| blob | d462497bb59e35bb428909513671cb83d258176a |
1 2024-07-24 David Malcolm <dmalcolm@redhat.com>
3 * checker-event.cc (maybe_add_sarif_properties): Update setting
4 of "original_fndecl" to use typesafe unique_ptr variant of
5 json::object::set.
7 2024-07-24 David Malcolm <dmalcolm@redhat.com>
9 * call-string.cc (call_string::to_json): Avoid naked "new".
10 * constraint-manager.cc (bounded_range::set_json_attr): Likewise.
11 (equiv_class::to_json): Likewise.
12 (constraint::to_json): Likewise.
13 (bounded_ranges_constraint::to_json): Likewise.
14 * diagnostic-manager.cc (saved_diagnostic::to_json): Likewise.
15 (saved_diagnostic::maybe_add_sarif_properties): Likewise.
16 * engine.cc (exploded_node::to_json): Likewise.
17 (exploded_edge::to_json): Likewise.
18 * program-point.cc (program_point::to_json): Likewise.
19 * program-state.cc (program_state::to_json): Likewise.
20 * sm.cc (state_machine::to_json): Likewise.
21 * store.cc (binding_cluster::to_json): Likewise.
22 (store::to_json): Likewise.
23 * supergraph.cc (supernode::to_json): Likewise.
24 (superedge::to_json): Likewise.
26 2024-07-24 David Malcolm <dmalcolm@redhat.com>
28 * supergraph.cc (supernode::to_json): Avoid naked "new" by using
29 json::array::append_string.
30 (supernode::to_json): Likewise.
32 2024-07-12 Daniel Bertalan <dani@danielbertalan.dev>
34 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
35 Change NULL to nullptr.
36 (struct null_assignment_sm_context): Likewise.
37 * infinite-loop.cc: Likewise.
38 * infinite-recursion.cc: Likewise.
39 * varargs.cc (va_list_state_machine::on_leak): Likewise.
41 2024-07-04 David Malcolm <dmalcolm@redhat.com>
43 * diagnostic-manager.cc
44 (diagnostic_manager::add_events_for_eedge): Pass sm_ctxt by
45 reference.
46 * engine.cc (impl_region_model_context::on_condition): Likewise.
47 (impl_region_model_context::on_bounded_ranges): Likewise.
48 (impl_region_model_context::on_phi): Likewise.
49 (exploded_node::on_stmt): Likewise.
50 * sm-fd.cc: Update all uses of sm_context * to sm_context &.
51 * sm-file.cc: Likewise.
52 * sm-malloc.cc: Likewise.
53 * sm-pattern-test.cc: Likewise.
54 * sm-sensitive.cc: Likewise.
55 * sm-signal.cc: Likewise.
56 * sm-taint.cc: Likewise.
57 * sm.h: Likewise.
58 * varargs.cc: Likewise.
60 2024-07-04 David Malcolm <dmalcolm@redhat.com>
62 PR analyzer/115724
63 * kf.cc (register_known_functions): Add __error_alias and
64 __error_at_line_alias.
66 2024-06-18 David Malcolm <dmalcolm@redhat.com>
68 * checker-event.h (checker_event::fndecl): Drop "final" and
69 "override", converting from a vfunc implementation to a plain
70 accessor.
71 * checker-path.cc (checker_path::same_function_p): New.
72 * checker-path.h (checker_path::same_function_p): New decl.
74 2024-06-18 David Malcolm <dmalcolm@redhat.com>
76 * checker-path.h: Include "simple-diagnostic-path.h".
78 2024-06-18 Jonathan Wakely <jwakely@redhat.com>
80 * constraint-manager.cc (equiv_class::make_dump_widget): Change
81 return type to match return value and do not use std::move on
82 return value.
83 (bounded_ranges_constraint::make_dump_widget): Likewise.
84 (constraint_manager::make_dump_widget): Likewise.
85 * constraint-manager.h (equiv_class::make_dump_widget): Change
86 return type.
87 (bounded_ranges_constraint::make_dump_widget): Likewise.
88 (constraint_manager::make_dump_widget): Likewise.
89 * program-state.cc (sm_state_map::make_dump_widget): Likewise.
90 (program_state::make_dump_widget): Likewise.
91 * program-state.h (sm_state_map::make_dump_widget): Likewise.
92 (program_state::make_dump_widget): Likewise.
93 * region-model.cc (region_to_value_map::make_dump_widget): Likewise.
94 (region_model::make_dump_widget): Likewise.
95 * region-model.h (region_to_value_map::make_dump_widget): Likewise.
96 (region_model::make_dump_widget): Likewise.
97 * region.cc (region::make_dump_widget): Likewise.
98 * region.h (region::make_dump_widget): Likewise.
99 * store.cc (binding_cluster::make_dump_widget): Likewise.
100 (store::make_dump_widget): Likewise.
101 * store.h (binding_cluster::make_dump_widget): Likewise.
102 (store::make_dump_widget): Likewise.
103 * svalue.cc (svalue::make_dump_widget): Likewise.
104 * svalue.h (svalue::make_dump_widget): Likewise.
106 2024-06-12 David Malcolm <dmalcolm@redhat.com>
108 * access-diagram.cc (access_range::dump): Update for fields of
109 pretty_printer becoming private.
110 * call-details.cc (call_details::dump): Likewise.
111 * call-summary.cc (call_summary::dump): Likewise.
112 (call_summary_replay::dump): Likewise.
113 * checker-event.cc (checker_event::debug): Likewise.
114 * constraint-manager.cc (range::dump): Likewise.
115 (bounded_range::dump): Likewise.
116 (constraint_manager::dump): Likewise.
117 * engine.cc (exploded_node::dump): Likewise.
118 (exploded_path::dump): Likewise.
119 (exploded_path::dump_to_file): Likewise.
120 * feasible-graph.cc (feasible_graph::dump_feasible_path): Likewise.
121 * program-point.cc (program_point::dump): Likewise.
122 * program-state.cc (extrinsic_state::dump_to_file): Likewise.
123 (sm_state_map::dump): Likewise.
124 (program_state::dump_to_file): Likewise.
125 * ranges.cc (symbolic_byte_offset::dump): Likewise.
126 (symbolic_byte_range::dump): Likewise.
127 * record-layout.cc (record_layout::dump): Likewise.
128 * region-model-reachability.cc (reachable_regions::dump): Likewise.
129 * region-model.cc (region_to_value_map::dump): Likewise.
130 (region_model::dump): Likewise.
131 (model_merger::dump): Likewise.
132 * region-model.h (one_way_id_map<T>::dump): Likewise.
133 * region.cc (region_offset::dump): Likewise.
134 (region::dump): Likewise.
135 * sm-malloc.cc (deallocator_set::dump): Likewise.
136 * store.cc (uncertainty_t::dump): Likewise.
137 (binding_key::dump): Likewise.
138 (bit_range::dump): Likewise.
139 (byte_range::dump): Likewise.
140 (binding_map::dump): Likewise.
141 (binding_cluster::dump): Likewise.
142 (store::dump): Likewise.
143 * supergraph.cc (supergraph::dump_dot_to_file): Likewise.
144 (superedge::dump): Likewise.
145 * svalue.cc (svalue::dump): Likewise.
147 2024-06-08 Roger Sayle <roger@nextmovesoftware.com>
149 * constraint-manager.cc (equiv_class::make_dump_widget): Use
150 std::move to return a std::unique_ptr.
151 (bounded_ranges_constraint::make_dump_widget): Likewise.
152 (constraint_manager::make_dump_widget): Likewise.
153 * program-state.cc (sm_state_map::make_dump_widget): Likewise.
154 (program_state::make_dump_widget): Likewise.
155 * region-model.cc (region_to_value_map::make_dump_widget): Likewise.
156 (region_model::make_dump_widget): Likewise.
157 * region.cc (region::make_dump_widget): Likewise.
158 * store.cc (binding_cluster::make_dump_widget): Likewise.
159 (store::make_dump_widget): Likewise.
160 * svalue.cc (svalue::make_dump_widget): Likewise.
162 2024-06-07 David Malcolm <dmalcolm@redhat.com>
164 * engine.cc (impl_region_model_context::on_state_leak): Pass nullptr
165 to get_representative_path_var.
166 * region-model.cc (region_model::get_representative_path_var_1):
167 Add logger param and use it in both overloads.
168 (region_model::get_representative_path_var): Likewise.
169 (region_model::get_representative_tree): Likewise.
170 (selftest::test_get_representative_path_var): Pass nullptr to
171 get_representative_path_var.
172 * region-model.h (region_model::get_representative_tree): Add
173 optional logger param to both overloads.
174 (region_model::get_representative_path_var): Add logger param to
175 both overloads.
176 (region_model::get_representative_path_var_1): Likewise.
177 * store.cc (binding_cluster::get_representative_path_vars): Add
178 logger param and use it.
179 (store::get_representative_path_vars): Likewise.
180 * store.h (binding_cluster::get_representative_path_vars): Add
181 logger param.
182 (store::get_representative_path_vars): Likewise.
184 2024-06-07 David Malcolm <dmalcolm@redhat.com>
186 * call-summary.cc
187 (call_summary_replay::convert_region_from_summary_1): Update
188 for removal of cast_region::m_original_region.
189 * region-model-manager.cc
190 (region_model_manager::get_or_create_initial_value): Likewise.
191 * region-model.cc (region_model::get_store_value): Likewise.
192 * region.cc (region::get_base_region): Likewise.
193 (region::descendent_of_p): Likewise.
194 (region::maybe_get_frame_region): Likewise.
195 (region::get_memory_space): Likewise.
196 (region::calc_offset): Likewise.
197 (cast_region::accept): Delete.
198 (cast_region::dump_to_pp): Update for removal of
199 cast_region::m_original_region.
200 (cast_region::add_dump_widget_children): Delete.
201 * region.h (struct cast_region::key_t): Rename "original_region"
202 to "parent".
203 (cast_region::cast_region): Likewise. Update for removal of
204 cast_region::m_original_region.
205 (cast_region::accept): Delete.
206 (cast_region::add_dump_widget_children): Delete.
207 (cast_region::get_original_region): Delete.
208 (cast_region::m_original_region): Delete.
209 * sm-taint.cc (region_model::check_region_for_taint): Remove
210 special-casing for RK_CAST.
212 2024-06-07 David Malcolm <dmalcolm@redhat.com>
214 PR analyzer/105892
215 * analyzer.opt (Wanalyzer-undefined-behavior-ptrdiff): New option.
216 * analyzer.opt.urls: Regenerate.
217 * region-model.cc (class undefined_ptrdiff_diagnostic): New.
218 (check_for_invalid_ptrdiff): New.
219 (region_model::get_gassign_result): Call it for POINTER_DIFF_EXPR.
221 2024-06-01 David Malcolm <dmalcolm@redhat.com>
223 PR analyzer/106203
224 * checker-event.h: Include "analyzer/event-loc-info.h".
225 (struct event_loc_info): Move to its own header file.
226 * diagnostic-manager.cc
227 (diagnostic_manager::emit_saved_diagnostic): Move creation of
228 event_loc_info here from add_final_event, and if we have a
229 stmt_finder, call its update_event_loc_info method.
230 * engine.cc (leak_stmt_finder::update_event_loc_info): New.
231 (exploded_node::detect_leaks): Likewise.
232 (exploded_node::detect_leaks): Pass nullptr as call_stmt arg to
233 region_model::pop_frame.
234 * event-loc-info.h: New file, with content taken from
235 checker-event.h.
236 * exploded-graph.h (stmt_finder::update_event_loc_info): New pure
237 virtual function.
238 * infinite-loop.cc (infinite_loop_diagnostic::add_final_event):
239 Update for change to vfunc signature.
240 * infinite-recursion.cc
241 (infinite_recursion_diagnostic::add_final_event): Likewise.
242 * pending-diagnostic.cc (pending_diagnostic::add_final_event):
243 Pass in the event_loc_info from the caller, rather than generating
244 it from a gimple stmt and enode.
245 * pending-diagnostic.h (pending_diagnostic::add_final_event):
246 Likewise.
247 * region-model.cc (region_model::on_longjmp): Pass nullptr as
248 call_stmt arg to region_model::pop_frame.
249 (region_model::update_for_return_gcall): Likewise, but pass
250 call_stmt.
251 (class caller_context): New.
252 (region_model::pop_frame): Add "call_stmt" argument. Use it
253 and the frame_region with a caller_context when setting
254 result_dst_reg's value so that any diagnostic is reported at the
255 call stmt in the caller.
256 (selftest::test_stack_frames): Pass nullptr as call_stmt arg to
257 region_model::pop_frame.
258 (selftest::test_alloca): Likewise.
259 * region-model.h (region_model::pop_frame): Add "call_stmt"
260 argument.
262 2024-05-30 David Malcolm <dmalcolm@redhat.com>
264 * infinite-loop.cc (looping_back_event::get_desc): Fix unused
265 parameter warning introduced by me in r15-636-g770657d02c986c.
267 2024-05-30 David Malcolm <dmalcolm@redhat.com>
269 * call-details.cc: Define INCLUDE_VECTOR.
270 * call-info.cc: Likewise.
271 * call-summary.cc: Likewise.
272 * checker-event.cc: Likewise.
273 * checker-path.cc: Likewise.
274 * complexity.cc: Likewise.
275 * constraint-manager.cc: Likewise.
276 (bounded_range::make_dump_widget): New.
277 (bounded_ranges::add_to_dump_widget): New.
278 (equiv_class::make_dump_widget): New.
279 (constraint::make_dump_widget): New.
280 (bounded_ranges_constraint::make_dump_widget): New.
281 (constraint_manager::make_dump_widget): New.
282 * constraint-manager.h (bounded_range::make_dump_widget): New
283 decl.
284 (bounded_ranges::add_to_dump_widget): New decl.
285 (equiv_class::make_dump_widget): New decl.
286 (constraint::make_dump_widget): New decl.
287 (bounded_ranges_constraint::make_dump_widget): New decl.
288 (constraint_manager::make_dump_widget): New decl.
289 * diagnostic-manager.cc: Define INCLUDE_VECTOR.
290 * engine.cc: Likewise. Include "text-art/dump.h".
291 (setjmp_svalue::print_dump_widget_label): New.
292 (setjmp_svalue::add_dump_widget_children): New.
293 (exploded_graph::dump_exploded_nodes): Use text_art::dump_to_file
294 for -fdump-analyzer-exploded-nodes-2 and
295 -fdump-analyzer-exploded-nodes-3. Fix overlong line.
296 * feasible-graph.cc: Define INCLUDE_VECTOR.
297 * infinite-recursion.cc: Likewise.
298 * kf-analyzer.cc: Likewise.
299 * kf-lang-cp.cc: Likewise.
300 * kf.cc: Likewise.
301 * known-function-manager.cc: Likewise.
302 * pending-diagnostic.cc: Likewise.
303 * program-point.cc: Likewise.
304 * program-state.cc: Likewise. Include "text-art/tree-widget" and
305 "text-art/dump.h".
306 (sm_state_map::make_dump_widget): New.
307 (program_state::dump): New.
308 (program_state::make_dump_widget): New.
309 * program-state.h: Include "text-art/widget.h".
310 (sm_state_map::make_dump_widget): New decl.
311 (program_state::dump): New decl.
312 (program_state::make_dump_widget): New decl.
313 * ranges.cc: Define INCLUDE_VECTOR.
314 * record-layout.cc: Likewise.
315 * region-model-asm.cc: Likewise.
316 * region-model-manager.cc: Likewise.
317 * region-model-reachability.cc: Likewise.
318 * region-model.cc: Likewise. Include "text-art/tree-widget.h".
319 (region_to_value_map::make_dump_widget): New.
320 (region_model::dump): New.
321 (region_model::make_dump_widget): New.
322 (selftest::test_dump): Add test of dump_to_pp<region_model>.
323 * region-model.h: Include "text-art/widget.h" and
324 "text-art/dump.h".
325 (region_to_value_map::make_dump_widget): New decl.
326 (region_model::dump): New decl.
327 (region_model::make_dump_widget): New decl.
328 * region.cc: Define INCLUDE_VECTOR and include "text-art/dump.h".
329 (region::dump): New.
330 (region::make_dump_widget): New.
331 (region::add_dump_widget_children): New.
332 (frame_region::print_dump_widget_label): New.
333 (globals_region::print_dump_widget_label): New.
334 (code_region::print_dump_widget_label): New.
335 (function_region::print_dump_widget_label): New.
336 (label_region::print_dump_widget_label): New.
337 (stack_region::print_dump_widget_label): New.
338 (heap_region::print_dump_widget_label): New.
339 (root_region::print_dump_widget_label): New.
340 (thread_local_region::print_dump_widget_label): New.
341 (symbolic_region::print_dump_widget_label): New.
342 (symbolic_region::add_dump_widget_children): New.
343 (decl_region::print_dump_widget_label): New.
344 (field_region::print_dump_widget_label): New.
345 (element_region::print_dump_widget_label): New.
346 (element_region::add_dump_widget_children): New.
347 (offset_region::print_dump_widget_label): New.
348 (offset_region::add_dump_widget_children): New.
349 (sized_region::print_dump_widget_label): New.
350 (sized_region::add_dump_widget_children): New.
351 (cast_region::print_dump_widget_label): New.
352 (cast_region::add_dump_widget_children): New.
353 (heap_allocated_region::print_dump_widget_label): New.
354 (alloca_region::print_dump_widget_label): New.
355 (string_region::print_dump_widget_label): New.
356 (bit_range_region::print_dump_widget_label): New.
357 (var_arg_region::print_dump_widget_label): New.
358 (errno_region::print_dump_widget_label): New.
359 (private_region::print_dump_widget_label): New.
360 (unknown_region::print_dump_widget_label): New.
361 * region.h: Include "text-art/widget.h".
362 (region::dump): New decl.
363 (region::make_dump_widget): New decl.
364 (region::add_dump_widget_children): New decl.
365 (frame_region::print_dump_widget_label): New decl.
366 (globals_region::print_dump_widget_label): New decl.
367 (code_region::print_dump_widget_label): New decl.
368 (function_region::print_dump_widget_label): New decl.
369 (label_region::print_dump_widget_label): New decl.
370 (stack_region::print_dump_widget_label): New decl.
371 (heap_region::print_dump_widget_label): New decl.
372 (root_region::print_dump_widget_label): New decl.
373 (thread_local_region::print_dump_widget_label): New decl.
374 (symbolic_region::print_dump_widget_label): New decl.
375 (symbolic_region::add_dump_widget_children): New decl.
376 (decl_region::print_dump_widget_label): New decl.
377 (field_region::print_dump_widget_label): New decl.
378 (element_region::print_dump_widget_label): New decl.
379 (element_region::add_dump_widget_children): New decl.
380 (offset_region::print_dump_widget_label): New decl.
381 (offset_region::add_dump_widget_children): New decl.
382 (sized_region::print_dump_widget_label): New decl.
383 (sized_region::add_dump_widget_children): New decl.
384 (cast_region::print_dump_widget_label): New decl.
385 (cast_region::add_dump_widget_children): New decl.
386 (heap_allocated_region::print_dump_widget_label): New decl.
387 (alloca_region::print_dump_widget_label): New decl.
388 (string_region::print_dump_widget_label): New decl.
389 (bit_range_region::print_dump_widget_label): New decl.
390 (var_arg_region::print_dump_widget_label): New decl.
391 (errno_region::print_dump_widget_label): New decl.
392 (private_region::print_dump_widget_label): New decl.
393 (unknown_region::print_dump_widget_label): New decl.
394 * sm-fd.cc: Define INCLUDE_VECTOR.
395 * sm-file.cc: Likewise.
396 * sm-malloc.cc: Likewise.
397 * sm-pattern-test.cc: Likewise.
398 * sm-signal.cc: Likewise.
399 * sm-taint.cc: Likewise.
400 * sm.cc: Likewise.
401 * state-purge.cc: Likewise.
402 * store.cc: Likewise. Include "text-art/tree-widget.h".
403 (add_binding_to_tree_widget): New.
404 (binding_map::add_to_tree_widget): New.
405 (binding_cluster::make_dump_widget): New.
406 (store::make_dump_widget): New.
407 * store.h: Include "text-art/tree-widget.h".
408 (binding_map::add_to_tree_widget): New decl.
409 (binding_cluster::make_dump_widget): New decl.
410 (store::make_dump_widget): New decl.
411 * svalue.cc: Define INCLUDE_VECTOR. Include "make-unique.h" and
412 "text-art/dump.h".
413 (svalue::dump): New.
414 (svalue::make_dump_widget): New.
415 (region_svalue::print_dump_widget_label): New.
416 (region_svalue::add_dump_widget_children): New.
417 (constant_svalue::print_dump_widget_label): New.
418 (constant_svalue::add_dump_widget_children): New.
419 (unknown_svalue::print_dump_widget_label): New.
420 (unknown_svalue::add_dump_widget_children): New.
421 (poisoned_svalue::print_dump_widget_label): New.
422 (poisoned_svalue::add_dump_widget_children): New.
423 (initial_svalue::print_dump_widget_label): New.
424 (initial_svalue::add_dump_widget_children): New.
425 (unaryop_svalue::print_dump_widget_label): New.
426 (unaryop_svalue::add_dump_widget_children): New.
427 (binop_svalue::print_dump_widget_label): New.
428 (binop_svalue::add_dump_widget_children): New.
429 (sub_svalue::print_dump_widget_label): New.
430 (sub_svalue::add_dump_widget_children): New.
431 (repeated_svalue::print_dump_widget_label): New.
432 (repeated_svalue::add_dump_widget_children): New.
433 (bits_within_svalue::print_dump_widget_label): New.
434 (bits_within_svalue::add_dump_widget_children): New.
435 (widening_svalue::print_dump_widget_label): New.
436 (widening_svalue::add_dump_widget_children): New.
437 (placeholder_svalue::print_dump_widget_label): New.
438 (placeholder_svalue::add_dump_widget_children): New.
439 (unmergeable_svalue::print_dump_widget_label): New.
440 (unmergeable_svalue::add_dump_widget_children): New.
441 (compound_svalue::print_dump_widget_label): New.
442 (compound_svalue::add_dump_widget_children): New.
443 (conjured_svalue::print_dump_widget_label): New.
444 (conjured_svalue::add_dump_widget_children): New.
445 (asm_output_svalue::print_dump_widget_label): New.
446 (asm_output_svalue::add_dump_widget_children): New.
447 (const_fn_result_svalue::print_dump_widget_label): New.
448 (const_fn_result_svalue::add_dump_widget_children): New.
449 * svalue.h: Include "text-art/widget.h". Add "using
450 text_art::dump_widget_info".
451 (svalue::dump): New decl.
452 (svalue::make_dump_widget): New decl.
453 (svalue::print_dump_widget_label): New decl.
454 (svalue::print_dump_widget_label): New decl.
455 (svalue::add_dump_widget_children): New decl.
456 (region_svalue::print_dump_widget_label): New decl.
457 (region_svalue::add_dump_widget_children): New decl.
458 (constant_svalue::print_dump_widget_label): New decl.
459 (constant_svalue::add_dump_widget_children): New decl.
460 (unknown_svalue::print_dump_widget_label): New decl.
461 (unknown_svalue::add_dump_widget_children): New decl.
462 (poisoned_svalue::print_dump_widget_label): New decl.
463 (poisoned_svalue::add_dump_widget_children): New decl.
464 (initial_svalue::print_dump_widget_label): New decl.
465 (initial_svalue::add_dump_widget_children): New decl.
466 (unaryop_svalue::print_dump_widget_label): New decl.
467 (unaryop_svalue::add_dump_widget_children): New decl.
468 (binop_svalue::print_dump_widget_label): New decl.
469 (binop_svalue::add_dump_widget_children): New decl.
470 (sub_svalue::print_dump_widget_label): New decl.
471 (sub_svalue::add_dump_widget_children): New decl.
472 (repeated_svalue::print_dump_widget_label): New decl.
473 (repeated_svalue::add_dump_widget_children): New decl.
474 (bits_within_svalue::print_dump_widget_label): New decl.
475 (bits_within_svalue::add_dump_widget_children): New decl.
476 (widening_svalue::print_dump_widget_label): New decl.
477 (widening_svalue::add_dump_widget_children): New decl.
478 (placeholder_svalue::print_dump_widget_label): New decl.
479 (placeholder_svalue::add_dump_widget_children): New decl.
480 (unmergeable_svalue::print_dump_widget_label): New decl.
481 (unmergeable_svalue::add_dump_widget_children): New decl.
482 (compound_svalue::print_dump_widget_label): New decl.
483 (compound_svalue::add_dump_widget_children): New decl.
484 (conjured_svalue::print_dump_widget_label): New decl.
485 (conjured_svalue::add_dump_widget_children): New decl.
486 (asm_output_svalue::print_dump_widget_label): New decl.
487 (asm_output_svalue::add_dump_widget_children): New decl.
488 (const_fn_result_svalue::print_dump_widget_label): New decl.
489 (const_fn_result_svalue::add_dump_widget_children): New decl.
490 * trimmed-graph.cc: Define INCLUDE_VECTOR.
491 * varargs.cc: Likewise.
493 2024-05-28 David Malcolm <dmalcolm@redhat.com>
495 * region-model.cc: Include "selftest-tree.h".
497 2024-05-17 David Malcolm <dmalcolm@redhat.com>
499 * checker-event.h (checker_event::connect_to_next_event_p):
500 Implement new diagnostic_event::connect_to_next_event_p vfunc.
501 (start_cfg_edge_event::connect_to_next_event_p): Likewise.
502 (start_consolidated_cfg_edges_event::connect_to_next_event_p):
503 Likewise.
504 * infinite-loop.cc (class looping_back_event): New subclass.
505 (infinite_loop_diagnostic::add_final_event): Use it.
507 2024-05-15 David Malcolm <dmalcolm@redhat.com>
509 PR analyzer/114899
510 * access-diagram.cc
511 (written_svalue_spatial_item::get_label_string): Bulletproof
512 against SSA_NAME_VAR being null.
514 2024-05-03 David Malcolm <dmalcolm@redhat.com>
516 PR analyzer/111475
517 * analyzer.cc (is_special_named_call_p): Add "look_in_std" param.
518 (is_std_function_p): Make non-static.
519 * analyzer.h (is_special_named_call_p): Add optional "look_in_std"
520 param.
521 (is_std_function_p): New decl.
522 * engine.cc (stmt_requires_new_enode_p): Look for both "signal"
523 and "std::signal".
524 * kf.cc (register_known_functions): Add various "std::" copies
525 of the known functions.
526 * known-function-manager.cc
527 (known_function_manager::~known_function_manager): Clean up
528 m_std_ns_map_id_to_kf.
529 (known_function_manager::add_std_ns): New.
530 (known_function_manager::get_match): Also look for known "std::"
531 functions.
532 (known_function_manager::get_by_identifier_in_std_ns): New.
533 * known-function-manager.h
534 (known_function_manager::add_std_ns): New decl.
535 (known_function_manager::get_by_identifier_in_std_ns): New decl.
536 (known_function_manager::m_std_ns_map_id_to_kf): New field.
537 * sm-file.cc (register_known_file_functions): Add various "std::"
538 copies of the known functions.
539 * sm-malloc.cc (malloc_state_machine::on_stmt): Handle
540 "std::realloc".
541 * sm-signal.cc (signal_unsafe_p): Consider "std::" copies of the
542 functions as also being async-signal-unsafe.
543 (signal_state_machine::on_stmt): Consider "std::signal".
545 2024-04-12 Stefan Schulze Frielinghaus <stefansf@linux.ibm.com>
547 * region-model.cc (region_model::check_region_size): Bail out
548 early on function pointers.
550 2024-04-10 David Malcolm <dmalcolm@redhat.com>
552 PR analyzer/114472
553 * access-diagram.cc (bit_size_expr::maybe_get_formatted_str):
554 Reject attempts to print sizes that are too large.
555 * region.cc (region_offset::calc_symbolic_bit_offset): Use a
556 typeless svalue for the bit offset.
557 * store.cc (bit_range::intersects_p): Replace assertion with
558 test.
559 (bit_range::exceeds_p): Likewise.
560 (bit_range::falls_short_of_p): Likewise.
562 2024-04-10 David Malcolm <dmalcolm@redhat.com>
564 * infinite-loop.cc: Include "diagnostic-format-sarif.h".
565 (infinite_loop::to_json): New.
566 (infinite_loop_diagnostic::maybe_add_sarif_properties): New.
568 2024-04-10 David Malcolm <dmalcolm@redhat.com>
570 * infinite-recursion.cc: Include "diagnostic-format-sarif.h".
571 (infinite_recursion_diagnostic::maybe_add_sarif_properties): New.
573 2024-04-10 David Malcolm <dmalcolm@redhat.com>
575 * call-details.cc: Include "diagnostic-format-sarif.h".
576 (overlapping_buffers::overlapping_buffers): Add params for new
577 fields.
578 (overlapping_buffers::maybe_add_sarif_properties): New.
579 (overlapping_buffers::m_byte_range_a): New field.
580 (overlapping_buffers::byte_range_b): New field.
581 (overlapping_buffers::m_num_bytes_read_sval): New field.
582 (call_details::complain_about_overlap): Pass new params to
583 overlapping_buffers ctor.
584 * ranges.cc (symbolic_byte_offset::to_json): New.
585 (symbolic_byte_range::to_json): New.
586 * ranges.h (symbolic_byte_offset::to_json): New decl.
587 (symbolic_byte_range::to_json): New decl.
589 2024-04-10 David Malcolm <dmalcolm@redhat.com>
591 * sm-taint.cc (tainted_allocation_size::tainted_allocation_size):
592 Add "size_in_bytes" param.
593 (tainted_allocation_size::maybe_add_sarif_properties): New.
594 (tainted_allocation_size::m_size_in_bytes): New field.
595 (region_model::check_dynamic_size_for_taint): Pass size_in_bytes
596 to tainted_allocation_size ctor.
598 2024-04-09 Jakub Jelinek <jakub@redhat.com>
600 * analyzer.opt (Wanalyzer-undefined-behavior-strtok): Fix duplicated
601 words; in in -> in.
602 * program-state.cc (sm_state_map::replay_call_summary): Fix duplicated
603 words in comment; to to -> to.
604 (program_state::replay_call_summary): Likewise.
605 * region-model.cc (region_model::replay_call_summary): Likewise.
607 2024-04-05 David Malcolm <dmalcolm@redhat.com>
609 PR analyzer/114588
610 * access-diagram.cc (access_diagram_impl::access_diagram_impl):
611 Replace hardcoded colors for valid_style and invalid_style with
612 calls to text_art::get_style_from_color_cap_name.
614 2024-04-02 David Malcolm <dmalcolm@redhat.com>
616 * region-model-manager.cc (maybe_undo_optimize_bit_field_compare):
617 Guard against null types.
618 * region-model.cc (apply_constraints_for_gswitch): Likewise.
620 2024-03-27 David Malcolm <dmalcolm@redhat.com>
622 PR analyzer/114473
623 * call-summary.cc
624 (call_summary_replay::convert_svalue_from_summary): Assert that
625 the types match.
626 (call_summary_replay::convert_region_from_summary): Likewise.
627 (call_summary_replay::convert_region_from_summary_1): Add missing
628 cast for the deref of RK_SYMBOLIC case.
630 2024-03-23 David Malcolm <dmalcolm@redhat.com>
632 PR analyzer/114408
633 * engine.cc (impl_run_checkers): Free up any dominance info that
634 we may have created.
635 * kf.cc (class kf_ubsan_handler): New.
636 (register_sanitizer_builtins): New.
637 (register_known_functions): Call register_sanitizer_builtins.
639 2024-03-22 David Malcolm <dmalcolm@redhat.com>
641 PR analyzer/112974
642 PR analyzer/112975
643 * sm-taint.cc (taint_state_machine::on_condition): Strip away
644 casts before considering LHS and RHS, to increase the chance of
645 detecting places where sanitization of a value may have happened.
647 2024-03-22 David Malcolm <dmalcolm@redhat.com>
649 * sm-taint.cc: Include "diagnostic-format-sarif.h".
650 (bounds_to_str): New.
651 (taint_diagnostic::maybe_add_sarif_properties): New.
652 (tainted_offset::tainted_offset): Add "offset" param.
653 (tainted_offset::maybe_add_sarif_properties): New.
654 (tainted_offset::m_offset): New.
655 (region_model::check_region_for_taint): Pass offset to
656 tainted_offset ctor.
658 2024-03-21 David Malcolm <dmalcolm@redhat.com>
660 PR analyzer/113619
661 * region-model.cc (region_model::eval_condition): Fix
662 cast-handling from r14-3632-ge7b267444045c5 so that if those give
663 an unknown result, we continue trying the constraint manager.
665 2024-03-20 David Malcolm <dmalcolm@redhat.com>
667 PR analyzer/109251
668 * sm-malloc.cc (deref_before_check::emit): Reject cases where the
669 check is in a loop header within a macro expansion.
670 (deref_before_check::loop_header_p): New.
672 2024-03-20 Jakub Jelinek <jakub@redhat.com>
674 * constraint-manager.cc (test_range, test_constraint_conditions,
675 test_constant_comparisons, test_constraint_impl, test_purging,
676 test_bits): Use integer_zero_node instead of
677 build_zero_cst (integer_type_node) or
678 build_int_cst (integer_type_node, 0) and integer_one_node instead of
679 build_int_cst (integer_type_node, 1).
680 * region-model.cc (region_model::get_store_value,
681 append_interesting_constants, test_array_1,
682 test_get_representative_tree, test_unique_constants, test_assignment,
683 test_stack_frames, test_constraint_merging, test_widening_constraints,
684 test_iteration_1, test_array_2): Likewise.
686 2024-03-19 Jakub Jelinek <jakub@redhat.com>
688 PR analyzer/113505
689 * region-model.cc (get_tree_for_byte_offset,
690 region_model::get_representative_path_var_1,
691 test_mem_ref, test_POINTER_PLUS_EXPR_then_MEM_REF): Use
692 char __attribute__((may_alias)) * as type of MEM_REF second argument.
694 2024-03-19 David Malcolm <dmalcolm@redhat.com>
696 PR analyzer/114286
697 * kf.cc (class kf_atomic_exchange): Reimplement based on signature
698 seen in gimple, rather than user-facing signature.
699 (class kf_atomic_load): Likewise.
700 (class kf_atomic_store): New.
701 (register_atomic_builtins): Register kf_atomic_store.
703 2024-03-18 David Malcolm <dmalcolm@redhat.com>
705 PR analyzer/110902
706 PR analyzer/110928
707 PR analyzer/111305
708 PR analyzer/111441
709 * access-diagram.cc: Include "analyzer/analyzer-selftests.h".
710 (get_access_size_str): Reimplement for conversion of
711 implmementation of bit_size_expr from tree to const svalue &. Use
712 svalue::maybe_print_for_user rather than tree printing routines.
713 (remove_ssa_names): Make non-static.
714 (bit_size_expr::get_formatted_str): Rename to...
715 (bit_size_expr::maybe_get_formatted_str): ...this, adding "model"
716 param and converting return type to a unique_ptr. Update for
717 conversion of implementation of bit_size_expr from tree to
718 const svalue &. Use svalue::maybe_print_for_user rather than tree
719 printing routines.
720 (bit_size_expr::print): Rename to...
721 (bit_size_expr::maybe_print_for_user): ...this, adding "model"
722 param and converting return type to bool. Update for
723 conversion of implementation of bit_size_expr from tree to
724 const svalue &. Use svalue::maybe_print_for_user rather than tree
725 printing routines.
726 (bit_size_expr::maybe_get_as_bytes): Add "mgr" param and convert
727 return type from tree to const svalue *; reimplement.
728 (access_range::access_range): Call strip_types when on region_offset
729 intializations.
730 (access_range::get_size): Update for conversion of implementation
731 of bit_size_expr from tree to const svalue &.
732 (access_operation::get_valid_bits): Pass manager to access_range
733 ctor.
734 (access_operation::maybe_get_invalid_before_bits): Likewise.
735 (access_operation::maybe_get_invalid_after_bits): Likewise.
736 (boundaries::add): Likewise.
737 (bit_to_table_map::populate): Add "mgr" param and pass it to
738 access_range ctor.
739 (access_diagram_impl::access_diagram_impl): Pass manager to
740 bit_to_table_map::populate.
741 (access_diagram_impl::maybe_add_gap): Use svalue rather than tree
742 for symbolic bit offsets. Port to new bit_size_expr
743 representation.
744 (access_diagram_impl::add_valid_vs_invalid_ruler): Port to new
745 bit_size_expr representation.
746 (selftest::assert_eq_typeless_integer): New.
747 (ASSERT_EQ_TYPELESS_INTEGER): New.
748 (selftest::test_bit_size_expr_to_bytes): New.
749 (selftest::analyzer_access_diagram_cc_tests): New.
750 * access-diagram.h (class bit_size_expr): Reimplement, converting
751 implementation from tree to const svalue &.
752 (access_range::access_range): Add "mgr" param. Call strip_types
753 on region_offset initializations.
754 (access_range::get_size): Update decl for reimplementation.
755 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
756 selftest::analyzer_access_diagram_cc_tests.
757 * analyzer-selftests.h
758 (selftest::analyzer_checker_script_cc_tests): Delete this stray
759 typo.
760 (selftest::analyzer_access_diagram_cc_tests): New decl.
761 * analyzer.h (print_expr_for_user): New decl.
762 (calc_symbolic_bit_offset): Update decl for reimplementation.
763 (strip_types): New decls.
764 (remove_ssa_names): New decl.
765 * bounds-checking.cc (strip_types): New.
766 (region_model::check_symbolic_bounds): Use typeless svalues.
767 * region-model-manager.cc
768 (region_model_manager::get_or_create_constant_svalue): Add "type"
769 param. Add overload with old signature.
770 (region_model_manager::get_or_create_int_cst): Support type being
771 NULL_TREE.
772 (region_model_manager::maybe_fold_unaryop): Gracefully reject folding
773 of casts to NULL_TREE type.
774 (get_code_for_cast): Use NOP_EXPR for "casting" svalues to
775 NULL_TREE type.
776 (region_model_manager::get_or_create_cast): Support "casting"
777 svalues to NULL_TREE type.
778 (region_model_manager::maybe_fold_binop): Don't crash on inputs
779 with NULL_TREE type. Handle folding of binops on constants with
780 NULL_TREE type. Add missing cast from PR analyzer/110902.
781 Support enough folding of other ops on NULL_TREE type to support
782 bounds checking.
783 (region_model_manager::get_or_create_const_fn_result_svalue):
784 Remove assertion that type is nonnull.
785 * region-model-manager.h
786 (region_model_manager::get_or_create_constant_svalue): Add
787 overloaded decl taking a type.
788 (region_model_manager::maybe_fold_binop): Make public.
789 (region_model_manager::constants_map_t): Use
790 constant_svalue::key_t for the key, rather than just tree.
791 * region-model.cc (print_expr_for_user): New.
792 (selftest::test_array_2): Handle casts.
793 * region.cc (region_offset::calc_symbolic_bit_offset): Return
794 const svalue & rather than tree, and reimplement accordingly.
795 (region::calc_offset): Use ptrdiff_type_node for types of byte
796 offsets.
797 (region::maybe_print_for_user): New.
798 (element_region::get_relative_symbolic_offset): Use NULL_TREE for
799 types of bit offsets.
800 (offset_region::get_bit_offset): Likewise.
801 (sized_region::get_bit_size_sval): Likewise for bit sizes.
802 * region.h (region::maybe_print_for_user): New decl.
803 * svalue.cc (class auto_add_parens): New.
804 (svalue::maybe_print_for_user): New.
805 (svalue::cmp_ptr): Support typeless constant svalues.
806 (tristate_from_boolean_tree_node): New, taken from...
807 (constant_svalue::eval_condition): ...here. Handle comparison of
808 typeless integer svalue constants.
809 * svalue.h (svalue::maybe_print_for_user): New decl.
810 (class constant_svalue): Support the type of the svalue being
811 NULL_TREE.
812 (struct default_hash_traits<constant_svalue::key_t>): New.
814 2024-03-18 David Malcolm <dmalcolm@redhat.com>
816 * access-diagram.cc (remove_ssa_names): Support operands being
817 NULL_TREE, such as e.g. for COMPONENT_REF's operand 2.
819 2024-03-07 Jakub Jelinek <jakub@redhat.com>
821 * access-diagram.cc: Include diagnostic-core.h before including
822 diagnostic.h or diagnostic-path.h.
