setjmp_svalue::key_t>): New. 3014 (class initial_svalue : public svalue): New. 3015 (is_a_helper <const initial_svalue *>::test): New. 3016 (class unaryop_svalue): New. 3017 (is_a_helper <const unaryop_svalue *>::test): New. 3018 (template <> struct default_hash_traits<unaryop_svalue::key_t>): New. 3019 (class binop_svalue): New. 3020 (is_a_helper <const binop_svalue *>::test): New. 3021 (template <> struct default_hash_traits<binop_svalue::key_t>): New. 3022 (class sub_svalue): New. 3023 (is_a_helper <const sub_svalue *>::test): New. 3024 (template <> struct default_hash_traits<sub_svalue::key_t>): New. 3025 (class unmergeable_svalue): New. 3026 (is_a_helper <const unmergeable_svalue *>::test): New. 3027 (class placeholder_svalue): New. 3028 (is_a_helper <placeholder_svalue *>::test): New. 3029 (class widening_svalue): New. 3030 (is_a_helper <widening_svalue *>::test): New. 3031 (template <> struct default_hash_traits<widening_svalue::key_t>): New. 3032 (class compound_svalue): New. 3033 (is_a_helper <compound_svalue *>::test): New. 3034 (template <> struct default_hash_traits<compound_svalue::key_t>): New. 3035 (class conjured_svalue): New. 3036 (is_a_helper <conjured_svalue *>::test): New. 3037 (template <> struct default_hash_traits<conjured_svalue::key_t>): New. 3038 (enum region_kind): Delete RK_PRIMITIVE, RK_STRUCT, RK_UNION, and 3039 RK_ARRAY. Add RK_LABEL, RK_DECL, RK_FIELD, RK_ELEMENT, RK_OFFSET, 3040 RK_CAST, RK_HEAP_ALLOCATED, RK_ALLOCA, RK_STRING, and RK_UNKNOWN. 3041 (region_kind_to_str): Delete. 3042 (region::~region): Move implementation to region.cc. 3043 (region::operator==): Delete. 3044 (region::operator!=): Delete. 3045 (region::clone): Delete. 3046 (region::get_id): New. 3047 (region::cmp_ids): New. 3048 (region::dyn_cast_map_region): Delete. 3049 (region::dyn_cast_array_region): Delete. 3050 (region::region_id get_parent): Delete. 3051 (region::get_parent_region): Convert to a simple accessor. 3052 (region::void set_value): Delete. 3053 (region::svalue_id get_value): Delete. 3054 (region::svalue_id get_value_direct): Delete. 3055 (region::svalue_id get_inherited_child_sid): Delete. 3056 (region::dyn_cast_frame_region): New. 3057 (region::dyn_cast_function_region): New. 3058 (region::dyn_cast_decl_region): New. 3059 (region::dyn_cast_field_region): New. 3060 (region::dyn_cast_element_region): New. 3061 (region::dyn_cast_offset_region): New. 3062 (region::dyn_cast_cast_region): New. 3063 (region::dyn_cast_string_region): New. 3064 (region::accept): New. 3065 (region::get_base_region): New. 3066 (region::base_region_p): New. 3067 (region::descendent_of_p): New. 3068 (region::maybe_get_frame_region): New. 3069 (region::maybe_get_decl): New. 3070 (region::hash): Delete. 3071 (region::rint): Delete. 3072 (region::dump_dot_to_pp): Delete. 3073 (region::get_desc): New. 3074 (region::dump_to_pp): Convert to vfunc, changing signature. 3075 (region::dump_child_label): Delete. 3076 (region::remap_svalue_ids): Delete. 3077 (region::remap_region_ids): Delete. 3078 (region::dump): New. 3079 (region::walk_for_canonicalization): Delete. 3080 (region::non_null_p): Drop region_model param. 3081 (region::add_view): Delete. 3082 (region::get_view): Delete. 3083 (region::get_active_view): Delete. 3084 (region::is_view_p): Delete. 3085 (region::cmp_ptrs): New. 3086 (region::validate): Delete. 3087 (region::get_offset): New. 3088 (region::get_byte_size): New. 3089 (region::get_bit_size): New. 3090 (region::get_subregions_for_binding): New. 3091 (region::region): Add complexity param. Convert parent from 3092 region_id to const region *. Drop svalue_id. Drop copy ctor. 3093 (region::symbolic_for_unknown_ptr_p): New. 3094 (region::add_to_hash): Delete. 3095 (region::print_fields): Delete. 3096 (region::get_complexity): New accessor. 3097 (region::become_active_view): Delete. 3098 (region::deactivate_any_active_view): Delete. 3099 (region::deactivate_view): Delete. 3100 (region::calc_offset): New. 3101 (region::m_parent_rid): Delete. 3102 (region::m_sval_id): Delete. 3103 (region::m_complexity): New. 3104 (region::m_id): New. 3105 (region::m_parent): New. 3106 (region::m_view_rids): Delete. 3107 (region::m_is_view): Delete. 3108 (region::m_active_view_rid): Delete. 3109 (region::m_cached_offset): New. 3110 (is_a_helper <region *>::test): Convert to... 3111 (is_a_helper <const region *>::test): ... this. 3112 (class primitive_region): Delete. 3113 (class space_region): New. 3114 (class map_region): Delete. 3115 (is_a_helper <map_region *>::test): Delete. 3116 (class frame_region): Reimplement. 3117 (template <> struct default_hash_traits<frame_region::key_t>): 3118 New. 3119 (class globals_region): Reimplement. 3120 (is_a_helper <globals_region *>::test): Convert to... 3121 (is_a_helper <const globals_region *>::test): ...this. 3122 (class struct_or_union_region): Delete. 3123 (is_a_helper <struct_or_union_region *>::test): Delete. 3124 (class code_region): Reimplement. 3125 (is_a_helper <const code_region *>::test): New. 3126 (class struct_region): Delete. 3127 (is_a_helper <struct_region *>::test): Delete. 3128 (class function_region): Reimplement. 3129 (is_a_helper <function_region *>::test): Convert to... 3130 (is_a_helper <const function_region *>::test): ...this. 3131 (class union_region): Delete. 3132 (is_a_helper <union_region *>::test): Delete. 3133 (class label_region): New. 3134 (is_a_helper <const label_region *>::test): New. 3135 (class scope_region): Delete. 3136 (class stack_region): Reimplement. 3137 (is_a_helper <stack_region *>::test): Convert to... 3138 (is_a_helper <const stack_region *>::test): ...this. 3139 (class heap_region): Reimplement. 3140 (is_a_helper <heap_region *>::test): Convert to... 3141 (is_a_helper <const heap_region *>::test): ...this. 3142 (class root_region): Reimplement. 3143 (is_a_helper <root_region *>::test): Convert to... 3144 (is_a_helper <const root_region *>::test): ...this. 3145 (class symbolic_region): Reimplement. 3146 (is_a_helper <const symbolic_region *>::test): New. 3147 (template <> struct default_hash_traits<symbolic_region::key_t>): 3148 New. 3149 (class decl_region): New. 3150 (is_a_helper <const decl_region *>::test): New. 3151 (class field_region): New. 3152 (template <> struct default_hash_traits<field_region::key_t>): New. 3153 (class array_region): Delete. 3154 (class element_region): New. 3155 (is_a_helper <array_region *>::test): Delete. 3156 (is_a_helper <const element_region *>::test): New. 3157 (template <> struct default_hash_traits<element_region::key_t>): 3158 New. 3159 (class offset_region): New. 3160 (is_a_helper <const offset_region *>::test): New. 3161 (template <> struct default_hash_traits<offset_region::key_t>): 3162 New. 3163 (class cast_region): New. 3164 (is_a_helper <const cast_region *>::test): New. 3165 (template <> struct default_hash_traits<cast_region::key_t>): New. 3166 (class heap_allocated_region): New. 3167 (class alloca_region): New. 3168 (class string_region): New. 3169 (is_a_helper <const string_region *>::test): New. 3170 (class unknown_region): New. 3171 (class region_model_manager): New. 3172 (struct append_ssa_names_cb_data): New. 3173 (class call_details): New. 3174 (region_model::region_model): Add region_model_manager param. 3175 (region_model::print_svalue): Delete. 3176 (region_model::dump_dot_to_pp): Delete. 3177 (region_model::dump_dot_to_file): Delete. 3178 (region_model::dump_dot): Delete. 3179 (region_model::dump_to_pp): Drop summarize param in favor of 3180 simple and multiline. 3181 (region_model::dump): Likewise. 3182 (region_model::summarize_to_pp): Delete. 3183 (region_model::summarize): Delete. 3184 (region_model::void canonicalize): Drop ctxt param. 3185 (region_model::void check_for_poison): Delete. 3186 (region_model::get_gassign_result): New. 3187 (region_model::impl_call_alloca): New. 3188 (region_model::impl_call_analyzer_describe): New. 3189 (region_model::impl_call_analyzer_eval): New. 3190 (region_model::impl_call_builtin_expect): New. 3191 (region_model::impl_call_calloc): New. 3192 (region_model::impl_call_free): New. 3193 (region_model::impl_call_malloc): New. 3194 (region_model::impl_call_memset): New. 3195 (region_model::impl_call_strlen): New. 3196 (region_model::get_reachable_svalues): New. 3197 (region_model::handle_phi): Drop is_back_edge param. 3198 (region_model::region_id get_root_rid): Delete. 3199 (region_model::root_region *get_root_region): Delete. 3200 (region_model::region_id get_stack_region_id): Delete. 3201 (region_model::push_frame): Convert from region_id and svalue_id 3202 to const region * and const svalue *. 3203 (region_model::get_current_frame_id): Replace with... 3204 (region_model::get_current_frame): ...this. 3205 (region_model::pop_frame): Convert from region_id to 3206 const region *. Drop purge and stats param. Add out_result. 3207 (region_model::function *get_function_at_depth): Delete. 3208 (region_model::get_globals_region_id): Delete. 3209 (region_model::add_svalue): Delete. 3210 (region_model::replace_svalue): Delete. 3211 (region_model::add_region): Delete. 3212 (region_model::add_region_for_type): Delete. 3213 (region_model::get_svalue): Delete. 3214 (region_model::get_region): Delete. 3215 (region_model::get_lvalue): Convert from region_id to 3216 const region *. 3217 (region_model::get_rvalue): Convert from svalue_id to 3218 const svalue *. 3219 (region_model::get_or_create_ptr_svalue): Delete. 3220 (region_model::get_or_create_constant_svalue): Delete. 3221 (region_model::get_svalue_for_fndecl): Delete. 3222 (region_model::get_svalue_for_label): Delete. 3223 (region_model::get_region_for_fndecl): Delete. 3224 (region_model::get_region_for_label): Delete. 