823 * sm-malloc.cc: Likewise.
824 * diagnostic-manager.cc: Likewise.
825 * call-summary.cc: Likewise.
826 * record-layout.cc: Likewise.
828 2024-02-29 David Malcolm <dmalcolm@redhat.com>
830 PR analyzer/114159
831 * analyzer.cc: Include "tree-dfa.h".
832 (get_ssa_default_def): New decl.
833 * analyzer.h (get_ssa_default_def): New.
834 * call-info.cc (call_info::call_info): New ctor taking an explicit
835 called_fn.
836 * call-info.h (call_info::call_info): Likewise.
837 * call-summary.cc (call_summary_replay::call_summary_replay):
838 Convert param from function * to const function &.
839 * call-summary.h (call_summary_replay::call_summary_replay):
840 Likewise.
841 * checker-event.h (state_change_event::get_dest_function):
842 Constify return value.
843 * engine.cc (point_and_state::validate): Update for conversion to
844 const function &.
845 (exploded_node::on_stmt): Likewise.
846 (call_summary_edge_info::call_summary_edge_info): Likewise.
847 Pass in called_fn to call_info ctor.
848 (exploded_node::replay_call_summaries): Update for conversion to
849 const function &. Convert per_function_data from * to &.
850 (exploded_node::replay_call_summary): Update for conversion to
851 const function &.
852 (exploded_graph::add_function_entry): Likewise.
853 (toplevel_function_p): Likewise.
854 (add_tainted_args_callback): Likewise.
855 (exploded_graph::build_initial_worklist): Likewise.
856 (exploded_graph::maybe_create_dynamic_call): Likewise.
857 (maybe_update_for_edge): Likewise.
858 (exploded_graph::on_escaped_function): Likewise.
859 * exploded-graph.h (exploded_node::replay_call_summaries):
860 Likewise.
861 (exploded_node::replay_call_summary): Likewise.
862 (exploded_graph::add_function_entry): Likewise.
863 * program-point.cc (function_point::from_function_entry):
864 Likewise.
865 (program_point::from_function_entry): Likewise.
866 * program-point.h (function_point::from_function_entry): Likewise.
867 (program_point::from_function_entry): Likewise.
868 * program-state.cc (program_state::push_frame): Likewise.
869 (program_state::get_current_function): Constify return type.
870 * program-state.h (program_state::push_frame): Update for
871 conversion to const function &.
872 (program_state::get_current_function): Likewise.
873 * region-model-manager.cc
874 (region_model_manager::get_frame_region): Likewise.
875 * region-model-manager.h
876 (region_model_manager::get_frame_region): Likewise.
877 * region-model.cc (region_model::called_from_main_p): Likewise.
878 (region_model::update_for_gcall): Likewise.
879 (region_model::push_frame): Likewise.
880 (region_model::get_current_function): Constify return type.
881 (region_model::pop_frame): Update for conversion to
882 const function &.
883 (selftest::test_stack_frames): Likewise.
884 (selftest::test_get_representative_path_var): Likewise.
885 (selftest::test_state_merging): Likewise.
886 (selftest::test_alloca): Likewise.
887 * region-model.h (region_model::push_frame): Likewise.
888 (region_model::get_current_function): Likewise.
889 * region.cc (frame_region::dump_to_pp): Likewise.
890 (frame_region::get_region_for_local): Likewise.
891 * region.h (class frame_region): Likewise.
892 * sm-signal.cc (signal_unsafe_call::describe_state_change):
893 Likewise.
894 (update_model_for_signal_handler): Likewise.
895 (signal_delivery_edge_info_t::update_model): Likewise.
896 (register_signal_handler::impl_transition): Likewise.
897 * state-purge.cc (class gimple_op_visitor): Likewise.
898 (state_purge_map::state_purge_map): Likewise.
899 (state_purge_map::get_or_create_data_for_decl): Likewise.
900 (state_purge_per_ssa_name::state_purge_per_ssa_name): Likewise.
901 (state_purge_per_ssa_name::add_to_worklist): Likewise.
902 (state_purge_per_ssa_name::process_point): Likewise.
903 (state_purge_per_decl::add_to_worklist): Likewise.
904 (state_purge_annotator::print_needed): Likewise.
905 * state-purge.h
906 (state_purge_map::get_or_create_data_for_decl): Likewise.
907 (class state_purge_per_tree): Likewise.
908 (class state_purge_per_ssa_name): Likewise.
909 (class state_purge_per_decl): Likewise.
910 * supergraph.cc (supergraph::dump_dot_to_pp): Likewise.
911 * supergraph.h
912 (supergraph::get_node_for_function_entry): Likewise.
913 (supergraph::get_node_for_function_exit): Likewise.
915 2024-02-27 David Malcolm <dmalcolm@redhat.com>
917 PR analyzer/110483
918 PR analyzer/111802
919 * access-diagram.cc
920 (string_literal_spatial_item::add_column_for_byte): Use %wu for
921 printing unsigned HOST_WIDE_INT.
923 2024-02-27 David Malcolm <dmalcolm@redhat.com>
925 PR analyzer/111881
926 * constraint-manager.cc (bound::ensure_closed): Assert that
927 m_constant has integral type.
928 (range::add_bound): Bail out on floating point constants.
930 2024-02-21 David Malcolm <dmalcolm@redhat.com>
932 PR analyzer/113999
933 * analyzer.h (get_string_cst_size): New decl.
934 * region-model-manager.cc (get_string_cst_size): New.
935 (region_model_manager::maybe_get_char_from_string_cst): Treat
936 single-byte accesses within string_cst but beyond
937 TREE_STRING_LENGTH as being 0.
938 * region-model.cc (string_cst_has_null_terminator): Likewise.
940 2024-02-21 David Malcolm <dmalcolm@redhat.com>
942 PR analyzer/113998
943 * ranges.cc (symbolic_byte_range::intersection): Handle empty ranges.
944 (selftest::test_intersects): Add test coverage for empty ranges.
946 2024-02-19 David Malcolm <dmalcolm@redhat.com>
948 PR analyzer/111289
949 * varargs.cc (representable_in_integral_type_p): New.
950 (va_arg_compatible_types_p): Add "arg_sval" param. Handle integer
951 types.
952 (kf_va_arg::impl_call_pre): Pass arg_sval to
953 va_arg_compatible_types_p.
955 2024-02-19 Andrew Pinski <quic_apinski@quicinc.com>
957 PR analyzer/113983
958 * region-model-manager.cc (maybe_undo_optimize_bit_field_compare): Reject
959 non integral types.
961 2024-02-15 David Malcolm <dmalcolm@redhat.com>
963 PR analyzer/111266
964 * region.cc (offset_region::get_byte_size_sval): Delete.
965 (offset_region::get_bit_size_sval): Delete.
966 * region.h (region::get_byte_size): Add comment clarifying that
967 this relates to the size of the access, rather than the size
968 that's valid to access.
969 (region::get_bit_size): Likewise.
970 (region::get_byte_size_sval): Likewise.
971 (region::get_bit_size_sval): Likewise.
972 (offset_region::get_byte_size_sval): Delete.
973 (offset_region::get_bit_size_sval): Delete.
975 2024-02-13 David Malcolm <dmalcolm@redhat.com>
977 * pending-diagnostic.cc (diagnostic_emission_context::warn):
978 Update for renaming of emit_diagnostic_valist overload to
979 emit_diagnostic_valist_meta.
980 (diagnostic_emission_context::inform): Likewise.
982 2024-01-31 David Malcolm <dmalcolm@redhat.com>
984 PR analyzer/113253
985 * region-model.cc (region_model::on_stmt_pre): Add gcc_unreachable
986 for debug statements.
987 * state-purge.cc
988 (state_purge_per_ssa_name::state_purge_per_ssa_name): Skip any
989 debug stmts in the FOR_EACH_IMM_USE_FAST list.
990 * supergraph.cc (supergraph::supergraph): Don't add debug stmts
991 to the supernodes.
993 2024-01-31 David Malcolm <dmalcolm@redhat.com>
995 PR analyzer/113509
996 * checker-event.cc (state_change_event::get_desc): Don't assume
997 "var" is non-NULL.
999 2024-01-30 David Malcolm <dmalcolm@redhat.com>
1001 PR analyzer/113654
1002 * region-model.cc (is_round_up): New.
1003 (is_multiple_p): New.
1004 (is_dubious_capacity): New.
1005 (region_model::check_region_size): Move usage of size_visitor into
1006 is_dubious_capacity.
1008 2024-01-30 David Malcolm <dmalcolm@redhat.com>
1010 * region-model.cc
1011 (dubious_allocation_size::dubious_allocation_size): Add
1012 "capacity_sval" param. Drop unused ctor.
1013 (dubious_allocation_size::maybe_add_sarif_properties): New.
1014 (dubious_allocation_size::m_capacity_sval): New field.
1015 (region_model::check_region_size): Pass capacity svalue to
1016 dubious_allocation_size ctor.
1018 2024-01-25 David Malcolm <dmalcolm@redhat.com>
1020 PR analyzer/112969
1021 * store.cc (binding_cluster::maybe_get_compound_binding): When
1022 populating default_map, express the bit-range of the default key
1023 for REG relative to REG, rather than to the base region.
1025 2024-01-24 David Malcolm <dmalcolm@redhat.com>
1027 PR analyzer/112977
1028 * engine.cc (impl_region_model_context::on_liveness_change): Pass
1029 m_ext_state to sm_state_map::on_liveness_change.
1030 * program-state.cc (sm_state_map::on_svalue_leak): Guard removal
1031 of map entry based on can_purge_p.
1032 (sm_state_map::on_liveness_change): Add ext_state param. Add
1033 workaround for bad interaction between state purging and
1034 alt-inherited sm-state.
1035 * program-state.h (sm_state_map::on_liveness_change): Add
1036 ext_state param.
1037 * sm-taint.cc
1038 (taint_state_machine::has_alt_get_inherited_state_p): New.
1039 (taint_state_machine::can_purge_p): Return false for "has_lb" and
1040 "has_ub".
1041 * sm.h (state_machine::has_alt_get_inherited_state_p): New vfunc.
1043 2024-01-18 David Malcolm <dmalcolm@redhat.com>
1045 PR analyzer/111361
1046 * region-model.cc (svalue_byte_range_has_null_terminator_1): The
1047 initial byte of an all-zeroes SVAL is a zero byte. Remove
1048 gcc_unreachable from SK_CONSTANT for constants that aren't
1049 STRING_CST or INTEGER_CST.
1051 2024-01-18 David Malcolm <dmalcolm@redhat.com>
1053 PR analyzer/112811
1054 * region-model.cc (fragment::dump_to_pp): New.
1055 (fragment::has_null_terminator): Convert to...
1056 (svalue_byte_range_has_null_terminator_1): ...this new function,
1057 updating to use a byte_range relative to the start of the svalue.
1058 (svalue_byte_range_has_null_terminator): New.
1059 (fragment::string_cst_has_null_terminator): Convert to...
1060 (string_cst_has_null_terminator): ...this, updating to use a
1061 byte_range relative to the start of the svalue.
1062 (iterable_cluster::dump_to_pp): New.
1063 (region_model::scan_for_null_terminator): Add logging, moving body
1064 to...
1065 (region_model::scan_for_null_terminator_1): ...this new function,
1066 adding more logging, and updating to use
1067 svalue_byte_range_has_null_terminator.
1068 * region-model.h (region_model::scan_for_null_terminator_1): New
1069 decl.
1071 2024-01-16 David Malcolm <dmalcolm@redhat.com>
1073 PR analyzer/106229
1074 * analyzer.h (compare_constants): New decl.
1075 * constraint-manager.cc (compare_constants): Make non-static.
1076 * sm-taint.cc: Add include "fold-const.h".
1077 (class concrete_range): New.
1078 (get_possible_range): New.
1079 (index_can_be_out_of_bounds_p): New.
1080 (region_model::check_region_for_taint): Reject
1081 -Wanalyzer-tainted-array-index if the type of the value makes it
1082 impossible for it to be out-of-bounds of the array.
1084 2024-01-16 David Malcolm <dmalcolm@redhat.com>
1086 PR analyzer/113333
1087 * region-model-manager.cc
1088 (region_model_manager::maybe_fold_unaryop): Casting all zeroes
1089 should give all zeroes.
1091 2024-01-04 David Malcolm <dmalcolm@redhat.com>
1093 * analyzer.opt.urls: New file, autogenerated by
1094 regenerate-opt-urls.py.
1096 2024-01-04 David Malcolm <dmalcolm@redhat.com>
1098 * checker-event.cc: Include "diagnostic-format-sarif.h" and
1099 "tree-logical-location.h".
1100 (checker_event::maybe_add_sarif_properties): New.
1101 (superedge_event::maybe_add_sarif_properties): New.
1102 (superedge_event::superedge_event): Add comment.
1103 * checker-event.h (checker_event::maybe_add_sarif_properties): New
1104 decl.
1105 (superedge_event::maybe_add_sarif_properties): New decl.
1107 2024-01-04 David Malcolm <dmalcolm@redhat.com>
1109 PR analyzer/112790
1110 * checker-event.cc (class inlining_info): Move to...
1111 * inlining-iterator.h (class inlining_info): ...here.
1112 * sm-malloc.cc: Include "analyzer/inlining-iterator.h".
1113 (maybe_complain_about_deref_before_check): Reject stmts that were
1114 inlined from another function.
1116 2024-01-04 David Malcolm <dmalcolm@redhat.com>
1118 PR analyzer/113222
1119 * access-diagram.cc (valid_region_spatial_item::add_boundaries):
1120 Handle TYPE_DOMAIN being null.
1121 (valid_region_spatial_item::add_array_elements_to_table):
1122 Likewise.
1124 2023-12-16 David Malcolm <dmalcolm@redhat.com>
1126 * analyzer.cc: Include "tree-pretty-print.h" and
1127 "diagnostic-event-id.h".
1128 (tree_to_json): New.
1129 (diagnostic_event_id_to_json): New.
1130 (bit_offset_to_json): New.
1131 (byte_offset_to_json): New.
1132 * analyzer.h (tree_to_json): New decl.
1133 (diagnostic_event_id_to_json): New decl.
1134 (bit_offset_to_json): New decl.
1135 (byte_offset_to_json): New decl.
1136 * bounds-checking.cc: Include "diagnostic-format-sarif.h".
1137 (out_of_bounds::maybe_add_sarif_properties): New.
1138 (concrete_out_of_bounds::maybe_add_sarif_properties): New.
1139 (concrete_past_the_end::maybe_add_sarif_properties): New.
1140 (symbolic_past_the_end::maybe_add_sarif_properties): New.
1141 * region-model.cc (region_to_value_map::to_json): New.
1142 (region_model::to_json): New.
1143 * region-model.h (region_to_value_map::to_json): New decl.
1144 (region_model::to_json): New decl.
1145 * store.cc (bit_range::to_json): New.
1146 (byte_range::to_json): New.
1147 * store.h (bit_range::to_json): New decl.
1148 (byte_range::to_json): New decl.
1150 2023-12-16 David Malcolm <dmalcolm@redhat.com>
1152 PR analyzer/112792
1153 * bounds-checking.cc
1154 (out_of_bounds::oob_region_creation_event_capacity): Rename
1155 "capacity" to "byte_capacity". Layout fix.
1156 (out_of_bounds::::add_region_creation_events): Rename
1157 "capacity" to "byte_capacity".
1158 (class concrete_out_of_bounds): Rename m_out_of_bounds_range to
1159 m_out_of_bounds_bits and convert from a byte_range to a bit_range.
1160 (concrete_out_of_bounds::get_out_of_bounds_bytes): New.
1161 (concrete_past_the_end::concrete_past_the_end): Rename param
1162 "byte_bound" to "bit_bound". Initialize m_byte_bound.
1163 (concrete_past_the_end::subclass_equal_p): Update for renaming
1164 of m_byte_bound to m_bit_bound.
1165 (concrete_past_the_end::m_bit_bound): New field.
1166 (concrete_buffer_overflow::concrete_buffer_overflow): Convert
1167 param "range" from byte_range to bit_range. Rename param
1168 "byte_bound" to "bit_bound".
1169 (concrete_buffer_overflow::emit): Update for bits vs bytes.
1170 (concrete_buffer_overflow::describe_final_event): Split
1171 into...
1172 (concrete_buffer_overflow::describe_final_event_as_bytes): ...this
1173 (concrete_buffer_overflow::describe_final_event_as_bits): ...and
1174 this.
1175 (concrete_buffer_over_read::concrete_buffer_over_read): Convert
1176 param "range" from byte_range to bit_range. Rename param
1177 "byte_bound" to "bit_bound".
1178 (concrete_buffer_over_read::emit): Update for bits vs bytes.
1179 (concrete_buffer_over_read::describe_final_event): Split into...
1180 (concrete_buffer_over_read::describe_final_event_as_bytes):
1181 ...this
1182 (concrete_buffer_over_read::describe_final_event_as_bits): ...and
1183 this.
1184 (concrete_buffer_underwrite::concrete_buffer_underwrite): Convert
1185 param "range" from byte_range to bit_range.
1186 (concrete_buffer_underwrite::describe_final_event): Split into...
1187 (concrete_buffer_underwrite::describe_final_event_as_bytes):
1188 ...this
1189 (concrete_buffer_underwrite::describe_final_event_as_bits): ...and
1190 this.
1191 (concrete_buffer_under_read::concrete_buffer_under_read): Convert
1192 param "range" from byte_range to bit_range.
1193 (concrete_buffer_under_read::describe_final_event): Split into...
1194 (concrete_buffer_under_read::describe_final_event_as_bytes):
1195 ...this
1196 (concrete_buffer_under_read::describe_final_event_as_bits): ...and
1197 this.
1198 (region_model::check_region_bounds): Use bits for concrete values,
1199 and rename locals to indicate whether we're dealing with bits or
1200 bytes. Specifically, replace "num_bytes_sval" with
1201 "num_bits_sval", and get it from reg's "get_bit_size_sval".
1202 Replace "num_bytes_tree" with "num_bits_tree". Rename "capacity"
1203 to "byte_capacity". Rename "cst_capacity_tree" to
1204 "cst_byte_capacity_tree". Replace "offset" and
1205 "num_bytes_unsigned" with "bit_offset" and "num_bits_unsigned"
1206 respectively, converting from byte_offset_t to bit_offset_t.
1207 Replace "out" and "read_bytes" with "bits_outside" and "read_bits"
1208 respectively, converting from byte_range to bit_range. Convert
1209 "buffer" from byte_range to bit_range. Replace "byte_bound" with
1210 "bit_bound".
1211 * region.cc (region::get_bit_size_sval): New.
1212 (offset_region::get_bit_offset): New.
1213 (offset_region::get_bit_size_sval): New.
1214 (sized_region::get_bit_size_sval): New.
1215 (bit_range_region::get_bit_size_sval): New.
1216 * region.h (region::get_bit_size_sval): New vfunc.
1217 (offset_region::get_bit_offset): New decl.
1218 (offset_region::get_bit_size_sval): New decl.
1219 (sized_region::get_bit_size_sval): New decl.
1220 (bit_range_region::get_bit_size_sval): New decl.
1221 * store.cc (bit_range::intersects_p): New, based on
1222 byte_range::intersects_p.
1223 (bit_range::exceeds_p): New, based on byte_range::exceeds_p.
1224 (bit_range::falls_short_of_p): New, based on
1225 byte_range::falls_short_of_p.
1226 (byte_range::intersects_p): Delete.
1227 (byte_range::exceeds_p): Delete.
1228 (byte_range::falls_short_of_p): Delete.
1229 * store.h (bit_range::intersects_p): New overload.
1230 (bit_range::exceeds_p): New.
1231 (bit_range::falls_short_of_p): New.
1232 (byte_range::intersects_p): Delete.
1233 (byte_range::exceeds_p): Delete.
1234 (byte_range::falls_short_of_p): Delete.
1236 2023-12-14 David Malcolm <dmalcolm@redhat.com>
1238 PR analyzer/112655
1239 * infinite-loop.cc (infinite_loop::infinite_loop): Pass eedges
1240 via rvalue reference rather than by value.
1241 (starts_infinite_loop_p): Move eedges when constructing an
1242 infinite_loop instance.
1243 * sm-file.cc (fileptr_state_machine::fileptr_state_machine): Use
1244 initializer list for states.
1245 * sm-sensitive.cc
1246 (sensitive_state_machine::sensitive_state_machine): Likewise.
1247 * sm-signal.cc (signal_state_machine::signal_state_machine):
1248 Likewise.
1249 * sm-taint.cc (taint_state_machine::taint_state_machine):
1250 Likewise.
1251 * varargs.cc (va_list_state_machine::va_list_state_machine): Likewise.
1253 2023-12-11 David Malcolm <dmalcolm@redhat.com>
1255 PR analyzer/112955
1256 * engine.cc (feasibility_state::feasibility_state): Initialize
1257 m_snodes_visited.
1259 2023-12-11 Andrew Pinski <apinski@marvell.com>
1261 * region-model-manager.cc (maybe_undo_optimize_bit_field_compare): Remove
1262 the check for type being unsigned_char_type_node.
1264 2023-12-08 David Malcolm <dmalcolm@redhat.com>
1266 * sm-taint.cc (taint_state_machine::alt_get_inherited_state): Fix
1267 handling of TRUNC_MOD_EXPR.
1269 2023-12-08 David Malcolm <dmalcolm@redhat.com>
1271 * region-model.cc (contains_uninit_p): Only check for
1272 svalues that the infoleak warning can handle.
1274 2023-12-08 David Malcolm <dmalcolm@redhat.com>
1276 PR analyzer/112889
1277 * store.h (concrete_binding::concrete_binding): Strengthen
1278 assertion to require size to be be positive, rather than just
1279 non-zero.
1280 (concrete_binding::mark_deleted): Use size rather than start bit
1281 offset.
1282 (concrete_binding::mark_empty): Likewise.
1283 (concrete_binding::is_deleted): Likewise.
1284 (concrete_binding::is_empty): Likewise.
1286 2023-12-07 Alexandre Oliva <oliva@adacore.com>
1288 * region-model.cc (has_nondefault_case_for_value_p): Take
1289 enumerate type as a parameter.
1290 (region_model::apply_constraints_for_gswitch): Cope with
1291 integral promotion type casts.
1293 2023-12-07 David Malcolm <dmalcolm@redhat.com>
1295 PR analyzer/103546
1296 PR analyzer/112850
1297 * analyzer.opt (-param=analyzer-max-svalue-depth=): Increase from
1298 12 to 18.
1299 (Wanalyzer-symbol-too-complex): New.
1300 * diagnostic-manager.cc
1301 (null_assignment_sm_context::clear_all_per_svalue_state): New.
1302 * engine.cc (impl_sm_context::clear_all_per_svalue_state): New.
1303 * program-state.cc (sm_state_map::clear_all_per_svalue_state):
1304 New.
1305 * program-state.h (sm_state_map::clear_all_per_svalue_state): New
1306 decl.
1307 * region-model-manager.cc
1308 (region_model_manager::reject_if_too_complex): Add
1309 -Wanalyzer-symbol-too-complex.
1310 * sm-taint.cc (taint_state_machine::on_condition): Handle
1311 comparisons against UNKNOWN.
1312 * sm.h (sm_context::clear_all_per_svalue_state): New.
1314 2023-12-06 David Malcolm <dmalcolm@redhat.com>
1316 * engine.cc (dump_analyzer_json): Use
1317 flag_diagnostics_json_formatting.
1319 2023-12-01 David Malcolm <dmalcolm@redhat.com>
1321 * analyzer.h (class saved_diagnostic): New forward decl.
1322 * bounds-checking.cc: Update for changes to
1323 pending_diagnostic::emit.
1324 * call-details.cc: Likewise.
1325 * diagnostic-manager.cc: Include "diagnostic-format-sarif.h".
1326 (saved_diagnostic::maybe_add_sarif_properties): New.
1327 (class pending_diagnostic_metadata): New.
1328 (diagnostic_manager::emit_saved_diagnostic): Create a
1329 pending_diagnostic_metadata and a diagnostic_emission_context.
1330 Pass the latter to the pending_diagnostic::emit vfunc.
1331 * diagnostic-manager.h
1332 (saved_diagnostic::maybe_add_sarif_properties): New decl.
1333 * engine.cc: Update for changes to pending_diagnostic::emit.
1334 * infinite-loop.cc: Likewise.
1335 * infinite-recursion.cc: Likewise.
1336 * kf-analyzer.cc: Likewise.
1337 * kf.cc: Likewise.
1338 * pending-diagnostic.cc
1339 (diagnostic_emission_context::get_pending_diagnostic): New.
1340 (diagnostic_emission_context::warn): New.
1341 (diagnostic_emission_context::inform): New.
1342 * pending-diagnostic.h (class diagnostic_emission_context): New.
1343 (pending_diagnostic::emit): Update params.
1344 (pending_diagnostic::maybe_add_sarif_properties): New vfunc.
1345 * region.cc: Don't include "diagnostic-metadata.h".
1346 * region-model.cc: Include "diagnostic-format-sarif.h". Update
1347 for changes to pending_diagnostic::emit.
1348 (exposure_through_uninit_copy::maybe_add_sarif_properties): New.
1349 * sm-fd.cc: Update for changes to pending_diagnostic::emit.
1350 * sm-file.cc: Likewise.
1351 * sm-malloc.cc: Likewise.
1352 * sm-pattern-test.cc: Likewise.
1353 * sm-sensitive.cc: Likewise.
1354 * sm-signal.cc: Likewise.
1355 * sm-taint.cc: Likewise.
1356 * store.cc: Don't include "diagnostic-metadata.h".
1357 * varargs.cc: Update for changes to pending_diagnostic::emit.
1359 2023-11-19 David Malcolm <dmalcolm@redhat.com>
1361 * analyzer.h: Include "rich-location.h".
1363 2023-11-19 David Malcolm <dmalcolm@redhat.com>
1365 PR analyzer/107573
1366 * analyzer.h (register_known_functions): Add region_model_manager
1367 param.
1368 * analyzer.opt (Wanalyzer-undefined-behavior-strtok): New.
1369 * call-summary.cc
1370 (call_summary_replay::convert_region_from_summary_1): Handle
1371 RK_PRIVATE.
1372 * engine.cc (impl_run_checkers): Pass model manager to
1373 register_known_functions.
1374 * kf.cc (class undefined_function_behavior): New.
1375 (class kf_strtok): New.
1376 (register_known_functions): Add region_model_manager param.
1377 Use it to register "strtok".
1378 * region-model-manager.cc
1379 (region_model_manager::get_or_create_conjured_svalue): Add "idx"
1380 param.
1381 * region-model-manager.h
1382 (region_model_manager::get_or_create_conjured_svalue): Add "idx"
1383 param.
1384 (region_model_manager::get_root_region): New accessor.
1385 * region-model.cc (region_model::scan_for_null_terminator): Handle
1386 "expr" being null.
1387 (region_model::get_representative_path_var_1): Handle RK_PRIVATE.
1388 * region-model.h (region_model::called_from_main_p): Make public.
1389 * region.cc (region::get_memory_space): Handle RK_PRIVATE.
1390 (region::can_have_initial_svalue_p): Handle MEMSPACE_PRIVATE.
1391 (private_region::dump_to_pp): New.
1392 * region.h (MEMSPACE_PRIVATE): New.
1393 (RK_PRIVATE): New.
1394 (class private_region): New.
1395 (is_a_helper <const private_region *>::test): New.
1396 * store.cc (store::replay_call_summary_cluster): Handle
1397 RK_PRIVATE.
1398 * svalue.h (struct conjured_svalue::key_t): Add "idx" param to
1399 ctor and "m_idx" field.
1400 (class conjured_svalue::conjured_svalue): Likewise.
1402 2023-11-18 David Malcolm <dmalcolm@redhat.com>
1404 PR analyzer/106147
1405 * analyzer.opt (Wanalyzer-infinite-loop): New option.
1406 (fdump-analyzer-infinite-loop): New option.
1407 * checker-event.h (start_cfg_edge_event::get_desc): Drop "final".
1408 (start_cfg_edge_event::maybe_describe_condition): Convert from
1409 private to protected.
1410 * checker-path.h (checker_path::get_logger): New.
1411 * diagnostic-manager.cc (process_worklist_item): Update for
1412 new context param of maybe_update_for_edge.
1413 * engine.cc
1414 (impl_region_model_context::impl_region_model_context): Add
1415 out_could_have_done_work param to both ctors and use it to
1416 initialize mm_out_could_have_done_work.
1417 (impl_region_model_context::maybe_did_work): New vfunc
1418 implementation.
1419 (exploded_node::on_stmt): Add out_could_have_done_work param and
1420 pass to ctxt ctor.
1421 (exploded_node::on_stmt_pre): Treat setjmp and longjmp as "doing
1422 work".
1423 (exploded_node::on_longjmp): Likewise.
1424 (exploded_edge::exploded_edge): Add "could_do_work" param and use
1425 it to initialize m_could_do_work_p.
1426 (exploded_edge::dump_dot_label): Add result of could_do_work_p.
1427 (exploded_graph::add_function_entry): Mark edge as doing no work.
1428 (exploded_graph::add_edge): Add "could_do_work" param and pass to
1429 exploded_edge ctor.
1430 (add_tainted_args_callback): Treat as doing no work.
1431 (exploded_graph::process_worklist): Likewise when merging nodes.
1432 (maybe_process_run_of_before_supernode_enodes::item): Likewise.
1433 (exploded_graph::maybe_create_dynamic_call): Likewise.
1434 (exploded_graph::process_node): Likewise for phi nodes.
1435 Pass in a "could_have_done_work" bool when handling stmts and use
1436 when creating edges. Assume work is done at bifurcation.
1437 (exploded_path::feasible_p): Update for new context param of
1438 maybe_update_for_edge.
1439 (feasibility_state::feasibility_state): New ctor.
1440 (feasibility_state::operator=): New.
1441 (feasibility_state::maybe_update_for_edge): Add ctxt param and use
1442 it. Fix missing newline when logging state.
1443 (impl_run_checkers): Call exploded_graph::detect_infinite_loops.
1444 * exploded-graph.h
1445 (impl_region_model_context::impl_region_model_context): Add
1446 out_could_have_done_work param to both ctors.
1447 (impl_region_model_context::maybe_did_work): New decl.
1448 (impl_region_model_context::checking_for_infinite_loop_p): New.
1449 (impl_region_model_context::on_unusable_in_infinite_loop): New.
1450 (impl_region_model_context::m_out_could_have_done_work): New
1451 field.
1452 (exploded_node::on_stmt): Add "out_could_have_done_work" param.
1453 (exploded_edge::exploded_edge): Add "could_do_work" param.
1454 (exploded_edge::could_do_work_p): New accessor.
1455 (exploded_edge::m_could_do_work_p): New field.
1456 (exploded_graph::add_edge): Add "could_do_work" param.
1457 (exploded_graph::detect_infinite_loops): New decl.
1458 (feasibility_state::feasibility_state): New ctor.
1459 (feasibility_state::operator=): New decl.
1460 (feasibility_state::maybe_update_for_edge): Add ctxt param.
1461 * infinite-loop.cc: New file.
1462 * program-state.cc (program_state::on_edge): Log the rejected
1463 constraint when region_model::maybe_update_for_edge fails.
1464 * region-model.cc (region_model::on_assignment): Treat any writes
1465 other than to the stack as "doing work".
1466 (region_model::on_stmt_pre): Treat all asm stmts as "doing work".
1467 (region_model::on_call_post): Likewise for all calls to functions
1468 with unknown side effects.
1469 (region_model::handle_phi): Add svals_changing_meaning param.
1470 Mark widening svalue in phi nodes as changing meaning.
1471 (unusable_in_infinite_loop_constraint_p): New.
1472 (region_model::add_constraint): If we're checking for an infinite
1473 loop, bail out on unusable svalues, or if we don't have a definite
1474 true/false for the constraint.
1475 (region_model::update_for_phis): Gather all svalues changing
1476 meaning in phi nodes, and purge constraints involving them.
1477 (region_model::replay_call_summary): Treat all call summaries as
1478 doing work.
1479 (region_model::can_merge_with_p): Purge constraints involving
1480 svalues that change meaning.
1481 (model_merger::on_widening_reuse): New.
1482 (test_iteration_1): Likewise.
1483 (selftest::test_iteration_1): Remove assertion that model6 "knows"
1484 that i < 157.
1485 * region-model.h (region_model::handle_phi): Add
1486 svals_changing_meaning param
1487 (region_model_context::maybe_did_work): New pure virtual func.
1488 (region_model_context::checking_for_infinite_loop_p): Likewise.
1489 (region_model_context::on_unusable_in_infinite_loop): Likewise.
1490 (noop_region_model_context::maybe_did_work): Implement.
1491 (noop_region_model_context::checking_for_infinite_loop_p):
1492 Likewise.
1493 (noop_region_model_context::on_unusable_in_infinite_loop):
1494 Likewise.
1495 (region_model_context_decorator::maybe_did_work): Implement.
1496 (region_model_context_decorator::checking_for_infinite_loop_p):
1497 Likewise.
1498 (region_model_context_decorator::on_unusable_in_infinite_loop):
1499 Likewise.
1500 (model_merger::on_widening_reuse): New decl.
1501 (model_merger::m_svals_changing_meaning): New field.
1502 * sm-signal.cc (register_signal_handler::impl_transition): Assume
1503 the edge "does work".
1504 * supergraph.cc (supernode::get_start_location): Use CFG edge's
1505 goto_locus if available.
1506 (supernode::get_end_location): Likewise.
1507 (cfg_superedge::dump_label_to_pp): Dump edges with a "goto_locus"
1508 * supergraph.h (cfg_superedge::get_goto_locus): New.
1509 * svalue.cc (svalue::can_merge_p): Call on_widening_reuse for
1510 widening values.
1511 (involvement_visitor::visit_widening_svalue): New.
1512 (svalue::involves_p): Update assertion to allow widening svalues.
1514 2023-11-14 David Malcolm <dmalcolm@redhat.com>
1516 PR analyzer/103533
1517 * sm-taint.cc: Remove "experimental" from comment.
1518 * sm.cc (make_checkers): Always add taint state machine.
1520 2023-11-04 David Malcolm <dmalcolm@redhat.com>
1522 * bounds-checking.cc: Update for changes to diagnostic_context.
1524 2023-11-02 David Malcolm <dmalcolm@redhat.com>
1526 PR analyzer/112317
1527 * access-diagram.cc (class x_aligned_x_ruler_widget): Eliminate
1528 unused field "m_col_widths".
1529 (access_diagram_impl::add_valid_vs_invalid_ruler): Update for
1530 above change.
1531 * region-model.cc
1532 (check_one_function_attr_null_terminated_string_arg): Remove
1533 unused variables "cd_unchecked", "strlen_sval", and
1534 "limited_sval".
1535 * region-model.h (region_model_context_decorator::warn): Add
1536 missing "override".
1538 2023-10-31 David Malcolm <dmalcolm@redhat.com>
1540 * record-layout.cc: New file, based on material in region-model.cc.
1541 * record-layout.h: Likewise.
1542 * region-model.cc: Include "analyzer/record-layout.h".
1543 (class record_layout): Move to record-layout.cc and .h
1545 2023-10-26 David Malcolm <dmalcolm@redhat.com>
1547 * region-model.cc
1548 (region_model::check_external_function_for_access_attr): Split
1549 out, replacing with...
1550 (region_model::check_function_attr_access): ...this new function
1551 and...
1552 (region_model::check_function_attrs): ...this new function.
1553 (region_model::check_one_function_attr_null_terminated_string_arg):
1554 New.
1555 (region_model::check_function_attr_null_terminated_string_arg):
1556 New.
1557 (region_model::handle_unrecognized_call): Update for renaming of
1558 check_external_function_for_access_attr to check_function_attrs.
1559 (region_model::check_for_null_terminated_string_arg): Add return
1560 value to one overload. Make both overloads const.
1561 * region-model.h: Include "stringpool.h" and "attribs.h".
1562 (region_model::check_for_null_terminated_string_arg): Add return
1563 value to one overload. Make both overloads const.
1564 (region_model::check_external_function_for_access_attr): Delete
1565 decl.
1566 (region_model::check_function_attr_access): New decl.
1567 (region_model::check_function_attr_null_terminated_string_arg):
1568 New decl.
1569 (region_model::check_one_function_attr_null_terminated_string_arg):
1570 New decl.
1571 (region_model::check_function_attrs): New decl.
1573 2023-10-09 David Malcolm <dmalcolm@redhat.com>
1575 * access-diagram.cc (boundaries::add): Explicitly state
1576 "boundaries::" scope for "kind" enum.
1578 2023-10-08 David Malcolm <dmalcolm@redhat.com>
1580 PR analyzer/111155
1581 * access-diagram.cc (boundaries::boundaries): Add logger param
1582 (boundaries::add): Add logging.
1583 (boundaries::get_hard_boundaries_in_range): New.
1584 (boundaries::m_logger): New field.
1585 (boundaries::get_table_x_for_offset): Make public.
1586 (class svalue_spatial_item): New.
1587 (class compound_svalue_spatial_item): New.
1588 (add_ellipsis_to_gaps): New.
1589 (valid_region_spatial_item::valid_region_spatial_item): Add theme
1590 param. Initialize m_boundaries, m_existing_sval, and
1591 m_existing_sval_spatial_item.
1592 (valid_region_spatial_item::add_boundaries): Set m_boundaries.
1593 Add boundaries for any m_existing_sval_spatial_item.
1594 (valid_region_spatial_item::add_array_elements_to_table): Rewrite
1595 creation of min/max index in terms of
1596 maybe_add_array_index_to_table. Rewrite ellipsis code using
1597 add_ellipsis_to_gaps. Add index values for any hard boundaries
1598 within the valid region.
1599 (valid_region_spatial_item::maybe_add_array_index_to_table): New,
1600 based on code formerly in add_array_elements_to_table.
1601 (valid_region_spatial_item::make_table): Make use of
1602 m_existing_sval_spatial_item, if any.
1603 (valid_region_spatial_item::m_boundaries): New field.
1604 (valid_region_spatial_item::m_existing_sval): New field.
1605 (valid_region_spatial_item::m_existing_sval_spatial_item): New
1606 field.
1607 (class svalue_spatial_item): Rename to...
1608 (class written_svalue_spatial_item): ...this.
1609 (class string_region_spatial_item): Rename to..
1610 (class string_literal_spatial_item): ...this. Add "kind".
1611 (string_literal_spatial_item::add_boundaries): Use m_kind to
1612 determine kind of boundary. Update for renaming of m_actual_bits
1613 to m_bits.
1614 (string_literal_spatial_item::make_table): Likewise. Support not
1615 displaying a row for byte indexes, and not displaying a row for
1616 the type.
1617 (string_literal_spatial_item::add_column_for_byte): Make byte index
1618 row optional.
1619 (svalue_spatial_item::make): Convert to...
1620 (make_written_svalue_spatial_item): ...this.
1621 (make_existing_svalue_spatial_item): New.
1622 (access_diagram_impl::access_diagram_impl): Pass theme to
1623 m_valid_region_spatial_item ctor. Update for renaming of
1624 m_svalue_spatial_item.
1625 (access_diagram_impl::find_boundaries): Pass logger to boundaries.
1626 Update for renaming of...
1627 (access_diagram_impl::m_svalue_spatial_item): Rename to...
1628 (access_diagram_impl::m_written_svalue_spatial_item): ...this.
1630 2023-10-03 David Malcolm <dmalcolm@redhat.com>
1632 * analyzer-logging.cc (logger::log_va_partial): Use text_info
1633 ctor.
1634 * analyzer.cc (make_label_text): Likewise.
1635 (make_label_text_n): Likewise.
1636 * pending-diagnostic.cc (evdesc::event_desc::formatted_print):
1637 Likewise.
1639 2023-10-02 David Malcolm <dmalcolm@redhat.com>
1641 * program-point.cc: Update for grouping of source printing fields
1642 within diagnostic_context.
1644 2023-09-15 David Malcolm <dmalcolm@redhat.com>
1646 * analyzer.cc (get_stmt_location): Handle null stmt.
1647 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic): Copy
1648 m_loc from ploc.
1649 (saved_diagnostic::operator==): Compare m_loc.