3225 (region_model::get_frame_at_index (int index) const;): New. 3226 (region_model::maybe_cast): Delete. 3227 (region_model::maybe_cast_1): Delete. 3228 (region_model::get_field_region): Delete. 3229 (region_model::id deref_rvalue): Convert from region_id and 3230 svalue_id to const region * and const svalue *. Drop overload, 3231 passing in both a tree and an svalue. 3232 (region_model::set_value): Convert from region_id and svalue_id to 3233 const region * and const svalue *. 3234 (region_model::set_to_new_unknown_value): Delete. 3235 (region_model::clobber_region (const region *reg);): New. 3236 (region_model::purge_region (const region *reg);): New. 3237 (region_model::zero_fill_region (const region *reg);): New. 3238 (region_model::mark_region_as_unknown (const region *reg);): New. 3239 (region_model::copy_region): Convert from region_id to 3240 const region *. 3241 (region_model::eval_condition): Convert from svalue_id to 3242 const svalue *. 3243 (region_model::eval_condition_without_cm): Likewise. 3244 (region_model::compare_initial_and_pointer): New. 3245 (region_model:maybe_get_constant): Delete. 3246 (region_model::add_new_malloc_region): Delete. 3247 (region_model::get_representative_tree): Convert from svalue_id to 3248 const svalue *. 3249 (region_model::get_representative_path_var): Delete decl taking a 3250 region_id in favor of two decls, for svalue vs region, with an 3251 svalue_set to ensure termination. 3252 (region_model::get_path_vars_for_svalue): Delete. 3253 (region_model::create_region_for_heap_alloc): New. 3254 (region_model::create_region_for_alloca): New. 3255 (region_model::purge_unused_svalues): Delete. 3256 (region_model::remap_svalue_ids): Delete. 3257 (region_model::remap_region_ids): Delete. 3258 (region_model::purge_regions): Delete. 3259 (region_model::get_num_svalues): Delete. 3260 (region_model::get_num_regions): Delete. 3261 (region_model::get_descendents): Delete. 3262 (region_model::get_store): New. 3263 (region_model::delete_region_and_descendents): Delete. 3264 (region_model::get_manager): New. 3265 (region_model::unbind_region_and_descendents): New. 3266 (region_model::can_merge_with_p): Add point param. Drop 3267 svalue_id_merger_mapping. 3268 (region_model::get_value_by_name): Delete. 3269 (region_model::convert_byte_offset_to_array_index): Delete. 3270 (region_model::get_or_create_mem_ref): Delete. 3271 (region_model::get_or_create_pointer_plus_expr): Delete. 3272 (region_model::get_or_create_view): Delete. 3273 (region_model::get_lvalue_1): Convert from region_id to 3274 const region *. 3275 (region_model::get_rvalue_1): Convert from svalue_id to 3276 const svalue *. 3277 (region_model::get_ssa_name_regions_for_current_frame): New. 3278 (region_model::append_ssa_names_cb): New. 3279 (region_model::get_store_value): New. 3280 (region_model::copy_struct_region): Delete. 3281 (region_model::copy_union_region): Delete. 3282 (region_model::copy_array_region): Delete. 3283 (region_model::region_exists_p): New. 3284 (region_model::make_region_for_unexpected_tree_code): Delete. 3285 (region_model::loop_replay_fixup): New. 3286 (region_model::poison_any_pointers_to_bad_regions): Delete. 3287 (region_model::poison_any_pointers_to_descendents): New. 3288 (region_model::dump_summary_of_rep_path_vars): Delete. 3289 (region_model::on_top_level_param): New. 3290 (region_model::record_dynamic_extents): New. 3291 (region_model::m_mgr;): New. 3292 (region_model::m_store;): New. 3293 (region_model::m_svalues;): Delete. 3294 (region_model::m_regions;): Delete. 3295 (region_model::m_root_rid;): Delete. 3296 (region_model::m_current_frame;): New. 3297 (region_model_context::remap_svalue_ids): Delete. 3298 (region_model_context::can_purge_p): Delete. 3299 (region_model_context::on_svalue_leak): New. 3300 (region_model_context::on_svalue_purge): Delete. 3301 (region_model_context::on_liveness_change): New. 3302 (region_model_context::on_inherited_svalue): Delete. 3303 (region_model_context::on_cast): Delete. 3304 (region_model_context::on_unknown_change): Convert from svalue_id to 3305 const svalue * and add is_mutable. 3306 (class noop_region_model_context): Update for region_model_context 3307 changes. 3308 (model_merger::model_merger): Add program_point. Drop 3309 svalue_id_merger_mapping. 3310 (model_merger::dump_to_pp): Add "simple" param. 3311 (model_merger::dump): Likewise. 3312 (model_merger::get_region_a): Delete. 3313 (model_merger::get_region_b): Delete. 3314 (model_merger::can_merge_values_p): Delete. 3315 (model_merger::record_regions): Delete. 3316 (model_merger::record_svalues): Delete. 3317 (model_merger::m_point): New field. 3318 (model_merger::m_map_regions_from_a_to_m): Delete. 3319 (model_merger::m_map_regions_from_b_to_m): Delete. 3320 (model_merger::m_sid_mapping): Delete. 3321 (struct svalue_id_merger_mapping): Delete. 3322 (class engine): New. 3323 (struct canonicalization): Delete. 3324 (inchash::add): Delete decls for hashing svalue_id and region_id. 3325 (test_region_model_context::on_unexpected_tree_code): Require t to 3326 be non-NULL. 3327 (selftest::assert_condition): Add overload comparing a pair of 3328 const svalue *. 3329 * sm-file.cc: Include "tristate.h", "selftest.h", 3330 "analyzer/call-string.h", "analyzer/program-point.h", 3331 "analyzer/store.h", and "analyzer/region-model.h". 3332 (fileptr_state_machine::get_default_state): New. 3333 (fileptr_state_machine::on_stmt): Remove calls to 3334 get_readable_tree in favor of get_diagnostic_tree. 3335 * sm-malloc.cc: Include "tristate.h", "selftest.h", 3336 "analyzer/call-string.h", "analyzer/program-point.h", 3337 "analyzer/store.h", and "analyzer/region-model.h". 3338 (malloc_state_machine::get_default_state): New. 3339 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New. 3340 (malloc_diagnostic::describe_state_change): Handle change.m_expr 3341 being NULL. 3342 (null_arg::emit): Avoid printing "NULL '0'". 3343 (null_arg::describe_final_event): Avoid printing "(0) NULL". 3344 (malloc_leak::emit): Handle m_arg being NULL. 3345 (malloc_leak::describe_final_event): Handle ev.m_expr being NULL. 3346 (malloc_state_machine::on_stmt): Don't call get_readable_tree. 3347 Call get_diagnostic_tree when creating pending diagnostics. 3348 Update for is_zero_assignment becoming a member function of 3349 sm_ctxt. 3350 Don't transition to m_non_heap for ADDR_EXPR(MEM_REF()). 3351 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New 3352 vfunc implementation. 3353 * sm-sensitive.cc (sensitive_state_machine::warn_for_any_exposure): Call 3354 get_diagnostic_tree and pass the result to warn_for_state. 3355 * sm-signal.cc: Move includes of "analyzer/call-string.h" and 3356 "analyzer/program-point.h" to before "analyzer/region-model.h", 3357 and also include "analyzer/store.h" before it. 3358 (signal_unsafe_call::describe_state_change): Use 3359 get_dest_function to get handler. 3360 (update_model_for_signal_handler): Pass manager to region_model 3361 ctor. 3362 (register_signal_handler::impl_transition): Update for changes to 3363 get_or_create_node and add_edge. 3364 * sm-taint.cc (taint_state_machine::on_stmt): Remove calls to 3365 get_readable_tree, replacing them when calling warn_for_state with 3366 calls to get_diagnostic_tree. 3367 * sm.cc (is_zero_assignment): Delete. 3368 (any_pointer_p): Move to within namespace ana. 3369 * sm.h (is_zero_assignment): Remove decl. 3370 (any_pointer_p): Move decl to within namespace ana. 3371 (state_machine::get_default_state): New vfunc. 3372 (state_machine::reset_when_passed_to_unknown_fn_p): New vfunc. 3373 (sm_context::get_readable_tree): Rename to... 3374 (sm_context::get_diagnostic_tree): ...this. 3375 (sm_context::is_zero_assignment): New vfunc. 3376 * store.cc: New file. 3377 * store.h: New file. 3378 * svalue.cc: New file. 3379 33802020-05-22 Mark Wielaard <mark@klomp.org> 3381 3382 * sm-signal.cc(signal_unsafe_call::emit): Possibly add 3383 gcc_rich_location note for replacement. 3384 (signal_unsafe_call::get_replacement_fn): New private function. 3385 (get_async_signal_unsafe_fns): Add "exit". 3386 33872020-04-28 David Malcolm <dmalcolm@redhat.com> 3388 3389 PR analyzer/94816 3390 * engine.cc (impl_region_model_context::on_unexpected_tree_code): 3391 Handle NULL tree. 3392 * region-model.cc (region_model::add_region_for_type): Handle 3393 NULL type. 3394 * region-model.h 3395 (test_region_model_context::on_unexpected_tree_code): Handle NULL 3396 tree. 3397 33982020-04-28 David Malcolm <dmalcolm@redhat.com> 3399 3400 PR analyzer/94447 3401 PR analyzer/94639 3402 PR analyzer/94732 3403 PR analyzer/94754 3404 * analyzer.opt (Wanalyzer-use-of-uninitialized-value): Delete. 3405 * program-state.cc (selftest::test_program_state_dumping): Update 3406 expected dump result for removal of "uninit". 3407 * region-model.cc (poison_kind_to_str): Delete POISON_KIND_UNINIT 3408 case. 3409 (root_region::ensure_stack_region): Initialize stack with null 3410 svalue_id rather than with a typeless POISON_KIND_UNINIT value. 3411 (root_region::ensure_heap_region): Likewise for the heap. 3412 (region_model::dump_summary_of_rep_path_vars): Remove 3413 summarization of uninit values. 3414 (region_model::validate): Remove check that the stack has a 3415 POISON_KIND_UNINIT value. 3416 (poisoned_value_diagnostic::emit): Remove POISON_KIND_UNINIT 3417 case. 3418 (poisoned_value_diagnostic::describe_final_event): Likewise. 3419 (selftest::test_dump): Update expected dump result for removal of 3420 "uninit". 3421 (selftest::test_svalue_equality): Remove "uninit" and "freed". 3422 * region-model.h (enum poison_kind): Remove POISON_KIND_UNINIT. 