1650 (saved_diagnostic::calc_best_epath): Only use m_stmt_finder if
1651 m_loc is unknown.
1652 (dedupe_key::dedupe_key): Initialize m_loc.
1653 (dedupe_key::operator==): Compare m_loc.
1654 (dedupe_key::get_location): Use m_loc if it's known.
1655 (dedupe_key::m_loc): New field.
1656 (diagnostic_manager::emit_saved_diagnostic): Only call
1657 get_emission_location if m_loc is unknown, preferring to use m_loc
1658 if it's available.
1659 * diagnostic-manager.h (saved_diagnostic::m_loc): New field.
1660 (pending_location::pending_location): Initialize m_loc. Add
1661 overload taking a location_t rather than a stmt/stmt_finder.
1662 (pending_location::m_loc): New field.
1664 2023-09-15 David Malcolm <dmalcolm@redhat.com>
1666 * analyzer.h (struct pending_location): New forward decl.
1667 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
1668 Replace params "enode", "snode", "stmt", and "stmt_finder" with
1669 "ploc".
1670 (diagnostic_manager::add_diagnostic): Likewise for both overloads.
1671 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic):
1672 Likewise.
1673 (struct pending_location): New.
1674 (diagnostic_manager::add_diagnostic): Replace params "enode",
1675 "snode", "stmt", and "stmt_finder" with "ploc".
1676 * engine.cc (impl_region_model_context::warn): Update call to
1677 add_diagnostic for above change.
1678 (impl_sm_context::warn): Likewise.
1679 (impl_region_model_context::on_state_leak): Likewise.
1680 * infinite-recursion.cc
1681 (exploded_graph::detect_infinite_recursion): Likewise.
1683 2023-09-15 David Malcolm <dmalcolm@redhat.com>
1685 * region-model.cc (region_model::get_gassign_result): Handle
1686 volatile ops by using a conjured_svalue.
1688 2023-09-14 David Malcolm <dmalcolm@redhat.com>
1690 * checker-event.h (checker_event::get_thread_id): New.
1691 * checker-path.h (class checker_path): Implement thread-related
1692 vfuncs via a single simple_diagnostic_thread instance named
1693 "main".
1695 2023-09-14 David Malcolm <dmalcolm@redhat.com>
1697 * diagnostic-manager.cc (compatible_epath_p): Fix missing return.
1699 2023-09-14 David Malcolm <dmalcolm@redhat.com>
1701 * diagnostic-manager.cc (process_worklist_item): Use
1702 std::unique_ptr rather than plain rejected_constraint *.
1703 * engine.cc (exploded_path::feasible_p): Likewise.
1704 (feasibility_state::maybe_update_for_edge): Likewise.
1705 * exploded-graph.h (feasibility_problem::feasibility_problem):
1706 Likewise.
1707 (feasibility_problem::~feasibility_problem): Delete.
1708 (feasibility_problem::m_rc): Use std::unique_ptr.
1709 (feasibility_state::maybe_update_for_edge): Likewise.
1710 * feasible-graph.cc (feasible_graph::add_feasibility_problem):
1711 Likewise.
1712 * feasible-graph.h (class infeasible_node): Likewise.
1713 (feasible_graph::add_feasibility_problem): Likewise.
1714 * region-model.cc (region_model::add_constraint): Likewise.
1715 (region_model::maybe_update_for_edge): Likewise.
1716 (region_model::apply_constraints_for_gcond): Likewise.
1717 (region_model::apply_constraints_for_gswitch): Likewise.
1718 (region_model::apply_constraints_for_exception): Likewise.
1719 * region-model.h (class region_model): Likewise for decls.
1721 2023-09-09 benjamin priour <vultkayn@gcc.gnu.org>
1723 PR analyzer/96395
1724 * region-model.cc
1725 (region_model::add_constraints_from_binop): binop_svalues around
1726 LT_EXPR, LE_EXPR, GT_EXPR, GE_EXPR are now unwrapped.
1728 2023-09-07 David Malcolm <dmalcolm@redhat.com>
1730 PR analyzer/110529
1731 * program-point.cc (program_point::on_edge): Don't reject
1732 EDGE_ABNORMAL for computed gotos.
1733 * region-model.cc (region_model::maybe_update_for_edge): Handle
1734 computed goto statements.
1735 (region_model::apply_constraints_for_ggoto): New.
1736 * region-model.h (region_model::apply_constraints_for_ggoto): New decl.
1737 * supergraph.cc (supernode::get_label): New.
1738 * supergraph.h (supernode::get_label): New decl.
1740 2023-09-07 benjamin priour <vultkayn@gcc.gnu.org>
1741 David Malcolm <dmalcolm@redhat.com>
1743 PR analyzer/110830
1744 * diagnostic-manager.cc
1745 (compatible_epaths_p): New function.
1746 (saved_diagnostic::supercedes_p): Now calls the above
1747 to determine if the diagnostics do overlap and the superseding
1748 may proceed.
1750 2023-09-07 David Malcolm <dmalcolm@redhat.com>
1752 * region-model.h: fix -Wunused-parameter warnings
1754 2023-09-06 David Malcolm <dmalcolm@redhat.com>
1756 PR analyzer/105899
1757 * kf.cc (class kf_strstr): New.
1758 (kf_strstr::impl_call_post): New.
1759 (register_known_functions): Register it.
1761 2023-09-06 David Malcolm <dmalcolm@redhat.com>
1763 PR analyzer/105899
1764 * kf.cc (class kf_strncpy): New.
1765 (kf_strncpy::impl_call_post): New.
1766 (register_known_functions): Register it.
1767 * region-model.cc (region_model::read_bytes): Handle unknown
1768 number of bytes.
1770 2023-09-06 David Malcolm <dmalcolm@redhat.com>
1772 * kf.cc (kf_calloc::impl_call_pre): Pass ctxt to zero_fill_region.
1773 (kf_memset::impl_call_pre): Move responsibility for calling
1774 check_region_for_write to fill_region.
1775 * region-model.cc (region_model::on_assignment): Pass ctxt to
1776 zero_fill_region.
1777 (region_model::fill_region): Add "ctxt" param, using it to call
1778 check_region_for_write.
1779 (region_model::zero_fill_region): Likewise.
1780 * region-model.h (region_model::fill_region): Add "ctxt" param.
1781 (region_model::zero_fill_region): Likewise.
1783 2023-09-01 benjamin priour <priour.be@gmail.com>
1785 PR analyzer/105948
1786 PR analyzer/94355
1787 * analyzer.h (is_placement_new_p): New declaration.
1788 * call-details.cc
1789 (call_details::deref_ptr_arg): New function.
1790 Dereference the argument at given index if possible.
1791 * call-details.h: Declaration of the above function.
1792 * kf-lang-cp.cc (is_placement_new_p): Returns true if the gcall
1793 is recognized as a placement new.
1794 (kf_operator_delete::impl_call_post): Unbinding a region and its
1795 descendents now poisons with POISON_KIND_DELETED.
1796 (register_known_functions_lang_cp): Known function "operator
1797 delete" is now registered only once independently of its number of
1798 arguments.
1799 * region-model.cc (region_model::eval_condition): Now
1800 recursively calls itself if any of the operand is wrapped in a
1801 cast.
1802 * sm-malloc.cc (malloc_state_machine::on_stmt):
1803 Add placement new recognition.
1804 * svalue.cc (poison_kind_to_str): Wording for the new PK.
1805 * svalue.h (enum poison_kind): Add value POISON_KIND_DELETED.
1807 2023-08-31 Francois-Xavier Coudert <fxcoudert@gcc.gnu.org>
1809 * kf.cc: Change spelling to macOS.
1811 2023-08-30 Eric Feng <ef2648@columbia.edu>
1813 PR analyzer/107646
1814 * engine.cc (impl_region_model_context::warn): New optional
1815 parameter.
1816 * exploded-graph.h (class impl_region_model_context): Likewise.
1817 * region-model.cc (region_model::pop_frame): New callback
1818 feature for region_model::pop_frame.
1819 * region-model.h (struct append_regions_cb_data): Likewise.
1820 (class region_model): Likewise.
1821 (class region_model_context): New optional parameter.
1822 (class region_model_context_decorator): Likewise.
1824 2023-08-30 Francois-Xavier Coudert <fxcoudert@gcc.gnu.org>
1826 * region-model.cc: Define INCLUDE_ALGORITHM.
1828 2023-08-29 David Malcolm <dmalcolm@redhat.com>
1830 PR analyzer/99860
1831 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
1832 selftest::analyzer_ranges_cc_tests.
1833 * analyzer-selftests.h (selftest::run_analyzer_selftests): New
1834 decl.
1835 * analyzer.opt (Wanalyzer-overlapping-buffers): New option.
1836 * call-details.cc: Include "analyzer/ranges.h" and "make-unique.h".
1837 (class overlapping_buffers): New.
1838 (call_details::complain_about_overlap): New.
1839 * call-details.h (call_details::complain_about_overlap): New decl.
1840 * kf.cc (kf_memcpy_memmove::impl_call_pre): Call
1841 cd.complain_about_overlap for memcpy and memcpy_chk.
1842 (kf_strcat::impl_call_pre): Call cd.complain_about_overlap.
1843 (kf_strcpy::impl_call_pre): Likewise.
1844 * ranges.cc: New file.
1845 * ranges.h: New file.
1847 2023-08-29 David Malcolm <dmalcolm@redhat.com>
1849 PR analyzer/105899
1850 * kf.cc (kf_strdup::impl_call_pre): Set size of
1851 dynamically-allocated buffer. Simulate copying the string from
1852 the source region to the new buffer.
1854 2023-08-27 benjamin priour <vultkayn@gcc.gnu.org>
1856 PR analyzer/96395
1857 * analyzer.h (class known_function): Add virtual casts
1858 to builtin_known_function.
1859 (class builtin_known_function): New subclass of known_function
1860 for builtins.
1861 * kf.cc (class kf_alloca): Now derived from
1862 builtin_known_function.
1863 (class kf_calloc): Likewise.
1864 (class kf_free): Likewise.
1865 (class kf_malloc): Likewise.
1866 (class kf_memcpy_memmove): Likewise.
1867 (class kf_memset): Likewise.
1868 (class kf_realloc): Likewise.
1869 (class kf_strchr): Likewise.
1870 (class kf_sprintf): Likewise.
1871 (class kf_strcat): Likewise.
1872 (class kf_strcpy): Likewise.
1873 (class kf_strdup): Likewise.
1874 (class kf_strlen): Likewise.
1875 (class kf_strndup): Likewise.
1876 (register_known_functions): Builtins are now registered as
1877 known_functions by name rather than by their BUILTIN_CODE.
1878 * known-function-manager.cc (get_normal_builtin): New overload.
1879 * known-function-manager.h: New overload declaration.
1880 * region-model.cc (region_model::get_builtin_kf): New function.
1881 * region-model.h (class region_model): Add declaration of
1882 get_builtin_kf.
1883 * sm-fd.cc: For called recognized as builtins, use the
1884 attributes of that builtin as defined in gcc/builtins.def
1885 rather than the user's.
1886 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
1888 2023-08-25 David Malcolm <dmalcolm@redhat.com>
1890 * access-diagram.cc (class string_region_spatial_item): Remove
1891 assumption that the string is written to the start of the cluster.
1893 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1895 PR analyzer/105899
1896 * call-details.cc
1897 (call_details::check_for_null_terminated_string_arg): Split into
1898 overloads, one taking just an arg_idx, the other a new
1899 "include_terminator" param.
1900 * call-details.h: Likewise.
1901 * kf.cc (class kf_strcat): New.
1902 (kf_strcpy::impl_call_pre): Update for change to
1903 check_for_null_terminated_string_arg.
1904 (register_known_functions): Register kf_strcat.
1905 * region-model.cc
1906 (region_model::check_for_null_terminated_string_arg): Split into
1907 overloads, one taking just an arg_idx, the other a new
1908 "include_terminator" param. When returning an svalue, handle
1909 "include_terminator" being false by subtracting one.
1910 * region-model.h
1911 (region_model::check_for_null_terminated_string_arg): Split into
1912 overloads, one taking just an arg_idx, the other a new
1913 "include_terminator" param.
1915 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1917 PR analyzer/105899
1918 * region-model.cc (fragment::has_null_terminator): Handle
1919 SK_BITS_WITHIN.
1921 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1923 PR analyzer/105899
1924 * region-model-manager.cc
1925 (region_model_manager::get_or_create_initial_value): Simplify
1926 INIT_VAL(ELEMENT_REG(STRING_REG), CONSTANT_SVAL) to
1927 CONSTANT_SVAL(STRING[N]).
1929 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1931 PR analyzer/105899
1932 * region-model.cc (fragment::has_null_terminator): Move STRING_CST
1933 handling to fragment::string_cst_has_null_terminator; also use it to
1934 handle INIT_VAL(STRING_REG).
1935 (fragment::string_cst_has_null_terminator): New, from above.
1937 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1939 * kf.cc (kf_memcpy_memmove::impl_call_pre): Reimplement using
1940 region_model::copy_bytes.
1941 * region-model.cc (region_model::read_bytes): New.
1942 (region_model::copy_bytes): New.
1943 * region-model.h (region_model::read_bytes): New decl.
1944 (region_model::copy_bytes): New decl.
1946 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1948 PR analyzer/105899
1949 * region-model.cc (region_model::get_string_size): Delete both.
1950 * region-model.h (region_model::get_string_size): Delete both
1951 decls.
1953 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1955 PR analyzer/105899
1956 * kf.cc (kf_strcpy::impl_call_pre): Reimplement using
1957 check_for_null_terminated_string_arg.
1958 * region-model.cc (region_model::get_store_bytes): Shortcut
1959 reading all of a string_region.
1960 (region_model::scan_for_null_terminator): Use get_store_value for
1961 the bytes rather than "unknown" when returning an unknown length.
1962 (region_model::write_bytes): New.
1963 * region-model.h (region_model::write_bytes): New decl.
1965 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1967 PR analyzer/105899
1968 * region-model.cc (iterable_cluster::iterable_cluster): Add
1969 symbolic binding keys to m_symbolic_bindings.
1970 (iterable_cluster::has_symbolic_bindings_p): New.
1971 (iterable_cluster::m_symbolic_bindings): New field.
1972 (region_model::scan_for_null_terminator): Treat clusters with
1973 symbolic bindings as having unknown strlen.
1975 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1977 * engine.cc (impl_path_context::impl_path_context): Add logger
1978 param.
1979 (impl_path_context::bifurcate): Add log message.
1980 (impl_path_context::terminate_path): Likewise.
1981 (impl_path_context::m_logger): New field.
1982 (exploded_graph::process_node): Pass logger to path_ctxt ctor.
1984 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1986 PR analyzer/105899
1987 * kf-analyzer.cc (class kf_analyzer_get_strlen): Move to kf.cc.
1988 (register_known_analyzer_functions): Use make_kf_strlen.
1989 * kf.cc (class kf_strlen::impl_call_pre): Replace with
1990 implementation of kf_analyzer_get_strlen from kf-analyzer.cc.
1991 Handle "UNKNOWN" return from check_for_null_terminated_string_arg
1992 by falling back to a conjured svalue.
1993 (make_kf_strlen): New.
1994 (register_known_functions): Use make_kf_strlen.
1995 * known-function-manager.h (make_kf_strlen): New decl.
1997 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1999 PR analyzer/105899
2000 * call-details.cc (call_details::call_details): New ctor.
2001 * call-details.h (call_details::call_details): New ctor decl.
2002 (struct call_arg_details): Move here from region-model.cc.
2003 * region-model.cc (region_model::check_call_format_attr): New.
2004 (region_model::check_call_args): Call it.
2005 (struct call_arg_details): Move it to call-details.h.
2006 * region-model.h (region_model::check_call_format_attr): New decl.
2008 2023-08-22 David Malcolm <dmalcolm@redhat.com>
2010 * kf.cc (class kf_fopen): New.
2011 (register_known_functions): Register it.
2013 2023-08-22 David Malcolm <dmalcolm@redhat.com>
2015 PR analyzer/105899
2016 * analyzer.opt (Wanalyzer-unterminated-string): Delete.
2017 * call-details.cc
2018 (call_details::check_for_null_terminated_string_arg): Convert
2019 return type from void to const svalue *. Add param "out_sval".
2020 * call-details.h
2021 (call_details::check_for_null_terminated_string_arg): Likewise.
2022 * kf-analyzer.cc (kf_analyzer_get_strlen::impl_call_pre): Wire up
2023 to result of check_for_null_terminated_string_arg.
2024 * region-model.cc (get_strlen): Delete.
2025 (class unterminated_string_arg): Delete.
2026 (struct fragment): New.
2027 (class iterable_cluster): New.
2028 (region_model::get_store_bytes): New.
2029 (get_tree_for_byte_offset): New.
2030 (region_model::scan_for_null_terminator): New.
2031 (region_model::check_for_null_terminated_string_arg): Convert
2032 return type from void to const svalue *. Add param "out_sval".
2033 Reimplement in terms of scan_for_null_terminator, dropping the
2034 special-case for -Wanalyzer-unterminated-string.
2035 * region-model.h (region_model::get_store_bytes): New decl.
2036 (region_model::scan_for_null_terminator): New decl.
2037 (region_model::check_for_null_terminated_string_arg): Convert
2038 return type from void to const svalue *. Add param "out_sval".
2039 * store.cc (concrete_binding::get_byte_range): New.
2040 * store.h (concrete_binding::get_byte_range): New decl.
2041 (store_manager::get_concrete_binding): New overload.
2043 2023-08-22 David Malcolm <dmalcolm@redhat.com>
2045 * region-model.cc (region_model_context_decorator::add_event):
2046 Handle m_inner being NULL.
2047 * region-model.h (class region_model_context_decorator): Likewise.
2048 (annotating_context::warn): Likewise.
2050 2023-08-22 David Malcolm <dmalcolm@redhat.com>
2052 * diagnostic-manager.cc (saved_diagnostic::add_event): New.
2053 (saved_diagnostic::add_any_saved_events): New.
2054 (diagnostic_manager::add_event): New.
2055 (dedupe_winners::emit_best): New.
2056 (diagnostic_manager::emit_saved_diagnostic): Make "sd" param
2057 non-const. Call saved_diagnostic::add_any_saved_events.
2058 * diagnostic-manager.h (saved_diagnostic::add_event): New decl.
2059 (saved_diagnostic::add_any_saved_events): New decl.
2060 (saved_diagnostic::m_saved_events): New field.
2061 (diagnostic_manager::add_event): New decl.
2062 (diagnostic_manager::emit_saved_diagnostic): Make "sd" param
2063 non-const.
2064 * engine.cc (impl_region_model_context::add_event): New.
2065 * exploded-graph.h (impl_region_model_context::add_event): New decl.
2066 * region-model.cc
2067 (noop_region_model_context::add_event): New.
2068 (region_model_context_decorator::add_event): New.
2069 * region-model.h (region_model_context::add_event): New vfunc.
2070 (noop_region_model_context::add_event): New decl.
2071 (region_model_context_decorator::add_event): New decl.
2073 2023-08-22 David Malcolm <dmalcolm@redhat.com>
2075 * region-model.cc
2076 (class check_external_function_for_access_attr::annotating_ctxt):
2077 Convert to an annotating_context.
2078 * region-model.h (class note_adding_context): Rename to...
2079 (class annotating_context): ...this, updating the "warn" method.
2080 (note_adding_context::make_note): Replace with...
2081 (annotating_context::add_annotations): ...this.
2083 2023-08-14 benjamin priour <vultkayn@gcc.gnu.org>
2085 PR analyzer/110543
2086 * analyzer.opt: Add new option.
2087 * diagnostic-manager.cc
2088 (diagnostic_manager::prune_path): Call prune_system_headers.
2089 (prune_frame): New function that deletes all events in a frame.
2090 (diagnostic_manager::prune_system_headers): New function.
2091 * diagnostic-manager.h: Add prune_system_headers declaration.
2093 2023-08-11 David Malcolm <dmalcolm@redhat.com>
2095 PR analyzer/105899
2096 * analyzer.opt (Wanalyzer-unterminated-string): New.
2097 * call-details.cc
2098 (call_details::check_for_null_terminated_string_arg): New.
2099 * call-details.h
2100 (call_details::check_for_null_terminated_string_arg): New decl.
2101 * kf-analyzer.cc (class kf_analyzer_get_strlen): New.
2102 (register_known_analyzer_functions): Register it.
2103 * kf.cc (kf_error::impl_call_pre): Check that format arg is a
2104 valid null-terminated string.
2105 (kf_putenv::impl_call_pre): Likewise for the sole param.
2106 (kf_strchr::impl_call_pre): Likewise for the first param.
2107 (kf_strcpy::impl_call_pre): Likewise for the second param.
2108 (kf_strdup::impl_call_pre): Likewise for the sole param.
2109 * region-model.cc (get_strlen): New.
2110 (struct call_arg_details): New.
2111 (inform_about_expected_null_terminated_string_arg): New.
2112 (class unterminated_string_arg): New.
2113 (region_model::check_for_null_terminated_string_arg): New.
2114 * region-model.h
2115 (region_model::check_for_null_terminated_string_arg): New decl.
2117 2023-08-11 Eric Feng <ef2648@columbia.edu>
2119 PR analyzer/107646
2120 * call-details.h: New function.
2121 * region-model.cc (region_model::get_or_create_region_for_heap_alloc):
2122 New optional parameters.
2123 * region-model.h (class region_model): New optional parameters.
2124 * sm-malloc.cc (on_realloc_with_move): New function.
2125 (region_model::transition_ptr_sval_non_null): New function.
2127 2023-08-09 David Malcolm <dmalcolm@redhat.com>
2129 * analyzer.h (class pure_known_function_with_default_return): New
2130 subclass.
2131 * call-details.cc (const_fn_p): Move here from region-model.cc.
2132 (maybe_get_const_fn_result): Likewise.
2133 (get_result_size_in_bytes): Likewise.
2134 (call_details::set_any_lhs_with_defaults): New function, based on
2135 code in region_model::on_call_pre.
2136 * call-details.h (call_details::set_any_lhs_with_defaults): New
2137 decl.
2138 * diagnostic-manager.cc
2139 (diagnostic_manager::emit_saved_diagnostic): Log the index of the
2140 saved_diagnostic.
2141 * kf.cc (pure_known_function_with_default_return::impl_call_pre):
2142 New.
2143 (kf_memset::impl_call_pre): Set the LHS to the first param.
2144 (kf_putenv::impl_call_pre): Call cd.set_any_lhs_with_defaults.
2145 (kf_sprintf::impl_call_pre): Call cd.set_any_lhs_with_defaults.
2146 (class kf_stack_restore): Derive from
2147 pure_known_function_with_default_return.
2148 (class kf_stack_save): Likewise.
2149 (kf_strlen::impl_call_pre): Call cd.set_any_lhs_with_defaults.
2150 * region-model-reachability.cc (reachable_regions::handle_sval):
2151 Remove logic for symbolic regions for pointers.
2152 * region-model.cc (region_model::canonicalize): Remove purging of
2153 dynamic extents workaround for surplus values from
2154 region_model::on_call_pre's default LHS code.
2155 (const_fn_p): Move to call-details.cc.
2156 (maybe_get_const_fn_result): Likewise.
2157 (get_result_size_in_bytes): Likewise.
2158 (region_model::update_for_nonzero_return): Call
2159 cd.set_any_lhs_with_defaults.
2160 (region_model::on_call_pre): Remove the assignment to the LHS of a
2161 default return value, instead requiring all known_function
2162 implementations to write to any LHS of the call. Use
2163 cd.set_any_lhs_with_defaults on the non-kf paths.
2164 * sm-fd.cc (kf_socket::outcome_of_socket::update_model): Use
2165 cd.set_any_lhs_with_defaults when failing to get at fd state.
2166 (kf_bind::outcome_of_bind::update_model): Likewise.
2167 (kf_listen::outcome_of_listen::update_model): Likewise.
2168 (kf_accept::outcome_of_accept::update_model): Likewise.
2169 (kf_connect::outcome_of_connect::update_model): Likewise.
2170 (kf_read::impl_call_pre): Use cd.set_any_lhs_with_defaults.
2171 * sm-file.cc (class kf_stdio_output_fn): Derive from
2172 pure_known_function_with_default_return.
2173 (class kf_ferror): Likewise.
2174 (class kf_fileno): Likewise.
2175 (kf_fgets::impl_call_pre): Use cd.set_any_lhs_with_defaults.
2176 (kf_read::impl_call_pre): Likewise.
2177 (class kf_getc): Derive from
2178 pure_known_function_with_default_return.
2179 (class kf_getchar): Likewise.
2180 * varargs.cc (kf_va_arg::impl_call_pre): Use
2181 cd.set_any_lhs_with_defaults.
2183 2023-08-04 David Malcolm <dmalcolm@redhat.com>
2185 PR analyzer/110426
2186 * bounds-checking.cc (region_model::check_region_bounds): Handle
2187 symbolic base regions.
2188 * call-details.cc: Include "stringpool.h" and "attribs.h".
2189 (call_details::lookup_function_attribute): New function.
2190 * call-details.h (call_details::lookup_function_attribute): New
2191 function decl.
2192 * region-model-manager.cc
2193 (region_model_manager::maybe_fold_binop): Add reference to
2194 PR analyzer/110902.
2195 * region-model-reachability.cc (reachable_regions::handle_sval):
2196 Add symbolic regions for pointers that are conjured svalues for
2197 the LHS of a stmt.
2198 * region-model.cc (region_model::canonicalize): Purge dynamic
2199 extents for regions that aren't referenced.
2200 (get_result_size_in_bytes): New function.
2201 (region_model::on_call_pre): Use get_result_size_in_bytes and
2202 potentially set the dynamic extents of the region pointed to by
2203 the return value.
2204 (region_model::deref_rvalue): Add param "add_nonnull_constraint"
2205 and use it to conditionalize adding the constraint.
2206 (pending_diagnostic_subclass::dubious_allocation_size): Add "stmt"
2207 param to both ctors and use it to initialize new "m_stmt" field.
2208 (pending_diagnostic_subclass::operator==): Use m_stmt; don't use
2209 m_lhs or m_rhs.
2210 (pending_diagnostic_subclass::m_stmt): New field.
2211 (region_model::check_region_size): Generalize to any kind of
2212 pointer svalue by using deref_rvalue rather than checking for
2213 region_svalue. Pass stmt to dubious_allocation_size ctor.
2214 * region-model.h (region_model::deref_rvalue): Add param
2215 "add_nonnull_constraint".
2216 * svalue.cc (conjured_svalue::lhs_value_p): New function.
2217 * svalue.h (conjured_svalue::lhs_value_p): New decl.
2219 2023-08-04 David Malcolm <dmalcolm@redhat.com>
2221 * svalue.cc (region_svalue::dump_to_pp): Support NULL type.
2222 (constant_svalue::dump_to_pp): Likewise.
2223 (initial_svalue::dump_to_pp): Likewise.
2224 (conjured_svalue::dump_to_pp): Likewise. Fix missing print of the
2225 type.
2227 2023-08-03 David Malcolm <dmalcolm@redhat.com>
2229 PR analyzer/110882
2230 * region.cc (int_size_in_bits): Fail on zero-sized types.
2232 2023-08-02 Eric Feng <ef2648@columbia.edu>
2234 PR analyzer/107646
2235 * analyzer-language.cc (run_callbacks): New function.
2236 (on_finish_translation_unit): New function.
2237 * analyzer-language.h (GCC_ANALYZER_LANGUAGE_H): New include.
2238 (class translation_unit): New vfuncs.
2240 2023-07-26 David Malcolm <dmalcolm@redhat.com>
2242 PR analyzer/104940
2243 * region-model-manager.cc
2244 (region_model_manager::region_model_manager): Update for
2245 generalizing region ids to also cover svalues.
2246 (region_model_manager::get_or_create_constant_svalue): Likewise.
2247 (region_model_manager::get_or_create_unknown_svalue): Likewise.
2248 (region_model_manager::create_unique_svalue): Likewise.
2249 (region_model_manager::get_or_create_initial_value): Likewise.
2250 (region_model_manager::get_or_create_setjmp_svalue): Likewise.
2251 (region_model_manager::get_or_create_poisoned_svalue): Likewise.
2252 (region_model_manager::get_ptr_svalue): Likewise.
2253 (region_model_manager::get_or_create_unaryop): Likewise.
2254 (region_model_manager::get_or_create_binop): Likewise.
2255 (region_model_manager::get_or_create_sub_svalue): Likewise.
2256 (region_model_manager::get_or_create_repeated_svalue): Likewise.
2257 (region_model_manager::get_or_create_bits_within): Likewise.
2258 (region_model_manager::get_or_create_unmergeable): Likewise.
2259 (region_model_manager::get_or_create_widening_svalue): Likewise.
2260 (region_model_manager::get_or_create_compound_svalue): Likewise.
2261 (region_model_manager::get_or_create_conjured_svalue): Likewise.
2262 (region_model_manager::get_or_create_asm_output_svalue): Likewise.
2263 (region_model_manager::get_or_create_const_fn_result_svalue):
2264 Likewise.
2265 (region_model_manager::get_region_for_fndecl): Likewise.
2266 (region_model_manager::get_region_for_label): Likewise.
2267 (region_model_manager::get_region_for_global): Likewise.
2268 (region_model_manager::get_field_region): Likewise.
2269 (region_model_manager::get_element_region): Likewise.
2270 (region_model_manager::get_offset_region): Likewise.
2271 (region_model_manager::get_sized_region): Likewise.
2272 (region_model_manager::get_cast_region): Likewise.
2273 (region_model_manager::get_frame_region): Likewise.
2274 (region_model_manager::get_symbolic_region): Likewise.
2275 (region_model_manager::get_region_for_string): Likewise.
2276 (region_model_manager::get_bit_range): Likewise.
2277 (region_model_manager::get_var_arg_region): Likewise.
2278 (region_model_manager::get_region_for_unexpected_tree_code):
2279 Likewise.
2280 (region_model_manager::get_or_create_region_for_heap_alloc):
2281 Likewise.
2282 (region_model_manager::create_region_for_alloca): Likewise.
2283 (region_model_manager::log_stats): Likewise.
2284 * region-model-manager.h (region_model_manager::get_num_regions):
2285 Replace with...
2286 (region_model_manager::get_num_symbols): ...this.
2287 (region_model_manager::alloc_region_id): Replace with...
2288 (region_model_manager::alloc_symbol_id): ...this.
2289 (region_model_manager::m_next_region_id): Replace with...
2290 (region_model_manager::m_next_symbol_id): ...this.
2291 * region-model.cc (selftest::test_get_representative_tree): Update
2292 for generalizing region ids to also cover svalues.
2293 (selftest::test_binop_svalue_folding): Likewise.
2294 (selftest::test_state_merging): Likewise.
2295 * region.cc (region::cmp_ids): Delete, in favor of
2296 symbol::cmp_ids.
2297 (region::region): Update for introduction of symbol base class.
2298 (frame_region::get_region_for_local): Likewise.
2299 (root_region::root_region): Likewise.
2300 (symbolic_region::symbolic_region): Likewise.
2301 * region.h: Replace include of "analyzer/complexity.h" with
2302 "analyzer/symbol.h".
2303 (class region): Make a subclass of symbol.
2304 (region::get_id): Delete in favor of symbol::get_id.
2305 (region::cmp_ids): Delete in favor of symbol::cmp_ids.
2306 (region::get_complexity): Delete in favor of
2307 symbol::get_complexity.
2308 (region::region): Use symbol::id_t for "id" param.
2309 (region::m_complexity): Move field to symbol base class.
2310 (region::m_id): Likewise.
2311 (space_region::space_region): Use symbol::id_t for "id" param.
2312 (frame_region::frame_region): Likewise.
2313 (globals_region::globals_region): Likewise.
2314 (code_region::code_region): Likewise.
2315 (function_region::function_region): Likewise.
2316 (label_region::label_region): Likewise.
2317 (stack_region::stack_region): Likewise.
2318 (heap_region::heap_region): Likewise.
2319 (thread_local_region::thread_local_region): Likewise.
2320 (root_region::root_region): Likewise.
2321 (symbolic_region::symbolic_region): Likewise.
2322 (decl_region::decl_region): Likewise.
2323 (field_region::field_region): Likewise.
2324 (element_region::element_region): Likewise.
2325 (offset_region::offset_region): Likewise.
2326 (sized_region::sized_region): Likewise.
2327 (cast_region::cast_region): Likewise.
2328 (heap_allocated_region::heap_allocated_region): Likewise.
2329 (alloca_region::alloca_region): Likewise.
2330 (string_region::string_region): Likewise.
2331 (bit_range_region::bit_range_region): Likewise.
2332 (var_arg_region::var_arg_region): Likewise.
2333 (errno_region::errno_region): Likewise.
2334 (unknown_region::unknown_region): Likewise.
2335 * svalue.cc (sub_svalue::sub_svalue): Add symbol::id_t param.
2336 (repeated_svalue::repeated_svalue): Likewise.
2337 (bits_within_svalue::bits_within_svalue): Likewise.
2338 (compound_svalue::compound_svalue): Likewise.
2339 * svalue.h: Replace include of "analyzer/complexity.h" with
2340 "analyzer/symbol.h".
2341 (class svalue): Make a subclass of symbol.
2342 (svalue::get_complexity): Delete in favor of
2343 symbol::get_complexity.
2344 (svalue::svalue): Add symbol::id_t param. Update for new base
2345 class.
2346 (svalue::m_complexity): Delete in favor of
2347 symbol::m_complexity.
2348 (region_svalue::region_svalue): Add symbol::id_t param
2349 (constant_svalue::constant_svalue): Likewise.
2350 (unknown_svalue::unknown_svalue): Likewise.
2351 (poisoned_svalue::poisoned_svalue): Likewise.
2352 (setjmp_svalue::setjmp_svalue): Likewise.
2353 (initial_svalue::initial_svalue): Likewise.
2354 (unaryop_svalue::unaryop_svalue): Likewise.
2355 (binop_svalue::binop_svalue): Likewise.
2356 (sub_svalue::sub_svalue): Likewise.
2357 (repeated_svalue::repeated_svalue): Likewise.
2358 (bits_within_svalue::bits_within_svalue): Likewise.
2359 (unmergeable_svalue::unmergeable_svalue): Likewise.
2360 (placeholder_svalue::placeholder_svalue): Likewise.
2361 (widening_svalue::widening_svalue): Likewise.
2362 (compound_svalue::compound_svalue): Likewise.
2363 (conjured_svalue::conjured_svalue): Likewise.
2364 (asm_output_svalue::asm_output_svalue): Likewise.
2365 (const_fn_result_svalue::const_fn_result_svalue): Likewise.
2366 * symbol.cc: New file.
2367 * symbol.h: New file.
2369 2023-07-21 David Malcolm <dmalcolm@redhat.com>
2371 PR analyzer/110455
2372 * region-model.cc (region_model::get_gassign_result): Only check
2373 for bad shift counts when dealing with an integral type.
2375 2023-07-21 David Malcolm <dmalcolm@redhat.com>
2377 PR analyzer/110433
2378 PR middle-end/110612
2379 * access-diagram.cc (class spatial_item): Add virtual dtor.
2381 2023-07-21 David Malcolm <dmalcolm@redhat.com>
2383 PR analyzer/110387
2384 * region.h (struct cast_region::key_t): Support "m_type" being
2385 null by using "m_original_region" for empty/deleted slots.
2387 2023-07-19 David Malcolm <dmalcolm@redhat.com>
2389 PR analyzer/110700
2390 * region-model-manager.cc
2391 (region_model_manager::get_or_create_int_cst): Assert that we have
2392 an integral or pointer type.
2393 * sm-taint.cc (taint_state_machine::check_for_tainted_divisor):
2394 Don't check non-integral types.
2396 2023-06-29 benjamin priour <priour.be@gmail.com>
2398 PR analyzer/110198
2399 * region-model-manager.cc
2400 (region_model_manager::get_or_create_initial_value): Take an
2401 optional boolean value to bypass poisoning checks
2402 * region-model-manager.h: Update declaration of the above function.
2403 * region-model.cc (region_model::get_store_value): No longer returns
2404 on OOB, but rather gives a boolean to get_or_create_initial_value.
2405 (region_model::check_region_access): Update docstring.
2406 (region_model::check_region_for_write): Update docstring.
2408 2023-06-24 David Malcolm <dmalcolm@redhat.com>
2410 * access-diagram.cc: Add #define INCLUDE_VECTOR.
2411 * bounds-checking.cc: Likewise.
2413 2023-06-22 David Malcolm <dmalcolm@redhat.com>
2415 PR analyzer/106626
2416 * access-diagram.cc: New file.
2417 * access-diagram.h: New file.
2418 * analyzer.h (class region_offset): Add default ctor.
2419 (region_offset::make_byte_offset): New decl.
2420 (region_offset::concrete_p): New.
2421 (region_offset::get_concrete_byte_offset): New.
2422 (region_offset::calc_symbolic_bit_offset): New decl.
2423 (region_offset::calc_symbolic_byte_offset): New decl.
2424 (region_offset::dump_to_pp): New decl.
2425 (region_offset::dump): New decl.
2426 (operator<, operator<=, operator>, operator>=): New decls for
2427 region_offset.
2428 * analyzer.opt
2429 (-param=analyzer-text-art-string-ellipsis-threshold=): New.
2430 (-param=analyzer-text-art-string-ellipsis-head-len=): New.
2431 (-param=analyzer-text-art-string-ellipsis-tail-len=): New.
2432 (-param=analyzer-text-art-ideal-canvas-width=): New.
2433 (fanalyzer-debug-text-art): New.
2434 * bounds-checking.cc: Include "intl.h", "diagnostic-diagram.h",
2435 and "analyzer/access-diagram.h".
2436 (class out_of_bounds::oob_region_creation_event_capacity): New.
2437 (out_of_bounds::out_of_bounds): Add "model" and "sval_hint"
2438 params.
2439 (out_of_bounds::mark_interesting_stuff): Use the base region.
2440 (out_of_bounds::add_region_creation_events): Use
2441 oob_region_creation_event_capacity.
2442 (out_of_bounds::get_dir): New pure vfunc.
2443 (out_of_bounds::maybe_show_notes): New.
2444 (out_of_bounds::maybe_show_diagram): New.
2445 (out_of_bounds::make_access_diagram): New.
2446 (out_of_bounds::m_model): New field.
2447 (out_of_bounds::m_sval_hint): New field.
2448 (out_of_bounds::m_region_creation_event_id): New field.
2449 (concrete_out_of_bounds::concrete_out_of_bounds): Update for new
2450 fields.
2451 (concrete_past_the_end::concrete_past_the_end): Likewise.
2452 (concrete_past_the_end::add_region_creation_events): Use
2453 oob_region_creation_event_capacity.
2454 (concrete_buffer_overflow::concrete_buffer_overflow): Update for
2455 new fields.
2456 (concrete_buffer_overflow::emit): Replace call to
2457 maybe_describe_array_bounds with maybe_show_notes.
2458 (concrete_buffer_overflow::get_dir): New.
2459 (concrete_buffer_over_read::concrete_buffer_over_read): Update for
2460 new fields.
2461 (concrete_buffer_over_read::emit): Replace call to
2462 maybe_describe_array_bounds with maybe_show_notes.
2463 (concrete_buffer_overflow::get_dir): New.
2464 (concrete_buffer_underwrite::concrete_buffer_underwrite): Update
2465 for new fields.
2466 (concrete_buffer_underwrite::emit): Replace call to
2467 maybe_describe_array_bounds with maybe_show_notes.
2468 (concrete_buffer_underwrite::get_dir): New.
2469 (concrete_buffer_under_read::concrete_buffer_under_read): Update
2470 for new fields.
2471 (concrete_buffer_under_read::emit): Replace call to
2472 maybe_describe_array_bounds with maybe_show_notes.
2473 (concrete_buffer_under_read::get_dir): New.
2474 (symbolic_past_the_end::symbolic_past_the_end): Update for new
2475 fields.
2476 (symbolic_buffer_overflow::symbolic_buffer_overflow): Likewise.
2477 (symbolic_buffer_overflow::emit): Call maybe_show_notes.
2478 (symbolic_buffer_overflow::get_dir): New.
2479 (symbolic_buffer_over_read::symbolic_buffer_over_read): Update for
2480 new fields.
2481 (symbolic_buffer_over_read::emit): Call maybe_show_notes.
2482 (symbolic_buffer_over_read::get_dir): New.