3423 34242020-04-01 David Malcolm <dmalcolm@redhat.com> 3425 3426 PR analyzer/94378 3427 * checker-path.cc: Include "bitmap.h". 3428 * constraint-manager.cc: Likewise. 3429 * diagnostic-manager.cc: Likewise. 3430 * engine.cc: Likewise. 3431 (exploded_node::detect_leaks): Pass null region_id to pop_frame. 3432 * program-point.cc: Include "bitmap.h". 3433 * program-state.cc: Likewise. 3434 * region-model.cc (id_set<region_id>::id_set): Convert to... 3435 (region_id_set::region_id_set): ...this. 3436 (svalue_id_set::svalue_id_set): New ctor. 3437 (region_model::copy_region): New function. 3438 (region_model::copy_struct_region): New function. 3439 (region_model::copy_union_region): New function. 3440 (region_model::copy_array_region): New function. 3441 (stack_region::pop_frame): Drop return value. Add 3442 "result_dst_rid" param; if it is non-null, use copy_region to copy 3443 the result to it. Rather than capture and pass a single "known 3444 used" return value to be used by purge_unused_values, instead 3445 gather and pass a set of known used return values. 3446 (root_region::pop_frame): Drop return value. Add "result_dst_rid" 3447 param. 3448 (region_model::on_assignment): Use copy_region. 3449 (region_model::on_return): Likewise for the result. 3450 (region_model::on_longjmp): Pass null for pop_frame's 3451 result_dst_rid. 3452 (region_model::update_for_return_superedge): Pass the region for the 3453 return value of the call, if any, to pop_frame, rather than setting 3454 the lvalue for the lhs of the result. 3455 (region_model::pop_frame): Drop return value. Add 3456 "result_dst_rid" param. 3457 (region_model::purge_unused_svalues): Convert third param from an 3458 svalue_id * to an svalue_id_set *, updating the initial populating 3459 of the "used" bitmap accordingly. Don't remap it when done. 3460 (struct selftest::coord_test): New selftest fixture, extracted from... 3461 (selftest::test_dump_2): ...here. 3462 (selftest::test_compound_assignment): New selftest. 3463 (selftest::test_stack_frames): Pass null to new param of pop_frame. 3464 (selftest::analyzer_region_model_cc_tests): Call the new selftest. 3465 * region-model.h (class id_set): Delete template. 3466 (class region_id_set): Reimplement, using old id_set implementation. 3467 (class svalue_id_set): Likewise. Convert from auto_sbitmap to 3468 auto_bitmap. 3469 (region::get_active_view): New accessor. 3470 (stack_region::pop_frame): Drop return value. Add 3471 "result_dst_rid" param. 3472 (root_region::pop_frame): Likewise. 3473 (region_model::pop_frame): Likewise. 3474 (region_model::copy_region): New decl. 3475 (region_model::purge_unused_svalues): Convert third param from an 3476 svalue_id * to an svalue_id_set *. 3477 (region_model::copy_struct_region): New decl. 3478 (region_model::copy_union_region): New decl. 3479 (region_model::copy_array_region): New decl. 3480 34812020-03-27 David Malcolm <dmalcolm@redhat.com> 3482 3483 * program-state.cc (selftest::test_program_state_dumping): Update 3484 expected dump to include symbolic_region's possibly_null field. 3485 * region-model.cc (symbolic_region::print_fields): New vfunc 3486 implementation. 3487 (region_model::add_constraint): Clear m_possibly_null from 3488 symbolic_regions now known to be non-NULL. 3489 (selftest::test_malloc_constraints): New selftest. 3490 (selftest::analyzer_region_model_cc_tests): Call it. 3491 * region-model.h (region::dyn_cast_symbolic_region): Add non-const 3492 overload. 3493 (symbolic_region::dyn_cast_symbolic_region): Implement it. 3494 (symbolic_region::print_fields): New vfunc override decl. 3495 34962020-03-27 David Malcolm <dmalcolm@redhat.com> 3497 3498 * analyzer.h (class feasibility_problem): New forward decl. 3499 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic): 3500 Initialize new fields m_status, m_epath_length, and m_problem. 3501 (saved_diagnostic::~saved_diagnostic): Delete m_problem. 3502 (dedupe_candidate::dedupe_candidate): Convert "sd" param from a 3503 const ref to a mutable ptr. 3504 (dedupe_winners::add): Convert "sd" param from a const ref to a 3505 mutable ptr. Record the length of the exploded_path. Record the 3506 feasibility/infeasibility of sd into sd, capturing a 3507 feasibility_problem when feasible_p fails, and storing it in sd. 3508 (diagnostic_manager::emit_saved_diagnostics): Update for pass by 3509 ptr rather than by const ref. 3510 * diagnostic-manager.h (class saved_diagnostic): Add new enum 3511 status. Add fields m_status, m_epath_length and m_problem. 3512 (saved_diagnostic::set_feasible): New member function. 3513 (saved_diagnostic::set_infeasible): New member function. 3514 (saved_diagnostic::get_feasibility_problem): New accessor. 3515 (saved_diagnostic::get_status): New accessor. 3516 (saved_diagnostic::set_epath_length): New member function. 3517 (saved_diagnostic::get_epath_length): New accessor. 3518 * engine.cc: Include "gimple-pretty-print.h". 3519 (exploded_path::feasible_p): Add OUT param and, if non-NULL, write 3520 a new feasibility_problem to it on failure. 3521 (viz_callgraph_node::dump_dot): Convert begin_tr calls to 3522 begin_trtd. Convert end_tr calls to end_tdtr. 3523 (class exploded_graph_annotator): New subclass of dot_annotator. 3524 (impl_run_checkers): Add a second -fdump-analyzer-supergraph dump 3525 after the analysis runs, using exploded_graph_annotator. dumping 3526 to DUMP_BASE_NAME.supergraph-eg.dot. 3527 * exploded-graph.h (exploded_node::get_dot_fillcolor): Make 3528 public. 3529 (exploded_path::feasible_p): Add OUT param. 3530 (class feasibility_problem): New class. 3531 * state-purge.cc (state_purge_annotator::add_node_annotations): 3532 Return a bool, add a "within_table" param. 3533 (print_vec_of_names): Convert begin_tr calls to begin_trtd. 3534 Convert end_tr calls to end_tdtr. 3535 (state_purge_annotator::add_stmt_annotations): Add "within_row" 3536 param. 3537 * state-purge.h ((state_purge_annotator::add_node_annotations): 3538 Return a bool, add a "within_table" param. 3539 (state_purge_annotator::add_stmt_annotations): Add "within_row" 3540 param. 3541 * supergraph.cc (supernode::dump_dot): Call add_node_annotations 3542 twice: as before, passing false for "within_table", then again 3543 with true when within the TABLE element. Convert some begin_tr 3544 calls to begin_trtd, and some end_tr calls to end_tdtr. 3545 Repeat each add_stmt_annotations call, distinguishing between 3546 calls that add TRs and those that add TDs to an existing TR. 3547 Add a call to add_after_node_annotations. 3548 * supergraph.h (dot_annotator::add_node_annotations): Add a 3549 "within_table" param. 3550 (dot_annotator::add_stmt_annotations): Add a "within_row" param. 3551 (dot_annotator::add_after_node_annotations): New vfunc. 3552 35532020-03-27 David Malcolm <dmalcolm@redhat.com> 3554 3555 * diagnostic-manager.cc (dedupe_winners::add): Show the 3556 exploded_node index in the log messages. 3557 (diagnostic_manager::emit_saved_diagnostics): Log a summary of 3558 m_saved_diagnostics at entry. 3559 35602020-03-27 David Malcolm <dmalcolm@redhat.com> 3561 3562 * supergraph.cc (superedge::dump): Add space before description; 3563 move newline to non-pretty_printer overload. 3564 35652020-03-18 David Malcolm <dmalcolm@redhat.com> 3566 3567 * region-model.cc: Include "stor-layout.h". 3568 (region_model::dump_to_pp): Rather than calling 3569 dump_summary_of_map on each of the current frame and the globals, 3570 instead get a vec of representative path_vars for all regions, 3571 and then dump a summary of all of them. 3572 (region_model::dump_summary_of_map): Delete, rewriting into... 3573 (region_model::dump_summary_of_rep_path_vars): ...this new 3574 function, working on a vec of path_vars. 3575 (region_model::set_value): New overload. 3576 (region_model::get_representative_path_var): Rename 3577 "parent_region" local to "parent_reg" and consolidate with other 3578 local. Guard test for grandparent being stack on parent_reg being 3579 non-NULL. Move handling for parent being an array_region to 3580 within guard for parent_reg being non-NULL. 3581 (selftest::make_test_compound_type): New function. 3582 (selftest::test_dump_2): New selftest. 3583 (selftest::test_dump_3): New selftest. 3584 (selftest::test_stack_frames): Update expected output from 3585 simplified dump to show "a" and "b" from parent frame and "y" in 3586 child frame. 3587 (selftest::analyzer_region_model_cc_tests): Call test_dump_2 and 3588 test_dump_3. 3589 * region-model.h (region_model::set_value): New overload decl. 3590 (region_model::dump_summary_of_map): Delete. 3591 (region_model::dump_summary_of_rep_path_vars): New. 3592 35932020-03-18 David Malcolm <dmalcolm@redhat.com> 3594 3595 * region-model.h (class noop_region_model_context): New subclass 3596 of region_model_context. 3597 (class tentative_region_model_context): Inherit from 3598 noop_region_model_context rather than from region_model_context; 3599 drop redundant vfunc implementations. 3600 (class test_region_model_context): Likewise. 3601 36022020-03-18 David Malcolm <dmalcolm@redhat.com> 3603 3604 * engine.cc (exploded_node::exploded_node): Move implementation 3605 here from header; accept point_and_state by const reference rather 3606 than by value. 3607 * exploded-graph.h (exploded_node::exploded_node): Pass 3608 point_and_state by const reference rather than by value. Move 3609 body to engine.cc. 3610 36112020-03-18 Jakub Jelinek <jakub@redhat.com> 3612 3613 * sm-malloc.cc (malloc_state_machine::on_stmt): Fix up duplicated word 3614 issue in a comment. 3615 * region-model.cc (region_model::make_region_for_unexpected_tree_code, 3616 region_model::delete_region_and_descendents): Likewise. 3617 * engine.cc (class exploded_cluster): Likewise. 3618 * diagnostic-manager.cc (class path_builder): Likewise. 3619 36202020-03-13 David Malcolm <dmalcolm@redhat.com> 3621 3622 PR analyzer/94099 3623 PR analyzer/94105 3624 * diagnostic-manager.cc (for_each_state_change): Bulletproof 3625 against errors in get_rvalue by passing a 3626 tentative_region_model_context and rejecting if there's an error. 3627 * region-model.cc (region_model::get_lvalue_1): When handling 3628 ARRAY_REF, handle results of error-handling. Handle NOP_EXPR. 3629 36302020-03-06 David Malcolm <dmalcolm@redhat.com> 3631 3632 * analyzer.h (class array_region): New forward decl. 3633 * program-state.cc (selftest::test_program_state_dumping_2): New. 3634 (selftest::analyzer_program_state_cc_tests): Call it. 3635 * region-model.cc (array_region::constant_from_key): New. 3636 (region_model::get_representative_tree): Handle region_svalue by 3637 generating an ADDR_EXPR. 3638 (region_model::get_representative_path_var): In view handling, 3639 remove erroneous TREE_TYPE when determining the type of the tree. 3640 Handle array regions and STRING_CST. 3641 (selftest::assert_dump_tree_eq): New. 3642 (ASSERT_DUMP_TREE_EQ): New macro. 3643 (selftest::test_get_representative_tree): New selftest. 3644 (selftest::analyzer_region_model_cc_tests): Call it. 3645 * region-model.h (region::dyn_cast_array_region): New vfunc. 3646 (array_region::dyn_cast_array_region): New vfunc implementation. 3647 (array_region::constant_from_key): New decl. 3648 36492020-03-06 David Malcolm <dmalcolm@redhat.com> 3650 3651 * analyzer.h (dump_quoted_tree): New decl. 3652 * engine.cc (exploded_node::dump_dot): Pass region model to 3653 sm_state_map::print. 3654 * program-state.cc: Include diagnostic-core.h. 3655 (sm_state_map::print): Add "model" param and use it to print 3656 representative trees. Only print origin information if non-null. 3657 (sm_state_map::dump): Pass NULL for model to print call. 3658 (program_state::print): Pass region model to sm_state_map::print. 3659 (program_state::dump_to_pp): Use spaces rather than newlines when 3660 summarizing. Pass region_model to sm_state_map::print. 3661 (ana::selftest::assert_dump_eq): New function. 3662 (ASSERT_DUMP_EQ): New macro. 3663 (ana::selftest::test_program_state_dumping): New function. 3664 (ana::selftest::analyzer_program_state_cc_tests): Call it. 3665 * program-state.h (program_state::print): Add model param. 3666 * region-model.cc (dump_quoted_tree): New function. 3667 (map_region::print_fields): Use dump_quoted_tree rather than 3668 %qE to avoid lang-dependent output. 3669 (map_region::dump_child_label): Likewise. 3670 (region_model::dump_summary_of_map): For SK_REGION, when 3671 get_representative_path_var fails, print the region id rather than 3672 erroneously printing NULL. 3673 * sm.cc (state_machine::get_state_by_name): New function. 3674 * sm.h (state_machine::get_state_by_name): New decl. 3675 36762020-03-04 David Malcolm <dmalcolm@redhat.com> 3677 3678 * region-model.cc (region::validate): Convert model param from ptr 3679 to reference. Update comment to reflect that it's now a vfunc. 3680 (map_region::validate): New vfunc implementation. 3681 (array_region::validate): New vfunc implementation. 3682 (stack_region::validate): New vfunc implementation. 3683 (root_region::validate): New vfunc implementation. 3684 (region_model::validate): Pass a reference rather than a pointer 3685 to the region::validate vfunc. 3686 * region-model.h (region::validate): Make virtual. Convert model 3687 param from ptr to reference. 3688 (map_region::validate): New vfunc decl. 3689 (array_region::validate): New vfunc decl. 3690 (stack_region::validate): New vfunc decl. 3691 (root_region::validate): New vfunc decl. 3692 36932020-03-04 David Malcolm <dmalcolm@redhat.com> 3694 3695 PR analyzer/93993 3696 * region-model.cc (region_model::on_call_pre): Handle 3697 BUILT_IN_EXPECT and its variants. 3698 (region_model::add_any_constraints_from_ssa_def_stmt): Split out 3699 gassign handling into add_any_constraints_from_gassign; add gcall 3700 handling. 3701 (region_model::add_any_constraints_from_gassign): New function, 3702 based on the above. Add handling for NOP_EXPR. 3703 (region_model::add_any_constraints_from_gcall): New function. 3704 (region_model::get_representative_path_var): Handle views. 3705 * region-model.h 3706 (region_model::add_any_constraints_from_ssa_def_stmt): New decl. 3707 (region_model::add_any_constraints_from_gassign): New decl. 3708 37092020-03-04 David Malcolm <dmalcolm@redhat.com> 3710 3711 PR analyzer/93993 3712 * checker-path.h (state_change_event::get_lvalue): Add ctxt param 3713 and pass it to region_model::get_value call. 3714 * diagnostic-manager.cc (get_any_origin): Pass a 3715 tentative_region_model_context to the calls to get_lvalue and reject 3716 the comparison if errors occur. 3717 (can_be_expr_of_interest_p): New function. 3718 (diagnostic_manager::prune_for_sm_diagnostic): Replace checks for 3719 CONSTANT_CLASS_P with calls to update_for_unsuitable_sm_exprs. 3720 Pass a tentative_region_model_context to the calls to 3721 state_change_event::get_lvalue and reject the comparison if errors 3722 occur. 3723 (diagnostic_manager::update_for_unsuitable_sm_exprs): New. 3724 * diagnostic-manager.h 3725 (diagnostic_manager::update_for_unsuitable_sm_exprs): New decl. 3726 * region-model.h (class tentative_region_model_context): New class. 3727 37282020-03-04 David Malcolm <dmalcolm@redhat.com> 3729 3730 * engine.cc (worklist::worklist): Remove unused field m_eg. 3731 (class viz_callgraph_edge): Remove unused field m_call_sedge. 3732 (class viz_callgraph): Remove unused field m_sg. 3733 * exploded-graph.h (worklist::::m_eg): Remove unused field. 3734 37352020-03-02 David Malcolm <dmalcolm@redhat.com> 3736 3737 * analyzer.opt (fanalyzer-show-duplicate-count): New option. 3738 * diagnostic-manager.cc 3739 (diagnostic_manager::emit_saved_diagnostic): Use the above to 3740 guard the printing of the duplicate count. 3741 37422020-03-02 David Malcolm <dmalcolm@redhat.com> 3743 3744 PR analyzer/93959 3745 * analyzer.cc (is_std_function_p): New function. 3746 (is_std_named_call_p): New functions. 3747 * analyzer.h (is_std_named_call_p): New decl. 3748 * sm-malloc.cc (malloc_state_machine::on_stmt): Check for "std::" 3749 variants when checking for malloc, calloc and free. 3750 37512020-02-26 David Malcolm <dmalcolm@redhat.com> 3752 3753 PR analyzer/93950 3754 * diagnostic-manager.cc 3755 (diagnostic_manager::prune_for_sm_diagnostic): Assert that var is 3756 either NULL or not a constant. When updating var, bulletproof 3757 against constant values. 3758 37592020-02-26 David Malcolm <dmalcolm@redhat.com> 3760 3761 PR analyzer/93947 3762 * region-model.cc (region_model::get_fndecl_for_call): Gracefully 3763 fail for fn_decls that don't have a cgraph_node. 3764 37652020-02-26 David Malcolm <dmalcolm@redhat.com> 3766 3767 * bar-chart.cc: New file. 3768 * bar-chart.h: New file. 3769 * engine.cc: Include "analyzer/bar-chart.h". 3770 (stats::log): Only log the m_num_nodes kinds that are non-zero. 3771 (stats::dump): Likewise when dumping. 3772 (stats::get_total_enodes): New. 3773 (exploded_graph::get_or_create_node): Increment the per-point-data 3774 m_excess_enodes when hitting the per-program-point limit on 3775 enodes. 3776 (exploded_graph::print_bar_charts): New. 3777 (exploded_graph::log_stats): Log the number of unprocessed enodes 3778 in the worklist. Call print_bar_charts. 3779 (exploded_graph::dump_stats): Print the number of unprocessed 3780 enodes in the worklist. 3781 * exploded-graph.h (stats::get_total_enodes): New decl. 3782 (struct per_program_point_data): Add field m_excess_enodes. 3783 (exploded_graph::print_bar_charts): New decl. 3784 * supergraph.cc (superedge::dump): New. 3785 (superedge::dump): New. 3786 * supergraph.h (supernode::get_function): New. 3787 (superedge::dump): New decl. 3788 (superedge::dump): New decl. 3789 37902020-02-24 David Malcolm <dmalcolm@redhat.com> 3791 3792 * engine.cc (exploded_graph::get_or_create_node): Dump the 3793 program_state to the pp, rather than to stderr. 3794 37952020-02-24 David Malcolm <dmalcolm@redhat.com> 3796 3797 PR analyzer/93032 3798 * sm.cc (make_checkers): Require the "taint" checker to be 3799 explicitly enabled. 3800 38012020-02-24 David Malcolm <dmalcolm@redhat.com> 3802 3803 PR analyzer/93899 3804 * engine.cc 3805 (impl_region_model_context::impl_region_model_context): Add logger 3806 param. 3807 * engine.cc (exploded_graph::add_function_entry): Create an 3808 impl_region_model_context and pass it to the push_frame call. 3809 Bail if the resulting state is invalid. 3810 (exploded_graph::build_initial_worklist): Likewise. 3811 (exploded_graph::build_initial_worklist): Handle the case where 3812 add_function_entry fails. 3813 * exploded-graph.h 3814 (impl_region_model_context::impl_region_model_context): Add logger 3815 param. 3816 * region-model.cc (map_region::get_or_create): Add ctxt param and 3817 pass it to add_region_for_type. 3818 (map_region::can_merge_p): Pass NULL as a ctxt to call to 3819 get_or_create. 3820 (array_region::get_element): Pass ctxt to call to get_or_create. 3821 (array_region::get_or_create): Add ctxt param and pass it to 3822 add_region_for_type. 3823 (root_region::push_frame): Pass ctxt to get_or_create calls. 3824 (region_model::get_lvalue_1): Likewise. 3825 (region_model::make_region_for_unexpected_tree_code): Assert that 3826 ctxt is non-NULL. 3827 (region_model::get_rvalue_1): Pass ctxt to get_svalue_for_fndecl 3828 and get_svalue_for_label calls. 3829 (region_model::get_svalue_for_fndecl): Add ctxt param and pass it 3830 to get_region_for_fndecl. 