2483 (region_model::check_symbolic_bounds): Add "sval_hint" param. Pass
2484 it and sized_offset_reg to diagnostics.
2485 (region_model::check_region_bounds): Add "sval_hint" param, passing
2486 it to diagnostics.
2487 * diagnostic-manager.cc
2488 (diagnostic_manager::emit_saved_diagnostic): Pass logger to
2489 pending_diagnostic::emit.
2490 * engine.cc: Add logger param to pending_diagnostic::emit
2491 implementations.
2492 * infinite-recursion.cc: Likewise.
2493 * kf-analyzer.cc: Likewise.
2494 * kf.cc: Likewise. Add nullptr for new param of
2495 check_region_for_write.
2496 * pending-diagnostic.h: Likewise in decl.
2497 * region-model-manager.cc
2498 (region_model_manager::get_or_create_int_cst): Convert param from
2499 poly_int64 to const poly_wide_int_ref &.
2500 (region_model_manager::maybe_fold_binop): Support type being NULL
2501 when checking for floating-point types.
2502 Check for (X + Y) - X => Y. Be less strict about types when folding
2503 associative ops. Check for (X + Y) * CST => (X * CST) + (Y * CST).
2504 * region-model-manager.h
2505 (region_model_manager::get_or_create_int_cst): Convert param from
2506 poly_int64 to const poly_wide_int_ref &.
2507 * region-model.cc: Add logger param to pending_diagnostic::emit
2508 implementations.
2509 (region_model::check_external_function_for_access_attr): Update
2510 for new param of check_region_for_write.
2511 (region_model::deref_rvalue): Use nullptr rather than NULL.
2512 (region_model::get_capacity): Handle RK_STRING.
2513 (region_model::check_region_access): Add "sval_hint" param; pass it to
2514 check_region_bounds.
2515 (region_model::check_region_for_write): Add "sval_hint" param;
2516 pass it to check_region_access.
2517 (region_model::check_region_for_read): Add NULL for new param to
2518 check_region_access.
2519 (region_model::set_value): Pass rhs_sval to
2520 check_region_for_write.
2521 (region_model::get_representative_path_var_1): Handle SK_CONSTANT
2522 in the check for infinite recursion.
2523 * region-model.h (region_model::check_region_for_write): Add
2524 "sval_hint" param.
2525 (region_model::check_region_access): Likewise.
2526 (region_model::check_symbolic_bounds): Likewise.
2527 (region_model::check_region_bounds): Likewise.
2528 * region.cc (region_offset::make_byte_offset): New.
2529 (region_offset::calc_symbolic_bit_offset): New.
2530 (region_offset::calc_symbolic_byte_offset): New.
2531 (region_offset::dump_to_pp): New.
2532 (region_offset::dump): New.
2533 (struct linear_op): New.
2534 (operator<, operator<=, operator>, operator>=): New, for
2535 region_offset.
2536 (region::get_next_offset): New.
2537 (region::get_relative_symbolic_offset): Use ptrdiff_type_node.
2538 (field_region::get_relative_symbolic_offset): Likewise.
2539 (element_region::get_relative_symbolic_offset): Likewise.
2540 (bit_range_region::get_relative_symbolic_offset): Likewise.
2541 * region.h (region::get_next_offset): New decl.
2542 * sm-fd.cc: Add logger param to pending_diagnostic::emit
2543 implementations.
2544 * sm-file.cc: Likewise.
2545 * sm-malloc.cc: Likewise.
2546 * sm-pattern-test.cc: Likewise.
2547 * sm-sensitive.cc: Likewise.
2548 * sm-signal.cc: Likewise.
2549 * sm-taint.cc: Likewise.
2550 * store.cc (bit_range::contains_p): Allow "out" to be null.
2551 * store.h (byte_range::get_start_bit_offset): New.
2552 (byte_range::get_next_bit_offset): New.
2553 * varargs.cc: Add logger param to pending_diagnostic::emit
2554 implementations.
2556 2023-06-10 Tim Lange <mail@tim-lange.me>
2558 PR analyzer/109577
2559 * constraint-manager.cc (class sval_finder): Visitor to find
2560 childs in svalue trees.
2561 (constraint_manager::sval_constrained_p): Add new function to
2562 check whether a sval might be part of an constraint.
2563 * constraint-manager.h: Add sval_constrained_p function.
2564 * region-model.cc (class size_visitor): Reverse behavior to not
2565 emit a warning on not explicitly considered cases.
2566 (region_model::check_region_size):
2567 Adapt to size_visitor changes.
2569 2023-06-09 David Malcolm <dmalcolm@redhat.com>
2571 PR analyzer/110112
2572 * region-model.cc (region_model::get_initial_value_for_global):
2573 Move code to region::calc_initial_value_at_main.
2574 * region.cc (region::get_initial_value_at_main): New function.
2575 (region::calc_initial_value_at_main): New function, based on code
2576 in region_model::get_initial_value_for_global.
2577 (region::region): Initialize m_cached_init_sval_at_main.
2578 (decl_region::get_svalue_for_constructor): Add a cache, splitting
2579 out body to...
2580 (decl_region::calc_svalue_for_constructor): ...this new function.
2581 * region.h (region::get_initial_value_at_main): New decl.
2582 (region::calc_initial_value_at_main): New decl.
2583 (region::m_cached_init_sval_at_main): New field.
2584 (decl_region::decl_region): Initialize m_ctor_svalue.
2585 (decl_region::calc_svalue_for_constructor): New decl.
2586 (decl_region::m_ctor_svalue): New field.
2588 2023-06-08 Benjamin Priour <vultkayn@gcc.gnu.org>
2590 * bounds-checking.cc (region_model::check_symbolic_bounds): Returns whether the BASE_REG
2591 region access was OOB.
2592 (region_model::check_region_bounds): Likewise.
2593 * region-model.cc (region_model::get_store_value): Creates an
2594 unknown svalue on OOB-read access to REG.
2595 (region_model::check_region_access): Returns whether an unknown svalue needs be created.
2596 (region_model::check_region_for_read): Passes check_region_access return value.
2597 * region-model.h: Update prior function definitions.
2599 2023-06-02 David Malcolm <dmalcolm@redhat.com>
2601 PR analyzer/109015
2602 * kf.cc (class kf_atomic_exchange): New.
2603 (class kf_atomic_exchange_n): New.
2604 (class kf_atomic_fetch_op): New.
2605 (class kf_atomic_op_fetch): New.
2606 (class kf_atomic_load): New.
2607 (class kf_atomic_load_n): New.
2608 (class kf_atomic_store_n): New.
2609 (register_atomic_builtins): New function.
2610 (register_known_functions): Call register_atomic_builtins.
2612 2023-06-02 David Malcolm <dmalcolm@redhat.com>
2614 * store.cc (store::eval_alias_1): Regions in different memory
2615 spaces can't alias.
2617 2023-05-18 Bernhard Reutner-Fischer <aldot@gcc.gnu.org>
2619 * region-model-manager.cc (get_code_for_cast): Use _P defines from
2620 tree.h.
2621 (region_model_manager::get_or_create_cast): Ditto.
2622 (region_model_manager::get_region_for_global): Ditto.
2623 * region-model.cc (region_model::get_lvalue_1): Ditto.
2624 * region.cc (decl_region::maybe_get_constant_value): Ditto.
2626 2023-03-22 David Malcolm <dmalcolm@redhat.com>
2628 PR analyzer/109239
2629 * program-point.cc: Include "analyzer/inlining-iterator.h".
2630 (program_point::effectively_intraprocedural_p): New function.
2631 * program-point.h (program_point::effectively_intraprocedural_p):
2632 New decl.
2633 * sm-malloc.cc (deref_before_check::emit): Use it when rejecting
2634 interprocedural cases, so that we reject interprocedural cases
2635 that have become intraprocedural due to inlining.
2637 2023-03-18 David Malcolm <dmalcolm@redhat.com>
2639 PR analyzer/109094
2640 * region-model.cc (region_model::on_longjmp): Pass false for
2641 new "eval_return_svalue" param of pop_frame.
2642 (region_model::pop_frame): Add new "eval_return_svalue" param and
2643 use it to suppress the call to get_rvalue on the result when
2644 needed by on_longjmp.
2645 * region-model.h (region_model::pop_frame): Add new
2646 "eval_return_svalue" param.
2648 2023-03-10 David Malcolm <dmalcolm@redhat.com>
2650 PR analyzer/109059
2651 * region-model.cc (region_model::mark_region_as_unknown): Gather a
2652 set of maybe-live svalues and call on_maybe_live_values with it.
2653 * store.cc (binding_map::remove_overlapping_bindings): Add new
2654 "maybe_live_values" param; add any removed svalues to it.
2655 (binding_cluster::clobber_region): Add NULL as new param of
2656 remove_overlapping_bindings.
2657 (binding_cluster::mark_region_as_unknown): Add "maybe_live_values"
2658 param and pass it to remove_overlapping_bindings.
2659 (binding_cluster::maybe_get_compound_binding): Add NULL for new
2660 param of binding_map::remove_overlapping_bindings.
2661 (binding_cluster::remove_overlapping_bindings): Add
2662 "maybe_live_values" param and pass to
2663 binding_map::remove_overlapping_bindings.
2664 (store::set_value): Capture a set of maybe-live svalues, and call
2665 on_maybe_live_values with it.
2666 (store::on_maybe_live_values): New.
2667 (store::mark_region_as_unknown): Add "maybe_live_values" param
2668 and pass it to binding_cluster::mark_region_as_unknown.
2669 (store::remove_overlapping_bindings): Pass NULL for new param of
2670 binding_cluster::remove_overlapping_bindings.
2671 * store.h (binding_map::remove_overlapping_bindings): Add
2672 "maybe_live_values" param.
2673 (binding_cluster::mark_region_as_unknown): Likewise.
2674 (binding_cluster::remove_overlapping_bindings): Likewise.
2675 (store::mark_region_as_unknown): Likewise.
2676 (store::on_maybe_live_values): New decl.
2678 2023-03-10 David Malcolm <dmalcolm@redhat.com>
2680 PR analyzer/108475
2681 PR analyzer/109060
2682 * sm-malloc.cc (deref_before_check::deref_before_check):
2683 Initialize new field m_deref_expr. Assert that arg is non-NULL.
2684 (deref_before_check::emit): Reject cases where the spelling of the
2685 thing that was dereferenced differs from that of what is checked,
2686 or if the dereference expression was not found. Remove code to
2687 handle NULL m_arg.
2688 (deref_before_check::describe_state_change): Remove code to handle
2689 NULL m_arg.
2690 (deref_before_check::describe_final_event): Likewise.
2691 (deref_before_check::sufficiently_similar_p): New.
2692 (deref_before_check::m_deref_expr): New field.
2693 (malloc_state_machine::maybe_complain_about_deref_before_check):
2694 Don't warn if the diag_ptr is NULL.
2696 2023-03-03 David Malcolm <dmalcolm@redhat.com>
2698 * kf.cc (class kf_sprintf): New.
2699 (register_known_functions): Register it.
2701 2023-03-02 David Malcolm <dmalcolm@redhat.com>
2703 PR analyzer/108968
2704 * region-model.cc (region_model::get_rvalue_1): Handle VAR_DECLs
2705 with a DECL_HARD_REGISTER by returning UNKNOWN.
2707 2023-03-02 Hans-Peter Nilsson <hp@axis.com>
2709 * kf.cc (register_known_functions): Add __errno function for newlib.
2711 2023-03-01 David Malcolm <dmalcolm@redhat.com>
2713 PR analyzer/107565
2714 * region-model.cc (region_model::on_call_pre): Flatten logic by
2715 returning early. Consolidate logic for detecting const and pure
2716 functions. When considering whether an unhandled built-in
2717 function has side-effects, consider all kinds of builtin, rather
2718 than just BUILT_IN_NORMAL, and don't require
2719 gimple_builtin_call_types_compatible_p.
2721 2023-03-01 David Malcolm <dmalcolm@redhat.com>
2723 PR analyzer/108935
2724 * infinite-recursion.cc (contains_unknown_p): New.
2725 (sufficiently_different_region_binding_p): New function, splitting
2726 out inner loop from...
2727 (sufficiently_different_p): ...here. Extend detection of unknown
2728 svalues to also include svalues that contain unknown. Treat
2729 changes in frames below the entry to the recursion as being
2730 sufficiently different to reject being an infinite recursion.
2732 2023-02-21 David Malcolm <dmalcolm@redhat.com>
2734 PR analyzer/108830
2735 * analyzer.opt (fanalyzer-suppress-followups): New option.
2736 * engine.cc (impl_region_model_context::warn): Terminate the path
2737 if the diagnostic's terminate_path_p vfunc returns true and
2738 -fanalyzer-suppress-followups is true (the default).
2739 (impl_sm_context::warn): Likewise, for both overloads.
2740 * pending-diagnostic.h (pending_diagnostic::terminate_path_p): New
2741 vfunc.
2742 * program-state.cc (program_state::on_edge): Terminate the path if
2743 the ctxt requests it during updating the edge.
2744 * region-model.cc (poisoned_value_diagnostic::terminate_path_p):
2745 New vfunc.
2746 * sm-malloc.cc (null_deref::terminate_path_p): New vfunc.
2747 (null_arg::terminate_path_p): New vfunc.
2749 2023-02-16 David Malcolm <dmalcolm@redhat.com>
2751 PR analyzer/108806
2752 * constraint-manager.cc (bounded_range::dump_to_pp): Use
2753 bounded_range::singleton_p.
2754 (constraint_manager::add_bounded_ranges): Handle singleton ranges
2755 by adding an EQ_EXPR constraint.
2756 (constraint_manager::impossible_derived_conditions_p): New.
2757 (constraint_manager::eval_condition): Reject EQ_EXPR when it would
2758 imply impossible derived conditions.
2759 (selftest::test_bits): New.
2760 (selftest::run_constraint_manager_tests): Run it.
2761 * constraint-manager.h (bounded_range::singleton_p): New.
2762 (constraint_manager::impossible_derived_conditions_p): New decl.
2763 * region-model.cc (region_model::get_rvalue_1): Handle
2764 BIT_AND_EXPR, BIT_IOR_EXPR, and BIT_XOR_EXPR.
2766 2023-02-15 David Malcolm <dmalcolm@redhat.com>
2768 PR analyzer/108664
2769 PR analyzer/108666
2770 PR analyzer/108725
2771 * diagnostic-manager.cc (epath_finder::get_best_epath): Add
2772 "target_stmt" param.
2773 (epath_finder::explore_feasible_paths): Likewise.
2774 (epath_finder::process_worklist_item): Likewise.
2775 (saved_diagnostic::calc_best_epath): Pass m_stmt to
2776 epath_finder::get_best_epath.
2777 * engine.cc (feasibility_state::maybe_update_for_edge): Move
2778 per-stmt logic to...
2779 (feasibility_state::update_for_stmt): ...this new function.
2780 * exploded-graph.h (feasibility_state::update_for_stmt): New decl.
2781 * feasible-graph.cc (feasible_node::get_state_at_stmt): New.
2782 * feasible-graph.h: Include "analyzer/exploded-graph.h".
2783 (feasible_node::get_state_at_stmt): New decl.
2784 * infinite-recursion.cc
2785 (infinite_recursion_diagnostic::check_valid_fpath_p): Update for
2786 vfunc signature change.
2787 * pending-diagnostic.h (pending_diagnostic::check_valid_fpath_p):
2788 Convert first param to a reference. Add stmt param.
2789 * region-model.cc: Include "analyzer/feasible-graph.h".
2790 (poisoned_value_diagnostic::poisoned_value_diagnostic): Add
2791 "check_expr" param.
2792 (poisoned_value_diagnostic::check_valid_fpath_p): New.
2793 (poisoned_value_diagnostic::m_check_expr): New field.
2794 (region_model::check_for_poison): Attempt to supply a check_expr
2795 to the diagnostic
2796 (region_model::deref_rvalue): Add NULL for new check_expr param
2797 of poisoned_value_diagnostic.
2798 (region_model::get_or_create_region_for_heap_alloc): Don't reuse
2799 regions that are marked as TOUCHED.
2801 2023-02-10 David Malcolm <dmalcolm@redhat.com>
2803 PR analyzer/108745
2804 * sm-malloc.cc (deref_before_check::emit): Reject the warning if
2805 the check occurs within a macro defintion.
2807 2023-02-09 David Malcolm <dmalcolm@redhat.com>
2809 PR analyzer/108733
2810 * state-purge.cc (get_candidate_for_purging): Add ADDR_EXPR
2811 and MEM_REF.
2813 2023-02-08 David Malcolm <dmalcolm@redhat.com>
2815 PR analyzer/108704
2816 * state-purge.cc (state_purge_per_decl::process_point_backwards):
2817 Don't stop processing the decl if it's fully overwritten by
2818 this stmt if it's also used by this stmt.
2820 2023-02-07 David Malcolm <dmalcolm@redhat.com>
2822 PR analyzer/108661
2823 * sm-fd.cc (class kf_read): New.
2824 (register_known_fd_functions): Register "read".
2825 * sm-file.cc (class kf_fread): Update comment.
2827 2023-02-02 David Malcolm <dmalcolm@redhat.com>
2829 PR analyzer/108633
2830 * sm-fd.cc (fd_state_machine::check_for_fd_attrs): Add missing
2831 "continue".
2832 (fd_state_machine::on_listen): Don't issue phase-mismatch or
2833 type-mismatch warnings for the "invalid" state.
2835 2023-02-01 David Malcolm <dmalcolm@redhat.com>
2837 PR analyzer/108616
2838 * pending-diagnostic.cc (fixup_location_in_macro_p): Add "alloca"
2839 to macros that we shouldn't unwind inside.
2841 2023-01-26 David Malcolm <dmalcolm@redhat.com>
2843 PR analyzer/108524
2844 * analyzer.h (class feasible_node): New forward decl.
2845 * diagnostic-manager.cc (epath_finder::get_best_epath): Add "pd"
2846 param.
2847 (epath_finder::explore_feasible_paths): Likewise.
2848 (epath_finder::process_worklist_item): Likewise. Use it to call
2849 pending_diagnostic::check_valid_fpath_p on the final fpath to
2850 give pending_diagnostic a way to add additional restrictions on
2851 feasibility.
2852 (saved_diagnostic::calc_best_epath): Pass pending_diagnostic to
2853 epath_finder::get_best_epath.
2854 * infinite-recursion.cc: Include "analyzer/feasible-graph.h".
2855 (infinite_recursion_diagnostic::check_valid_fpath_p): New.
2856 (infinite_recursion_diagnostic::fedge_uses_conjured_svalue_p): New.
2857 (infinite_recursion_diagnostic::expr_uses_conjured_svalue_p): New.
2858 * pending-diagnostic.h (pending_diagnostic::check_valid_fpath_p):
2859 New vfunc.
2861 2023-01-19 David Malcolm <dmalcolm@redhat.com>
2863 PR analyzer/108455
2864 * analyzer.h (class checker_event): New forward decl.
2865 (class state_change_event): Indent.
2866 (class warning_event): New forward decl.
2867 * checker-event.cc (state_change_event::state_change_event): Add
2868 "enode" param.
2869 (warning_event::get_desc): Update for new param of
2870 evdesc::final_event ctor.
2871 * checker-event.h (state_change_event::state_change_event): Add
2872 "enode" param.
2873 (state_change_event::get_exploded_node): New accessor.
2874 (state_change_event::m_enode): New field.
2875 (warning_event::warning_event): New "enode" param.
2876 (warning_event::get_exploded_node): New accessor.
2877 (warning_event::m_enode): New field.
2878 * diagnostic-manager.cc
2879 (state_change_event_creator::on_global_state_change): Pass
2880 src_node to state_change_event ctor.
2881 (state_change_event_creator::on_state_change): Likewise.
2882 (null_assignment_sm_context::set_next_state): Pass NULL for
2883 new param of state_change_event ctor.
2884 * infinite-recursion.cc
2885 (infinite_recursion_diagnostic::add_final_event): Update for new
2886 param of warning_event ctor.
2887 * pending-diagnostic.cc (pending_diagnostic::add_final_event):
2888 Pass enode to warning_event ctor.
2889 * pending-diagnostic.h (evdesc::final_event): Add reference to
2890 warning_event.
2891 * sm-malloc.cc: Include "analyzer/checker-event.h" and
2892 "analyzer/exploded-graph.h".
2893 (deref_before_check::deref_before_check): Initialize new fields.
2894 (deref_before_check::emit): Reject warnings in which we were
2895 unable to determine the enodes of the dereference and the check.
2896 Reject warnings interprocedural warnings. Reject warnings in which
2897 the dereference doesn't dominate the check.
2898 (deref_before_check::describe_state_change): Set m_deref_enode.
2899 (deref_before_check::describe_final_event): Set m_check_enode.
2900 (deref_before_check::m_deref_enode): New field.
2901 (deref_before_check::m_check_enode): New field.
2903 2023-01-13 David Malcolm <dmalcolm@redhat.com>
2905 PR analyzer/105273
2906 * region-model.cc (has_nondefault_case_for_value_p): New.
2907 (has_nondefault_cases_for_all_enum_values_p): New.
2908 (region_model::apply_constraints_for_gswitch): Skip
2909 implicitly-created "default" when switching on an enum
2910 and all enum values have non-default cases.
2911 (rejected_default_case::dump_to_pp): New.
2912 * region-model.h (region_model_context::possibly_tainted_p): New
2913 decl.
2914 (class rejected_default_case): New.
2915 * sm-taint.cc (region_model_context::possibly_tainted_p): New.
2916 * supergraph.cc (switch_cfg_superedge::dump_label_to_pp): Dump
2917 when implicitly_created_default_p.
2918 (switch_cfg_superedge::implicitly_created_default_p): New.
2919 * supergraph.h
2920 (switch_cfg_superedge::implicitly_created_default_p): New decl.
2922 2023-01-11 David Malcolm <dmalcolm@redhat.com>
2924 PR analyzer/108252
2925 * kf.cc (class kf_strdup): New.
2926 (class kf_strndup): New.
2927 (register_known_functions): Register them.
2928 * region-model.cc (region_model::on_call_pre): Use
2929 &HEAP_ALLOCATED_REGION for the default result of an external
2930 function with the "malloc" attribute, rather than CONJURED_SVALUE.
2931 (region_model::get_or_create_region_for_heap_alloc): Allow
2932 "size_in_bytes" to be NULL.
2933 * store.cc (store::set_value): When handling *UNKNOWN = VAL,
2934 mark VAL as "maybe bound".
2936 2022-12-16 David Malcolm <dmalcolm@redhat.com>
2938 PR analyzer/106479
2939 * kf.cc (kf_memcpy_memmove::impl_call_pre): Pass in source region
2940 to region_model::check_for_poison.
2941 * region-model-asm.cc (region_model::on_asm_stmt): Pass NULL
2942 region to region_model::check_for_poison.
2943 * region-model.cc (region_model::check_for_poison): Add
2944 "src_region" param, and pass it to poisoned_value_diagnostic.
2945 (region_model::on_assignment): Pass NULL region to
2946 region_model::check_for_poison.
2947 (region_model::get_rvalue): Likewise.
2948 * region-model.h (region_model::check_for_poison): Add
2949 "src_region" param.
2950 * sm-fd.cc (fd_state_machine::on_accept): Pass in source region
2951 to region_model::check_for_poison.
2952 * varargs.cc (kf_va_copy::impl_call_pre): Pass NULL region to
2953 region_model::check_for_poison.
2954 (kf_va_arg::impl_call_pre): Pass in source region to
2955 region_model::check_for_poison.
2957 2022-12-14 David Malcolm <dmalcolm@redhat.com>
2959 PR analyzer/108065
2960 * region.cc (decl_region::get_svalue_for_initializer): Bail out to
2961 avoid calling binding_key::make with an empty region.
2962 * store.cc (binding_map::apply_ctor_val_to_range): Likewise.
2963 (binding_map::apply_ctor_pair_to_child_region): Likewise.
2964 (binding_cluster::bind): Likewise.
2965 (binding_cluster::purge_region): Likewise.
2966 (binding_cluster::maybe_get_compound_binding): Likewise.
2967 (binding_cluster::maybe_get_simple_value): Likewise.
2969 2022-12-09 David Malcolm <dmalcolm@redhat.com>
2971 * analyzer.h (class known_function): Expand comment.
2972 * region-model-impl-calls.cc: Rename to...
2973 * kf.cc: ...this.
2974 * known-function-manager.h (class known_function_manager): Add
2975 leading comment.
2977 2022-12-09 David Malcolm <dmalcolm@redhat.com>
2979 PR analyzer/108003
2980 * call-summary.cc
2981 (call_summary_replay::convert_region_from_summary_1): Convert
2982 heap_regs_in_use from auto_sbitmap to auto_bitmap.
2983 * region-model-manager.cc
2984 (region_model_manager::get_or_create_region_for_heap_alloc):
2985 Convert from sbitmap to bitmap.
2986 * region-model-manager.h: Likewise.
2987 * region-model.cc
2988 (region_model::get_or_create_region_for_heap_alloc): Convert from
2989 auto_sbitmap to auto_bitmap.
2990 (region_model::get_referenced_base_regions): Likewise.
2991 * region-model.h: Include "bitmap.h" rather than "sbitmap.h".
2992 (region_model::get_referenced_base_regions): Convert from
2993 auto_sbitmap to auto_bitmap.
2995 2022-12-09 David Malcolm <dmalcolm@redhat.com>
2997 * region-model-impl-calls.cc (class kf_memcpy): Rename to...
2998 (class kf_memcpy_memmove): ...this.
2999 (kf_memcpy::impl_call_pre): Rename to...
3000 (kf_memcpy_memmove::impl_call_pre): ...this, and check the src for
3001 poison.
3002 (register_known_functions): Update for above renaming, and
3003 register BUILT_IN_MEMMOVE and BUILT_IN_MEMMOVE_CHK.
3005 2022-12-06 David Malcolm <dmalcolm@redhat.com>
3007 PR analyzer/107882
3008 * region-model.cc (region_model::get_store_value): Return an
3009 unknown value for empty regions.
3010 (region_model::set_value): Bail on empty regions.
3011 * region.cc (region::empty_p): New.
3012 * region.h (region::empty_p): New decl.
3013 * state-purge.cc (same_binding_p): Bail if either region is empty.
3014 * store.cc (binding_key::make): Assert that a concrete binding's
3015 bit_size must be > 0.
3016 (binding_cluster::mark_region_as_unknown): Bail on empty regions.
3017 (binding_cluster::get_binding): Likewise.
3018 (binding_cluster::remove_overlapping_bindings): Likewise.
3019 (binding_cluster::on_unknown_fncall): Don't conjure values for
3020 empty regions.
3021 (store::fill_region): Bail on empty regions.
3022 * store.h (class concrete_binding): Update comment to reflect that
3023 the range of bits must be non-empty.
3024 (concrete_binding::concrete_binding): Assert that bit range is
3025 non-empty.
3027 2022-12-06 David Malcolm <dmalcolm@redhat.com>
3029 PR analyzer/106325
3030 * region-model-manager.cc
3031 (region_model_manager::get_or_create_null_ptr): New.
3032 * region-model-manager.h
3033 (region_model_manager::get_or_create_null_ptr): New decl.
3034 * region-model.cc (region_model::on_top_level_param): Add
3035 "nonnull" param and make use of it.
3036 (region_model::push_frame): When handling a top-level entrypoint
3037 to the analysis, determine which params __attribute__((nonnull))
3038 applies to, and pass to on_top_level_param.
3039 * region-model.h (region_model::on_top_level_param): Add "nonnull"
3040 param.
3042 2022-12-06 David Malcolm <dmalcolm@redhat.com>
3044 * analyzer.h (register_known_analyzer_functions): New decl.
3045 (register_known_functions_lang_cp): New decl.
3046 * call-details.cc: New file, split out from
3047 region-model-impl-calls.cc.
3048 * call-details.h: New file, split out from region-model.h.
3049 * call-info.cc: Include "analyzer/call-details.h".
3050 * call-summary.h: Likewise.
3051 * kf-analyzer.cc: New file, split out from
3052 region-model-impl-calls.cc.
3053 * kf-lang-cp.cc: Likewise.
3054 * known-function-manager.cc: Include "analyzer/call-details.h".
3055 * region-model-impl-calls.cc: Move definitions of call_details's
3056 member functions to call-details.cc. Move class kf_analyzer_* to
3057 kf-analyzer.cc. Move kf_operator_new and kf_operator_delete to
3058 kf-lang-cp.cc. Refresh #includes accordingly.
3059 (register_known_functions): Replace registration of __analyzer_*
3060 functions with a call to register_known_analyzer_functions.
3061 Replace registration of C++ support functions with a call to
3062 register_known_functions_lang_cp.
3063 * region-model.h (class call_details): Move to new call-details.h.
3064 * sm-fd.cc: Include "analyzer/call-details.h".
3065 * sm-file.cc: Likewise.
3066 * sm-malloc.cc: Likewise.
3067 * varargs.cc: Likewise.
3069 2022-12-02 David Malcolm <dmalcolm@redhat.com>
3071 * analyzer.h (struct event_loc_info): New forward decl.
3072 * bounds-checking.cc: Use event_loc_info throughout to bundle the
3073 loc, fndecl, depth triples.
3074 * call-info.cc: Likewise.
3075 * checker-event.cc: Likewise.
3076 * checker-event.h (struct event_loc_info): New decl. Use it
3077 throughout to bundle the loc, fndecl, depth triples.
3078 * checker-path.cc: Likewise.
3079 * checker-path.h: Likewise.
3080 * diagnostic-manager.cc: Likewise.
3081 * engine.cc: Likewise.
3082 * infinite-recursion.cc: Likewise.
3083 * pending-diagnostic.cc: Likewise.
3084 * pending-diagnostic.h: Likewise.
3085 * region-model.cc: Likewise.
3086 * sm-signal.cc: Likewise.
3087 * varargs.cc: Likewise.
3089 2022-12-02 David Malcolm <dmalcolm@redhat.com>
3091 PR analyzer/107851
3092 * analyzer.cc (make_label_text_n): Convert param "n" from int to
3093 unsigned HOST_WIDE_INT.
3094 * analyzer.h (make_label_text_n): Likewise for decl.
3095 * bounds-checking.cc: Include "analyzer/checker-event.h" and
3096 "analyzer/checker-path.h".
3097 (out_of_bounds::add_region_creation_events): New.
3098 (concrete_past_the_end::describe_region_creation_event): Replace
3099 with...
3100 (concrete_past_the_end::add_region_creation_events): ...this.
3101 (symbolic_past_the_end::describe_region_creation_event): Delete.
3102 * checker-event.cc (region_creation_event::region_creation_event):
3103 Update for dropping all member data.
3104 (region_creation_event::get_desc): Delete, splitting out into
3105 region_creation_event_memory_space::get_desc,
3106 region_creation_event_capacity::get_desc, and
3107 region_creation_event_debug::get_desc.
3108 (region_creation_event_memory_space::get_desc): New.
3109 (region_creation_event_capacity::get_desc): New.
3110 (region_creation_event_allocation_size::get_desc): New.
3111 (region_creation_event_debug::get_desc): New.
3112 * checker-event.h: Include "analyzer/program-state.h".
3113 (enum rce_kind): Delete.
3114 (class region_creation_event): Drop all member data.
3115 (region_creation_event::region_creation_event): Make protected.
3116 (region_creation_event::get_desc): Delete.
3117 (class region_creation_event_memory_space): New.
3118 (class region_creation_event_capacity): New.
3119 (class region_creation_event_allocation_size): New.
3120 (class region_creation_event_debug): New.
3121 * checker-path.cc (checker_path::add_region_creation_events): Add
3122 "pd" param. Call pending_diangnostic::add_region_creation_events.
3123 Update for conversion of RCE_DEBUG to region_creation_event_debug.
3124 * checker-path.h (checker_path::add_region_creation_events): Add
3125 "pd" param.
3126 * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
3127 Pass pending_diagnostic to
3128 emission_path::add_region_creation_events.
3129 (diagnostic_manager::build_emission_path): Pass path_builder to
3130 add_event_on_final_node.
3131 (diagnostic_manager::add_event_on_final_node): Add "pb" param.
3132 Pass pending_diagnostic to
3133 emission_path::add_region_creation_events.
3134 (diagnostic_manager::add_events_for_eedge): Pass
3135 pending_diagnostic to emission_path::add_region_creation_events.
3136 * diagnostic-manager.h
3137 (diagnostic_manager::add_event_on_final_node): Add "pb" param.
3138 * pending-diagnostic.cc
3139 (pending_diagnostic::add_region_creation_events): New.
3140 * pending-diagnostic.h (struct region_creation): Delete.
3141 (pending_diagnostic::describe_region_creation_event): Delete.
3142 (pending_diagnostic::add_region_creation_events): New vfunc.
3143 * region-model.cc: Include "analyzer/checker-event.h" and
3144 "analyzer/checker-path.h".
3145 (dubious_allocation_size::dubious_allocation_size): Initialize
3146 m_has_allocation_event.
3147 (dubious_allocation_size::describe_region_creation_event): Delete.
3148 (dubious_allocation_size::describe_final_event): Update for
3149 replacement of m_allocation_event with m_has_allocation_event.
3150 (dubious_allocation_size::add_region_creation_events): New.
3151 (dubious_allocation_size::m_allocation_event): Replace with...
3152 (dubious_allocation_size::m_has_allocation_event): ...this.
3154 2022-12-02 David Malcolm <dmalcolm@redhat.com>
3156 PR analyzer/107948
3157 * region-model-manager.cc
3158 (region_model_manager::maybe_fold_binop): Fold (0 - VAL) to -VAL.
3159 * region-model.cc (region_model::eval_condition): Handle e.g.
3160 "-X <= 0" as equivalent to X >= 0".
3162 2022-12-01 David Malcolm <dmalcolm@redhat.com>
3164 PR analyzer/106626
3165 * bounds-checking.cc
3166 (symbolic_past_the_end::describe_final_event): Delete, moving to
3167 symbolic_buffer_overflow::describe_final_event and
3168 symbolic_buffer_over_read::describe_final_event, eliminating
3169 composition of text strings via "byte_str" and "m_dir_str".
3170 (symbolic_past_the_end::m_dir_str): Delete field.
3171 (symbolic_buffer_overflow::symbolic_buffer_overflow): Drop
3172 m_dir_str.
3173 (symbolic_buffer_overflow::describe_final_event): New, as noted
3174 above.
3175 (symbolic_buffer_over_read::symbolic_buffer_overflow): Drop
3176 m_dir_str.
3177 (symbolic_buffer_over_read::describe_final_event): New, as noted
3178 above.
3180 2022-12-01 David Malcolm <dmalcolm@redhat.com>
3182 * bounds-checking.cc (class out_of_bounds): Split out from...
3183 (class concrete_out_of_bounds): New abstract subclass.
3184 (class past_the_end): Rename to...
3185 (class concrete_past_the_end): ...this, and make a subclass of
3186 concrete_out_of_bounds.
3187 (class buffer_overflow): Rename to...
3188 (class concrete_buffer_overflow): ...this, and make a subclass of
3189 concrete_past_the_end.
3190 (class buffer_over_read): Rename to...
3191 (class concrete_buffer_over_read): ...this, and make a subclass of
3192 concrete_past_the_end.
3193 (class buffer_underwrite): Rename to...
3194 (class concrete_buffer_underwrite): ...this, and make a subclass
3195 of concrete_out_of_bounds.
3196 (class buffer_under_read): Rename to...
3197 (class concrete_buffer_under_read): ...this, and make a subclass
3198 of concrete_out_of_bounds.
3199 (class symbolic_past_the_end): Convert to a subclass of
3200 out_of_bounds.
3201 (symbolic_buffer_overflow::get_kind): New.
3202 (symbolic_buffer_over_read::get_kind): New.
3203 (region_model::check_region_bounds): Update for renamings.
3204 * engine.cc (impl_sm_context::set_next_state): Eliminate
3205 "new_ctxt", passing NULL to get_rvalue instead.
3206 (impl_sm_context::warn): Likewise.
3208 2022-12-01 David Malcolm <dmalcolm@redhat.com>
3210 PR analyzer/106626
3211 * bounds-checking.cc (out_of_bounds::get_memory_space): New.
3212 (buffer_overflow::emit): Use it.
3213 (class buffer_overread): Rename to...
3214 (class buffer_over_read): ...this.
3215 (buffer_over_read::emit): Specify which memory space the read is
3216 from, where known. Change "overread" to "over-read".
3217 (class buffer_underflow): Rename to...
3218 (class buffer_underwrite): ...this.
3219 (buffer_underwrite::emit): Specify which memory space the write is
3220 to, where known. Change "underflow" to "underwrite".
3221 (class buffer_underread): Rename to...
3222 (class buffer_under_read): Rename to...
3223 (buffer_under_read::emit): Specify which memory space the read is
3224 from, where known. Change "underread" to "under-read".
3225 (symbolic_past_the_end::get_memory_space): New.
3226 (symbolic_buffer_overflow::emit): Use it.
3227 (class symbolic_buffer_overread): Rename to...
3228 (class symbolic_buffer_over_read): ...this.
3229 (symbolic_buffer_over_read::emit): Specify which memory space the
3230 read is from, where known. Change "overread" to "over-read".
3231 (region_model::check_symbolic_bounds): Update for class renaming.
3232 (region_model::check_region_bounds): Likewise.
3234 2022-12-01 David Malcolm <dmalcolm@redhat.com>
3236 PR analyzer/106626
3237 * bounds-checking.cc (out_of_bounds::maybe_describe_array_bounds):
3238 New.
3239 (buffer_overflow::emit): Call maybe_describe_array_bounds.
3240 (buffer_overread::emit): Likewise.
3241 (buffer_underflow::emit): Likewise.
3242 (buffer_underread::emit): Likewise.
3244 2022-12-01 David Malcolm <dmalcolm@redhat.com>
3246 PR analyzer/106626
3247 * bounds-checking.cc (buffer_overflow::emit): Use inform_n.
3248 Update wording to clarify that we're talking about the size of
3249 the bad access, rather than its position.
3250 (buffer_overread::emit): Likewise.
3252 2022-12-01 David Malcolm <dmalcolm@redhat.com>
3254 * bounds-checking.cc: New file, taken from region-model.cc.
3255 * region-model.cc (class out_of_bounds): Move to
3256 bounds-checking.cc.
3257 (class past_the_end): Likewise.
3258 (class buffer_overflow): Likewise.
3259 (class buffer_overread): Likewise.
3260 (class buffer_underflow): Likewise.
3261 (class buffer_underread): Likewise.
3262 (class symbolic_past_the_end): Likewise.
3263 (class symbolic_buffer_overflow): Likewise.
3264 (class symbolic_buffer_overread): Likewise.
3265 (region_model::check_symbolic_bounds): Likewise.
3266 (maybe_get_integer_cst_tree): Likewise.
3267 (region_model::check_region_bounds): Likewise.
3268 * region-model.h: Add comment.
3270 2022-12-01 David Malcolm <dmalcolm@redhat.com>
3272 PR analyzer/107928
3273 * sm-fd.cc (fd_state_machine::on_bind): Handle m_constant_fd in
3274 the "success" outcome.
3275 (fd_state_machine::on_connect): Likewise.
3276 * sm-fd.dot: Add "constant_fd" state and its transitions.
3278 2022-11-30 David Malcolm <dmalcolm@redhat.com>
3280 * region-model-impl-calls.cc (class kf_fgets): Move to sm-file.cc.
3281 (kf_fgets::impl_call_pre): Likewise.
3282 (class kf_fread): Likewise.
3283 (kf_fread::impl_call_pre): Likewise.
3284 (class kf_getchar): Likewise.
3285 (class kf_stdio_output_fn): Likewise.
3286 (register_known_functions): Move registration of
3287 BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
3288 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
3289 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
3290 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
3291 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
3292 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF,
3293 "getchar", "fgets", "fgets_unlocked", and "fread" to
3294 register_known_file_functions.
3295 * sm-file.cc (class kf_stdio_output_fn): Move here from
3296 region-model-impl-calls.cc.
3297 (class kf_fgets): Likewise.
3298 (class kf_fread): Likewise.
3299 (class kf_getchar): Likewise.
3300 (register_known_file_functions): Move registration of
3301 BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
3302 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
3303 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
3304 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
3305 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
3306 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF,
3307 "fgets", "fgets_unlocked", "fread", and "getchar" to here from
3308 register_known_functions.