3831 (region_model::get_region_for_fndecl): Add ctxt param and pass it 3832 to get_or_create. 3833 (region_model::get_svalue_for_label): Add ctxt param and pass it 3834 to get_region_for_label. 3835 (region_model::get_region_for_label): Add ctxt param and pass it 3836 to get_region_for_fndecl and get_or_create. 3837 (region_model::get_field_region): Add ctxt param and pass it to 3838 get_or_create_view and get_or_create. 3839 (make_region_for_type): Replace gcc_unreachable with return NULL. 3840 (region_model::add_region_for_type): Add ctxt param. Handle a 3841 return of NULL from make_region_for_type by calling 3842 make_region_for_unexpected_tree_code. 3843 (region_model::get_or_create_mem_ref): Pass ctxt to calls to 3844 get_or_create_view. 3845 (region_model::get_or_create_view): Add ctxt param and pass it to 3846 add_region_for_type. 3847 (selftest::test_state_merging): Pass ctxt to get_or_create_view. 3848 * region-model.h (region_model::get_or_create): Add ctxt param. 3849 (region_model::add_region_for_type): Likewise. 3850 (region_model::get_svalue_for_fndecl): Likewise. 3851 (region_model::get_svalue_for_label): Likewise. 3852 (region_model::get_region_for_fndecl): Likewise. 3853 (region_model::get_region_for_label): Likewise. 3854 (region_model::get_field_region): Likewise. 3855 (region_model::get_or_create_view): Likewise. 3856 38572020-02-24 David Malcolm <dmalcolm@redhat.com> 3858 3859 * checker-path.cc (superedge_event::should_filter_p): Update 3860 filter for empty descriptions to cover verbosity level 3 as well 3861 as 2. 3862 * diagnostic-manager.cc: Include "analyzer/reachability.h". 3863 (class path_builder): New class. 3864 (diagnostic_manager::emit_saved_diagnostic): Create a path_builder 3865 and pass it to build_emission_path, rather passing eg; similarly 3866 for add_events_for_eedge and ext_state. 3867 (diagnostic_manager::build_emission_path): Replace "eg" param 3868 with a path_builder, pass it to add_events_for_eedge. 3869 (diagnostic_manager::add_events_for_eedge): Replace ext_state 3870 param with path_builder; pass it to add_events_for_superedge. 3871 (diagnostic_manager::significant_edge_p): New. 3872 (diagnostic_manager::add_events_for_superedge): Add path_builder 3873 param. Reject insignificant edges at verbosity levels below 3. 3874 (diagnostic_manager::prune_for_sm_diagnostic): Update highest 3875 verbosity level to 4. 3876 * diagnostic-manager.h (class path_builder): New forward decl. 3877 (diagnostic_manager::build_emission_path): Replace "eg" param 3878 with a path_builder. 3879 (diagnostic_manager::add_events_for_eedge): Replace ext_state 3880 param with path_builder. 3881 (diagnostic_manager::significant_edge_p): New. 3882 (diagnostic_manager::add_events_for_superedge): Add path_builder 3883 param. 3884 * reachability.h: New file. 3885 38862020-02-18 David Malcolm <dmalcolm@redhat.com> 3887 3888 PR analyzer/93692 3889 * analyzer.opt (fdump-analyzer-callgraph): Rewrite description. 3890 38912020-02-18 David Malcolm <dmalcolm@redhat.com> 3892 3893 PR analyzer/93777 3894 * region-model.cc (region_model::maybe_cast_1): Replace assertion 3895 that build_cast returns non-NULL with a conditional, falling 3896 through to the logic which returns a new unknown value of the 3897 desired type if it fails. 3898 38992020-02-18 David Malcolm <dmalcolm@redhat.com> 3900 3901 PR analyzer/93778 3902 * engine.cc (impl_region_model_context::on_unknown_tree_code): 3903 Rename to... 3904 (impl_region_model_context::on_unexpected_tree_code): ...this and 3905 convert first argument from path_var to tree. 3906 (exploded_node::on_stmt): Pass ctxt to purge_for_unknown_fncall. 3907 * exploded-graph.h (region_model_context::on_unknown_tree_code): 3908 Rename to... 3909 (region_model_context::on_unexpected_tree_code): ...this and 3910 convert first argument from path_var to tree. 3911 * program-state.cc (sm_state_map::purge_for_unknown_fncall): Add 3912 ctxt param and pass on to calls to get_rvalue. 3913 * program-state.h (sm_state_map::purge_for_unknown_fncall): Add 3914 ctxt param. 3915 * region-model.cc (region_model::handle_unrecognized_call): Pass 3916 ctxt on to call to get_rvalue. 3917 (region_model::get_lvalue_1): Move body of default case to 3918 region_model::make_region_for_unexpected_tree_code and call it. 3919 Within COMPONENT_REF case, reject attempts to handle types other 3920 than RECORD_TYPE and UNION_TYPE. 3921 (region_model::make_region_for_unexpected_tree_code): New 3922 function, based on default case of region_model::get_lvalue_1. 3923 * region-model.h 3924 (region_model::make_region_for_unexpected_tree_code): New decl. 3925 (region_model::on_unknown_tree_code): Rename to... 3926 (region_model::on_unexpected_tree_code): ...this and convert first 3927 argument from path_var to tree. 3928 (class test_region_model_context): Update vfunc implementation for 3929 above change. 3930 39312020-02-18 David Malcolm <dmalcolm@redhat.com> 3932 3933 PR analyzer/93774 3934 * region-model.cc 3935 (region_model::convert_byte_offset_to_array_index): Use 3936 int_size_in_bytes before calling size_in_bytes, to gracefully fail 3937 on incomplete types. 3938 39392020-02-17 David Malcolm <dmalcolm@redhat.com> 3940 3941 PR analyzer/93775 3942 * region-model.cc (region_model::get_fndecl_for_call): Handle the 3943 case where the code_region's get_tree_for_child_region returns 3944 NULL. 3945 39462020-02-17 David Malcolm <dmalcolm@redhat.com> 3947 3948 PR analyzer/93388 3949 * engine.cc (impl_region_model_context::on_unknown_tree_code): 3950 New. 3951 (exploded_graph::get_or_create_node): Reject invalid states. 3952 * exploded-graph.h 3953 (impl_region_model_context::on_unknown_tree_code): New decl. 3954 (point_and_state::point_and_state): Assert that the state is 3955 valid. 3956 * program-state.cc (program_state::program_state): Initialize 3957 m_valid to true. 3958 (program_state::operator=): Copy m_valid. 3959 (program_state::program_state): Likewise for move constructor. 3960 (program_state::print): Print m_valid. 3961 (program_state::dump_to_pp): Likewise. 3962 * program-state.h (program_state::m_valid): New field. 3963 * region-model.cc (region_model::get_lvalue_1): Implement the 3964 default case by returning a new symbolic region and calling 3965 the context's on_unknown_tree_code, rather than issuing an 3966 internal_error. Implement VIEW_CONVERT_EXPR. 3967 * region-model.h (region_model_context::on_unknown_tree_code): New 3968 vfunc. 3969 (test_region_model_context::on_unknown_tree_code): New. 3970 39712020-02-17 David Malcolm <dmalcolm@redhat.com> 3972 3973 * sm-malloc.cc (malloc_diagnostic::describe_state_change): For 3974 transition to the "null" state, only say "assuming" when 3975 transitioning from the "unchecked" state. 3976 39772020-02-17 David Malcolm <dmalcolm@redhat.com> 3978 3979 * diagnostic-manager.h (diagnostic_manager::get_saved_diagnostic): 3980 Add const overload. 3981 * engine.cc (exploded_node::dump_dot): Dump saved_diagnostics. 3982 * exploded-graph.h (exploded_graph::get_diagnostic_manager): Add 3983 const overload. 3984 39852020-02-11 David Malcolm <dmalcolm@redhat.com> 3986 3987 PR analyzer/93288 3988 * analysis-plan.cc (analysis_plan::use_summary_p): Look through 3989 the ultimate_alias_target when getting the called function. 3990 * engine.cc (exploded_node::on_stmt): Rename second "ctxt" to 3991 "sm_ctxt". Use the region_model's get_fndecl_for_call rather than 3992 gimple_call_fndecl. 3993 * region-model.cc (region_model::get_fndecl_for_call): Use 3994 ultimate_alias_target on fndecl. 3995 * supergraph.cc (get_ultimate_function_for_cgraph_edge): New 3996 function. 3997 (supergraph_call_edge): Use it when rejecting edges without 3998 functions. 3999 (supergraph::supergraph): Use it to get the function for the 4000 cgraph_edge when building interprocedural superedges. 4001 (callgraph_superedge::get_callee_function): Use it. 4002 * supergraph.h (supergraph::get_num_snodes): Make param const. 4003 (supergraph::function_to_num_snodes_t): Make first type param 4004 const. 4005 40062020-02-11 David Malcolm <dmalcolm@redhat.com> 4007 4008 PR analyzer/93374 4009 * engine.cc (exploded_edge::exploded_edge): Add ext_state param 4010 and pass it to change.validate. 4011 (exploded_graph::get_or_create_node): Move purging of change 4012 svalues to also cover the case of reusing an existing enode. 4013 (exploded_graph::add_edge): Pass m_ext_state to exploded_edge's 4014 ctor. 4015 * exploded-graph.h (exploded_edge::exploded_edge): Add ext_state 4016 param. 4017 * program-state.cc (state_change::sm_change::validate): Likewise. 4018 Assert that m_sm_idx is sane. Use ext_state to validate 4019 m_old_state and m_new_state. 4020 (state_change::validate): Add ext_state param and pass it to 4021 the sm_change validate calls. 4022 * program-state.h (state_change::sm_change::validate): Add 4023 ext_state param. 4024 (state_change::validate): Likewise. 4025 40262020-02-11 David Malcolm <dmalcolm@redhat.com> 4027 4028 PR analyzer/93669 4029 * engine.cc (exploded_graph::dump_exploded_nodes): Handle missing 4030 case of STATUS_WORKLIST in implementation of 4031 "__analyzer_dump_exploded_nodes". 4032 40332020-02-11 David Malcolm <dmalcolm@redhat.com> 4034 4035 PR analyzer/93649 4036 * constraint-manager.cc (constraint_manager::add_constraint): When 4037 merging equivalence classes and updating m_constant, also update 4038 m_cst_sid. 4039 (constraint_manager::validate): If m_constant is non-NULL assert 4040 that m_cst_sid is non-null and is valid. 4041 40422020-02-11 David Malcolm <dmalcolm@redhat.com> 4043 4044 PR analyzer/93657 4045 * analyzer.opt (fdump-analyzer): Reword description. 4046 (fdump-analyzer-stderr): Likewise. 4047 40482020-02-11 David Malcolm <dmalcolm@redhat.com> 4049 4050 * region-model.cc (print_quoted_type): New function. 4051 (svalue::print): Use it to replace %qT. 4052 (region::dump_to_pp): Likewise. 4053 (region::dump_child_label): Likewise. 4054 (region::print_fields): Likewise. 4055 40562020-02-10 David Malcolm <dmalcolm@redhat.com> 4057 4058 PR analyzer/93659 4059 * analyzer.opt (-param=analyzer-max-recursion-depth=): Fix "tha" 4060 -> "that" typo. 4061 (Wanalyzer-use-of-uninitialized-value): Fix "initialized" -> 4062 "uninitialized" typo. 4063 40642020-02-10 David Malcolm <dmalcolm@redhat.com> 4065 4066 PR analyzer/93350 4067 * region-model.cc (region_model::get_lvalue_1): 4068 Handle BIT_FIELD_REF. 4069 (make_region_for_type): Handle VECTOR_TYPE. 4070 40712020-02-10 David Malcolm <dmalcolm@redhat.com> 4072 4073 PR analyzer/93647 4074 * diagnostic-manager.cc 4075 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof against 4076 VAR being constant. 4077 * region-model.cc (region_model::get_lvalue_1): Provide a better 4078 error message when encountering an unhandled tree code. 4079 40802020-02-10 David Malcolm <dmalcolm@redhat.com> 4081 4082 PR analyzer/93405 4083 * region-model.cc (region_model::get_lvalue_1): Implement 4084 CONST_DECL. 4085 40862020-02-06 David Malcolm <dmalcolm@redhat.com> 4087 4088 * region-model.cc (region_model::maybe_cast_1): Attempt to provide 4089 a region_svalue if either type is a pointer, rather than if both 4090 types are pointers. 4091 40922020-02-05 David Malcolm <dmalcolm@redhat.com> 4093 4094 * engine.cc (exploded_node::dump_dot): Show merger enodes. 4095 (worklist::add_node): Assert that the node's m_status is 4096 STATUS_WORKLIST. 4097 (exploded_graph::process_worklist): Likewise for nodes from the 4098 worklist. Set status of merged nodes to STATUS_MERGER. 4099 (exploded_graph::process_node): Set status of node to 4100 STATUS_PROCESSED. 4101 (exploded_graph::dump_exploded_nodes): Rework handling of 4102 "__analyzer_dump_exploded_nodes", splitting enodes by status into 4103 "processed" and "merger", showing the count of just the processed 4104 enodes at the call, rather than the count of all enodes. 4105 * exploded-graph.h (exploded_node::status): New enum. 4106 (exploded_node::exploded_node): Initialize m_status to 4107 STATUS_WORKLIST. 4108 (exploded_node::get_status): New getter. 4109 (exploded_node::set_status): New setter. 4110 41112020-02-04 David Malcolm <dmalcolm@redhat.com> 4112 4113 PR analyzer/93543 4114 * engine.cc (pod_hash_traits<function_call_string>::mark_empty): 4115 Eliminate reinterpret_cast. 4116 (pod_hash_traits<function_call_string>::is_empty): Likewise. 4117 41182020-02-03 David Malcolm <dmalcolm@redhat.com> 4119 4120 * constraint-manager.cc (range::constrained_to_single_element): 4121 Replace fold_build2 with fold_binary. Remove unnecessary newline. 4122 (constraint_manager::get_or_add_equiv_class): Replace fold_build2 4123 with fold_binary in two places, and remove out-of-date comment. 4124 (constraint_manager::eval_condition): Replace fold_build2 with 4125 fold_binary. 4126 * region-model.cc (constant_svalue::eval_condition): Likewise. 4127 (region_model::on_assignment): Likewise. 4128 41292020-02-03 David Malcolm <dmalcolm@redhat.com> 4130 4131 PR analyzer/93544 4132 * diagnostic-manager.cc 4133 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof 4134 against bad choices due to bad paths. 4135 * engine.cc (impl_region_model_context::on_phi): New. 4136 * exploded-graph.h (impl_region_model_context::on_phi): New decl. 4137 * region-model.cc (region_model::on_longjmp): Likewise. 4138 (region_model::handle_phi): Add phi param. Call the ctxt's on_phi 4139 vfunc. 4140 (region_model::update_for_phis): Pass phi to handle_phi. 4141 * region-model.h (region_model::handle_phi): Add phi param. 4142 (region_model_context::on_phi): New vfunc. 4143 (test_region_model_context::on_phi): New. 4144 * sm-malloc.cc (malloc_state_machine::on_phi): New. 4145 (malloc_state_machine::on_zero_assignment): New. 4146 * sm.h (state_machine::on_phi): New vfunc. 4147 41482020-02-03 David Malcolm <dmalcolm@redhat.com> 4149 4150 * engine.cc (supernode_cluster::dump_dot): Show BB index as 4151 well as SN index. 4152 * supergraph.cc (supernode::dump_dot): Likewise. 4153 41542020-02-03 David Malcolm <dmalcolm@redhat.com> 4155 4156 PR analyzer/93546 4157 * region-model.cc (region_model::on_call_pre): Update for new 4158 param of symbolic_region ctor. 4159 (region_model::deref_rvalue): Likewise. 4160 (region_model::add_new_malloc_region): Likewise. 4161 (make_region_for_type): Likewise, preserving type. 4162 * region-model.h (symbolic_region::symbolic_region): Add "type" 4163 param and pass it to base class ctor. 4164 41652020-02-03 David Malcolm <dmalcolm@redhat.com> 4166 4167 PR analyzer/93547 4168 * constraint-manager.cc 4169 (constraint_manager::get_or_add_equiv_class): Ensure types are 4170 compatible before comparing constants. 4171 41722020-01-31 David Malcolm <dmalcolm@redhat.com> 4173 4174 PR analyzer/93457 4175 * region-model.cc (make_region_for_type): Use VOID_TYPE_P rather 4176 than checking against void_type_node. 4177 41782020-01-31 David Malcolm <dmalcolm@redhat.com> 4179 4180 PR analyzer/93373 4181 * region-model.cc (ASSERT_COMPAT_TYPES): Convert to... 4182 (assert_compat_types): ...this, and bail when either type is NULL, 4183 or when VOID_TYPE_P (dst_type). 4184 (region_model::get_lvalue): Update for above conversion. 4185 (region_model::get_rvalue): Likewise. 4186 41872020-01-31 David Malcolm <dmalcolm@redhat.com> 4188 4189 PR analyzer/93379 4190 * region-model.cc (region_model::update_for_return_superedge): 4191 Move check for null result so that it also guards setting the 4192 lhs. 4193 41942020-01-31 David Malcolm <dmalcolm@redhat.com> 4195 4196 PR analyzer/93438 4197 * region-model.cc (stack_region::can_merge_p): Split into a two 4198 pass approach, creating all stack regions first, then populating 4199 them. 4200 (selftest::test_state_merging): Add test coverage for (a) the case 4201 of self-merging a model in which a local in an older stack frame 4202 points to a local in a more recent stack frame (which previously 4203 would ICE), and (b) the case of self-merging a model in which a 4204 local points to a global (which previously worked OK). 4205 42062020-01-31 David Malcolm <dmalcolm@redhat.com> 4207 4208 * analyzer.cc (is_named_call_p): Replace tests for fndecl being 4209 extern at file scope and having a non-NULL DECL_NAME with a call 4210 to maybe_special_function_p. 4211 * function-set.cc (function_set::contains_decl_p): Add call to 4212 maybe_special_function_p. 4213 42142020-01-31 David Malcolm <dmalcolm@redhat.com> 4215 4216 PR analyzer/93450 4217 * constraint-manager.cc 4218 (constraint_manager::get_or_add_equiv_class): Only compare constants 4219 if their types are compatible. 4220 * region-model.cc (constant_svalue::eval_condition): Replace check 4221 for identical types with call to types_compatible_p. 4222 42232020-01-30 David Malcolm <dmalcolm@redhat.com> 4224 4225 * program-state.cc (extrinsic_state::dump_to_pp): New. 4226 (extrinsic_state::dump_to_file): New. 4227 (extrinsic_state::dump): New. 4228 * program-state.h (extrinsic_state::dump_to_pp): New decl. 4229 (extrinsic_state::dump_to_file): New decl. 4230 (extrinsic_state::dump): New decl. 4231 * sm.cc: Include "pretty-print.h". 4232 (state_machine::dump_to_pp): New. 4233 * sm.h (state_machine::dump_to_pp): New decl. 4234 42352020-01-30 David Malcolm <dmalcolm@redhat.com> 4236 4237 * diagnostic-manager.cc (for_each_state_change): Use 4238 extrinsic_state::get_num_checkers rather than accessing m_checkers 4239 directly. 4240 * program-state.cc (program_state::program_state): Likewise. 4241 * program-state.h (extrinsic_state::m_checkers): Make private. 4242 42432020-01-30 David Malcolm <dmalcolm@redhat.com> 4244 4245 PR analyzer/93356 4246 * region-model.cc (region_model::eval_condition): In both 4247 overloads, bail out immediately on floating-point types. 4248 (region_model::eval_condition_without_cm): Likewise. 4249 (region_model::add_constraint): Likewise. 4250 42512020-01-30 David Malcolm <dmalcolm@redhat.com> 4252 4253 PR analyzer/93450 4254 * program-state.cc (sm_state_map::set_state): For the overload 4255 taking an svalue_id, bail out if the set_state on the ec does 4256 nothing. Convert the latter's return type from void to bool, 4257 returning true if anything changed. 4258 (sm_state_map::impl_set_state): Convert the return type from void 4259 to bool, returning true if the state changed. 4260 * program-state.h (sm_state_map::set_state): Convert return type 4261 from void to bool. 4262 (sm_state_map::impl_set_state): Likewise. 4263 * region-model.cc (constant_svalue::eval_condition): Only call 4264 fold_build2 if the types are the same. 4265 42662020-01-29 Jakub Jelinek <jakub@redhat.com> 4267 4268 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Remove. 4269 * constraint-manager.cc: Include diagnostic-core.h before graphviz.h. 4270 (range::dump, equiv_class::print): Don't use PUSH_IGNORE_WFORMAT or 4271 POP_IGNORE_WFORMAT. 4272 * state-purge.cc: Include diagnostic-core.h before 4273 gimple-pretty-print.h. 4274 (state_purge_annotator::add_node_annotations, print_vec_of_names): 4275 Don't use PUSH_IGNORE_WFORMAT or POP_IGNORE_WFORMAT. 4276 * region-model.cc: Move diagnostic-core.h include before graphviz.h. 4277 (path_var::dump, svalue::print, constant_svalue::print_details, 4278 region::dump_to_pp, region::dump_child_label, region::print_fields, 4279 map_region::print_fields, map_region::dump_dot_to_pp, 4280 map_region::dump_child_label, array_region::print_fields, 4281 array_region::dump_dot_to_pp): Don't use PUSH_IGNORE_WFORMAT or 4282 POP_IGNORE_WFORMAT. 