3310 2022-11-30 David Malcolm <dmalcolm@redhat.com>
3312 PR analyzer/103546
3313 * analyzer.h (register_known_file_functions): New decl.
3314 * program-state.cc (sm_state_map::replay_call_summary): Rejct
3315 attempts to store sm-state for caller_sval that can't have
3316 associated state.
3317 * region-model-impl-calls.cc (register_known_functions): Call
3318 register_known_file_functions.
3319 * sm-fd.cc (class kf_isatty): New.
3320 (register_known_fd_functions): Register it.
3321 * sm-file.cc (class kf_ferror): New.
3322 (class kf_fileno): New.
3323 (class kf_getc): New.
3324 (register_known_file_functions): New.
3326 2022-11-30 David Malcolm <dmalcolm@redhat.com>
3328 PR analyzer/105784
3329 * region-model-manager.cc
3330 (region_model_manager::maybe_fold_binop): For POINTER_PLUS_EXPR,
3331 PLUS_EXPR and MINUS_EXPR, eliminate requirement that the final
3332 type matches that of arg0 in favor of a cast.
3334 2022-11-24 Martin Liska <mliska@suse.cz>
3336 * varargs.cc: Fix Clang warnings.
3338 2022-11-24 David Malcolm <dmalcolm@redhat.com>
3340 PR analyzer/106473
3341 * call-summary.cc
3342 (call_summary_replay::convert_region_from_summary_1): Update for
3343 change to creation of heap-allocated regions.
3344 * program-state.cc (test_program_state_1): Likewise.
3345 (test_program_state_merging): Likewise.
3346 * region-model-impl-calls.cc (kf_calloc::impl_call_pre): Likewise.
3347 (kf_malloc::impl_call_pre): Likewise.
3348 (kf_operator_new::impl_call_pre): Likewise.
3349 (kf_realloc::impl_call_postsuccess_with_move::update_model): Likewise.
3350 * region-model-manager.cc
3351 (region_model_manager::create_region_for_heap_alloc): Convert
3352 to...
3353 (region_model_manager::get_or_create_region_for_heap_alloc):
3354 ...this, reusing an existing region if it's unreferenced in the
3355 client state.
3356 * region-model-manager.h (region_model_manager::get_num_regions): New.
3357 (region_model_manager::create_region_for_heap_alloc): Convert to...
3358 (region_model_manager::get_or_create_region_for_heap_alloc): ...this.
3359 * region-model.cc (region_to_value_map::can_merge_with_p): Reject
3360 merger when the values are different.
3361 (region_model::create_region_for_heap_alloc): Convert to...
3362 (region_model::get_or_create_region_for_heap_alloc): ...this.
3363 (region_model::get_referenced_base_regions): New.
3364 (selftest::test_state_merging): Update for change to creation of
3365 heap-allocated regions.
3366 (selftest::test_malloc_constraints): Likewise.
3367 (selftest::test_malloc): Likewise.
3368 * region-model.h: Include "sbitmap.h".
3369 (region_model::create_region_for_heap_alloc): Convert to...
3370 (region_model::get_or_create_region_for_heap_alloc): ...this.
3371 (region_model::get_referenced_base_regions): New decl.
3372 * store.cc (store::canonicalize): Don't purge a heap-allocated region
3373 that's been marked as escaping.
3375 2022-11-24 David Malcolm <dmalcolm@redhat.com>
3377 * checker-path.cc (checker_path::inject_any_inlined_call_events):
3378 Don't dump the address of the block when -fdump-noaddr.
3380 2022-11-24 David Malcolm <dmalcolm@redhat.com>
3382 * region-model.h (region_model::on_socket): Delete decl.
3383 (region_model::on_bind): Likewise.
3384 (region_model::on_listen): Likewise.
3385 (region_model::on_accept): Likewise.
3386 (region_model::on_connect): Likewise.
3387 * sm-fd.cc (kf_socket::outcome_of_socket::update_model): Move body
3388 of region_model::on_socket into here, ...
3389 (region_model::on_socket): ...eliminating this function.
3390 (kf_bind::outcome_of_bind::update_model): Likewise for on_bind...
3391 (region_model::on_bind): ...eliminating this function.
3392 (kf_listen::outcome_of_listen::update_model): Likewise fo
3393 on_listen...
3394 (region_model::on_listen): ...eliminating this function.
3395 (kf_accept::outcome_of_accept::update_model): Likewise fo
3396 on_accept...
3397 (region_model::on_accept): ...eliminating this function.
3398 (kf_connect::outcome_of_connect::update_model): Likewise fo
3399 on_connect...
3400 (region_model::on_connect): ...eliminating this function.
3402 2022-11-24 David Malcolm <dmalcolm@redhat.com>
3404 * analyzer.h (register_known_fd_functions): New decl.
3405 * region-model-impl-calls.cc (class kf_accept): Move to sm-fd.cc.
3406 (class kf_bind): Likewise.
3407 (class kf_connect): Likewise.
3408 (class kf_listen): Likewise.
3409 (class kf_pipe): Likewise.
3410 (class kf_socket): Likewise.
3411 (register_known_functions): Remove registration of the above
3412 functions, instead calling register_known_fd_functions.
3413 * sm-fd.cc: Include "analyzer/call-info.h".
3414 (class kf_socket): Move here from region-model-impl-calls.cc.
3415 (class kf_bind): Likewise.
3416 (class kf_listen): Likewise.
3417 (class kf_accept): Likewise.
3418 (class kf_connect): Likewise.
3419 (class kf_pipe): Likewise.
3420 (register_known_fd_functions): New.
3422 2022-11-22 David Malcolm <dmalcolm@redhat.com>
3424 PR analyzer/107788
3425 * known-function-manager.cc (known_function_manager::get_match):
3426 Don't look up fndecls by name when they're not in the root
3427 namespace.
3429 2022-11-22 David Malcolm <dmalcolm@redhat.com>
3431 PR analyzer/107783
3432 * sm-fd.cc (fd_state_machine::check_for_new_socket_fd): Don't
3433 complain when old state is "fd-constant".
3434 (fd_state_machine::on_listen): Likewise.
3435 (fd_state_machine::on_accept): Likewise.
3437 2022-11-22 David Malcolm <dmalcolm@redhat.com>
3439 PR analyzer/107807
3440 * region-model-impl-calls.cc (register_known_functions): Register
3441 "___errno" and "__error" as synonyms for "__errno_location".
3443 2022-11-22 David Malcolm <dmalcolm@redhat.com>
3445 * analyzer.h (class internal_known_function): New.
3446 (register_varargs_builtins): New decl.
3447 * engine.cc (exploded_node::on_stmt_pre): Remove
3448 "out_terminate_path" param from call to region_model::on_stmt_pre.
3449 (feasibility_state::maybe_update_for_edge): Likewise.
3450 * known-function-manager.cc: Include "basic-block.h", "gimple.h",
3451 and "analyzer/region-model.h".
3452 (known_function_manager::known_function_manager): Initialize
3453 m_combined_fns_arr.
3454 (known_function_manager::~known_function_manager): Clean up
3455 m_combined_fns_arr.
3456 (known_function_manager::get_by_identifier): Make const.
3457 (known_function_manager::add): New overloaded definitions for
3458 enum built_in_function and enum internal_fn.
3459 (known_function_manager::get_by_fndecl): Delete.
3460 (known_function_manager::get_match): New.
3461 (known_function_manager::get_internal_fn): New.
3462 (known_function_manager::get_normal_builtin): New.
3463 * known-function-manager.h
3464 (known_function_manager::get_by_identifier): Make private and
3465 add const qualifier.
3466 (known_function_manager::get_by_fndecl): Delete.
3467 (known_function_manager::add): Add overloaded decls for
3468 enum built_in_function name and enum internal_fn.
3469 (known_function_manager::get_match): New decl.
3470 (known_function_manager::get_internal_fn): New decl.
3471 (known_function_manager::get_normal_builtin): New decl.
3472 (known_function_manager::m_combined_fns_arr): New field.
3473 * region-model-impl-calls.cc (call_details::arg_is_size_p): New.
3474 (class kf_alloca): New.
3475 (region_model::impl_call_alloca): Convert to...
3476 (kf_alloca::impl_call_pre): ...this.
3477 (kf_analyzer_dump_capacity::matches_call_types_p): Rewrite check
3478 to use call_details::arg_is_pointer_p.
3479 (region_model::impl_call_builtin_expect): Convert to...
3480 (class kf_expect): ...this.
3481 (class kf_calloc): New, adding check that both arguments are
3482 size_t.
3483 (region_model::impl_call_calloc): Convert to...
3484 (kf_calloc::impl_call_pre): ...this.
3485 (kf_connect::matches_call_types_p): Rewrite check to use
3486 call_details::arg_is_pointer_p.
3487 (region_model::impl_call_error): Convert to...
3488 (class kf_error): ...this, and...
3489 (kf_error::impl_call_pre): ...this.
3490 (class kf_fgets): New, adding checks that args 0 and 2 are
3491 pointers.
3492 (region_model::impl_call_fgets): Convert to...
3493 (kf_fgets::impl_call_pre): ...this.
3494 (class kf_fread): New, adding checks on the argument types.
3495 (region_model::impl_call_fread): Convert to...
3496 (kf_fread::impl_call_pre): ...this.
3497 (class kf_free): New, adding check that the argument is a pointer.
3498 (region_model::impl_call_free): Convert to...
3499 (kf_free::impl_call_post): ...this.
3500 (class kf_getchar): New.
3501 (class kf_malloc): New, adding check that the argument is a
3502 size_t.
3503 (region_model::impl_call_malloc): Convert to...
3504 (kf_malloc::impl_call_pre): ...this.
3505 (class kf_memcpy): New, adding checks on arguments.
3506 (region_model::impl_call_memcpy): Convert to...
3507 (kf_memcpy::impl_call_pre): ...this.
3508 (class kf_memset): New.
3509 (region_model::impl_call_memset): Convert to...
3510 (kf_memset::impl_call_pre): ...this.
3511 (kf_pipe::matches_call_types_p): Rewrite check to use
3512 call_details::arg_is_pointer_p.
3513 (kf_putenv::matches_call_types_p): Likewise.
3514 (class kf_realloc): New, adding checks on the argument types.
3515 (region_model::impl_call_realloc): Convert to...
3516 (kf_realloc::impl_call_post): ...this.
3517 (class kf_strchr): New.
3518 (region_model::impl_call_strchr): Convert to...
3519 (kf_strchr::impl_call_post): ...this.
3520 (class kf_stack_restore): New.
3521 (class kf_stack_save): New.
3522 (class kf_stdio_output_fn): New.
3523 (class kf_strcpy): New,
3524 (region_model::impl_call_strcpy): Convert to...
3525 (kf_strcpy::impl_call_pre): ...this.
3526 (class kf_strlen): New.
3527 (region_model::impl_call_strlen): Convert to...
3528 (kf_strlen::impl_call_pre): ...this.
3529 (class kf_ubsan_bounds): New.
3530 (region_model::impl_deallocation_call): Reimplement to avoid call
3531 to impl_call_free.
3532 (register_known_functions): Add handlers for IFN_BUILTIN_EXPECT
3533 and IFN_UBSAN_BOUNDS. Add handlers for BUILT_IN_ALLOCA,
3534 BUILT_IN_ALLOCA_WITH_ALIGN, BUILT_IN_CALLOC, BUILT_IN_EXPECT,
3535 BUILT_IN_EXPECT_WITH_PROBABILITY, BUILT_IN_FPRINTF,
3536 BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
3537 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
3538 BUILT_IN_FREE, BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED,
3539 BUILT_IN_MALLOC, BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK,
3540 BUILT_IN_MEMSET, BUILT_IN_MEMSET_CHK, BUILT_IN_PRINTF,
3541 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
3542 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
3543 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_REALLOC, BUILT_IN_STACK_RESTORE,
3544 BUILT_IN_STACK_SAVE, BUILT_IN_STRCHR, BUILT_IN_STRCPY,
3545 BUILT_IN_STRCPY_CHK, BUILT_IN_STRLEN, BUILT_IN_VFPRINTF, and
3546 BUILT_IN_VPRINTF. Call register_varargs_builtins. Add handlers
3547 for "getchar", "memset", "fgets", "fgets_unlocked", "fread",
3548 "error", and "error_at_line".
3549 * region-model.cc (region_model::on_stmt_pre): Drop
3550 "out_terminate_path" param.
3551 (region_model::get_known_function): Reimplement by calling
3552 known_function_manager::get_match, passing new "cd" param.
3553 Add overload taking enum internal_fn.
3554 (region_model::on_call_pre): Drop "out_terminate_path" param.
3555 Remove special-case handling of internal fns IFN_BUILTIN_EXPECT,
3556 IFN_UBSAN_BOUNDS, and IFN_VA_ARG, of built-in fns BUILT_IN_ALLOCA,
3557 BUILT_IN_ALLOCA_WITH_ALIGN, BUILT_IN_CALLOC, BUILT_IN_EXPECT,
3558 BUILT_IN_EXPECT_WITH_PROBABILITY, BUILT_IN_FREE, BUILT_IN_MALLOC,
3559 BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_MEMSET,
3560 BUILT_IN_MEMSET_CHK, BUILT_IN_REALLOC, BUILT_IN_STRCHR,
3561 BUILT_IN_STRCPY, BUILT_IN_STRCPY_CHK, BUILT_IN_STRLEN,
3562 BUILT_IN_STACK_SAVE, BUILT_IN_STACK_RESTORE, BUILT_IN_FPRINTF,
3563 BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED,
3564 BUILT_IN_FPUTC, BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS,
3565 BUILT_IN_FPUTS_UNLOCKED, BUILT_IN_FWRITE,
3566 BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
3567 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR,
3568 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED,
3569 BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF, BUILT_IN_VA_START, and
3570 BUILT_IN_VA_COPY, and of named functions "malloc", "calloc",
3571 "alloca", "realloc", "error", "error_at_line", "fgets",
3572 "fgets_unlocked", "fread", "getchar", "memset", "strchr", and
3573 "strlen". Replace all this special-casing with calls to
3574 get_known_function for internal fns and for fn decls.
3575 (region_model::on_call_post): Remove special-casing handling for
3576 "free" and "strchr", and for BUILT_IN_REALLOC, BUILT_IN_STRCHR,
3577 and BUILT_IN_VA_END. Replace by consolidating on usage of
3578 get_known_function.
3579 * region-model.h (call_details::arg_is_size_p): New.
3580 (region_model::on_stmt_pre): Drop "out_terminate_path" param.
3581 (region_model::on_call_pre): Likewise.
3582 (region_model::impl_call_alloca): Delete.
3583 (region_model::impl_call_builtin_expect): Delete.
3584 (region_model::impl_call_calloc): Delete.
3585 (region_model::impl_call_error): Delete.
3586 (region_model::impl_call_fgets): Delete.
3587 (region_model::impl_call_fread): Delete.
3588 (region_model::impl_call_free): Delete.
3589 (region_model::impl_call_malloc): Delete.
3590 (region_model::impl_call_memcpy): Delete.
3591 (region_model::impl_call_memset): Delete.
3592 (region_model::impl_call_realloc): Delete.
3593 (region_model::impl_call_strchr): Delete.
3594 (region_model::impl_call_strcpy): Delete.
3595 (region_model::impl_call_strlen): Delete.
3596 (region_model::impl_call_va_start): Delete.
3597 (region_model::impl_call_va_copy): Delete.
3598 (region_model::impl_call_va_arg): Delete.
3599 (region_model::impl_call_va_end): Delete.
3600 (region_model::check_region_for_write): Public.
3601 (region_model::get_known_function): Add "cd" param. Add
3602 overloaded decl taking enum internal_fn.
3603 * sm-malloc.cc: Update comments.
3604 * varargs.cc (class kf_va_start): New.
3605 (region_model::impl_call_va_start): Convert to...
3606 (kf_va_start::impl_call_pre): ...this.
3607 (class kf_va_copy): New.
3608 (region_model::impl_call_va_copy): Convert to...
3609 (kf_va_copy::impl_call_pre): ...this.
3610 (class kf_va_arg): New.
3611 (region_model::impl_call_va_arg): Convert to...
3612 (kf_va_arg::impl_call_pre): ...this.
3613 (class kf_va_end): New.
3614 (region_model::impl_call_va_end): Delete.
3615 (register_varargs_builtins): New.
3617 2022-11-22 David Malcolm <dmalcolm@redhat.com>
3619 PR analyzer/107788
3620 * region-model.cc (region_model::update_for_int_cst_return):
3621 Require that the return type be an integer type.
3622 (region_model::update_for_nonzero_return): Likewise.
3624 2022-11-22 David Malcolm <dmalcolm@redhat.com>
3626 PR analyzer/107783
3627 * region-model-impl-calls.cc (kf_accept::matches_call_types_p):
3628 Require that args 1 and 2 be pointers.
3629 (kf_bind::matches_call_types_p): Require that arg 1 be a pointer.
3630 * region-model.h (call_details::arg_is_pointer_p): New
3632 2022-11-22 David Malcolm <dmalcolm@redhat.com>
3634 PR analyzer/107777
3635 * call-summary.cc
3636 (call_summary_replay::convert_region_from_summary_1): Handle
3637 RK_THREAD_LOCAL and RK_ERRNO in switch.
3638 * region-model.cc (region_model::get_representative_path_var_1):
3639 Likewise.
3641 2022-11-19 David Malcolm <dmalcolm@redhat.com>
3643 PR analyzer/107582
3644 * engine.cc (dynamic_call_info_t::update_model): Update the model
3645 by pushing or pop a frame, rather than by clobbering it with the
3646 model from the exploded_node's state.
3648 2022-11-18 David Malcolm <dmalcolm@redhat.com>
3650 * analyzer.cc (is_pipe_call_p): Delete.
3651 * analyzer.h (is_pipe_call_p): Delete.
3652 * region-model-impl-calls.cc (call_details::get_location): New.
3653 (class kf_analyzer_break): New, adapted from
3654 region_model::on_stmt_pre.
3655 (region_model::impl_call_analyzer_describe): Convert to...
3656 (class kf_analyzer_describe): ...this.
3657 (region_model::impl_call_analyzer_dump_capacity): Convert to...
3658 (class kf_analyzer_dump_capacity): ...this.
3659 (region_model::impl_call_analyzer_dump_escaped): Convert to...
3660 (class kf_analyzer_dump_escaped): ...this.
3661 (class kf_analyzer_dump_exploded_nodes): New.
3662 (region_model::impl_call_analyzer_dump_named_constant): Convert
3663 to...
3664 (class kf_analyzer_dump_named_constant): ...this.
3665 (class dump_path_diagnostic): Move here from region-model.cc.
3666 (class kf_analyzer_dump_path) New, adapted from
3667 region_model::on_stmt_pre.
3668 (class kf_analyzer_dump_region_model): Likewise.
3669 (region_model::impl_call_analyzer_eval): Convert to...
3670 (class kf_analyzer_eval): ...this.
3671 (region_model::impl_call_analyzer_get_unknown_ptr): Convert to...
3672 (class kf_analyzer_get_unknown_ptr): ...this.
3673 (class known_function_accept): Rename to...
3674 (class kf_accept): ...this.
3675 (class known_function_bind): Rename to...
3676 (class kf_bind): ...this.
3677 (class known_function_connect): Rename to...
3678 (class kf_connect): ...this.
3679 (region_model::impl_call_errno_location): Convert to...
3680 (class kf_errno_location): ...this.
3681 (class known_function_listen): Rename to...
3682 (class kf_listen): ...this.
3683 (region_model::impl_call_pipe): Convert to...
3684 (class kf_pipe): ...this.
3685 (region_model::impl_call_putenv): Convert to...
3686 (class kf_putenv): ...this.
3687 (region_model::impl_call_operator_new): Convert to...
3688 (class kf_operator_new): ...this.
3689 (region_model::impl_call_operator_delete): Convert to...
3690 (class kf_operator_delete): ...this.
3691 (class known_function_socket): Rename to...
3692 (class kf_socket): ...this.
3693 (register_known_functions): Rename param to KFM. Break out
3694 existing known functions into a "POSIX" section, and add "pipe",
3695 "pipe2", and "putenv". Add debugging functions
3696 "__analyzer_break", "__analyzer_describe",
3697 "__analyzer_dump_capacity", "__analyzer_dump_escaped",
3698 "__analyzer_dump_exploded_nodes",
3699 "__analyzer_dump_named_constant", "__analyzer_dump_path",
3700 "__analyzer_dump_region_model", "__analyzer_eval",
3701 "__analyzer_get_unknown_ptr". Add C++ support functions
3702 "operator new", "operator new []", "operator delete", and
3703 "operator delete []".
3704 * region-model.cc (class dump_path_diagnostic): Move to
3705 region-model-impl-calls.cc.
3706 (region_model::on_stmt_pre): Eliminate special-casing of
3707 "__analyzer_describe", "__analyzer_dump_capacity",
3708 "__analyzer_dump_escaped", "__analyzer_dump_named_constant",
3709 "__analyzer_dump_path", "__analyzer_dump_region_model",
3710 "__analyzer_eval", "__analyzer_break",
3711 "__analyzer_dump_exploded_nodes", "__analyzer_get_unknown_ptr",
3712 "__errno_location", "pipe", "pipe2", "putenv", "operator new",
3713 "operator new []", "operator delete", "operator delete []"
3714 "pipe" and "pipe2", handling them instead via the known_functions
3715 mechanism.
3716 * region-model.h (call_details::get_location): New decl.
3717 (region_model::impl_call_analyzer_describe): Delete decl.
3718 (region_model::impl_call_analyzer_dump_capacity): Delete decl.
3719 (region_model::impl_call_analyzer_dump_escaped): Delete decl.
3720 (region_model::impl_call_analyzer_dump_named_constant): Delete decl.
3721 (region_model::impl_call_analyzer_eval): Delete decl.
3722 (region_model::impl_call_analyzer_get_unknown_ptr): Delete decl.
3723 (region_model::impl_call_errno_location): Delete decl.
3724 (region_model::impl_call_pipe): Delete decl.
3725 (region_model::impl_call_putenv): Delete decl.
3726 (region_model::impl_call_operator_new): Delete decl.
3727 (region_model::impl_call_operator_delete): Delete decl.
3728 * sm-fd.cc: Update comments.
3730 2022-11-16 David Malcolm <dmalcolm@redhat.com>
3732 PR analyzer/107711
3733 * analyzer-language.cc: Include "diagnostic.h".
3734 (maybe_stash_named_constant): Add logger param and use it to log
3735 the name being looked up, and the result.
3736 (stash_named_constants): New, splitting out from...
3737 (on_finish_translation_unit): ...this function. Call
3738 get_or_create_logfile and use the result to create a logger
3739 instance, passing it to stash_named_constants.
3740 * analyzer.h (get_or_create_any_logfile): New decl.
3741 * engine.cc (dump_fout, owns_dump_fout): New globals, split out
3742 from run_checkers.
3743 (get_or_create_any_logfile): New function, split out from...
3744 (run_checkers): ...here, so that the logfile can be opened by
3745 on_finish_translation_unit. Clear the globals when closing the
3746 dump file.
3748 2022-11-16 David Malcolm <dmalcolm@redhat.com>
3750 * analyzer.h (known_function::matches_call_types_p): New vfunc.
3751 (known_function::impl_call_pre): Provide base implementation.
3752 (known_function::impl_call_post): New vfunc.
3753 (register_known_functions): New.
3754 * engine.cc (impl_run_checkers): Call register_known_functions.
3755 * region-model-impl-calls.cc (region_model::impl_call_accept):
3756 Convert to...
3757 (class known_function_accept): ...this.
3758 (region_model::impl_call_bind): Convert to...
3759 (class known_function_bind): ...this.
3760 (region_model::impl_call_connect): Convert to...
3761 (class known_function_connect): ...this.
3762 (region_model::impl_call_listen): Convert to...
3763 (class known_function_listen): ...this.
3764 (region_model::impl_call_socket): Convert to...
3765 (class known_function_socket): ...this.
3766 (register_known_functions): New.
3767 * region-model.cc (region_model::on_call_pre): Remove special
3768 case for "bind" in favor of the known_function-handling dispatch.
3769 Add call to known_function::matches_call_types_p to latter.
3770 (region_model::on_call_post): Remove special cases for "accept",
3771 "bind", "connect", "listen", and "socket" in favor of dispatch
3772 to known_function::impl_call_post.
3773 * region-model.h (region_model::impl_call_accept): Delete decl.
3774 (region_model::impl_call_bind): Delete decl.
3775 (region_model::impl_call_connect): Delete decl.
3776 (region_model::impl_call_listen): Delete decl.
3777 (region_model::impl_call_socket): Delete decl.
3778 * sm-fd.cc: Update comments.
3780 2022-11-16 David Malcolm <dmalcolm@redhat.com>
3782 * checker-event.cc: New file, split out from...
3783 * checker-path.cc: ...this file.
3785 2022-11-15 David Malcolm <dmalcolm@redhat.com>
3787 PR analyzer/106140
3788 * analyzer-language.cc (on_finish_translation_unit): Stash named
3789 constants "SOCK_STREAM" and "SOCK_DGRAM".
3790 * analyzer.opt (Wanalyzer-fd-phase-mismatch): New.
3791 (Wanalyzer-fd-type-mismatch): New.
3792 * engine.cc (impl_region_model_context::get_state_map_by_name):
3793 Add "out_sm_context" param. Allow out_sm_idx to be NULL.
3794 * exploded-graph.h
3795 (impl_region_model_context::get_state_map_by_name):
3796 Add "out_sm_context" param.
3797 * region-model-impl-calls.cc (region_model::impl_call_accept): New.
3798 (region_model::impl_call_bind): New.
3799 (region_model::impl_call_connect): New.
3800 (region_model::impl_call_listen): New.
3801 (region_model::impl_call_socket): New.
3802 * region-model.cc (region_model::on_call_pre): Special-case
3803 "bind".
3804 (region_model::on_call_post): Special-case "accept", "bind",
3805 "connect", "listen", and "socket".
3806 * region-model.h (region_model::impl_call_accept): New decl.
3807 (region_model::impl_call_bind): New decl.
3808 (region_model::impl_call_connect): New decl.
3809 (region_model::impl_call_listen): New decl.
3810 (region_model::impl_call_socket): New decl.
3811 (region_model::on_socket): New decl.
3812 (region_model::on_bind): New decl.
3813 (region_model::on_listen): New decl.
3814 (region_model::on_accept): New decl.
3815 (region_model::on_connect): New decl.
3816 (region_model::add_constraint): Make public.
3817 (region_model::check_for_poison): Make public.
3818 (region_model_context::get_state_map_by_name): Add out_sm_context param.
3819 (region_model_context::get_fd_map): Likewise.
3820 (region_model_context::get_malloc_map): Likewise.
3821 (region_model_context::get_taint_map): Likewise.
3822 (noop_region_model_context::get_state_map_by_name): Likewise.
3823 (region_model_context_decorator::get_state_map_by_name): Likewise.
3824 * sm-fd.cc: Include "analyzer/supergraph.h" and
3825 "analyzer/analyzer-language.h".
3826 (enum expected_phase): New enum.
3827 (fd_state_machine::m_new_datagram_socket): New.
3828 (fd_state_machine::m_new_stream_socket): New.
3829 (fd_state_machine::m_new_unknown_socket): New.
3830 (fd_state_machine::m_bound_datagram_socket): New.
3831 (fd_state_machine::m_bound_stream_socket): New.
3832 (fd_state_machine::m_bound_unknown_socket): New.
3833 (fd_state_machine::m_listening_stream_socket): New.
3834 (fd_state_machine::m_m_connected_stream_socket): New.
3835 (fd_state_machine::m_SOCK_STREAM): New.
3836 (fd_state_machine::m_SOCK_DGRAM): New.
3837 (fd_diagnostic::describe_state_change): Handle socket states.
3838 (fd_diagnostic::get_meaning_for_state_change): Likewise.
3839 (class fd_phase_mismatch): New.
3840 (enum expected_type): New enum.
3841 (class fd_type_mismatch): New.
3842 (fd_state_machine::fd_state_machine): Initialize new states and
3843 stashed named constants.
3844 (fd_state_machine::is_socket_fd_p): New.
3845 (fd_state_machine::is_datagram_socket_fd_p): New.
3846 (fd_state_machine::is_stream_socket_fd_p): New.
3847 (fd_state_machine::on_close): Handle the socket states.
3848 (fd_state_machine::check_for_open_fd): Complain about fncalls on
3849 sockets in the wrong phase. Support socket FDs.
3850 (add_constraint_ge_zero): New.
3851 (fd_state_machine::get_state_for_socket_type): New.
3852 (fd_state_machine::on_socket): New.
3853 (fd_state_machine::check_for_socket_fd): New.
3854 (fd_state_machine::check_for_new_socket_fd): New.
3855 (fd_state_machine::on_bind): New.
3856 (fd_state_machine::on_listen): New.
3857 (fd_state_machine::on_accept): New.
3858 (fd_state_machine::on_connect): New.
3859 (fd_state_machine::can_purge_p): Don't purge socket values.
3860 (get_fd_state): New.
3861 (region_model::mark_as_valid_fd): Use get_fd_state.
3862 (region_model::on_socket): New.
3863 (region_model::on_bind): New.
3864 (region_model::on_listen): New.
3865 (region_model::on_accept): New.
3866 (region_model::on_connect): New.
3867 * sm-fd.dot: Update to reflect sm-fd.cc changes.
3869 2022-11-15 David Malcolm <dmalcolm@redhat.com>
3871 PR analyzer/106302
3872 * analyzer-language.cc: New file.
3873 * analyzer-language.h: New file.
3874 * analyzer.h (get_stashed_constant_by_name): New decl.
3875 (log_stashed_constants): New decl.
3876 * engine.cc (impl_run_checkers): Call log_stashed_constants.
3877 * region-model-impl-calls.cc
3878 (region_model::impl_call_analyzer_dump_named_constant): New.
3879 * region-model.cc (region_model::on_stmt_pre): Handle
3880 __analyzer_dump_named_constant.
3881 * region-model.h
3882 (region_model::impl_call_analyzer_dump_named_constant): New decl.
3883 * sm-fd.cc (fd_state_machine::m_O_ACCMODE): New.
3884 (fd_state_machine::m_O_RDONLY): New.
3885 (fd_state_machine::m_O_WRONLY): New.
3886 (fd_state_machine::fd_state_machine): Initialize the new fields.
3887 (fd_state_machine::get_access_mode_from_flag): Use the new fields,
3888 rather than using the host values.
3890 2022-11-13 David Malcolm <dmalcolm@redhat.com>
3892 PR analyzer/106235
3893 * analyzer.opt (Wanalyzer-tainted-assertion): New.
3894 * checker-path.cc (checker_path::fixup_locations): Pass false to
3895 pending_diagnostic::fixup_location.
3896 * diagnostic-manager.cc (get_emission_location): Pass true to
3897 pending_diagnostic::fixup_location.
3898 * pending-diagnostic.cc (pending_diagnostic::fixup_location): Add
3899 bool param.
3900 * pending-diagnostic.h (pending_diagnostic::fixup_location): Add
3901 bool param to decl.
3902 * sm-taint.cc (taint_state_machine::m_tainted_control_flow): New.
3903 (taint_diagnostic::describe_state_change): Drop "final".
3904 (class tainted_assertion): New.
3905 (taint_state_machine::taint_state_machine): Initialize
3906 m_tainted_control_flow.
3907 (taint_state_machine::alt_get_inherited_state): Support
3908 comparisons being tainted, based on their arguments.
3909 (is_assertion_failure_handler_p): New.
3910 (taint_state_machine::on_stmt): Complain about calls to assertion
3911 failure handlers guarded by an attacker-controller conditional.
3912 Detect attacker-controlled gcond conditionals and gswitch index
3913 values.
3914 (taint_state_machine::check_control_flow_arg_for_taint): New.
3916 2022-11-11 David Malcolm <dmalcolm@redhat.com>
3918 * sm-fd.dot: Fix typo in comment.
3919 * sm-file.dot: New file.
3920 * varargs.cc: Fix typo in comment.
3921 * varargs.dot: New file.
3923 2022-11-11 David Malcolm <dmalcolm@redhat.com>
3925 * checker-path.h: Split out checker_event and its subclasses to...
3926 * checker-event.h: ...this new header.
3928 2022-11-11 David Malcolm <dmalcolm@redhat.com>
3930 PR analyzer/106147
3931 * analyzer.opt (Wanalyzer-infinite-recursion): New.
3932 * call-string.cc (call_string::count_occurrences_of_function):
3933 New.
3934 * call-string.h (call_string::count_occurrences_of_function): New
3935 decl.
3936 * checker-path.cc (function_entry_event::function_entry_event):
3937 New ctor.
3938 (checker_path::add_final_event): Delete.
3939 * checker-path.h (function_entry_event::function_entry_event): New
3940 ctor.
3941 (function_entry_event::get_desc): Drop "final".
3942 (checker_path::add_final_event): Delete.
3943 * diagnostic-manager.cc
3944 (diagnostic_manager::emit_saved_diagnostic): Create the final
3945 event via a new pending_diagnostic::add_final_event vfunc, rather
3946 than checker_path::add_final_event.
3947 (diagnostic_manager::add_events_for_eedge): Create function entry
3948 events via a new pending_diagnostic::add_function_entry_event
3949 vfunc.
3950 * engine.cc (exploded_graph::process_node): When creating a new
3951 PK_BEFORE_SUPERNODE node, call
3952 exploded_graph::detect_infinite_recursion on it after adding the
3953 in-edge.
3954 * exploded-graph.h (exploded_graph::detect_infinite_recursion):
3955 New decl.
3956 (exploded_graph::find_previous_entry_to): New decl.
3957 * infinite-recursion.cc: New file.
3958 * pending-diagnostic.cc
3959 (pending_diagnostic::add_function_entry_event): New.
3960 (pending_diagnostic::add_final_event): New.
3961 * pending-diagnostic.h
3962 (pending_diagnostic::add_function_entry_event): New vfunc.
3963 (pending_diagnostic::add_final_event): New vfunc.
3965 2022-11-10 David Malcolm <dmalcolm@redhat.com>
3967 PR analyzer/99671
3968 * analyzer.opt (Wanalyzer-deref-before-check): New warning.
3969 * diagnostic-manager.cc
3970 (null_assignment_sm_context::set_next_state): Only add state
3971 change events for transition to "null" state.
3972 (null_assignment_sm_context::is_transition_to_null): New.
3973 * engine.cc (impl_region_model_context::on_pop_frame): New.
3974 * exploded-graph.h (impl_region_model_context::on_pop_frame): New
3975 decl.
3976 * program-state.cc (sm_state_map::clear_any_state): New.
3977 (sm_state_map::can_merge_with_p): New.
3978 (program_state::can_merge_with_p): Replace requirement that
3979 sm-states be equal in favor of an attempt to merge them.
3980 * program-state.h (sm_state_map::clear_any_state): New decl.
3981 (sm_state_map::can_merge_with_p): New decl.
3982 * region-model.cc (region_model::eval_condition): Make const.
3983 (region_model::pop_frame): Call ctxt->on_pop_frame.
3984 * region-model.h (region_model::eval_condition): Make const.
3985 (region_model_context::on_pop_frame): New vfunc.
3986 (noop_region_model_context::on_pop_frame): New.
3987 (region_model_context_decorator::on_pop_frame): New.
3988 * sm-malloc.cc (enum resource_state): Add RS_ASSUMED_NON_NULL.
3989 (allocation_state::dump_to_pp): Drop "final".
3990 (struct assumed_non_null_state): New subclass.
3991 (malloc_state_machine::m_assumed_non_null): New.
3992 (assumed_non_null_p): New.
3993 (class deref_before_check): New.
3994 (assumed_non_null_state::dump_to_pp): New.
3995 (malloc_state_machine::get_or_create_assumed_non_null_state_for_frame):
3996 New.
3997 (malloc_state_machine::maybe_assume_non_null): New.
3998 (malloc_state_machine::on_stmt): Transition from start state to
3999 "assumed-non-null" state for pointers passed to
4000 __attribute__((nonnull)) arguments, and for pointers explicitly
4001 dereferenced. Call maybe_complain_about_deref_before_check for
4002 pointers explicitly compared against NULL.
4003 (malloc_state_machine::maybe_complain_about_deref_before_check):
4004 New.
4005 (malloc_state_machine::on_deallocator_call): Also transition
4006 "assumed-non-null" states to "freed".
4007 (malloc_state_machine::on_pop_frame): New.
4008 (malloc_state_machine::maybe_get_merged_states_nonequal): New.
4009 * sm-malloc.dot: Update for changes to sm-malloc.cc.
4010 * sm.h (state_machine::on_pop_frame): New.
4011 (state_machine::maybe_get_merged_state): New.
4012 (state_machine::maybe_get_merged_states_nonequal): New.
4014 2022-11-09 David Malcolm <dmalcolm@redhat.com>
4016 * checker-path.cc (checker_event::debug): New.
4017 (checker_path::add_event): Move here from checker-path.h. Add
4018 logging.
4019 * checker-path.h (checker_event::debug): New decl.
4020 (checker_path::checker_path): Add logger param.
4021 (checker_path::add_event): Move definition from here to
4022 checker-path.cc.
4023 (checker_path::m_logger): New field.
4024 * diagnostic-manager.cc
4025 (diagnostic_manager::emit_saved_diagnostic): Pass logger to
4026 checker_path ctor.
4027 (diagnostic_manager::add_events_for_eedge): Log scope when
4028 processing a run of stmts.
4030 2022-11-08 David Malcolm <dmalcolm@redhat.com>
4032 PR analyzer/101962
4033 * region-model-impl-calls.cc: Update comment.
4034 * region-model.cc (region_model::check_symbolic_bounds): Fix
4035 layout of "void" return. Replace usage of
4036 eval_condition_without_cm with eval_condition.
4037 (region_model::eval_condition): Take over body of...
4038 (region_model::eval_condition_without_cm): ...this subroutine,
4039 dropping the latter. Eliminating this distinction avoids issues
4040 where constraints were not considered when recursing.
4041 (region_model::compare_initial_and_pointer): Update comment.
4042 (region_model::symbolic_greater_than): Replace usage of
4043 eval_condition_without_cm with eval_condition.
4044 * region-model.h
4045 (region_model::eval_condition_without_cm): Delete decl.
4047 2022-11-08 David Malcolm <dmalcolm@redhat.com>
4049 * region-model-impl-calls.cc
4050 (region_model::impl_call_errno_location): New.
4051 * region-model-manager.cc
4052 (region_model_manager::region_model_manager): Initialize
4053 m_thread_local_region and m_errno_region.
4054 * region-model-manager.h (region_model_manager::get_errno_region):
4055 New accessor.
4056 (region_model_manager::m_thread_local_region): New.
4057 (region_model_manager::m_errno_region): New.
4058 * region-model.cc (region_model::on_call_pre): Special-case
4059 "__errno_location".
4060 (region_model::set_errno): New.
4061 * region-model.h (impl_call_errno_location): New decl.
4062 (region_model::set_errno): New decl.
4063 * region.cc (thread_local_region::dump_to_pp): New.
4064 (errno_region::dump_to_pp): New.
4065 * region.h (enum memory_space): Add MEMSPACE_THREAD_LOCAL.
4066 (enum region_kind): Add RK_THREAD_LOCAL and RK_ERRNO.
4067 (class thread_local_region): New.
4068 (is_a_helper <const thread_local_region *>::test): New.
4069 (class errno_region): New.
4070 (is_a_helper <const errno_region *>::test): New.
4071 * store.cc (binding_cluster::escaped_p): New.
4072 (store::escaped_p): Treat errno as always having escaped.
4073 (store::replay_call_summary_cluster): Handle RK_THREAD_LOCAL and
4074 RK_ERRNO.
4075 * store.h (binding_cluster::escaped_p): Remove definition.
4077 2022-11-08 David Malcolm <dmalcolm@redhat.com>
4079 * call-info.cc (success_call_info::get_desc): Delete.
4080 (failed_call_info::get_desc): Likewise.
4081 (succeed_or_fail_call_info::get_desc): New.
4082 * call-info.h (class succeed_or_fail_call_info): New.
4083 (class success_call_info): Convert to a subclass of
4084 succeed_or_fail_call_info.
4085 (class failed_call_info): Likewise.