4283 42842020-01-28 David Malcolm <dmalcolm@redhat.com> 4285 4286 PR analyzer/93316 4287 * engine.cc (rewind_info_t::update_model): Get the longjmp call 4288 stmt via get_longjmp_call () rather than assuming it is the last 4289 stmt in the longjmp's supernode. 4290 (rewind_info_t::add_events_to_path): Get the location_t for the 4291 rewind_from_longjmp_event via get_longjmp_call () rather than from 4292 the supernode's get_end_location (). 4293 42942020-01-28 David Malcolm <dmalcolm@redhat.com> 4295 4296 * region-model.cc (poisoned_value_diagnostic::emit): Update for 4297 renaming of warning_at overload to warning_meta. 4298 * sm-file.cc (file_leak::emit): Likewise. 4299 * sm-malloc.cc (double_free::emit): Likewise. 4300 (possible_null_deref::emit): Likewise. 4301 (possible_null_arg::emit): Likewise. 4302 (null_deref::emit): Likewise. 4303 (null_arg::emit): Likewise. 4304 (use_after_free::emit): Likewise. 4305 (malloc_leak::emit): Likewise. 4306 (free_of_non_heap::emit): Likewise. 4307 * sm-sensitive.cc (exposure_through_output_file::emit): Likewise. 4308 * sm-signal.cc (signal_unsafe_call::emit): Likewise. 4309 * sm-taint.cc (tainted_array_index::emit): Likewise. 4310 43112020-01-27 David Malcolm <dmalcolm@redhat.com> 4312 4313 PR analyzer/93451 4314 * region-model.cc (tree_cmp): For the REAL_CST case, impose an 4315 arbitrary order on NaNs relative to other NaNs and to non-NaNs; 4316 const-correctness tweak. 4317 (ana::selftests::build_real_cst_from_string): New function. 4318 (ana::selftests::append_interesting_constants): New function. 4319 (ana::selftests::test_tree_cmp_on_constants): New test. 4320 (ana::selftests::test_canonicalization_4): New test. 4321 (ana::selftests::analyzer_region_model_cc_tests): Call the new 4322 tests. 4323 43242020-01-27 David Malcolm <dmalcolm@redhat.com> 4325 4326 PR analyzer/93349 4327 * engine.cc (run_checkers): Save and restore input_location. 4328 43292020-01-27 David Malcolm <dmalcolm@redhat.com> 4330 4331 * call-string.cc (call_string::cmp_1): Delete, moving body to... 4332 (call_string::cmp): ...here. 4333 * call-string.h (call_string::cmp_1): Delete decl. 4334 * engine.cc (worklist::key_t::cmp_1): Delete, moving body to... 4335 (worklist::key_t::cmp): ...here. Implement hash comparisons 4336 via comparison rather than subtraction to avoid overflow issues. 4337 * exploded-graph.h (worklist::key_t::cmp_1): Delete decl. 4338 * region-model.cc (tree_cmp): Eliminate buggy checking for 4339 symmetry. 4340 43412020-01-27 David Malcolm <dmalcolm@redhat.com> 4342 4343 * analyzer.cc (is_named_call_p): Check that fndecl is "extern" 4344 and at file scope. Potentially disregard prefix _ or __ in 4345 fndecl's name. Bail if the identifier is NULL. 4346 (is_setjmp_call_p): Expect a gcall rather than plain gimple. 4347 Remove special-case check for leading prefix, and also check for 4348 sigsetjmp. 4349 (is_longjmp_call_p): Also check for siglongjmp. 4350 (get_user_facing_name): New function. 4351 * analyzer.h (is_setjmp_call_p): Expect a gcall rather than plain 4352 gimple. 4353 (get_user_facing_name): New decl. 4354 * checker-path.cc (setjmp_event::get_desc): Use 4355 get_user_facing_name to avoid hardcoding the function name. 4356 (rewind_event::rewind_event): Add rewind_info param, using it to 4357 initialize new m_rewind_info field, and strengthen the assertion. 4358 (rewind_from_longjmp_event::get_desc): Use get_user_facing_name to 4359 avoid hardcoding the function name. 4360 (rewind_to_setjmp_event::get_desc): Likewise. 4361 * checker-path.h (setjmp_event::setjmp_event): Add setjmp_call 4362 param and use it to initialize... 4363 (setjmp_event::m_setjmp_call): New field. 4364 (rewind_event::rewind_event): Add rewind_info param. 4365 (rewind_event::m_rewind_info): New protected field. 4366 (rewind_from_longjmp_event::rewind_from_longjmp_event): Add 4367 rewind_info param. 4368 (class rewind_to_setjmp_event): Move rewind_info field to parent 4369 class. 4370 * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge): 4371 Update setjmp-handling for is_setjmp_call_p requiring a gcall; 4372 pass the call to the new setjmp_event. 4373 * engine.cc (exploded_node::on_stmt): Update for is_setjmp_call_p 4374 requiring a gcall. 4375 (stale_jmp_buf::emit): Use get_user_facing_name to avoid 4376 hardcoding the function names. 4377 (exploded_node::on_longjmp): Pass the longjmp_call when 4378 constructing rewind_info. 4379 (rewind_info_t::add_events_to_path): Pass the rewind_info_t to the 4380 rewind_from_longjmp_event's ctor. 4381 * exploded-graph.h (rewind_info_t::rewind_info_t): Add 4382 longjmp_call param. 4383 (rewind_info_t::get_longjmp_call): New. 4384 (rewind_info_t::m_longjmp_call): New. 4385 * region-model.cc (region_model::on_setjmp): Update comment to 4386 indicate this is also for sigsetjmp. 4387 * region-model.h (struct setjmp_record): Likewise. 4388 (class setjmp_svalue): Likewise. 4389 43902020-01-27 David Malcolm <dmalcolm@redhat.com> 4391 4392 PR analyzer/93276 4393 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Guard these 4394 macros with GCC_VERSION >= 4006, making them no-op otherwise. 4395 * engine.cc (exploded_edge::exploded_edge): Specify template for 4396 base class initializer. 4397 (exploded_graph::add_edge): Specify template when chaining up to 4398 base class add_edge implementation. 4399 (viz_callgraph_node::dump_dot): Drop redundant "typename". 4400 (viz_callgraph_edge::viz_callgraph_edge): Specify template for 4401 base class initializer. 4402 * program-state.cc (sm_state_map::clone_with_remapping): Drop 4403 redundant "typename". 4404 (sm_state_map::print): Likewise. 4405 (sm_state_map::hash): Likewise. 4406 (sm_state_map::operator==): Likewise. 4407 (sm_state_map::remap_svalue_ids): Likewise. 4408 (sm_state_map::on_svalue_purge): Likewise. 4409 (sm_state_map::validate): Likewise. 4410 * program-state.h (sm_state_map::iterator_t): Likewise. 4411 * supergraph.h (superedge::superedge): Specify template for base 4412 class initializer. 4413 44142020-01-23 David Malcolm <dmalcolm@redhat.com> 4415 4416 PR analyzer/93375 4417 * supergraph.cc (callgraph_superedge::get_arg_for_parm): Fail 4418 gracefully is the number of parameters at the callee exceeds the 4419 number of arguments at the call stmt. 4420 (callgraph_superedge::get_parm_for_arg): Likewise. 4421 44222020-01-22 David Malcolm <dmalcolm@redhat.com> 4423 4424 PR analyzer/93382 4425 * program-state.cc (sm_state_map::on_svalue_purge): If the 4426 entry survives, but the origin is being purged, then reset the 4427 origin to null. 4428 44292020-01-22 David Malcolm <dmalcolm@redhat.com> 4430 4431 * sm-signal.cc: Fix nesting of CHECKING_P and namespace ana. 4432 44332020-01-22 David Malcolm <dmalcolm@redhat.com> 4434 4435 PR analyzer/93378 4436 * engine.cc (setjmp_svalue::compare_fields): Update for 4437 replacement of m_enode with m_setjmp_record. 4438 (setjmp_svalue::add_to_hash): Likewise. 4439 (setjmp_svalue::get_index): Rename... 4440 (setjmp_svalue::get_enode_index): ...to this. 4441 (setjmp_svalue::print_details): Update for replacement of m_enode 4442 with m_setjmp_record. 4443 (exploded_node::on_longjmp): Likewise. 4444 * exploded-graph.h (rewind_info_t::m_enode_origin): Replace... 4445 (rewind_info_t::m_setjmp_record): ...with this. 4446 (rewind_info_t::rewind_info_t): Update for replacement of m_enode 4447 with m_setjmp_record. 4448 (rewind_info_t::get_setjmp_point): Likewise. 4449 (rewind_info_t::get_setjmp_call): Likewise. 4450 * region-model.cc (region_model::dump_summary_of_map): Likewise. 4451 (region_model::on_setjmp): Likewise. 4452 * region-model.h (struct setjmp_record): New struct. 4453 (setjmp_svalue::m_enode): Replace... 4454 (setjmp_svalue::m_setjmp_record): ...with this. 4455 (setjmp_svalue::setjmp_svalue): Update for replacement of m_enode 4456 with m_setjmp_record. 4457 (setjmp_svalue::clone): Likewise. 4458 (setjmp_svalue::get_index): Rename... 4459 (setjmp_svalue::get_enode_index): ...to this. 4460 (setjmp_svalue::get_exploded_node): Replace... 4461 (setjmp_svalue::get_setjmp_record): ...with this. 4462 44632020-01-22 David Malcolm <dmalcolm@redhat.com> 4464 4465 PR analyzer/93316 4466 * analyzer.cc (is_setjmp_call_p): Check for "setjmp" as well as 4467 "_setjmp". 4468 44692020-01-22 David Malcolm <dmalcolm@redhat.com> 4470 4471 PR analyzer/93307 4472 * analysis-plan.h: Wrap everything namespace "ana". 4473 * analyzer-logging.cc: Likewise. 4474 * analyzer-logging.h: Likewise. 4475 * analyzer-pass.cc (pass_analyzer::execute): Update for "ana" 4476 namespace. 4477 * analyzer-selftests.cc: Wrap everything namespace "ana". 4478 * analyzer-selftests.h: Likewise. 4479 * analyzer.h: Likewise for forward decls of types. 4480 * call-string.h: Likewise. 4481 * checker-path.cc: Likewise. 4482 * checker-path.h: Likewise. 4483 * constraint-manager.cc: Likewise. 4484 * constraint-manager.h: Likewise. 4485 * diagnostic-manager.cc: Likewise. 4486 * diagnostic-manager.h: Likewise. 4487 * engine.cc: Likewise. 4488 * engine.h: Likewise. 4489 * exploded-graph.h: Likewise. 4490 * function-set.cc: Likewise. 4491 * function-set.h: Likewise. 4492 * pending-diagnostic.cc: Likewise. 4493 * pending-diagnostic.h: Likewise. 4494 * program-point.cc: Likewise. 4495 * program-point.h: Likewise. 4496 * program-state.cc: Likewise. 4497 * program-state.h: Likewise. 4498 * region-model.cc: Likewise. 4499 * region-model.h: Likewise. 4500 * sm-file.cc: Likewise. 4501 * sm-malloc.cc: Likewise. 4502 * sm-pattern-test.cc: Likewise. 4503 * sm-sensitive.cc: Likewise. 4504 * sm-signal.cc: Likewise. 4505 * sm-taint.cc: Likewise. 4506 * sm.cc: Likewise. 4507 * sm.h: Likewise. 4508 * state-purge.h: Likewise. 4509 * supergraph.cc: Likewise. 4510 * supergraph.h: Likewise. 4511 45122020-01-21 David Malcolm <dmalcolm@redhat.com> 4513 4514 PR analyzer/93352 4515 * region-model.cc (int_cmp): Rename to... 4516 (array_region::key_cmp): ...this, using key_t rather than int. 4517 Rewrite in terms of comparisons rather than subtraction to 4518 ensure qsort is anti-symmetric when handling extreme values. 4519 (array_region::walk_for_canonicalization): Update for above 4520 renaming. 4521 * region-model.h (array_region::key_cmp): New decl. 4522 45232020-01-17 David Malcolm <dmalcolm@redhat.com> 4524 4525 PR analyzer/93290 4526 * region-model.cc (region_model::eval_condition_without_cm): Avoid 4527 gcc_unreachable for unexpected operations for the case where 4528 we're comparing an svalue against itself. 4529 45302020-01-17 David Malcolm <dmalcolm@redhat.com> 4531 4532 PR analyzer/93281 4533 * region-model.cc 4534 (region_model::convert_byte_offset_to_array_index): Convert to 4535 ssizetype before dividing by byte_size. Use fold_binary rather 4536 than fold_build2 to avoid needlessly constructing a tree for the 4537 non-const case. 4538 45392020-01-15 David Malcolm <dmalcolm@redhat.com> 4540 4541 * engine.cc (class impl_region_model_context): Fix comment. 4542 45432020-01-14 David Malcolm <dmalcolm@redhat.com> 4544 4545 PR analyzer/93212 4546 * region-model.cc (make_region_for_type): Use 4547 FUNC_OR_METHOD_TYPE_P rather than comparing against FUNCTION_TYPE. 4548 * region-model.h (function_region::function_region): Likewise. 4549 45502020-01-14 David Malcolm <dmalcolm@redhat.com> 4551 4552 * program-state.cc (sm_state_map::clone_with_remapping): Copy 4553 m_global_state. 4554 (selftest::test_program_state_merging_2): New selftest. 4555 (selftest::analyzer_program_state_cc_tests): Call it. 4556 45572020-01-14 David Malcolm <dmalcolm@redhat.com> 4558 4559 * checker-path.h (checker_path::get_checker_event): New function. 4560 (checker_path): Add DISABLE_COPY_AND_ASSIGN; make fields private. 4561 * diagnostic-manager.cc 4562 (diagnostic_manager::prune_for_sm_diagnostic): Replace direct 4563 access to checker_path::m_events with accessor functions. Fix 4564 overlong line. 4565 (diagnostic_manager::prune_interproc_events): Replace direct 4566 access to checker_path::m_events with accessor functions. 4567 (diagnostic_manager::finish_pruning): Likewise. 4568 45692020-01-14 David Malcolm <dmalcolm@redhat.com> 4570 4571 * checker-path.h (checker_event::clone): Delete vfunc decl. 4572 (debug_event::clone): Delete vfunc impl. 4573 (custom_event::clone): Delete vfunc impl. 4574 (statement_event::clone): Delete vfunc impl. 4575 (function_entry_event::clone): Delete vfunc impl. 4576 (state_change_event::clone): Delete vfunc impl. 4577 (start_cfg_edge_event::clone): Delete vfunc impl. 4578 (end_cfg_edge_event::clone): Delete vfunc impl. 4579 (call_event::clone): Delete vfunc impl. 4580 (return_event::clone): Delete vfunc impl. 4581 (setjmp_event::clone): Delete vfunc impl. 4582 (rewind_from_longjmp_event::clone): Delete vfunc impl. 4583 (rewind_to_setjmp_event::clone): Delete vfunc impl. 4584 (warning_event::clone): Delete vfunc impl. 4585 45862020-01-14 David Malcolm <dmalcolm@redhat.com> 4587 4588 * supergraph.cc (supernode::dump_dot): Ensure that the TABLE 4589 element has at least one TR. 4590 45912020-01-14 David Malcolm <dmalcolm@redhat.com> 4592 4593 PR analyzer/58237 4594 * engine.cc (leak_stmt_finder::find_stmt): Use get_pure_location 4595 when comparing against UNKNOWN_LOCATION. 4596 (stmt_requires_new_enode_p): Likewise. 4597 (exploded_graph::dump_exploded_nodes): Likewise. 4598 * supergraph.cc (supernode::get_start_location): Likewise. 4599 (supernode::get_end_location): Likewise. 4600 46012020-01-14 David Malcolm <dmalcolm@redhat.com> 4602 4603 PR analyzer/58237 4604 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call 4605 selftest::analyzer_sm_file_cc_tests. 4606 * analyzer-selftests.h (selftest::analyzer_sm_file_cc_tests): New 4607 decl. 4608 * sm-file.cc: Include "analyzer/function-set.h" and 4609 "analyzer/analyzer-selftests.h". 4610 (get_file_using_fns): New function. 4611 (is_file_using_fn_p): New function. 4612 (fileptr_state_machine::on_stmt): Return true for known functions. 4613 (selftest::analyzer_sm_file_cc_tests): New function. 4614 46152020-01-14 David Malcolm <dmalcolm@redhat.com> 4616 4617 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call 4618 selftest::analyzer_sm_signal_cc_tests. 4619 * analyzer-selftests.h (selftest::analyzer_sm_signal_cc_tests): 4620 New decl. 4621 * sm-signal.cc: Include "analyzer/function-set.h" and 4622 "analyzer/analyzer-selftests.h". 4623 (get_async_signal_unsafe_fns): New function. 4624 (signal_unsafe_p): Reimplement in terms of the above. 4625 (selftest::analyzer_sm_signal_cc_tests): New function. 4626 46272020-01-14 David Malcolm <dmalcolm@redhat.com> 4628 4629 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call 4630 selftest::analyzer_function_set_cc_tests. 4631 * analyzer-selftests.h (selftest::analyzer_function_set_cc_tests): 4632 New decl. 4633 * function-set.cc: New file. 4634 * function-set.h: New file. 4635 46362020-01-14 David Malcolm <dmalcolm@redhat.com> 4637 4638 * analyzer.h (fndecl_has_gimple_body_p): New decl. 4639 * engine.cc (impl_region_model_context::on_unknown_change): New 4640 function. 4641 (fndecl_has_gimple_body_p): Make non-static. 4642 (exploded_node::on_stmt): Treat __analyzer_dump_exploded_nodes as 4643 known. Track whether we have a call with unknown side-effects and 4644 pass it to on_call_post. 4645 * exploded-graph.h (impl_region_model_context::on_unknown_change): 4646 New decl. 4647 * program-state.cc (sm_state_map::on_unknown_change): New function. 4648 * program-state.h (sm_state_map::on_unknown_change): New decl. 4649 * region-model.cc: Include "bitmap.h". 4650 (region_model::on_call_pre): Return a bool, capturing whether the 4651 call has unknown side effects. 4652 (region_model::on_call_post): Add arg "bool unknown_side_effects" 4653 and if true, call handle_unrecognized_call. 4654 (class reachable_regions): New class. 4655 (region_model::handle_unrecognized_call): New function. 4656 * region-model.h (region_model::on_call_pre): Return a bool. 4657 (region_model::on_call_post): Add arg "bool unknown_side_effects". 4658 (region_model::handle_unrecognized_call): New decl. 4659 (region_model_context::on_unknown_change): New vfunc. 4660 (test_region_model_context::on_unknown_change): New function. 4661 46622020-01-14 David Malcolm <dmalcolm@redhat.com> 4663 4664 * diagnostic-manager.cc (saved_diagnostic::operator==): Move here 4665 from header. Replace pointer equality test on m_var with call to 4666 pending_diagnostic::same_tree_p. 4667 * diagnostic-manager.h (saved_diagnostic::operator==): Move to 4668 diagnostic-manager.cc. 4669 * pending-diagnostic.cc (pending_diagnostic::same_tree_p): New. 4670 * pending-diagnostic.h (pending_diagnostic::same_tree_p): New. 4671 * sm-file.cc (file_diagnostic::subclass_equal_p): Replace pointer 4672 equality on m_arg with call to pending_diagnostic::same_tree_p. 4673 * sm-malloc.cc (malloc_diagnostic::subclass_equal_p): Likewise. 4674 (possible_null_arg::subclass_equal_p): Likewise. 4675 (null_arg::subclass_equal_p): Likewise. 4676 (free_of_non_heap::subclass_equal_p): Likewise. 4677 * sm-pattern-test.cc (pattern_match::operator==): Likewise. 4678 * sm-sensitive.cc (exposure_through_output_file::operator==): 4679 Likewise. 4680 * sm-taint.cc (tainted_array_index::operator==): Likewise. 4681 46822020-01-14 David Malcolm <dmalcolm@redhat.com> 4683 4684 * diagnostic-manager.cc (dedupe_winners::add): Add logging 4685 of deduplication decisions made. 4686 46872020-01-14 David Malcolm <dmalcolm@redhat.com> 4688 4689 * ChangeLog: New file. 4690 * analyzer-selftests.cc: New file. 4691 * analyzer-selftests.h: New file. 4692 * analyzer.opt: New file. 4693 * analysis-plan.cc: New file. 4694 * analysis-plan.h: New file. 4695 * analyzer-logging.cc: New file. 4696 * analyzer-logging.h: New file. 4697 * analyzer-pass.cc: New file. 4698 * analyzer.cc: New file. 4699 * analyzer.h: New file. 4700 * call-string.cc: New file. 4701 * call-string.h: New file. 4702 * checker-path.cc: New file. 4703 * checker-path.h: New file. 4704 * constraint-manager.cc: New file. 4705 * constraint-manager.h: New file. 4706 * diagnostic-manager.cc: New file. 4707 * diagnostic-manager.h: New file. 4708 * engine.cc: New file. 4709 * engine.h: New file. 4710 * exploded-graph.h: New file. 4711 * pending-diagnostic.cc: New file. 4712 * pending-diagnostic.h: New file. 4713 * program-point.cc: New file. 4714 * program-point.h: New file. 4715 * program-state.cc: New file. 4716 * program-state.h: New file. 4717 * region-model.cc: New file. 4718 * region-model.h: New file. 4719 * sm-file.cc: New file. 4720 * sm-malloc.cc: New file. 4721 * sm-malloc.dot: New file. 4722 * sm-pattern-test.cc: New file. 4723 * sm-sensitive.cc: New file. 4724 * sm-signal.cc: New file. 4725 * sm-taint.cc: New file. 4726 * sm.cc: New file. 4727 * sm.h: New file. 4728 * state-purge.cc: New file. 4729 * state-purge.h: New file. 4730 * supergraph.cc: New file. 4731 * supergraph.h: New file. 4732 47332019-12-13 David Malcolm <dmalcolm@redhat.com> 4734 4735 * Initial creation 4736 4737 4738Copyright (C) 2019-2021 Free Software Foundation, Inc. 4739 4740Copying and distribution of this file, with or without modification, 4741are permitted in any medium without royalty provided the copyright 4742notice and this notice are preserved. 4743