4087 2022-11-08 David Malcolm <dmalcolm@redhat.com>
4089 * region-model-impl-calls.cc (region_model::impl_call_strchr):
4090 Move to on_call_post. Handle both outcomes using bifurcation,
4091 rather than just the "not found" case.
4092 * region-model.cc (region_model::on_call_pre): Move
4093 BUILT_IN_STRCHR and "strchr" to...
4094 (region_model::on_call_post): ...here.
4096 2022-11-03 David Malcolm <dmalcolm@redhat.com>
4098 * analyzer.h: Use std::unique_ptr for state machines from plugins.
4099 * engine.cc: Likewise.
4101 2022-11-03 David Malcolm <dmalcolm@redhat.com>
4103 * analyzer.h: Use std::unique_ptr for known functions.
4104 * engine.cc: Likewise.
4105 * known-function-manager.cc: Likewise.
4106 * known-function-manager.h: Likewise.
4108 2022-11-03 David Malcolm <dmalcolm@redhat.com>
4110 * analysis-plan.cc: Define INCLUDE_MEMORY before including
4111 system.h.
4112 * analyzer-pass.cc: Likewise.
4113 * analyzer-selftests.cc: Likewise.
4114 * analyzer.cc: Likewise.
4115 * analyzer.h: Use std::unique_ptr in bifurcation code.
4116 * call-string.cc: Define INCLUDE_MEMORY before including system.h.
4117 * complexity.cc: Likewise.
4118 * engine.cc: Use std::unique_ptr in bifurcation code.
4119 * exploded-graph.h: Likewise.
4120 * known-function-manager.cc: Define INCLUDE_MEMORY before
4121 including system.h.
4122 * region-model-impl-calls.cc: Use std::unique_ptr in bifurcation
4123 code.
4124 * region-model.cc: Likewise.
4125 * region-model.h: Likewise.
4126 * supergraph.cc: Define INCLUDE_MEMORY before including system.h.
4128 2022-11-03 David Malcolm <dmalcolm@redhat.com>
4130 * call-info.cc: Use std::unique_ptr for checker_event.
4131 * checker-path.cc: Likewise.
4132 * checker-path.h: Likewise.
4133 * diagnostic-manager.cc: Likewise.
4134 * engine.cc: Likewise.
4135 * pending-diagnostic.cc: Likewise.
4136 * sm-signal.cc: Likewise.
4137 * varargs.cc: Likewise.
4139 2022-11-03 David Malcolm <dmalcolm@redhat.com>
4141 * diagnostic-manager.cc: Include "make-unique.h".
4142 Use std::unique_ptr for feasibility_problems and exploded_path.
4143 Delete explicit saved_diagnostic dtor.
4144 * diagnostic-manager.h: Likewise.
4145 * engine.cc: Likewise.
4146 * exploded-graph.h: Likewise.
4147 * feasible-graph.cc: Likewise.
4148 * feasible-graph.h: Likewise.
4150 2022-11-03 David Malcolm <dmalcolm@redhat.com>
4152 * checker-path.cc (rewind_event::rewind_event): Update for usage of
4153 std::unique_ptr on custom_edge_info.
4154 * engine.cc (exploded_node::on_longjmp): Likewise.
4155 (exploded_edge::exploded_edge): Likewise.
4156 (exploded_edge::~exploded_edge): Delete.
4157 (exploded_graph::add_function_entry): Update for usage of
4158 std::unique_ptr on custom_edge_info.
4159 (exploded_graph::add_edge): Likewise.
4160 (add_tainted_args_callback): Likewise.
4161 (exploded_graph::maybe_create_dynamic_call): Likewise.
4162 (exploded_graph::process_node): Likewise.
4163 * exploded-graph.h (exploded_edge::~exploded_edge): Delete.
4164 (exploded_edge::m_custom_info): Use std::unique_ptr.
4165 (exploded_edge::add_edge): Likewise.
4166 * sm-signal.cc (register_signal_handler::impl_transition): Use
4167 make_unique.
4169 2022-11-03 David Malcolm <dmalcolm@redhat.com>
4171 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic): Make
4172 stmt_finder const.
4173 (saved_diagnostic::~saved_diagnostic): Remove explicit delete of
4174 m_stmt_finder.
4175 (diagnostic_manager::add_diagnostic): Make stmt_finder const.
4176 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic):
4177 Likewise.
4178 (saved_diagnostic::m_stmt_finder): Convert to std::unique_ptr.
4179 (diagnostic_manager::add_diagnostic): Make stmt_finder const.
4180 * engine.cc (impl_sm_context::impl_sm_context): Likewise.
4181 (impl_sm_context::m_stmt_finder): Likewise.
4182 (leak_stmt_finder::clone): Convert return type to std::unique_ptr.
4183 * exploded-graph.h (stmt_finder::clone): Likewise.
4185 2022-11-03 David Malcolm <dmalcolm@redhat.com>
4187 * call-info.cc: Add define of INCLUDE_MEMORY.
4188 * call-summary.cc: Likewise.
4189 * checker-path.cc: Likewise.
4190 * constraint-manager.cc: Likewise.
4191 * diagnostic-manager.cc: Likewise.
4192 (saved_diagnostic::saved_diagnostic): Use std::unique_ptr for
4193 param d and field m_d.
4194 (saved_diagnostic::~saved_diagnostic): Remove explicit delete of m_d.
4195 (saved_diagnostic::add_note): Use std::unique_ptr for
4196 param pn.
4197 (saved_diagnostic::get_pending_diagnostic): Update for conversion
4198 of m_sd.m_d to unique_ptr.
4199 (diagnostic_manager::add_diagnostic): Use std::unique_ptr for
4200 param d. Remove explicit deletion.
4201 (diagnostic_manager::add_note): Use std::unique_ptr for param pn.
4202 (diagnostic_manager::emit_saved_diagnostic): Update for conversion
4203 of m_sd.m_d to unique_ptr.
4204 (null_assignment_sm_context::warn): Use std::unique_ptr for
4205 param d. Remove explicit deletion.
4206 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Use
4207 std::unique_ptr for param d.
4208 (saved_diagnostic::add_note): Likewise for param pn.
4209 (saved_diagnostic::m_d): Likewise.
4210 (diagnostic_manager::add_diagnostic): Use std::unique_ptr for
4211 param d.
4212 (diagnostic_manager::add_note): Use std::unique_ptr for param pn.
4213 * engine.cc: Include "make-unique.h".
4214 (impl_region_model_context::warn): Update to use std::unique_ptr
4215 for param, removing explicit deletion.
4216 (impl_region_model_context::add_note): Likewise.
4217 (impl_sm_context::warn): Update to use std::unique_ptr
4218 for param.
4219 (impl_region_model_context::on_state_leak): Likewise for result of
4220 on_leak.
4221 (exploded_node::on_longjmp): Use make_unique when creating
4222 pending_diagnostic.
4223 (exploded_graph::process_node): Likewise.
4224 * exploded-graph.h (impl_region_model_context::warn): Update to
4225 use std::unique_ptr for param.
4226 (impl_region_model_context::add_note): Likewise.
4227 * feasible-graph.cc: Add define of INCLUDE_MEMORY.
4228 * pending-diagnostic.cc: Likewise.
4229 * pending-diagnostic.h: Include analyzer.sm.h"
4230 * program-point.cc: Add define of INCLUDE_MEMORY.
4231 * program-state.cc: Likewise.
4232 * region-model-asm.cc: Likewise.
4233 * region-model-impl-calls.cc: Likewise. Include "make-unique.h".
4234 (region_model::impl_call_putenv): Use make_unique when creating
4235 pending_diagnostic.
4236 * region-model-manager.cc: Add define of INCLUDE_MEMORY.
4237 * region-model-reachability.cc: Likewise.
4238 * region-model.cc: Likewise. Include "make-unique.h".
4239 (region_model::get_gassign_result): Use make_unique when creating
4240 pending_diagnostic.
4241 (region_model::check_for_poison): Likewise.
4242 (region_model::on_stmt_pre): Likewise.
4243 (region_model::check_symbolic_bounds): Likewise.
4244 (region_model::check_region_bounds): Likewise.
4245 (annotating_ctxt: make_note): Use std::unique_ptr for result.
4246 (region_model::deref_rvalue): Use make_unique when creating
4247 pending_diagnostic.
4248 (region_model::check_for_writable_region): Likewise.
4249 (region_model::check_region_size): Likewise.
4250 (region_model::check_dynamic_size_for_floats): Likewise.
4251 (region_model::maybe_complain_about_infoleak): Likewise.
4252 (noop_region_model_context::add_note): Use std::unique_ptr for
4253 param. Remove explicit deletion.
4254 * region-model.h: Include "analyzer/pending-diagnostic.h".
4255 (region_model_context::warn): Convert param to std::unique_ptr.
4256 (region_model_context::add_note): Likewise.
4257 (noop_region_model_context::warn): Likewise.
4258 (noop_region_model_context::add_note): Likewise.
4259 (region_model_context_decorator::warn): Likewise.
4260 (region_model_context_decorator::add_note): Likewise.
4261 (note_adding_context::warn): Likewise.
4262 (note_adding_context::make_note): Likewise for return type.
4263 (test_region_model_context::warn): Convert param to
4264 std::unique_ptr.
4265 * region.cc: Add define of INCLUDE_MEMORY.
4266 * sm-fd.cc: Likewise. Include "make-unique.h".
4267 (fd_state_machine::check_for_fd_attrs): Use make_unique when
4268 creating pending_diagnostics.
4269 (fd_state_machine::on_open): Likewise.
4270 (fd_state_machine::on_creat): Likewise.
4271 (fd_state_machine::check_for_dup): Likewise.
4272 (fd_state_machine::on_close): Likewise.
4273 (fd_state_machine::check_for_open_fd): Likewise.
4274 (fd_state_machine::on_leak): Likewise, converting return type to
4275 std::unique_ptr.
4276 * sm-file.cc: Add define of INCLUDE_MEMORY. Include
4277 "make-unique.h".
4278 (fileptr_state_machine::on_stmt): Use make_unique when creating
4279 pending_diagnostic.
4280 (fileptr_state_machine::on_leak): Likewise, converting return type
4281 to std::unique_ptr.
4282 * sm-malloc.cc: Add define of INCLUDE_MEMORY. Include
4283 "make-unique.h".
4284 (malloc_state_machine::on_stmt): Use make_unique when creating
4285 pending_diagnostic.
4286 (malloc_state_machine::handle_free_of_non_heap): Likewise.
4287 (malloc_state_machine::on_deallocator_call): Likewise.
4288 (malloc_state_machine::on_realloc_call): Likewise.
4289 (malloc_state_machine::on_leak): Likewise, converting return type
4290 to std::unique_ptr.
4291 * sm-pattern-test.cc: Add define of INCLUDE_MEMORY. Include
4292 "make-unique.h".
4293 (pattern_test_state_machine::on_condition): Use make_unique when
4294 creating pending_diagnostic.
4295 * sm-sensitive.cc: Add define of INCLUDE_MEMORY. Include
4296 "make-unique.h".
4297 (sensitive_state_machine::warn_for_any_exposure): Use make_unique
4298 when creating pending_diagnostic.
4299 * sm-signal.cc: Add define of INCLUDE_MEMORY. Include
4300 "make-unique.h".
4301 (signal_state_machine::on_stmt): Use make_unique when creating
4302 pending_diagnostic.
4303 * sm-taint.cc: Add define of INCLUDE_MEMORY. Include
4304 "make-unique.h".
4305 (taint_state_machine::check_for_tainted_size_arg): Use make_unique
4306 when creating pending_diagnostic.
4307 (taint_state_machine::check_for_tainted_divisor): Likewise.
4308 (region_model::check_region_for_taint): Likewise.
4309 (region_model::check_dynamic_size_for_taint): Likewise.
4310 * sm.cc: Add define of INCLUDE_MEMORY. Include
4311 "analyzer/pending-diagnostic.h".
4312 (state_machine::on_leak): Move here from sm.h, changing return
4313 type to std::unique_ptr.
4314 * sm.h (state_machine::on_leak): Change return type to
4315 std::unique_ptr. Move defn of base impl to sm.cc
4316 (sm_context::warn): Convert param d to std_unique_ptr.
4317 * state-purge.cc: Add define of INCLUDE_MEMORY.
4318 * store.cc: Likewise.
4319 * svalue.cc: Likewise.
4320 * trimmed-graph.cc: Likewise.
4321 * varargs.cc: Likewise. Include "make-unique.h".
4322 (va_list_state_machine::check_for_ended_va_list): Use make_unique
4323 when creating pending_diagnostic.
4324 (va_list_state_machine::on_leak): Likewise, converting return type
4325 to std::unique_ptr.
4326 (region_model::impl_call_va_arg): Use make_unique when creating
4327 pending_diagnostic.
4329 2022-11-03 David Malcolm <dmalcolm@redhat.com>
4331 PR analyzer/107486
4332 * analyzer.cc (is_pipe_call_p): New.
4333 * analyzer.h (is_pipe_call_p): New decl.
4334 * region-model.cc (region_model::on_call_pre): Use it.
4335 (region_model::on_call_post): Likewise.
4337 2022-10-26 David Malcolm <dmalcolm@redhat.com>
4339 * sm-fd.cc (fd_state_machine::on_open): Transition to "unchecked"
4340 when the mode is symbolic, rather than just on integer constants.
4341 (fd_state_machine::check_for_open_fd): Don't complain about
4342 unchecked values in the start state.
4344 2022-10-26 David Malcolm <dmalcolm@redhat.com>
4346 * sm-fd.dot: New file.
4348 2022-10-24 David Malcolm <dmalcolm@redhat.com>
4350 PR analyzer/107349
4351 * varargs.cc (get_va_copy_arg): Fix the non-pointer case.
4353 2022-10-24 David Malcolm <dmalcolm@redhat.com>
4355 PR analyzer/107345
4356 * region-model.cc (region_model::eval_condition_without_cm):
4357 Ensure that constants are on the right-hand side before checking
4358 for them.
4360 2022-10-24 David Malcolm <dmalcolm@redhat.com>
4362 * engine.cc (impl_region_model_context::get_malloc_map): Replace
4363 with...
4364 (impl_region_model_context::get_state_map_by_name): ...this.
4365 (impl_region_model_context::get_fd_map): Delete.
4366 (impl_region_model_context::get_taint_map): Delete.
4367 * exploded-graph.h (impl_region_model_context::get_fd_map):
4368 Delete.
4369 (impl_region_model_context::get_malloc_map): Delete.
4370 (impl_region_model_context::get_taint_map): Delete.
4371 (impl_region_model_context::get_state_map_by_name): New.
4372 * region-model.h (region_model_context::get_state_map_by_name):
4373 New vfunc.
4374 (region_model_context::get_fd_map): Convert from vfunc to
4375 function.
4376 (region_model_context::get_malloc_map): Likewise.
4377 (region_model_context::get_taint_map): Likewise.
4378 (noop_region_model_context::get_state_map_by_name): New.
4379 (noop_region_model_context::get_fd_map): Delete.
4380 (noop_region_model_context::get_malloc_map): Delete.
4381 (noop_region_model_context::get_taint_map): Delete.
4382 (region_model_context_decorator::get_state_map_by_name): New.
4383 (region_model_context_decorator::get_fd_map): Delete.
4384 (region_model_context_decorator::get_malloc_map): Delete.
4385 (region_model_context_decorator::get_taint_map): Delete.
4387 2022-10-24 David Malcolm <dmalcolm@redhat.com>
4389 PR analyzer/106300
4390 * engine.cc (impl_region_model_context::get_fd_map): New.
4391 * exploded-graph.h (impl_region_model_context::get_fd_map): New
4392 decl.
4393 * region-model-impl-calls.cc (region_model::impl_call_pipe): New.
4394 * region-model.cc (region_model::update_for_int_cst_return): New,
4395 based on...
4396 (region_model::update_for_zero_return): ...this. Reimplement in
4397 terms of the former.
4398 (region_model::on_call_pre): Handle "pipe" and "pipe2".
4399 (region_model::on_call_post): Likewise.
4400 * region-model.h (region_model::impl_call_pipe): New decl.
4401 (region_model::update_for_int_cst_return): New decl.
4402 (region_model::mark_as_valid_fd): New decl.
4403 (region_model_context::get_fd_map): New pure virtual fn.
4404 (noop_region_model_context::get_fd_map): New.
4405 (region_model_context_decorator::get_fd_map): New.
4406 * sm-fd.cc: Include "analyzer/program-state.h".
4407 (fd_state_machine::describe_state_change): Handle transitions from
4408 start state to valid states.
4409 (fd_state_machine::mark_as_valid_fd): New.
4410 (fd_state_machine::on_stmt): Add missing return for "creat".
4411 (region_model::mark_as_valid_fd): New.
4413 2022-10-19 David Malcolm <dmalcolm@redhat.com>
4415 PR analyzer/105765
4416 * varargs.cc (get_BT_VALIST_ARG): Rename to...
4417 (get_va_copy_arg): ...this, and update logic for determining level
4418 of indirection of va_copy's argument to use type of argument,
4419 rather than looking at va_list_type_node, to correctly handle
4420 __builtin_ms_va_copy.
4421 (get_stateful_BT_VALIST_ARG): Rename to...
4422 (get_stateful_va_copy_arg): ...this.
4423 (va_list_state_machine::on_va_copy): Update for renaming.
4424 (region_model::impl_call_va_copy): Likewise.
4426 2022-10-13 David Malcolm <dmalcolm@redhat.com>
4428 PR analyzer/107210
4429 * svalue.cc (constant_svalue::maybe_fold_bits_within): Only
4430 attempt to extract individual bits when tree_fits_uhwi_p.
4432 2022-10-07 David Malcolm <dmalcolm@redhat.com>
4434 PR analyzer/105783
4435 * region-model.cc (selftest::get_bit): New function.
4436 (selftest::test_bits_within_svalue_folding): New.
4437 (selfftest::analyzer_region_model_cc_tests): Call it.
4438 * svalue.cc (constant_svalue::maybe_fold_bits_within): Handle the
4439 case of extracting a single bit.
4441 2022-10-06 David Malcolm <dmalcolm@redhat.com>
4443 PR analyzer/107158
4444 * store.cc (store::replay_call_summary_cluster): Eliminate
4445 special-casing of RK_HEAP_ALLOCATED in favor of sharing code with
4446 RK_DECL, avoiding an ICE due to attempting to bind a
4447 compound_svalue into a binding_cluster when an svalue in the
4448 summary cluster converts to a compound_svalue in the caller.
4450 2022-10-06 David Malcolm <dmalcolm@redhat.com>
4452 * call-summary.cc (call_summary_replay::dump_to_pp): Bulletproof
4453 against NULL caller regions/svalues.
4455 2022-10-05 David Malcolm <dmalcolm@redhat.com>
4457 * analysis-plan.cc: Simplify includes.
4458 * analyzer-pass.cc: Likewise.
4459 * analyzer-selftests.cc: Likewise.
4460 * analyzer.cc: Likewise.
4461 * analyzer.h: Add includes of "json.h" and "tristate.h".
4462 * call-info.cc: Simplify includes.
4463 * call-string.cc: Likewise.
4464 * call-summary.cc: Likewise.
4465 * checker-path.cc: Likewise.
4466 * complexity.cc: Likewise.
4467 * constraint-manager.cc: Likewise.
4468 * diagnostic-manager.cc: Likewise.
4469 * engine.cc: Likewise.
4470 * feasible-graph.cc: Likewise.
4471 * known-function-manager.cc: Likewise.
4472 * pending-diagnostic.cc: Likewise.
4473 * program-point.cc: Likewise.
4474 * program-state.cc: Likewise.
4475 * region-model-asm.cc: Likewise.
4476 * region-model-impl-calls.cc: Likewise.
4477 * region-model-manager.cc: Likewise.
4478 * region-model-reachability.cc: Likewise.
4479 * region-model.cc: Likewise.
4480 * region-model.h: Include "selftest.h".
4481 * region.cc: Simplify includes.
4482 * sm-fd.cc: Likewise.
4483 * sm-file.cc: Likewise.
4484 * sm-malloc.cc: Likewise.
4485 * sm-pattern-test.cc: Likewise.
4486 * sm-sensitive.cc: Likewise.
4487 * sm-signal.cc: Likewise.
4488 * sm-taint.cc: Likewise.
4489 * sm.cc: Likewise.
4490 * state-purge.cc: Likewise.
4491 * store.cc: Likewise.
4492 * store.h: Likewise.
4493 * supergraph.cc: Likewise.
4494 * svalue.cc: Likewise.
4495 * svalue.h: Likewise.
4496 * trimmed-graph.cc: Likewise.
4497 * varargs.cc: Likewise.
4499 2022-10-05 David Malcolm <dmalcolm@redhat.com>
4501 PR analyzer/107060
4502 * call-summary.cc
4503 (call_summary_replay::convert_svalue_from_summary_1): Handle NULL
4504 results from convert_svalue_from_summary in SK_UNARY_OP and
4505 SK_BIN_OP.
4506 * engine.cc (impl_region_model_context::on_unknown_change): Bail
4507 out on svalues that can't have associated state.
4508 * region-model-impl-calls.cc
4509 (region_model::impl_call_analyzer_get_unknown_ptr): New.
4510 * region-model.cc (region_model::on_stmt_pre): Handle
4511 "__analyzer_get_unknown_ptr".
4512 * region-model.h
4513 (region_model::impl_call_analyzer_get_unknown_ptr): New decl.
4514 * store.cc (store::replay_call_summary_cluster): Avoid trying to
4515 create binding clusters for base regions that shouldn't have them.
4517 2022-10-05 Martin Liska <mliska@suse.cz>
4519 * call-summary.cc (call_summary_replay::call_summary_replay):
4520 Remove unused variable and arguments.
4521 * call-summary.h: Likewise.
4522 * engine.cc (exploded_node::on_stmt): Likewise.
4523 (exploded_node::replay_call_summaries): Likewise.
4524 (exploded_node::replay_call_summary): Likewise.
4525 * exploded-graph.h (class exploded_node): Likewise.
4527 2022-10-05 David Malcolm <dmalcolm@redhat.com>
4529 PR analyzer/107072
4530 * analyzer-logging.h: Include "diagnostic-core.h".
4531 * analyzer.h: Include "function.h".
4532 (class call_summary): New forward decl.
4533 (class call_summary_replay): New forward decl.
4534 (struct per_function_data): New forward decl.
4535 (struct interesting_t): New forward decl.
4536 (custom_edge_info::update_state): New vfunc.
4537 * call-info.cc (custom_edge_info::update_state): New.
4538 * call-summary.cc: New file.
4539 * call-summary.h: New file.
4540 * constraint-manager.cc: Include "analyzer/call-summary.h".
4541 (class replay_fact_visitor): New.
4542 (constraint_manager::replay_call_summary): New.
4543 * constraint-manager.h (constraint_manager::replay_call_summary):
4544 New.
4545 * engine.cc: Include "analyzer/call-summary.h".
4546 (exploded_node::on_stmt): Handle call summaries.
4547 (class call_summary_edge_info): New.
4548 (exploded_node::replay_call_summaries): New.
4549 (exploded_node::replay_call_summary): New.
4550 (per_function_data::~per_function_data): New.
4551 (per_function_data::add_call_summary): Move here from header and
4552 reimplement.
4553 (exploded_graph::process_node): Call update_state rather than
4554 update_model when handling bifurcation
4555 (viz_callgraph_node::dump_dot): Use a regular label rather
4556 than an HTML table; add summaries to dump.
4557 * exploded-graph.h: Include "alloc-pool.h", "fibonacci_heap.h",
4558 "supergraph.h", "sbitmap.h", "shortest-paths.h", "analyzer/sm.h",
4559 "analyzer/program-state.h", and "analyzer/diagnostic-manager.h".
4560 (exploded_node::replay_call_summaries): New decl.
4561 (exploded_node::replay_call_summary): New decl.
4562 (per_function_data::~per_function_data): New decl.
4563 (per_function_data::add_call_summary): Move implemention from
4564 header.
4565 (per_function_data::m_summaries): Update type of element.
4566 * known-function-manager.h: Include "analyzer/analyzer-logging.h".
4567 * program-point.h: Include "pretty-print.h" and
4568 "analyzer/call-string.h".
4569 * program-state.cc: Include "analyzer/call-summary.h".
4570 (sm_state_map::replay_call_summary): New.
4571 (program_state::replay_call_summary): New.
4572 * program-state.h (sm_state_map::replay_call_summary): New decl.
4573 (program_state::replay_call_summary): New decl.
4574 * region-model-manager.cc
4575 (region_model_manager::get_or_create_asm_output_svalue): New
4576 overload.
4577 * region-model-manager.h
4578 (region_model_manager::get_or_create_asm_output_svalue): New
4579 overload decl.
4580 * region-model.cc: Include "analyzer/call-summary.h".
4581 (region_model::maybe_update_for_edge): Remove call to
4582 region_model::update_for_call_summary on
4583 SUPEREDGE_INTRAPROCEDURAL_CALL.
4584 (region_model::update_for_call_summary): Delete.
4585 (region_model::replay_call_summary): New.
4586 * region-model.h (region_model::replay_call_summary): New decl.
4587 (region_model::update_for_call_summary): Delete decl.
4588 * store.cc: Include "analyzer/call-summary.h".
4589 (store::replay_call_summary): New.
4590 (store::replay_call_summary_cluster): New.
4591 * store.h: Include "tristate.h".
4592 (is_a_helper <const ana::concrete_binding *>::test): New.
4593 (store::replay_call_summary): New decl.
4594 (store::replay_call_summary_cluster): New decl.
4595 * supergraph.cc (get_ultimate_function_for_cgraph_edge): Remove
4596 "static" from decl.
4597 (supergraph_call_edge): Make stmt param const.
4598 * supergraph.h: Include "ordered-hash-map.h", "cfg.h",
4599 "basic-block.h", "gimple.h", "gimple-iterator.h", and "digraph.h".
4600 (supergraph_call_edge): Make stmt param const.
4601 (get_ultimate_function_for_cgraph_edge): New decl.
4602 * svalue.cc (compound_svalue::compound_svalue): Assert that we're
4603 not nesting compound_svalues.
4604 * svalue.h: Include "json.h", "analyzer/store.h", and
4605 "analyzer/program-point.h".
4606 (asm_output_svalue::get_num_outputs): New accessor.
4608 2022-10-05 David Malcolm <dmalcolm@redhat.com>
4610 * region-model.h: Include "analyzer/region-model-manager.h"
4611 (class region_model_manager): Move decl to...
4612 * region-model-manager.h: ...this new file.
4614 2022-10-05 David Malcolm <dmalcolm@redhat.com>
4616 * region-model-manager.cc
4617 (region_model_manager::maybe_fold_unaryop): Fold -(-(VAL)) to VAL.
4619 2022-10-05 David Malcolm <dmalcolm@redhat.com>
4621 * region-model-manager.cc
4622 (region_model_manager::get_or_create_widening_svalue): Use a
4623 function_point rather than a program_point.
4624 * region-model.cc (selftest::test_widening_constraints): Likewise.
4625 * region-model.h
4626 (region_model_manager::get_or_create_widening_svalue): Likewise.
4627 (model_merger::get_function_point): New.
4628 * svalue.cc (svalue::can_merge_p): Use a function_point rather
4629 than a program_point.
4630 (svalue::can_merge_p): Likewise.
4631 * svalue.h (widening_svalue::key_t): Likewise.
4632 (widening_svalue::widening_svalue): Likewise.
4634 2022-09-12 Martin Liska <mliska@suse.cz>
4636 * region-model.cc (region_model::maybe_complain_about_infoleak):
4637 Remove unused fields.
4639 2022-09-11 Tim Lange <mail@tim-lange.me>
4641 PR analyzer/106845
4642 * region-model.cc (region_model::check_region_bounds):
4643 Bail out if 0 bytes were accessed.
4644 * store.cc (byte_range::dump_to_pp):
4645 Add special case for empty ranges.
4646 (byte_range::exceeds_p): Restrict to non-empty ranges.
4647 (byte_range::falls_short_of_p): Restrict to non-empty ranges.
4648 * store.h (bit_range::empty_p): New function.
4649 (bit_range::get_last_byte_offset): Restrict to non-empty ranges.
4650 (byte_range::empty_p): New function.
4651 (byte_range::get_last_byte_offset): Restrict to non-empty ranges.
4653 2022-09-09 David Malcolm <dmalcolm@redhat.com>
4655 * analyzer.opt (Wanalyzer-exposure-through-uninit-copy): New.
4656 * checker-path.cc (region_creation_event::region_creation_event):
4657 Add "capacity" and "kind" params.
4658 (region_creation_event::get_desc): Generalize to different kinds
4659 of event.
4660 (checker_path::add_region_creation_event): Convert to...
4661 (checker_path::add_region_creation_events): ...this.
4662 * checker-path.h (enum rce_kind): New.
4663 (region_creation_event::region_creation_event): Add "capacity" and
4664 "kind" params.
4665 (region_creation_event::m_capacity): New field.
4666 (region_creation_event::m_rce_kind): New field.
4667 (checker_path::add_region_creation_event): Convert to...
4668 (checker_path::add_region_creation_events): ...this.
4669 * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
4670 Update for multiple region creation events.
4671 (diagnostic_manager::add_event_on_final_node): Likewise.
4672 (diagnostic_manager::add_events_for_eedge): Likewise.
4673 * region-model-impl-calls.cc (call_details::get_logger): New.
4674 * region-model.cc: Define INCLUDE_MEMORY before including
4675 "system.h". Include "gcc-rich-location.h".
4676 (class record_layout): New.
4677 (class exposure_through_uninit_copy): New.
4678 (contains_uninit_p): New.
4679 (region_model::maybe_complain_about_infoleak): New.
4680 * region-model.h (call_details::get_logger): New decl.
4681 (region_model::maybe_complain_about_infoleak): New decl.
4682 (region_model::mark_as_tainted): New decl.
4683 * sm-taint.cc (region_model::mark_as_tainted): New.
4685 2022-09-09 David Malcolm <dmalcolm@redhat.com>
4687 * analyzer.h (class known_function_manager): New forward decl.
4688 (class known_function): New.
4689 (plugin_analyzer_init_iface::register_known_function): New.
4690 * engine.cc: Include "analyzer/known-function-manager.h".
4691 (plugin_analyzer_init_impl::plugin_analyzer_init_impl): Add
4692 known_fn_mgr param.
4693 (plugin_analyzer_init_impl::register_state_machine): Add
4694 LOC_SCOPE.
4695 (plugin_analyzer_init_impl::register_known_function): New.
4696 (plugin_analyzer_init_impl::m_known_fn_mgr): New.
4697 (impl_run_checkers): Update plugin callback invocation to use
4698 eng's known_function_manager.
4699 * known-function-manager.cc: New file.
4700 * known-function-manager.h: New file.
4701 * region-model-manager.cc
4702 (region_model_manager::region_model_manager): Pass logger to
4703 m_known_fn_mgr's ctor.
4704 * region-model.cc (region_model::update_for_zero_return): New.
4705 (region_model::update_for_nonzero_return): New.
4706 (maybe_simplify_upper_bound): New.
4707 (region_model::maybe_get_copy_bounds): New.
4708 (region_model::get_known_function): New.
4709 (region_model::on_call_pre): Handle plugin-supplied known
4710 functions.
4711 * region-model.h: Include "analyzer/known-function-manager.h".
4712 (region_model_manager::get_known_function_manager): New.
4713 (region_model_manager::m_known_fn_mgr): New.
4714 (call_details::get_model): New accessor.
4715 (region_model::maybe_get_copy_bounds): New decl.
4716 (region_model::update_for_zero_return): New decl.
4717 (region_model::update_for_nonzero_return): New decl.
4718 (region_model::get_known_function): New decl.
4719 (region_model::get_known_function_manager): New.
4721 2022-09-08 Tim Lange <mail@tim-lange.me>
4723 PR analyzer/106625
4724 * analyzer.h (region_offset): Eliminate m_is_symbolic member.
4725 * region-model-impl-calls.cc (region_model::impl_call_realloc):
4726 Refine implementation to be more precise.
4727 * region-model.cc (class symbolic_past_the_end):
4728 Abstract diagnostic class to complain about accesses past the end
4729 with symbolic values.
4730 (class symbolic_buffer_overflow):
4731 Concrete diagnostic class to complain about buffer overflows with
4732 symbolic values.
4733 (class symbolic_buffer_overread):
4734 Concrete diagnostic class to complain about buffer overreads with
4735 symbolic values.
4736 (region_model::check_symbolic_bounds): New function.
4737 (maybe_get_integer_cst_tree): New helper function.
4738 (region_model::check_region_bounds):
4739 Add call to check_symbolic_bounds if offset is not concrete.
4740 (region_model::eval_condition_without_cm):
4741 Add support for EQ_EXPR and GT_EXPR with binaryop_svalues.
4742 (is_positive_svalue): New hleper function.
4743 (region_model::symbolic_greater_than):
4744 New function to handle GT_EXPR comparisons with symbolic values.
4745 (region_model::structural_equality): New function to compare
4746 whether two svalues are structured the same, i.e. evaluate to
4747 the same value.
4748 (test_struct): Reflect changes to region::calc_offset.
4749 (test_var): Likewise.
4750 (test_array_2): Likewise and add selftest with symbolic i.
4751 * region-model.h (class region_model): Add check_symbolic_bounds,
4752 symbolic_greater_than and structural_equality.
4753 * region.cc (region::get_offset):
4754 Reflect changes to region::calc_offset.
4755 (region::calc_offset):
4756 Compute the symbolic offset if the offset is not concrete.
4757 (region::get_relative_symbolic_offset): New function to return the
4758 symbolic offset in bytes relative to its parent.
4759 (field_region::get_relative_symbolic_offset): Likewise.
4760 (element_region::get_relative_symbolic_offset): Likewise.
4761 (offset_region::get_relative_symbolic_offset): Likewise.
4762 (bit_range_region::get_relative_symbolic_offset): Likewise.
4763 * region.h: Add get_relative_symbolic_offset.
4764 * store.cc (binding_key::make):
4765 Reflect changes to region::calc_offset.
4766 (binding_map::apply_ctor_val_to_range): Likewise.
4767 (binding_map::apply_ctor_pair_to_child_region): Likewise.
4768 (binding_cluster::bind_compound_sval): Likewise.
4769 (binding_cluster::get_any_binding): Likewise.
4770 (binding_cluster::maybe_get_compound_binding): Likewise.
4772 2022-09-05 Tim Lange <mail@tim-lange.me>
4774 * region-model-impl-calls.cc (region_model::impl_call_strcpy):
4775 Handle the constant string case.
4776 * region-model.cc (region_model::get_string_size):
4777 New function to get the string size from a region or svalue.
4778 * region-model.h (class region_model): Add get_string_size.
4780 2022-09-05 Tim Lange <mail@tim-lange.me>
4782 * region.cc (cast_region::get_relative_concrete_offset):
4783 New overloaded method.
4784 * region.h: Add cast_region::get_relative_concrete_offset.
4786 2022-08-22 Martin Liska <mliska@suse.cz>
4788 * region-model.cc: Add missing final keyword.
4790 2022-08-18 Tim Lange <mail@tim-lange.me>
4792 PR analyzer/106181
4793 * analyzer.opt: Add Wanalyzer-imprecise-floating-point-arithmetic.
4794 * region-model.cc (is_any_cast_p): Formatting.
4795 (region_model::check_region_size): Ensure precondition.
4796 (class imprecise_floating_point_arithmetic): New abstract
4797 diagnostic class for all floating-point related warnings.
4798 (class float_as_size_arg): Concrete diagnostic class to complain
4799 about floating-point operands inside the size argument.
4800 (class contains_floating_point_visitor):
4801 New visitor to find floating-point operands inside svalues.
4802 (region_model::check_dynamic_size_for_floats): New function.
4803 (region_model::set_dynamic_extents):
4804 Call to check_dynamic_size_for_floats.
4805 * region-model.h (class region_model):
4806 Add region_model::check_dynamic_size_for_floats.
4808 2022-08-16 Martin Liska <mliska@suse.cz>
4810 * region-model.cc: Fix -Winconsistent-missing-override clang
4811 warning.
4812 * region.h: Likewise.
4814 2022-08-15 David Malcolm <dmalcolm@redhat.com>
4816 PR analyzer/106626
4817 * region-model.cc (buffer_overread::emit): Fix copy&paste error in
4818 direction of the access in the note.
4820 2022-08-15 David Malcolm <dmalcolm@redhat.com>
4822 PR analyzer/106573
4823 * region-model.cc (region_model::on_call_pre): Use check_call_args
4824 when ensuring that we call get_arg_svalue on all args. Remove
4825 redundant call from handling for stdio builtins.
4827 2022-08-15 Immad Mir <mirimmad@outlook.com>
4829 PR analyzer/106551
4830 * sm-fd.cc (check_for_dup): exit early if first
4831 argument is invalid for all dup functions.
4833 2022-08-12 Tim Lange <mail@tim-lange.me>
4835 PR analyzer/106000
4836 * analyzer.opt: Add Wanalyzer-out-of-bounds.
4837 * region-model.cc (class out_of_bounds): Diagnostics base class
4838 for all out-of-bounds diagnostics.
4839 (class past_the_end): Base class derived from out_of_bounds for
4840 the buffer_overflow and buffer_overread diagnostics.
4841 (class buffer_overflow): Buffer overflow diagnostics.
4842 (class buffer_overread): Buffer overread diagnostics.
4843 (class buffer_underflow): Buffer underflow diagnostics.
4844 (class buffer_underread): Buffer overread diagnostics.
4845 (region_model::check_region_bounds): New function to check region
4846 bounds for out-of-bounds accesses.
4847 (region_model::check_region_access):
4848 Add call to check_region_bounds.
4849 (region_model::get_representative_tree): New function that accepts
4850 a region instead of an svalue.
4851 * region-model.h (class region_model):
4852 Add region_model::check_region_bounds.
4853 * region.cc (region::symbolic_p): New predicate.
4854 (offset_region::get_byte_size_sval): Only return the remaining
4855 byte size on offset_regions.
4856 * region.h: Add region::symbolic_p.
4857 * store.cc (byte_range::intersects_p):
4858 Add new function equivalent to bit_range::intersects_p.
4859 (byte_range::exceeds_p): New function.
4860 (byte_range::falls_short_of_p): New function.
4861 * store.h (struct byte_range): Add byte_range::intersects_p,
4862 byte_range::exceeds_p and byte_range::falls_short_of_p.
4864 2022-08-12 Tim Lange <mail@tim-lange.me>
4866 PR analyzer/106539
4867 * region-model-impl-calls.cc (region_model::impl_call_realloc):
4868 Use the result of get_copied_size as the size for the
4869 sized_regions in realloc.
4870 (success_with_move::get_copied_size): New function.
4872 2022-08-11 Immad Mir <mirimmad@outlook.com>
4874 PR analyzer/106551
4875 * sm-fd.cc (check_for_dup): handle the m_start
4876 state when transitioning the state of LHS
4877 of dup, dup2 and dup3 call.
4879 2022-08-09 David Malcolm <dmalcolm@redhat.com>
4881 PR analyzer/106573
4882 * region-model.cc (region_model::on_call_pre): Ensure that we call
4883 get_arg_svalue on all arguments.
4885 2022-08-05 David Malcolm <dmalcolm@redhat.com>
4887 PR analyzer/105947
4888 * analyzer.opt (Wanalyzer-jump-through-null): New option.
4889 * engine.cc (class jump_through_null): New.
4890 (exploded_graph::process_node): Complain about jumps through NULL
4891 function pointers.
4893 2022-08-02 Immad Mir <mirimmad@outlook.com>
4895 PR analyzer/106298
4896 * sm-fd.cc (fd_state_machine::on_open): Add
4897 creat, dup, dup2 and dup3 functions.
4898 (enum dup): New.
4899 (fd_state_machine::valid_to_unchecked_state): New.
4900 (fd_state_machine::on_creat): New.
4901 (fd_state_machine::on_dup): New.
4903 2022-07-28 David Malcolm <dmalcolm@redhat.com>
4905 PR analyzer/105893
4906 * analyzer.opt (Wanalyzer-putenv-of-auto-var): New.
4907 * region-model-impl-calls.cc (class putenv_of_auto_var): New.
4908 (region_model::impl_call_putenv): New.
4909 * region-model.cc (region_model::on_call_pre): Handle putenv.
4910 * region-model.h (region_model::impl_call_putenv): New decl.
4912 2022-07-28 David Malcolm <dmalcolm@redhat.com>
4914 * sm-malloc.cc (free_of_non_heap::emit): Add comment about CWE.
4915 * sm-taint.cc (tainted_size::emit): Likewise.
4917 2022-07-28 David Malcolm <dmalcolm@redhat.com>
4919 * region.h: Add notes to the comment describing the region
4920 class hierarchy.
4922 2022-07-27 Immad Mir <mirimmad@outlook.com>
4924 PR analyzer/106286
4925 * sm-fd.cc:
4926 (fd_diagnostic::get_meaning_for_state_change): New.
4928 2022-07-26 David Malcolm <dmalcolm@redhat.com>
4930 PR analyzer/106319
4931 * store.cc (store::set_value): Don't strip away casts if the
4932 region has NULL type.
4934 2022-07-26 David Malcolm <dmalcolm@redhat.com>
4936 * region.h (code_region::get_element): Remove stray decl.
4937 (function_region::get_element): Likewise.
4939 2022-07-25 Martin Liska <mliska@suse.cz>
4941 * sm-fd.cc: Run dos2unix and fix coding style issues.
4943 2022-07-23 Immad Mir <mirimmad@outlook.com>
4945 * sm-fd.cc (fd_param_diagnostic): New diagnostic class.
4946 (fd_access_mode_mismatch): Change inheritance from fd_diagnostic
4947 to fd_param_diagnostic. Add new overloaded constructor.
4948 (fd_use_after_close): Likewise.
4949 (unchecked_use_of_fd): Likewise and also change name to fd_use_without_check.
4950 (double_close): Change name to fd_double_close.
4951 (enum access_directions): New.
4952 (fd_state_machine::on_stmt): Handle calls to function with the
4953 new three function attributes.
4954 (fd_state_machine::check_for_fd_attrs): New.
4955 (fd_state_machine::on_open): Use the new overloaded constructors
4956 of diagnostic classes.
4958 2022-07-22 David Malcolm <dmalcolm@redhat.com>
4960 PR analyzer/106413
4961 * varargs.cc (region_model::impl_call_va_start): Avoid iterating
4962 through non-existant variadic arguments by initializing the
4963 impl_region to "UNKNOWN" if the va_start occurs in the top-level
4964 function to the analysis.
4966 2022-07-22 David Malcolm <dmalcolm@redhat.com>
4968 PR analyzer/106401
4969 * store.cc (binding_cluster::binding_cluster): Remove overzealous
4970 assertion; we're checking for tracked_p in
4971 store::get_or_create_cluster.
4973 2022-07-22 Tim Lange <mail@tim-lange.me>
4975 PR analyzer/106394
4976 * region-model.cc (capacity_compatible_with_type): Always return true
4977 if alloc_size is zero.
4979 2022-07-21 David Malcolm <dmalcolm@redhat.com>
4981 PR analyzer/106383
4982 * varargs.cc (region_model::impl_call_va_arg): When determining if
4983 we're doing interprocedural analysis, use the stack depth of the
4984 frame in which va_start was called, rather than the current stack
4985 depth.
4987 2022-07-21 David Malcolm <dmalcolm@redhat.com>
4989 * sm-taint.cc (tainted_array_index::emit): Bulletproof against
4990 NULL m_arg.
4991 (tainted_array_index::describe_final_event): Likewise.
4992 (tainted_size::emit): Likewise.
4993 (tainted_size::describe_final_event): Likewise.
4995 2022-07-21 David Malcolm <dmalcolm@redhat.com>
4997 PR analyzer/106374
4998 * region.cc (decl_region::get_svalue_for_initializer): Bail out on
4999 untracked regions.
5001 2022-07-20 David Malcolm <dmalcolm@redhat.com>
5003 PR analyzer/106373
5004 * sm-taint.cc (taint_state_machine::on_condition): Potentially
5005 update the state of the RHS as well as the LHS.
5007 2022-07-20 David Malcolm <dmalcolm@redhat.com>
5009 PR analyzer/106359
5010 * region.h (string_region::tracked_p): New.
5011 * store.cc (binding_cluster::binding_cluster): Move here from
5012 store.h. Add assertion that base_region is tracked_p.
5013 * store.h (binding_cluster::binding_cluster): Move to store.cc.
5015 2022-07-19 David Malcolm <dmalcolm@redhat.com>
5017 PR analyzer/106321
5018 * constraint-manager.h (bounded_ranges::get_count): New.
5019 (bounded_ranges::get_range): New.
5020 * engine.cc (impl_region_model_context::on_bounded_ranges): New.
5021 * exploded-graph.h (impl_region_model_context::on_bounded_ranges):
5022 New decl.
5023 * region-model.cc (region_model::apply_constraints_for_gswitch):
5024 Potentially call ctxt->on_bounded_ranges.
5025 * region-model.h (region_model_context::on_bounded_ranges): New
5026 vfunc.
5027 (noop_region_model_context::on_bounded_ranges): New.
5028 (region_model_context_decorator::on_bounded_ranges): New.
5029 * sm-taint.cc: Include "analyzer/constraint-manager.h".
5030 (taint_state_machine::on_bounded_ranges): New.
5031 * sm.h (state_machine::on_bounded_ranges): New.
5033 2022-07-19 David Malcolm <dmalcolm@redhat.com>
5035 * engine.cc (exploded_graph::process_node): Show any description
5036 of the out-edge when logging it for consideration.
5038 2022-07-15 David Malcolm <dmalcolm@redhat.com>
5040 PR analyzer/106284
5041 * sm-taint.cc (taint_state_machine::on_condition): Handle range
5042 checks optimized by build_range_check.
5044 2022-07-15 Jonathan Wakely <jwakely@redhat.com>
5046 * call-info.cc (call_info::print): Adjust to new label_text API.
5047 * checker-path.cc (checker_event::dump): Likewise.
5048 (region_creation_event::get_desc): Likewise.
5049 (state_change_event::get_desc): Likewise.
5050 (superedge_event::should_filter_p): Likewise.
5051 (start_cfg_edge_event::get_desc): Likewise.
5052 (call_event::get_desc): Likewise.
5053 (return_event::get_desc): Likewise.
5054 (warning_event::get_desc): Likewise.
5055 (checker_path::dump): Likewise.
5056 (checker_path::debug): Likewise.
5057 * diagnostic-manager.cc (diagnostic_manager::prune_for_sm_diagnostic):
5058 Likewise.
5059 (diagnostic_manager::prune_interproc_events): Likewise.
5060 * engine.cc (feasibility_state::maybe_update_for_edge):
5061 Likewise.
5062 * program-state.cc (sm_state_map::to_json): Likewise.
5063 * region-model-impl-calls.cc (region_model::impl_call_analyzer_describe): Likewise.
5064 (region_model::impl_call_analyzer_dump_capacity): Likewise.
5065 * region.cc (region::to_json): Likewise.
5066 * sm-malloc.cc (inform_nonnull_attribute): Likewise.
5067 * store.cc (binding_map::to_json): Likewise.
5068 (store::to_json): Likewise.
5069 * supergraph.cc (superedge::dump): Likewise.
5070 * svalue.cc (svalue::to_json): Likewise.
5072 2022-07-07 David Malcolm <dmalcolm@redhat.com>
5074 * checker-path.cc (start_cfg_edge_event::get_desc): Update for
5075 superedge::get_description returning a label_text.
5076 * engine.cc (feasibility_state::maybe_update_for_edge): Likewise.
5077 * supergraph.cc (superedge::dump): Likewise.
5078 (superedge::get_description): Convert return type from char * to
5079 label_text.
5080 * supergraph.h (superedge::get_description): Likewise.
5082 2022-07-07 David Malcolm <dmalcolm@redhat.com>
5084 * call-info.cc (call_info::print): Update for removal of
5085 label_text::maybe_free in favor of automatic memory management.
5086 * checker-path.cc (checker_event::dump): Likewise.
5087 (checker_event::prepare_for_emission): Likewise.
5088 (state_change_event::get_desc): Likewise.
5089 (superedge_event::should_filter_p): Likewise.
5090 (start_cfg_edge_event::get_desc): Likewise.
5091 (warning_event::get_desc): Likewise.
5092 (checker_path::dump): Likewise.
5093 (checker_path::debug): Likewise.
5094 * diagnostic-manager.cc
5095 (diagnostic_manager::prune_for_sm_diagnostic): Likewise.
5096 (diagnostic_manager::prune_interproc_events): Likewise.
5097 * program-state.cc (sm_state_map::to_json): Likewise.
5098 * region.cc (region::to_json): Likewise.
5099 * sm-malloc.cc (inform_nonnull_attribute): Likewise.
5100 * store.cc (binding_map::to_json): Likewise.
5101 (store::to_json): Likewise.
5102 * svalue.cc (svalue::to_json): Likewise.
5104 2022-07-07 David Malcolm <dmalcolm@redhat.com>
5106 PR analyzer/106225
5107 * sm-taint.cc (taint_state_machine::on_stmt): Move handling of
5108 assignments from division to...
5109 (taint_state_machine::check_for_tainted_divisor): ...this new
5110 function. Reject warning when the divisor is known to be non-zero.
5111 * sm.cc: Include "analyzer/program-state.h".
5112 (sm_context::get_old_region_model): New.
5113 * sm.h (sm_context::get_old_region_model): New decl.
5115 2022-07-06 Immad Mir <mirimmad@outlook.com>
5117 PR analyzer/106184
5118 * sm-fd.cc (fd_state_machine): Change ordering of initialization
5119 of state m_invalid so that the order of initializers is same as
5120 the ordering of the fields in the class decl.
5122 2022-07-06 Immad Mir <mirimmad@outlook.com>
5124 * sm-fd.cc (use_after_close): save the "close" event and
5125 show it where possible.
5127 2022-07-06 David Malcolm <dmalcolm@redhat.com>
5129 PR analyzer/106204
5130 * region-model.cc (within_short_circuited_stmt_p): Move extraction
5131 of assign_stmt to caller.
5132 (due_to_ifn_deferred_init_p): New.
5133 (region_model::check_for_poison): Move extraction of assign_stmt
5134 from within_short_circuited_stmt_p to here. Share logic with
5135 call to due_to_ifn_deferred_init_p.
5137 2022-07-02 Tim Lange <mail@tim-lange.me>
5139 PR analyzer/105900
5140 * analyzer.opt: Added Wanalyzer-allocation-size.
5141 * checker-path.cc (region_creation_event::get_desc): Added call to new
5142 virtual function pending_diagnostic::describe_region_creation_event.
5143 * checker-path.h: Added region_creation_event::get_desc.
5144 * diagnostic-manager.cc (diagnostic_manager::add_event_on_final_node):
5145 New function.
5146 * diagnostic-manager.h:
5147 Added diagnostic_manager::add_event_on_final_node.
5148 * pending-diagnostic.h (struct region_creation): New event_desc struct.
5149 (pending_diagnostic::describe_region_creation_event): Added virtual
5150 function to overwrite description of a region creation.
5151 * region-model.cc (class dubious_allocation_size): New class.
5152 (capacity_compatible_with_type): New helper function.
5153 (class size_visitor): New class.
5154 (struct_or_union_with_inheritance_p): New helper function.
5155 (is_any_cast_p): New helper function.
5156 (region_model::check_region_size): New function.
5157 (region_model::set_value): Added call to
5158 region_model::check_region_size.
5159 * region-model.h (class region_model): New function check_region_size.
5160 * svalue.cc (region_svalue::accept): Changed to post-order traversal.
5161 (initial_svalue::accept): Likewise.
5162 (unaryop_svalue::accept): Likewise.
5163 (binop_svalue::accept): Likewise.
5164 (sub_svalue::accept): Likewise.
5165 (repeated_svalue::accept): Likewise.
5166 (bits_within_svalue::accept): Likewise.
5167 (widening_svalue::accept): Likewise.
5168 (unmergeable_svalue::accept): Likewise.
5169 (compound_svalue::accept): Likewise.
5170 (conjured_svalue::accept): Likewise.
5171 (asm_output_svalue::accept): Likewise.
5172 (const_fn_result_svalue::accept): Likewise.
5174 2022-07-02 Immad Mir <mirimmad17@gmail.com>
5176 PR analyzer/106003
5177 * analyzer.opt (Wanalyzer-fd-leak): New option.
5178 (Wanalyzer-fd-access-mode-mismatch): New option.
5179 (Wanalyzer-fd-use-without-check): New option.
5180 (Wanalyzer-fd-double-close): New option.
5181 (Wanalyzer-fd-use-after-close): New option.
5182 * sm.h (make_fd_state_machine): New decl.
5183 * sm.cc (make_checkers): Call make_fd_state_machine.
5184 * sm-fd.cc: New file.
5186 2022-06-24 David Malcolm <dmalcolm@redhat.com>
5188 * call-string.cc: Add includes of "analyzer/analyzer.h"
5189 and "analyzer/analyzer-logging.h".
5190 (call_string::call_string): Delete copy ctor.
5191 (call_string::operator=): Delete.
5192 (call_string::operator==): Delete.
5193 (call_string::hash): Delete.
5194 (call_string::push_call): Make const, returning the resulting
5195 call_string.
5196 (call_string::pop): Delete.
5197 (call_string::cmp_ptr_ptr): New.
5198 (call_string::validate): Assert that m_parent is non-NULL, or
5199 m_elements is empty.
5200 (call_string::call_string): Move default ctor here from
5201 call-string.h and reimplement. Add ctor taking a parent
5202 and an element.
5203 (call_string::~call_string): New.
5204 (call_string::recursive_log): New.
5205 * call-string.h (call_string::call_string): Move default ctor's
5206 defn to call-string.cc. Delete copy ctor. Add ctor taking a
5207 parent and an element.
5208 (call_string::operator=): Delete.
5209 (call_string::operator==): Delete.
5210 (call_string::hash): Delete.
5211 (call_string::push_call): Make const, returning the resulting
5212 call_string.
5213 (call_string::pop): Delete decl.
5214 (call_string::get_parent): New.
5215 (call_string::cmp_ptr_ptr): New decl.
5216 (call_string::get_top_of_stack): New.
5217 (struct call_string::hashmap_traits_t): New.
5218 (class call_string): Add friend class region_model_manager. Add
5219 DISABLE_COPY_AND_ASSIGN.
5220 (call_string::~call_string): New decl.
5221 (call_string::recursive_log): New decl.
5222 (call_string::m_parent): New field.
5223 (call_string::m_children): New field.
5224 * constraint-manager.cc (selftest::test_many_constants): Pass
5225 model manager to program_point::origin.
5226 * engine.cc (exploded_graph::exploded_graph): Likewise.
5227 (exploded_graph::add_function_entry): Likewise for
5228 program_point::from_function_entry.
5229 (add_tainted_args_callback): Likewise.
5230 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
5231 Update for change to program_point.get_call_string.
5232 (exploded_graph::process_node): Likewise.
5233 (class function_call_string_cluster): Convert m_cs from a
5234 call_string to a const call_string &.
5235 (struct function_call_string): Likewise.
5236 (pod_hash_traits<function_call_string>::hash): Use pointer_hash
5237 for m_cs.
5238 (pod_hash_traits<function_call_string>::equal): Update for change
5239 to m_cs.
5240 (root_cluster::add_node): Update for change to
5241 function_call_string.
5242 (viz_callgraph_node::dump_dot): Update for change to call_string.
5243 * exploded-graph.h (per_call_string_data::m_key): Convert to a
5244 reference.
5245 (struct eg_call_string_hash_map_traits): Delete.
5246 (exploded_graph::call_string_data_map_t): Remove traits class.
5247 * program-point.cc: Move include of "analyzer/call-string.h" to
5248 after "analyzer/analyzer-logging.h".
5249 (program_point::print): Update for conversion of m_call_string to
5250 a pointer.
5251 (program_point::to_json): Likewise.
5252 (program_point::push_to_call_stack): Update for immutability of
5253 call strings.
5254 (program_point::pop_from_call_stack): Likewise.
5255 (program_point::hash): Use pointer hashing for m_call_string.
5256 (program_point::get_function_at_depth): Update for change to
5257 m_call_string.
5258 (program_point::validate): Update for changes to call_string.
5259 (program_point::on_edge): Likewise.
5260 (program_point::origin): Move here from call-string.h. Add
5261 region_model_manager param and use it to get empty call string.
5262 (program_point::from_function_entry): Likewise.
5263 (selftest::test_function_point_ordering): Likewise.
5264 (selftest::test_function_point_ordering): Likewise.
5265 * program-point.h (program_point::program_point): Update for
5266 change to m_call_string.
5267 (program_point::get_call_string): Likewise.
5268 (program_point::get_stack_depth): Likewise.
5269 (program_point::origin): Add region_model_manager param, and move
5270 defn to call-string.cc.
5271 (program_point::from_function_entry): Likewise.
5272 (program_point::empty): Drop call_string.
5273 (program_point::deleted): Likewise.
5274 (program_point::program_point): New private ctor.
5275 (program_point::m_call_string): Convert from call_string to const
5276 call_string *.
5277 * program-state.cc (selftest::test_program_state_merging): Update
5278 for call_string changes.
5279 (selftest::test_program_state_merging_2): Likewise.
5280 * region-model-manager.cc
5281 (region_model_manager::region_model_manager): Construct
5282 m_empty_call_string.
5283 (region_model_manager::log_stats): Log the call strings.
5284 * region-model.cc (assert_region_models_merge): Pass the
5285 region_model_manager when creating program_point instances.
5286 (selftest::test_state_merging): Likewise.
5287 (selftest::test_constraint_merging): Likewise.
5288 (selftest::test_widening_constraints): Likewise.
5289 (selftest::test_iteration_1): Likewise.
5290 * region-model.h (region_model_manager::get_empty_call_string):
5291 New.
5292 (region_model_manager::m_empty_call_string): New.
5293 * sm-signal.cc (register_signal_handler::impl_transition): Update
5294 for changes to call_string.
5296 2022-06-24 David Malcolm <dmalcolm@redhat.com>
5298 * call-string.cc (call_string::calc_recursion_depth): Whitespace
5299 cleanups.
5300 (call_string::cmp): Likewise.
5301 (call_string::get_caller_node): Likewise.
5302 (call_string::validate): Likewise.
5303 * engine.cc (dynamic_call_info_t::add_events_to_path): Likewise.
5304 (exploded_graph::get_per_function_data): Likewise.
5305 (exploded_graph::maybe_create_dynamic_call): Likewise.
5306 (exploded_graph::maybe_create_dynamic_call): Likewise.
5307 (exploded_graph::process_node): Likewise.
5309 2022-06-16 David Malcolm <dmalcolm@redhat.com>
5311 * varargs.cc (va_arg_type_mismatch::emit): Associate the warning
5312 with CWE-686 ("Function Call With Incorrect Argument Type").
5314 2022-06-16 David Malcolm <dmalcolm@redhat.com>
5316 * varargs.cc: Include "diagnostic-metadata.h".
5317 (va_list_exhausted::emit): Associate the warning with
5318 CWE-685 ("Function Call With Incorrect Number of Arguments").
5320 2022-06-16 David Malcolm <dmalcolm@redhat.com>
5322 * sm-file.cc (double_fclose::emit): Associate the warning with
5323 CWE-1341 ("Multiple Releases of Same Resource or Handle").
5325 2022-06-15 David Malcolm <dmalcolm@redhat.com>
5327 PR analyzer/105962
5328 * analyzer.opt (fanalyzer-undo-inlining): New option.
5329 * checker-path.cc: Include "diagnostic-core.h" and
5330 "inlining-iterator.h".
5331 (event_kind_to_string): Handle EK_INLINED_CALL.
5332 (class inlining_info): New class.
5333 (checker_event::checker_event): Move here from checker-path.h.
5334 Store original fndecl and depth, and calculate effective fndecl
5335 and depth based on inlining information.
5336 (checker_event::dump): Emit original depth as well as effective
5337 depth when they differ; likewise for fndecl.
5338 (region_creation_event::get_desc): Use m_effective_fndecl.
5339 (inlined_call_event::get_desc): New.
5340 (inlined_call_event::get_meaning): New.
5341 (checker_path::inject_any_inlined_call_events): New.
5342 * checker-path.h (enum event_kind): Add EK_INLINED_CALL.
5343 (checker_event::checker_event): Make protected, and move
5344 definition to checker-path.cc.
5345 (checker_event::get_fndecl): Use effective fndecl.
5346 (checker_event::get_stack_depth): Use effective stack depth.
5347 (checker_event::get_logical_location): Use effective stack depth.
5348 (checker_event::get_original_stack_depth): New.
5349 (checker_event::m_fndecl): Rename to...
5350 (checker_event::m_original_fndecl): ...this.
5351 (checker_event::m_depth): Rename to...
5352 (checker_event::m_original_depth): ...this.
5353 (checker_event::m_effective_fndecl): New field.
5354 (checker_event::m_effective_depth): New field.
5355 (class inlined_call_event): New checker_event subclass.
5356 (checker_path::inject_any_inlined_call_events): New decl.
5357 * diagnostic-manager.cc: Include "inlining-iterator.h".
5358 (diagnostic_manager::emit_saved_diagnostic): Call
5359 checker_path::inject_any_inlined_call_events.
5360 (diagnostic_manager::prune_for_sm_diagnostic): Handle
5361 EK_INLINED_CALL.
5362 * engine.cc (tainted_args_function_custom_event::get_desc): Use
5363 effective fndecl.
5364 * inlining-iterator.h: New file.
5366 2022-06-15 David Malcolm <dmalcolm@redhat.com>
5368 * diagnostic-manager.cc (saved_diagnostic::dump_dot_id): New.
5369 (saved_diagnostic::dump_as_dot_node): New.
5370 * diagnostic-manager.h (saved_diagnostic::dump_dot_id): New decl.
5371 (saved_diagnostic::dump_as_dot_node): New decl.
5372 * engine.cc (exploded_node::dump_dot): Add nodes for saved
5373 diagnostics.
5375 2022-06-02 David Malcolm <dmalcolm@redhat.com>
5377 * checker-path.cc (checker_event::get_meaning): New.
5378 (function_entry_event::get_meaning): New.
5379 (state_change_event::get_desc): Add dump of meaning of the event
5380 to the -fanalyzer-verbose-state-changes output.
5381 (state_change_event::get_meaning): New.
5382 (cfg_edge_event::get_meaning): New.
5383 (call_event::get_meaning): New.
5384 (return_event::get_meaning): New.
5385 (start_consolidated_cfg_edges_event::get_meaning): New.
5386 (warning_event::get_meaning): New.
5387 * checker-path.h: Include "tree-logical-location.h".
5388 (checker_event::checker_event): Construct m_logical_loc.
5389 (checker_event::get_logical_location): New.
5390 (checker_event::get_meaning): New decl.
5391 (checker_event::m_logical_loc): New.
5392 (function_entry_event::get_meaning): New decl.
5393 (state_change_event::get_meaning): New decl.
5394 (cfg_edge_event::get_meaning): New decl.
5395 (call_event::get_meaning): New decl.
5396 (return_event::get_meaning): New decl.
5397 (start_consolidated_cfg_edges_event::get_meaning): New.
5398 (warning_event::get_meaning): New decl.
5399 * pending-diagnostic.h: Include "diagnostic-path.h".
5400 (pending_diagnostic::get_meaning_for_state_change): New vfunc.
5401 * sm-file.cc (file_diagnostic::get_meaning_for_state_change): New
5402 vfunc impl.
5403 * sm-malloc.cc (malloc_diagnostic::get_meaning_for_state_change):
5404 Likewise.
5405 * sm-sensitive.cc
5406 (exposure_through_output_file::get_meaning_for_state_change):
5407 Likewise.
5408 * sm-taint.cc (taint_diagnostic::get_meaning_for_state_change):
5409 Likewise.
5410 * varargs.cc
5411 (va_list_sm_diagnostic::get_meaning_for_state_change): Likewise.
5413 2022-05-23 David Malcolm <dmalcolm@redhat.com>
5415 * call-info.cc: Add "final" and "override" to all vfunc
5416 implementations that were missing them, as appropriate.
5417 * engine.cc: Likewise.
5418 * region-model.cc: Likewise.
5419 * sm-malloc.cc: Likewise.
5420 * supergraph.h: Likewise.
5421 * svalue.cc: Likewise.
5422 * varargs.cc: Likewise.
5424 2022-05-20 David Malcolm <dmalcolm@redhat.com>
5426 * analyzer-pass.cc: Replace uses of "FINAL" and "OVERRIDE" with
5427 "final" and "override".
5428 * call-info.h: Likewise.
5429 * checker-path.h: Likewise.
5430 * constraint-manager.cc: Likewise.
5431 * diagnostic-manager.cc: Likewise.
5432 * engine.cc: Likewise.
5433 * exploded-graph.h: Likewise.
5434 * feasible-graph.h: Likewise.
5435 * pending-diagnostic.h: Likewise.
5436 * region-model-impl-calls.cc: Likewise.
5437 * region-model.cc: Likewise.
5438 * region-model.h: Likewise.
5439 * region.h: Likewise.
5440 * sm-file.cc: Likewise.
5441 * sm-malloc.cc: Likewise.
5442 * sm-pattern-test.cc: Likewise.
5443 * sm-sensitive.cc: Likewise.
5444 * sm-signal.cc: Likewise.
5445 * sm-taint.cc: Likewise.
5446 * state-purge.h: Likewise.
5447 * store.cc: Likewise.
5448 * store.h: Likewise.
5449 * supergraph.h: Likewise.
5450 * svalue.h: Likewise.
5451 * trimmed-graph.h: Likewise.
5452 * varargs.cc: Likewise.
5454 2022-05-16 David Malcolm <dmalcolm@redhat.com>
5456 PR analyzer/105103
5457 * analyzer.cc (make_label_text_n): New.
5458 * analyzer.h (class var_arg_region): New forward decl.
5459 (make_label_text_n): New decl.
5460 * analyzer.opt (Wanalyzer-va-arg-type-mismatch): New option.
5461 (Wanalyzer-va-list-exhausted): New option.
5462 (Wanalyzer-va-list-leak): New option.
5463 (Wanalyzer-va-list-use-after-va-end): New option.
5464 * checker-path.cc (call_event::get_desc): Split out decl access
5465 into..
5466 (call_event::get_caller_fndecl): ...this new function and...
5467 (call_event::get_callee_fndecl): ...this new function.
5468 * checker-path.h (call_event::get_desc): Drop "FINAL".
5469 (call_event::get_caller_fndecl): New decl.
5470 (call_event::get_callee_fndecl): New decl.
5471 (class call_event): Make fields protected.
5472 * diagnostic-manager.cc (null_assignment_sm_context::warn): New
5473 overload.
5474 (null_assignment_sm_context::get_new_program_state): New.
5475 (diagnostic_manager::add_events_for_superedge): Move case
5476 SUPEREDGE_CALL to a new pending_diagnostic::add_call_event vfunc.
5477 * engine.cc (impl_sm_context::warn): Implement new override.
5478 (impl_sm_context::get_new_program_state): New.
5479 * pending-diagnostic.cc: Include "analyzer/diagnostic-manager.h",
5480 "cpplib.h", "digraph.h", "ordered-hash-map.h", "cfg.h",
5481 "basic-block.h", "gimple.h", "gimple-iterator.h", "cgraph.h"
5482 "analyzer/supergraph.h", "analyzer/program-state.h",
5483 "alloc-pool.h", "fibonacci_heap.h", "shortest-paths.h",
5484 "sbitmap.h", "analyzer/exploded-graph.h", "diagnostic-path.h",
5485 and "analyzer/checker-path.h".
5486 (ht_ident_eq): New.
5487 (fixup_location_in_macro_p): New.
5488 (pending_diagnostic::fixup_location): New.
5489 (pending_diagnostic::add_call_event): New.
5490 * pending-diagnostic.h (pending_diagnostic::fixup_location): Drop
5491 no-op inline implementation in favor of the more complex
5492 implementation above.
5493 (pending_diagnostic::add_call_event): New vfunc.
5494 * region-model-impl-calls.cc: Include "analyzer/sm.h",
5495 "diagnostic-path.h", and "analyzer/pending-diagnostic.h".
5496 * region-model-manager.cc
5497 (region_model_manager::get_var_arg_region): New.
5498 (region_model_manager::log_stats): Log m_var_arg_regions.
5499 * region-model.cc (region_model::on_call_pre): Handle IFN_VA_ARG,
5500 BUILT_IN_VA_START, and BUILT_IN_VA_COPY.
5501 (region_model::on_call_post): Handle BUILT_IN_VA_END.
5502 (region_model::get_representative_path_var_1): Handle RK_VAR_ARG.
5503 (region_model::push_frame): Push variadic arguments.
5504 * region-model.h (region_model_manager::get_var_arg_region): New
5505 decl.
5506 (region_model_manager::m_var_arg_regions): New field.
5507 (region_model::impl_call_va_start): New decl.
5508 (region_model::impl_call_va_copy): New decl.
5509 (region_model::impl_call_va_arg): New decl.
5510 (region_model::impl_call_va_end): New decl.
5511 * region.cc (alloca_region::dump_to_pp): Dump the id.
5512 (var_arg_region::dump_to_pp): New.
5513 (var_arg_region::get_frame_region): New.
5514 * region.h (enum region_kind): Add RK_VAR_ARG.
5515 (region::dyn_cast_var_arg_region): New.
5516 (class var_arg_region): New.
5517 (is_a_helper <const var_arg_region *>::test): New.
5518 (struct default_hash_traits<var_arg_region::key_t>): New.
5519 * sm.cc (make_checkers): Call make_va_list_state_machine.
5520 * sm.h (sm_context::warn): New vfunc.
5521 (sm_context::get_old_svalue): Drop unused decl.
5522 (sm_context::get_new_program_state): New vfunc.
5523 (make_va_list_state_machine): New decl.
5524 * varargs.cc: New file.
5526 2022-05-16 Martin Liska <mliska@suse.cz>
5528 * engine.cc (exploded_node::get_dot_fillcolor): Use ARRAY_SIZE.
5529 * function-set.cc (test_stdio_example): Likewise.
5530 * sm-file.cc (get_file_using_fns): Likewise.
5531 * sm-malloc.cc (malloc_state_machine::unaffected_by_call_p): Likewise.
5532 * sm-signal.cc (get_async_signal_unsafe_fns): Likewise.
5534 2022-05-13 Richard Biener <rguenther@suse.de>
5536 * supergraph.cc: Re-order gimple-fold.h include.
5538 2022-05-11 David Malcolm <dmalcolm@redhat.com>
5540 * checker-path.cc (state_change_event::get_desc): Call maybe_free
5541 on label_text temporaries.
5542 * diagnostic-manager.cc
5543 (diagnostic_manager::prune_for_sm_diagnostic): Likewise.
5544 * engine.cc (exploded_graph::~exploded_graph): Fix leak of
5545 m_per_point_data and m_per_call_string_data values. Simplify
5546 cleanup of m_per_function_stats and m_per_point_data values.
5547 (feasibility_state::maybe_update_for_edge): Fix leak of result of
5548 superedge::get_description.
5549 * region-model-manager.cc
5550 (region_model_manager::~region_model_manager): Move cleanup of
5551 m_setjmp_values to match the ordering of the fields within
5552 region_model_manager. Fix leak of values within
5553 m_repeated_values_map, m_bits_within_values_map,
5554 m_asm_output_values_map, and m_const_fn_result_values_map.
5556 2022-04-28 David Malcolm <dmalcolm@redhat.com>
5558 PR analyzer/105285
5559 * store.cc (binding_cluster::get_any_binding): Handle accessing
5560 sub_svalues of clusters where the base region has a symbolic
5561 binding.
5563 2022-04-28 David Malcolm <dmalcolm@redhat.com>
5565 * diagnostic-manager.cc (epath_finder::process_worklist_item):
5566 Call dump_feasible_path when a path that reaches the the target
5567 enode is found.
5568 (epath_finder::dump_feasible_path): New.
5569 * engine.cc (feasibility_state::dump_to_pp): New.
5570 * exploded-graph.h (feasibility_state::dump_to_pp): New decl.
5571 * feasible-graph.cc (feasible_graph::dump_feasible_path): New.
5572 * feasible-graph.h (feasible_graph::dump_feasible_path): New
5573 decls.
5574 * program-point.cc (function_point::print): Fix missing trailing
5575 newlines.
5576 * program-point.h (program_point::print_source_line): Remove
5577 unimplemented decl.
5579 2022-04-25 David Malcolm <dmalcolm@redhat.com>
5581 PR analyzer/105365
5582 PR analyzer/105366
5583 * svalue.cc
5584 (cmp_cst): Rename to...
5585 (cmp_csts_same_type): ...this. Convert all recursive calls to
5586 calls to...
5587 (cmp_csts_and_types): ....this new function.
5588 (svalue::cmp_ptr): Update for renaming of cmp_cst
5590 2022-04-14 David Malcolm <dmalcolm@redhat.com>
5592 PR analyzer/105264
5593 * region-model-reachability.cc (reachable_regions::handle_parm):
5594 Use maybe_get_deref_base_region rather than just region_svalue, to
5595 handle pointer arithmetic also.
5596 * svalue.cc (svalue::maybe_get_deref_base_region): New.
5597 * svalue.h (svalue::maybe_get_deref_base_region): New decl.
5599 2022-04-14 David Malcolm <dmalcolm@redhat.com>
5601 PR analyzer/105252
5602 * svalue.cc (cmp_cst): When comparing VECTOR_CSTs, compare the
5603 types of the encoded elements before calling cmp_cst on them.
5605 2022-04-09 David Malcolm <dmalcolm@redhat.com>
5607 PR analyzer/103892
5608 * region-model-manager.cc
5609 (region_model_manager::get_unknown_symbolic_region): New,
5610 extracted from...
5611 (region_model_manager::get_field_region): ...here.
5612 (region_model_manager::get_element_region): Use it here.
5613 (region_model_manager::get_offset_region): Likewise.
5614 (region_model_manager::get_sized_region): Likewise.
5615 (region_model_manager::get_cast_region): Likewise.
5616 (region_model_manager::get_bit_range): Likewise.
5617 * region-model.h
5618 (region_model_manager::get_unknown_symbolic_region): New decl.
5619 * region.cc (symbolic_region::symbolic_region): Handle sval_ptr
5620 having NULL type.
5621 (symbolic_region::dump_to_pp): Handle having NULL type.
5623 2022-04-07 David Malcolm <dmalcolm@redhat.com>
5625 PR analyzer/102208
5626 * store.cc (binding_map::remove_overlapping_bindings): Add
5627 "always_overlap" param, using it to generalize to the case where
5628 we want to remove all bindings. Update "uncertainty" logic to
5629 only record maybe-bound values for cases where there is a symbolic
5630 write involved.
5631 (binding_cluster::mark_region_as_unknown): Split param "reg" into
5632 "reg_to_bind" and "reg_for_overlap".
5633 (binding_cluster::maybe_get_compound_binding): Pass "false" to
5634 binding_map::remove_overlapping_bindings new "always_overlap" param.
5635 (binding_cluster::remove_overlapping_bindings): Determine
5636 "always_overlap" and pass it to
5637 binding_map::remove_overlapping_bindings.
5638 (store::set_value): Pass uncertainty to remove_overlapping_bindings
5639 call. Update for new param of
5640 binding_cluster::mark_region_as_unknown, passing both the base
5641 region of the iter_cluster, and the lhs_reg.
5642 (store::mark_region_as_unknown): Update for new param of
5643 binding_cluster::mark_region_as_unknown, passing "reg" for both.
5644 (store::remove_overlapping_bindings): Add param "uncertainty", and
5645 pass it on to call to
5646 binding_cluster::remove_overlapping_bindings.
5647 * store.h (binding_map::remove_overlapping_bindings): Add
5648 "always_overlap" param.
5649 (binding_cluster::mark_region_as_unknown): Split param "reg" into
5650 "reg_to_bind" and "reg_for_overlap".
5651 (store::remove_overlapping_bindings): Add param "uncertainty".
5653 2022-03-29 David Malcolm <dmalcolm@redhat.com>
5655 PR testsuite/105085
5656 * region-model-manager.cc (dump_untracked_region): Skip decls in
5657 the constant pool.
5659 2022-03-29 David Malcolm <dmalcolm@redhat.com>
5661 PR analyzer/105087
5662 * analyzer.h (class conjured_purge): New forward decl.
5663 * region-model-asm.cc (region_model::on_asm_stmt): Add
5664 conjured_purge param to calls binding_cluster::on_asm and
5665 region_model_manager::get_or_create_conjured_svalue.
5666 * region-model-impl-calls.cc
5667 (call_details::get_or_create_conjured_svalue): Likewise for call
5668 to region_model_manager::get_or_create_conjured_svalue.
5669 (region_model::impl_call_fgets): Remove call to
5670 region_model::purge_state_involving, as this is now done
5671 implicitly by call_details::get_or_create_conjured_svalue.
5672 (region_model::impl_call_fread): Likewise.
5673 (region_model::impl_call_strchr): Pass conjured_purge param to
5674 call to region_model_manager::get_or_create_conjured_svalue.
5675 * region-model-manager.cc (conjured_purge::purge): New.
5676 (region_model_manager::get_or_create_conjured_svalue): Add
5677 param "p". Use it to purge state when reusing an existing
5678 conjured_svalue.
5679 * region-model.cc (region_model::on_call_pre): Replace call to
5680 region_model::purge_state_involving with passing conjured_purge
5681 to region_model_manager::get_or_create_conjured_svalue.
5682 (region_model::handle_unrecognized_call): Pass conjured_purge to
5683 store::on_unknown_fncall.
5684 * region-model.h
5685 (region_model_manager::get_or_create_conjured_svalue): Add param
5686 "p".
5687 * store.cc (binding_cluster::on_unknown_fncall): Likewise. Pass
5688 it on to region_model_manager::get_or_create_conjured_svalue.
5689 (binding_cluster::on_asm): Likewise.
5690 (store::on_unknown_fncall): Add param "p" and pass it on to
5691 binding_cluster::on_unknown_fncall.
5692 * store.h (binding_cluster::on_unknown_fncall): Add param p.
5693 (binding_cluster::on_asm): Likewise.
5694 (store::on_unknown_fncall): Likewise.
5695 * svalue.h (class conjured_purge): New.
5697 2022-03-29 David Malcolm <dmalcolm@redhat.com>
5699 PR analyzer/105074
5700 * region.cc (ipa_ref_requires_tracking): Drop "context_fndecl",
5701 instead using the ref->referring to get the cgraph node of the
5702 caller.
5703 (symnode_requires_tracking_p): Likewise.
5705 2022-03-26 David Malcolm <dmalcolm@redhat.com>
5707 PR analyzer/105057
5708 * store.cc (binding_cluster::make_unknown_relative_to): Reject
5709 attempts to create a cluster for untracked base regions.
5710 (store::set_value): Likewise.
5711 (store::fill_region): Likewise.
5712 (store::mark_region_as_unknown): Likewise.
5714 2022-03-25 David Malcolm <dmalcolm@redhat.com>
5716 PR analyzer/104954
5717 * analyzer.opt (-fdump-analyzer-untracked): New option.
5718 * engine.cc (impl_run_checkers): Handle it.
5719 * region-model-asm.cc (region_model::on_asm_stmt): Don't attempt
5720 to clobber regions with !tracked_p ().
5721 * region-model-manager.cc (dump_untracked_region): New.
5722 (region_model_manager::dump_untracked_regions): New.
5723 (frame_region::dump_untracked_regions): New.
5724 * region-model.h (region_model_manager::dump_untracked_regions):
5725 New decl.
5726 * region.cc (ipa_ref_requires_tracking): New.
5727 (symnode_requires_tracking_p): New.
5728 (decl_region::calc_tracked_p): New.
5729 * region.h (region::tracked_p): New vfunc.
5730 (frame_region::dump_untracked_regions): New decl.
5731 (class decl_region): Note that this is also used fo SSA names.
5732 (decl_region::decl_region): Initialize m_tracked.
5733 (decl_region::tracked_p): New.
5734 (decl_region::calc_tracked_p): New decl.
5735 (decl_region::m_tracked): New.
5736 * store.cc (store::get_or_create_cluster): Assert that we
5737 don't try to create clusters for base regions that aren't
5738 trackable.
5739 (store::mark_as_escaped): Don't mark base regions that we're not
5740 tracking.
5742 2022-03-23 David Malcolm <dmalcolm@redhat.com>
5744 PR analyzer/104979
5745 * engine.cc (impl_run_checkers): Create the engine after the
5746 supergraph, and pass the supergraph to the engine.
5747 * region-model.cc (region_model::get_lvalue_1): Pass ctxt to
5748 frame_region::get_region_for_local.
5749 (region_model::update_for_return_gcall): Pass the lvalue for the
5750 result to pop_frame as a tree, rather than as a region.
5751 (region_model::pop_frame): Update for above change, determining
5752 the destination region after the frame is popped and thus with
5753 respect to the caller frame rather than the called frame.
5754 Likewise, set the value of the region to the return value after
5755 the frame is popped.
5756 (engine::engine): Add supergraph pointer.
5757 (selftest::test_stack_frames): Set the DECL_CONTECT of PARM_DECLs.
5758 (selftest::test_get_representative_path_var): Likewise.
5759 (selftest::test_state_merging): Likewise.
5760 * region-model.h (region_model::pop_frame): Convert first param
5761 from a const region * to a tree.
5762 (engine::engine): Add param "sg".
5763 (engine::m_sg): New field.
5764 * region.cc: Include "analyzer/sm.h" and
5765 "analyzer/program-state.h".
5766 (frame_region::get_region_for_local): Add "ctxt" param.
5767 Add assertions that VAR_DECLs are locals, and that expr is for the
5768 correct function.
5769 * region.h (frame_region::get_region_for_local): Add "ctxt" param.
5771 2022-03-23 David Malcolm <dmalcolm@redhat.com>
5773 PR analyzer/105017
5774 * sm-taint.cc (taint_diagnostic::subclass_equal_p): Check
5775 m_has_bounds as well as m_arg.
5776 (tainted_allocation_size::subclass_equal_p): Chain up to base
5777 class implementation. Also check m_mem_space.
5778 (tainted_allocation_size::emit): Add note showing stack-based vs
5779 heap-based allocations.
5781 2022-03-23 David Malcolm <dmalcolm@redhat.com>
5783 PR analyzer/104997
5784 * diagnostic-manager.cc (diagnostic_manager::add_diagnostic):
5785 Convert return type from "void" to "bool", reporting success vs
5786 failure to caller, for both overloads.
5787 * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
5788 Likewise.
5789 * engine.cc (impl_region_model_context::warn): Propagate return
5790 value from diagnostic_manager::add_diagnostic.
5792 2022-03-18 David Malcolm <dmalcolm@redhat.com>
5794 PR analyzer/104943
5795 PR analyzer/104954
5796 PR analyzer/103533
5797 * analyzer.h (class state_purge_per_decl): New forward decl.
5798 * engine.cc (impl_run_checkers): Pass region_model_manager to
5799 state_purge_map ctor.
5800 * program-point.cc (function_point::final_stmt_p): New.
5801 (function_point::get_next): New.
5802 * program-point.h (function_point::final_stmt_p): New decl.
5803 (function_point::get_next): New decl.
5804 * program-state.cc (program_state::prune_for_point): Generalize to
5805 purge local decls as well as SSA names.
5806 (program_state::can_purge_base_region_p): New.
5807 * program-state.h (program_state::can_purge_base_region_p): New
5808 decl.
5809 * region-model.cc (struct append_ssa_names_cb_data): Rename to...
5810 (struct append_regions_cb_data): ...this.
5811 (region_model::get_ssa_name_regions_for_current_frame): Rename
5812 to...
5813 (region_model::get_regions_for_current_frame): ...this, updating
5814 for other renamings.
5815 (region_model::append_ssa_names_cb): Rename to...
5816 (region_model::append_regions_cb): ...this, and drop the requirement
5817 that the subregion be a SSA name.
5818 * region-model.h (struct append_ssa_names_cb_data): Rename decl
5819 to...
5820 (struct append_regions_cb_data): ...this.
5821 (region_model::get_ssa_name_regions_for_current_frame): Rename
5822 decl to...
5823 (region_model::get_regions_for_current_frame): ...this.
5824 (region_model::append_ssa_names_cb): Rename decl to...
5825 (region_model::append_regions_cb): ...this.
5826 * state-purge.cc: Include "tristate.h", "selftest.h",
5827 "analyzer/store.h", "analyzer/region-model.h", and
5828 "gimple-walk.h".
5829 (get_candidate_for_purging): New.
5830 (class gimple_op_visitor): New.
5831 (my_load_cb): New.
5832 (my_store_cb): New.
5833 (my_addr_cb): New.
5834 (state_purge_map::state_purge_map): Add "mgr" param. Update for
5835 renamings. Find uses of local variables.
5836 (state_purge_map::~state_purge_map): Update for renaming of m_map
5837 to m_ssa_map. Clean up m_decl_map.
5838 (state_purge_map::get_or_create_data_for_decl): New.
5839 (state_purge_per_ssa_name::state_purge_per_ssa_name): Update for
5840 inheriting from state_purge_per_tree.
5841 (state_purge_per_ssa_name::add_to_worklist): Likewise.
5842 (state_purge_per_decl::state_purge_per_decl): New.
5843 (state_purge_per_decl::add_needed_at): New.
5844 (state_purge_per_decl::add_pointed_to_at): New.
5845 (state_purge_per_decl::process_worklists): New.
5846 (state_purge_per_decl::add_to_worklist): New.
5847 (same_binding_p): New.
5848 (fully_overwrites_p): New.
5849 (state_purge_per_decl::process_point_backwards): New.
5850 (state_purge_per_decl::process_point_forwards): New.
5851 (state_purge_per_decl::needed_at_point_p): New.
5852 (state_purge_annotator::print_needed): Generalize to print local
5853 decls as well as SSA names.
5854 * state-purge.h (class state_purge_map): Update leading comment.
5855 (state_purge_map::map_t): Rename to...
5856 (state_purge_map::ssa_map_t): ...this.
5857 (state_purge_map::iterator): Rename to...
5858 (state_purge_map::ssa_iterator): ...this.
5859 (state_purge_map::decl_map_t): New typedef.
5860 (state_purge_map::decl_iterator): New typedef.
5861 (state_purge_map::state_purge_map): Add "mgr" param.
5862 (state_purge_map::get_data_for_ssa_name): Update for renaming.
5863 (state_purge_map::get_any_data_for_decl): New.
5864 (state_purge_map::get_or_create_data_for_decl): New decl.
5865 (state_purge_map::begin): Rename to...
5866 (state_purge_map::begin_ssas): ...this.
5867 (state_purge_map::end): Rename to...
5868 (state_purge_map::end_ssa): ...this.
5869 (state_purge_map::begin_decls): New.
5870 (state_purge_map::end_decls): New.
5871 (state_purge_map::m_map): Rename to...
5872 (state_purge_map::m_ssa_map): ...this.
5873 (state_purge_map::m_decl_map): New field.
5874 (class state_purge_per_tree): New class.
5875 (class state_purge_per_ssa_name): Inherit from state_purge_per_tree.
5876 (state_purge_per_ssa_name::get_function): Move to base class.
5877 (state_purge_per_ssa_name::point_set_t): Likewise.
5878 (state_purge_per_ssa_name::m_fun): Likewise.
5879 (class state_purge_per_decl): New.
5881 2022-03-17 David Malcolm <dmalcolm@redhat.com>
5883 * state-purge.cc (state_purge_annotator::add_node_annotations):
5884 Avoid duplicate before-supernode annotations when returning from
5885 an interprocedural call. Show after-supernode annotations.
5887 2022-03-17 David Malcolm <dmalcolm@redhat.com>
5889 * program-point.cc (program_point::get_next): Fix missing
5890 increment of index.
5892 2022-03-16 David Malcolm <dmalcolm@redhat.com>
5894 PR analyzer/104955
5895 * diagnostic-manager.cc (get_emission_location): New.
5896 (diagnostic_manager::diagnostic_manager): Initialize
5897 m_num_disabled_diagnostics.
5898 (diagnostic_manager::add_diagnostic): Reject diagnostics that
5899 will eventually be rejected due to being disabled.
5900 (diagnostic_manager::emit_saved_diagnostics): Log the number
5901 of disabled diagnostics.
5902 (diagnostic_manager::emit_saved_diagnostic): Split out logic for
5903 determining emission location to get_emission_location.
5904 * diagnostic-manager.h
5905 (diagnostic_manager::m_num_disabled_diagnostics): New field.
5906 * engine.cc (stale_jmp_buf::get_controlling_option): New.
5907 (stale_jmp_buf::emit): Use it.
5908 * pending-diagnostic.h
5909 (pending_diagnostic::get_controlling_option): New vfunc.
5910 * region-model.cc
5911 (poisoned_value_diagnostic::get_controlling_option): New.
5912 (poisoned_value_diagnostic::emit): Use it.
5913 (shift_count_negative_diagnostic::get_controlling_option): New.
5914 (shift_count_negative_diagnostic::emit): Use it.
5915 (shift_count_overflow_diagnostic::get_controlling_option): New.
5916 (shift_count_overflow_diagnostic::emit): Use it.
5917 (dump_path_diagnostic::get_controlling_option): New.
5918 (dump_path_diagnostic::emit): Use it.
5919 (write_to_const_diagnostic::get_controlling_option): New.
5920 (write_to_const_diagnostic::emit): Use it.
5921 (write_to_string_literal_diagnostic::get_controlling_option): New.
5922 (write_to_string_literal_diagnostic::emit): Use it.
5923 * sm-file.cc (double_fclose::get_controlling_option): New.
5924 (double_fclose::emit): Use it.
5925 (file_leak::get_controlling_option): New.
5926 (file_leak::emit): Use it.
5927 * sm-malloc.cc (mismatching_deallocation::get_controlling_option):
5928 New.
5929 (mismatching_deallocation::emit): Use it.
5930 (double_free::get_controlling_option): New.
5931 (double_free::emit): Use it.
5932 (possible_null_deref::get_controlling_option): New.
5933 (possible_null_deref::emit): Use it.
5934 (possible_null_arg::get_controlling_option): New.
5935 (possible_null_arg::emit): Use it.
5936 (null_deref::get_controlling_option): New.
5937 (null_deref::emit): Use it.
5938 (null_arg::get_controlling_option): New.
5939 (null_arg::emit): Use it.
5940 (use_after_free::get_controlling_option): New.
5941 (use_after_free::emit): Use it.
5942 (malloc_leak::get_controlling_option): New.
5943 (malloc_leak::emit): Use it.
5944 (free_of_non_heap::get_controlling_option): New.
5945 (free_of_non_heap::emit): Use it.
5946 * sm-pattern-test.cc (pattern_match::get_controlling_option): New.
5947 (pattern_match::emit): Use it.
5948 * sm-sensitive.cc
5949 (exposure_through_output_file::get_controlling_option): New.
5950 (exposure_through_output_file::emit): Use it.
5951 * sm-signal.cc (signal_unsafe_call::get_controlling_option): New.
5952 (signal_unsafe_call::emit): Use it.
5953 * sm-taint.cc (tainted_array_index::get_controlling_option): New.
5954 (tainted_array_index::emit): Use it.
5955 (tainted_offset::get_controlling_option): New.
5956 (tainted_offset::emit): Use it.
5957 (tainted_size::get_controlling_option): New.
5958 (tainted_size::emit): Use it.
5959 (tainted_divisor::get_controlling_option): New.
5960 (tainted_divisor::emit): Use it.
5961 (tainted_allocation_size::get_controlling_option): New.
5962 (tainted_allocation_size::emit): Use it.
5964 2022-03-15 David Malcolm <dmalcolm@redhat.com>
5966 * store.cc (store::store): Presize m_cluster_map.
5968 2022-03-10 David Malcolm <dmalcolm@redhat.com>
5970 PR analyzer/104863
5971 * constraint-manager.cc (constraint_manager::add_constraint):
5972 Refresh the EC IDs when adding constraints implied by offsets.
5974 2022-03-10 David Malcolm <dmalcolm@redhat.com>
5976 PR analyzer/104793
5977 * analyzer.h (class pending_note): New forward decl.
5978 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
5979 Initialize m_notes.
5980 (saved_diagnostic::operator==): Compare m_notes.
5981 (saved_diagnostic::add_note): New.
5982 (saved_diagnostic::emit_any_notes): New.
5983 (diagnostic_manager::add_note): New.
5984 (diagnostic_manager::emit_saved_diagnostic): Call emit_any_notes
5985 after emitting the warning.
5986 * diagnostic-manager.h (saved_diagnostic::add_note): New decl.
5987 (saved_diagnostic::emit_any_notes): New decl.
5988 (saved_diagnostic::m_notes): New field.
5989 (diagnostic_manager::add_note): New decl.
5990 * engine.cc (impl_region_model_context::add_note): New.
5991 * exploded-graph.h (impl_region_model_context::add_note): New
5992 decl.
5993 * pending-diagnostic.h (class pending_note): New.
5994 (class pending_note_subclass): New template.
5995 * region-model.cc (class reason_attr_access): New.
5996 (check_external_function_for_access_attr): Add class
5997 annotating_ctxt and use it when checking region.
5998 (noop_region_model_context::add_note): New.
5999 * region-model.h (region_model_context::add_note): New vfunc.
6000 (noop_region_model_context::add_note): New decl.
6001 (class region_model_context_decorator): New.
6002 (class note_adding_context): New.
6004 2022-03-10 David Malcolm <dmalcolm@redhat.com>
6006 PR analyzer/104793
6007 * region-model.cc
6008 (region_model::check_external_function_for_access_attr): New.
6009 (region_model::handle_unrecognized_call): Call it.
6010 * region-model.h
6011 (region_model::check_external_function_for_access_attr): New decl.
6012 (region_model::handle_unrecognized_call): New decl.
6014 2022-03-10 David Malcolm <dmalcolm@redhat.com>
6016 * sm-taint.cc (taint_state_machine::check_for_tainted_size_arg):
6017 Avoid generating duplicate saved_diagnostics by only handling the
6018 rdwr_map entry for the ptrarg, not the duplicate entry for the
6019 sizarg.
6021 2022-03-07 David Malcolm <dmalcolm@redhat.com>
6023 PR analyzer/101983
6024 * engine.cc (returning_from_function_p): New.
6025 (impl_region_model_context::on_state_leak): Use it when rejecting
6026 leaks at the return from "main".
6028 2022-03-07 Jakub Jelinek <jakub@redhat.com>
6030 * store.cc: Fix up duplicated word issue in a comment.
6031 * analyzer.cc: Likewise.
6032 * engine.cc: Likewise.
6033 * sm-taint.cc: Likewise.
6035 2022-03-04 David Malcolm <dmalcolm@redhat.com>
6037 PR analyzer/103521
6038 * analyzer.opt (-param=analyzer-max-svalue-depth=): Reduce from 13
6039 to 12.
6041 2022-02-23 David Malcolm <dmalcolm@redhat.com>
6043 PR analyzer/104434
6044 * analyzer.h (class const_fn_result_svalue): New decl.
6045 * region-model-impl-calls.cc (call_details::get_manager): New.
6046 * region-model-manager.cc
6047 (region_model_manager::get_or_create_const_fn_result_svalue): New.
6048 (region_model_manager::log_stats): Log
6049 m_const_fn_result_values_map.
6050 * region-model.cc (const_fn_p): New.
6051 (maybe_get_const_fn_result): New.
6052 (region_model::on_call_pre): Handle fndecls with
6053 __attribute__((const)) by calling the above rather than making
6054 a conjured_svalue.
6055 * region-model.h (visitor::visit_const_fn_result_svalue): New.
6056 (region_model_manager::get_or_create_const_fn_result_svalue): New
6057 decl.
6058 (region_model_manager::const_fn_result_values_map_t): New typedef.
6059 (region_model_manager::m_const_fn_result_values_map): New field.
6060 (call_details::get_manager): New decl.
6061 * svalue.cc (svalue::cmp_ptr): Handle SK_CONST_FN_RESULT.
6062 (const_fn_result_svalue::dump_to_pp): New.
6063 (const_fn_result_svalue::dump_input): New.
6064 (const_fn_result_svalue::accept): New.
6065 * svalue.h (enum svalue_kind): Add SK_CONST_FN_RESULT.
6066 (svalue::dyn_cast_const_fn_result_svalue): New.
6067 (class const_fn_result_svalue): New.
6068 (is_a_helper <const const_fn_result_svalue *>::test): New.
6069 (template <> struct default_hash_traits<const_fn_result_svalue::key_t>):
6070 New.
6072 2022-02-17 David Malcolm <dmalcolm@redhat.com>
6074 PR analyzer/104576
6075 * region-model.cc: Include "calls.h".
6076 (region_model::on_call_pre): Use flags_from_decl_or_type to
6077 generalize check for DECL_PURE_P to also check for ECF_CONST.
6079 2022-02-16 David Malcolm <dmalcolm@redhat.com>
6081 PR analyzer/104560
6082 * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
6083 Add region creation events for globals of interest.
6084 (null_assignment_sm_context::get_old_program_state): New.
6085 (diagnostic_manager::add_events_for_eedge): Move check for
6086 changing dynamic extents from PK_BEFORE_STMT case to after the
6087 switch on the dst_point's kind so that we can emit them for the
6088 final stmt in a basic block.
6089 * engine.cc (impl_sm_context::get_old_program_state): New.
6090 * sm-malloc.cc (malloc_state_machine::get_default_state): Rewrite
6091 detection of m_non_heap to use get_memory_space.
6092 (free_of_non_heap::free_of_non_heap): Add freed_reg param.
6093 (free_of_non_heap::subclass_equal_p): Update for changes to
6094 fields.
6095 (free_of_non_heap::emit): Drop m_kind in favor of
6096 get_memory_space.
6097 (free_of_non_heap::describe_state_change): Remove logic for
6098 detecting alloca.
6099 (free_of_non_heap::mark_interesting_stuff): Add region-creation of
6100 m_freed_reg.
6101 (free_of_non_heap::get_memory_space): New.
6102 (free_of_non_heap::kind): Drop enum.
6103 (free_of_non_heap::m_freed_reg): New field.
6104 (free_of_non_heap::m_kind): Drop field.
6105 (malloc_state_machine::on_stmt): Drop transition to m_non_heap.
6106 (malloc_state_machine::handle_free_of_non_heap): New function,
6107 split out from on_deallocator_call and on_realloc_call, adding
6108 detection of the freed region.
6109 (malloc_state_machine::on_deallocator_call): Use it.
6110 (malloc_state_machine::on_realloc_call): Likewise.
6111 * sm.h (sm_context::get_old_program_state): New vfunc.
6113 2022-02-15 David Malcolm <dmalcolm@redhat.com>
6115 PR analyzer/104524
6116 * region-model-manager.cc
6117 (region_model_manager::maybe_fold_sub_svalue): Only call
6118 get_or_create_cast if type is non-NULL.
6120 2022-02-15 David Malcolm <dmalcolm@redhat.com>
6122 PR analyzer/102692
6123 * exploded-graph.h (impl_region_model_context::get_stmt): New.
6124 * region-model.cc: Include "gimple-ssa.h", "tree-phinodes.h",
6125 "tree-ssa-operands.h", and "ssa-iterators.h".
6126 (within_short_circuited_stmt_p): New.
6127 (region_model::check_for_poison): Don't warn about uninit values
6128 if within_short_circuited_stmt_p.
6129 * region-model.h (region_model_context::get_stmt): New vfunc.
6130 (noop_region_model_context::get_stmt): New.
6132 2022-02-11 David Malcolm <dmalcolm@redhat.com>
6134 PR analyzer/104274
6135 * region-model.cc (region_model::check_for_poison): Ignore
6136 uninitialized uses of empty types.
6138 2022-02-10 David Malcolm <dmalcolm@redhat.com>
6140 PR analyzer/98797
6141 * region-model-manager.cc
6142 (region_model_manager::maybe_fold_sub_svalue): Generalize getting
6143 individual chars of a STRING_CST from element_region to any
6144 subregion which is a concrete access of a single byte from its
6145 parent region.
6146 * region.cc (region::get_relative_concrete_byte_range): New.
6147 * region.h (region::get_relative_concrete_byte_range): New decl.
6149 2022-02-09 David Malcolm <dmalcolm@redhat.com>
6151 PR analyzer/104452
6152 * region-model.cc (selftest::test_bit_range_regions): New.
6153 (selftest::analyzer_region_model_cc_tests): Call it.
6154 * region.h (bit_range_region::key_t::hash): Fix hashing of m_bits
6155 to avoid using uninitialized data.
6157 2022-02-07 David Malcolm <dmalcolm@redhat.com>
6159 PR analyzer/104417
6160 * sm-taint.cc (tainted_allocation_size::tainted_allocation_size):
6161 Remove overzealous assertion.
6162 (tainted_allocation_size::emit): Likewise.
6163 (region_model::check_dynamic_size_for_taint): Likewise.
6165 2022-02-07 David Malcolm <dmalcolm@redhat.com>
6167 PR analyzer/103872
6168 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
6169 Reimplement in terms of a get_store_value followed by a set_value.
6171 2022-02-03 David Malcolm <dmalcolm@redhat.com>
6173 PR analyzer/104369
6174 * engine.cc (exploded_graph::process_node): Use the node for any
6175 diagnostics, avoiding ICE if a bifurcation update adds a
6176 saved_diagnostic, such as for a tainted realloc size.
6177 * region-model-impl-calls.cc
6178 (region_model::impl_call_realloc::success_no_move::update_model):
6179 Require the old pointer to be non-NULL to be able successfully
6180 grow in place. Use model->deref_rvalue rather than maybe_get_region
6181 to support the old pointer being symbolic.
6182 (region_model::impl_call_realloc::success_with_move::update_model):
6183 Likewise. Add a constraint that the new pointer != the old pointer.
6184 Use a sized_region when setting the value of the new region.
6185 Handle the case where we don't know the dynamic size of the old
6186 region by marking the new region as unknown.
6187 * sm-taint.cc (tainted_allocation_size::tainted_allocation_size):
6188 Update assertion to also allow for MEMSPACE_UNKNOWN.
6189 (tainted_allocation_size::emit): Likewise.
6190 (region_model::check_dynamic_size_for_taint): Likewise.
6192 2022-02-03 David Malcolm <dmalcolm@redhat.com>
6194 * region-model-impl-calls.cc (region_model::impl_call_calloc): Use
6195 a sized_region when calling zero_fill_region.
6197 2022-02-02 David Malcolm <dmalcolm@redhat.com>
6199 * region-model.cc (region_model::on_return): Replace usage of
6200 copy_region with get_rvalue/set_value pair.
6201 (region_model::pop_frame): Likewise.
6202 (selftest::test_compound_assignment): Likewise.
6203 * region-model.h (region_model::copy_region): Delete decl.
6204 * region.cc (region_model::copy_region): Delete.
6206 2022-02-02 David Malcolm <dmalcolm@redhat.com>
6208 * region.cc (region::calc_offset): Consolidate effectively
6209 identical cases.
6211 2022-02-02 David Malcolm <dmalcolm@redhat.com>
6213 * analyzer.h (class bit_range_region): New forward decl.
6214 * region-model-manager.cc (region_model_manager::get_bit_range):
6215 New.
6216 (region_model_manager::log_stats): Handle m_bit_range_regions.
6217 * region-model.cc (region_model::get_lvalue_1): Handle
6218 BIT_FIELD_REF.
6219 * region-model.h (region_model_manager::get_bit_range): New decl.
6220 (region_model_manager::m_bit_range_regions): New field.
6221 * region.cc (region::get_base_region): Handle RK_BIT_RANGE.
6222 (region::base_region_p): Likewise.
6223 (region::calc_offset): Likewise.
6224 (bit_range_region::dump_to_pp): New.
6225 (bit_range_region::get_byte_size): New.
6226 (bit_range_region::get_bit_size): New.
6227 (bit_range_region::get_byte_size_sval): New.
6228 (bit_range_region::get_relative_concrete_offset): New.
6229 * region.h (enum region_kind): Add RK_BIT_RANGE.
6230 (region::dyn_cast_bit_range_region): New vfunc.
6231 (class bit_range_region): New.
6232 (is_a_helper <const bit_range_region *>::test): New.
6233 (default_hash_traits<bit_range_region::key_t>): New.
6235 2022-02-02 David Malcolm <dmalcolm@redhat.com>
6237 PR analyzer/104270
6238 * region-model.cc (region_model::on_call_pre): Handle
6239 IFN_DEFERRED_INIT.
6241 2022-01-27 David Malcolm <dmalcolm@redhat.com>
6243 * checker-path.cc (event_kind_to_string): Handle
6244 EK_REGION_CREATION.
6245 (region_creation_event::region_creation_event): New.
6246 (region_creation_event::get_desc): New.
6247 (checker_path::add_region_creation_event): New.
6248 * checker-path.h (enum event_kind): Add EK_REGION_CREATION.
6249 (class region_creation_event): New subclass.
6250 (checker_path::add_region_creation_event): New decl.
6251 * diagnostic-manager.cc
6252 (diagnostic_manager::emit_saved_diagnostic): Pass NULL for new
6253 param to add_events_for_eedge when handling trailing eedge.
6254 (diagnostic_manager::build_emission_path): Create an interesting_t
6255 instance, allow the pending diagnostic to populate it, and pass it
6256 to the calls to add_events_for_eedge.
6257 (diagnostic_manager::add_events_for_eedge): Add "interest" param.
6258 Use it to add region_creation_events for on-stack regions created
6259 within at function entry, and when pertinent dynamically-sized
6260 regions are created.
6261 (diagnostic_manager::prune_for_sm_diagnostic): Add case for
6262 EK_REGION_CREATION.
6263 * diagnostic-manager.h (diagnostic_manager::add_events_for_eedge):
6264 Add "interest" param.
6265 * pending-diagnostic.cc: Include "selftest.h", "tristate.h",
6266 "analyzer/call-string.h", "analyzer/program-point.h",
6267 "analyzer/store.h", and "analyzer/region-model.h".
6268 (interesting_t::add_region_creation): New.
6269 (interesting_t::dump_to_pp): New.
6270 * pending-diagnostic.h (struct interesting_t): New.
6271 (pending_diagnostic::mark_interesting_stuff): New vfunc.
6272 * region-model.cc
6273 (poisoned_value_diagnostic::poisoned_value_diagnostic): Add
6274 (poisoned_value_diagnostic::operator==): Compare m_pkind and
6275 m_src_region fields.
6276 (poisoned_value_diagnostic::mark_interesting_stuff): New.
6277 (poisoned_value_diagnostic::m_src_region): New.
6278 (region_model::check_for_poison): Call
6279 get_region_for_poisoned_expr for uninit values and pass the resul
6280 to the diagnostic.
6281 (region_model::get_region_for_poisoned_expr): New.
6282 (region_model::deref_rvalue): Pass NULL for
6283 poisoned_value_diagnostic's src_region.
6284 * region-model.h (region_model::get_region_for_poisoned_expr): New
6285 decl.
6286 * region.h (frame_region::get_fndecl): New.
6288 2022-01-27 Martin Liska <mliska@suse.cz>
6290 PR analyzer/104247
6291 * constraint-manager.cc (bounded_ranges_manager::log_stats):
6292 Cast to long for format purpose.
6293 * region-model-manager.cc (log_uniq_map): Likewise.
6295 2022-01-26 David Malcolm <dmalcolm@redhat.com>
6297 PR analyzer/104224
6298 * region-model.cc (region_model::check_call_args): New.
6299 (region_model::on_call_pre): Call it when ignoring stdio builtins.
6300 * region-model.h (region_model::check_call_args): New decl
6302 2022-01-26 David Malcolm <dmalcolm@redhat.com>
6304 PR analyzer/94362
6305 * constraint-manager.cc (range::add_bound): Fix tests for
6306 discarding redundant constraints. Perform test for rejecting
6307 unsatisfiable constraints earlier so that they don't update
6308 the object on failure.
6309 (selftest::test_range): New.
6310 (selftest::test_constant_comparisons): Add test coverage for
6311 existing constraints becoming narrower until they are
6312 unsatisfiable.
6313 (selftest::run_constraint_manager_tests): Call test_range.
6315 2022-01-22 David Malcolm <dmalcolm@redhat.com>
6317 PR analyzer/104159
6318 * region-model-manager.cc
6319 (region_model_manager::get_or_create_cast): Bail out if the types
6320 are the same. Don't attempt to handle casts involving vector
6321 types.
6323 2022-01-20 David Malcolm <dmalcolm@redhat.com>
6325 PR analyzer/94362
6326 * constraint-manager.cc (bound::ensure_closed): Convert param to
6327 enum bound_kind.
6328 (range::constrained_to_single_element): Likewise.
6329 (range::add_bound): New.
6330 (constraint_manager::add_constraint): Handle SVAL + OFFSET
6331 compared to a constant.
6332 (constraint_manager::get_ec_bounds): Rewrite in terms of
6333 range::add_bound.
6334 (constraint_manager::eval_condition): Reject if range::add_bound
6335 fails.
6336 (selftest::test_constant_comparisons): Add test coverage for
6337 various impossible combinations of integer comparisons.
6338 * constraint-manager.h (enum bound_kind): New.
6339 (struct bound): Likewise.
6340 (bound::ensure_closed): Convert to param to enum bound_kind.
6341 (struct range): Convert to...
6342 (class range): ...this, making fields private.
6343 (range::add_bound): New decls.
6344 * region-model.cc (region_model::add_constraint): Fail if
6345 constraint_manager::add_constraint fails.
6347 2022-01-18 David Malcolm <dmalcolm@redhat.com>
6349 PR analyzer/104089
6350 * region-model-manager.cc
6351 (region_model_manager::get_or_create_constant_svalue): Assert that
6352 we have a CONSTANT_CLASS_P.
6353 (region_model_manager::maybe_fold_unaryop): Only fold a constant
6354 when fold_unary's result is a constant or a cast of a constant.
6356 2022-01-18 David Malcolm <dmalcolm@redhat.com>
6358 PR analyzer/104062
6359 * region-model-manager.cc
6360 (region_model_manager::maybe_fold_sub_svalue): Avoid casting to
6361 NULL type when folding access to repeated svalue.
6363 2022-01-17 Martin Liska <mliska@suse.cz>
6365 * analyzer.cc (is_special_named_call_p): Rename .c names to .cc.
6366 (is_named_call_p): Likewise.
6367 * region-model-asm.cc (deterministic_p): Likewise.
6368 * region.cc (field_region::get_relative_concrete_offset): Likewise.
6369 * sm-malloc.cc (method_p): Likewise.
6370 * supergraph.cc (superedge::dump_dot): Likewise.
6372 2022-01-14 David Malcolm <dmalcolm@redhat.com>
6374 * sm-taint.cc (taint_state_machine::combine_states): Handle combination
6375 of has_ub and has_lb.
6377 2022-01-14 David Malcolm <dmalcolm@redhat.com>
6379 PR analyzer/104029
6380 * sm-taint.cc (taint_state_machine::alt_get_inherited_state):
6381 Remove gcc_unreachable from default case for unary ops.
6383 2022-01-14 David Malcolm <dmalcolm@redhat.com>
6385 * engine.cc: Include "stringpool.h", "attribs.h", and
6386 "tree-dfa.h".
6387 (mark_params_as_tainted): New.
6388 (class tainted_args_function_custom_event): New.
6389 (class tainted_args_function_info): New.
6390 (exploded_graph::add_function_entry): Handle functions with
6391 "tainted_args" attribute.
6392 (class tainted_args_field_custom_event): New.
6393 (class tainted_args_callback_custom_event): New.
6394 (class tainted_args_call_info): New.
6395 (add_tainted_args_callback): New.
6396 (add_any_callbacks): New.
6397 (exploded_graph::build_initial_worklist): Likewise.
6398 (exploded_graph::build_initial_worklist): Find callbacks that are
6399 reachable from global initializers, calling add_any_callbacks on
6400 them.
6402 2022-01-12 David Malcolm <dmalcolm@redhat.com>
6404 PR analyzer/103940
6405 * engine.cc (impl_sm_context::impl_sm_context): Add
6406 "unknown_side_effects" param and use it to initialize
6407 new m_unknown_side_effects field.
6408 (impl_sm_context::unknown_side_effects_p): New.
6409 (impl_sm_context::m_unknown_side_effects): New.
6410 (exploded_node::on_stmt): Pass unknown_side_effects to sm_ctxt
6411 ctor.
6412 * sm-taint.cc: Include "stringpool.h" and "attribs.h".
6413 (tainted_size::tainted_size): Drop "dir" param.
6414 (tainted_size::get_kind): Drop "FINAL".
6415 (tainted_size::emit): Likewise.
6416 (tainted_size::m_dir): Drop unused field.
6417 (class tainted_access_attrib_size): New subclass.
6418 (taint_state_machine::on_stmt): Call check_for_tainted_size_arg on
6419 external functions with unknown side effects.
6420 (taint_state_machine::check_for_tainted_size_arg): New.
6421 (region_model::check_region_for_taint): Drop "dir" param from
6422 tainted_size ctor.
6423 * sm.h (sm_context::unknown_side_effects_p): New.
6425 2022-01-11 David Malcolm <dmalcolm@redhat.com>
6427 PR analyzer/102692
6428 * diagnostic-manager.cc
6429 (class auto_disable_complexity_checks): Rename to...
6430 (class auto_checking_feasibility): ...this, updating
6431 the calls accordingly.
6432 (epath_finder::explore_feasible_paths): Update for renaming.
6433 * region-model-manager.cc
6434 (region_model_manager::region_model_manager): Update for change from
6435 m_check_complexity to m_checking_feasibility.
6436 (region_model_manager::reject_if_too_complex): Likewise.
6437 (region_model_manager::get_or_create_unknown_svalue): Handle
6438 m_checking_feasibility.
6439 (region_model_manager::create_unique_svalue): New.
6440 (region_model_manager::maybe_fold_binop): Handle BIT_AND_EXPR and
6441 BIT_IOR_EXPRs on booleans where we know the result.
6442 * region-model.cc (test_binop_svalue_folding): Add test coverage
6443 for the above.
6444 * region-model.h (region_model_manager::create_unique_svalue): New
6445 decl.
6446 (region_model_manager::enable_complexity_check): Replace with...
6447 (region_model_manager::begin_checking_feasibility): ...this.
6448 (region_model_manager::disable_complexity_check): Replace with...
6449 (region_model_manager::end_checking_feasibility): ...this.
6450 (region_model_manager::m_check_complexity): Replace with...
6451 (region_model_manager::m_checking_feasibility): ...this.
6452 (region_model_manager::m_managed_dynamic_svalues): New field.
6454 2022-01-08 David Malcolm <dmalcolm@redhat.com>
6456 * engine.cc (impl_run_checkers): Pass logger to engine ctor.
6457 * region-model-manager.cc
6458 (region_model_manager::region_model_manager): Add logger param and
6459 use it to initialize m_logger.
6460 * region-model.cc (engine::engine): New.
6461 * region-model.h (region_model_manager::region_model_manager):
6462 Add logger param.
6463 (region_model_manager::get_logger): New.
6464 (region_model_manager::m_logger): New field.
6465 (engine::engine): New.
6466 * store.cc (store_manager::get_logger): New.
6467 (store::set_value): Log scope. Log when marking a cluster as
6468 unknown due to possible aliasing.
6469 * store.h (store_manager::get_logger): New decl.
6471 2022-01-08 David Malcolm <dmalcolm@redhat.com>
6473 * region-model-impl-calls.cc (cmp_decls): New.
6474 (cmp_decls_ptr_ptr): New.
6475 (region_model::impl_call_analyzer_dump_escaped): New.
6476 * region-model.cc (region_model::on_stmt_pre): Handle
6477 __analyzer_dump_escaped.
6478 * region-model.h (region_model::impl_call_analyzer_dump_escaped):
6479 New decl.
6480 * store.h (binding_cluster::get_base_region): New accessor.
6482 2022-01-08 David Malcolm <dmalcolm@redhat.com>
6484 * region.cc (region::is_named_decl_p): New.
6485 * region.h (region::is_named_decl_p): New decl.
6487 2022-01-06 David Malcolm <dmalcolm@redhat.com>
6489 PR analyzer/103546
6490 * store.cc (store::eval_alias_1): Refactor handling of decl
6491 regions, adding a test for may_be_aliased, rejecting those for
6492 which it returns false.
6494 2021-12-12 Jonathan Wakely <jwakely@redhat.com>
6496 * engine.cc: Define INCLUDE_MEMORY instead of INCLUDE_UNIQUE_PTR.
6498 2021-12-06 David Malcolm <dmalcolm@redhat.com>
6500 PR analyzer/103533
6501 * constraint-manager.cc (equiv_class::contains_non_constant_p):
6502 New.
6503 (constraint_manager::canonicalize): Call it when determining
6504 redundant ECs.
6505 (selftest::test_purging): New selftest.
6506 (selftest::run_constraint_manager_tests): Likewise.
6507 * constraint-manager.h (equiv_class::contains_non_constant_p):
6508 New decl.
6510 2021-12-01 David Malcolm <dmalcolm@redhat.com>
6512 PR analyzer/102471
6513 * region-model-reachability.cc (reachable_regions::handle_parm):
6514 Treat all svalues within a compound parm has reachable, and those
6515 wrapped in a cast.
6517 2021-11-29 David Malcolm <dmalcolm@redhat.com>
6519 PR analyzer/103217
6520 * store.cc (binding_cluster::can_merge_p): For the "key is bound"
6521 vs "key is not bound" merger case, check that the bound svalue
6522 is mergeable before merging it to "unknown", rejecting the merger
6523 otherwise.
6525 2021-11-19 David Malcolm <dmalcolm@redhat.com>
6527 PR analyzer/103217
6528 * engine.cc (exploded_graph::get_or_create_node): Pass in
6529 m_ext_state to program_state::can_merge_with_p.
6530 (exploded_graph::process_worklist): Likewise.
6531 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
6532 Likewise.
6533 (exploded_graph::process_node): Add missing call to detect_leaks
6534 when handling phi nodes.
6535 * program-state.cc (program_state::can_merge_with_p): Add
6536 "ext_state" param. Pass it and state ptrs to
6537 region_model::can_merge_with_p.
6538 (selftest::test_program_state_merging): Update for new ext_state
6539 param of program_state::can_merge_with_p.
6540 (selftest::test_program_state_merging_2): Likewise.
6541 * program-state.h (program_state::can_purge_p): Make const.
6542 (program_state::can_merge_with_p): Add "ext_state" param.
6543 * region-model.cc: Include "analyzer/program-state.h".
6544 (region_model::can_merge_with_p): Add params "ext_state",
6545 "state_a", and "state_b", use them when creating model_merger
6546 object.
6547 (model_merger::mergeable_svalue_p): New.
6548 * region-model.h (region_model::can_merge_with_p): Add params
6549 "ext_state", "state_a", and "state_b".
6550 (model_merger::model_merger) Likewise, initializing new fields.
6551 (model_merger::mergeable_svalue_p): New decl.
6552 (model_merger::m_ext_state): New field.
6553 (model_merger::m_state_a): New field.
6554 (model_merger::m_state_b): New field.
6555 * svalue.cc (svalue::can_merge_p): Call
6556 model_merger::mergeable_svalue_p on both states and reject the
6557 merger accordingly.
6559 2021-11-17 David Malcolm <dmalcolm@redhat.com>
6561 PR analyzer/102695
6562 * region-model-impl-calls.cc (region_model::impl_call_strchr): New.
6563 * region-model-manager.cc
6564 (region_model_manager::maybe_fold_unaryop): Simplify cast to
6565 pointer type of an existing pointer to a region.
6566 * region-model.cc (region_model::on_call_pre): Handle
6567 BUILT_IN_STRCHR and "strchr".
6568 (write_to_const_diagnostic::emit): Add auto_diagnostic_group. Add
6569 alternate wordings for functions and labels.
6570 (write_to_const_diagnostic::describe_final_event): Add alternate
6571 wordings for functions and labels.
6572 (region_model::check_for_writable_region): Handle RK_FUNCTION and
6573 RK_LABEL.
6574 * region-model.h (region_model::impl_call_strchr): New decl.
6576 2021-11-16 David Malcolm <dmalcolm@redhat.com>
6578 PR analyzer/102662
6579 * constraint-manager.cc (bounded_range::operator==): Require the
6580 types to be the same for equality.
6582 2021-11-13 David Malcolm <dmalcolm@redhat.com>
6584 * analyzer.opt (Wanalyzer-tainted-allocation-size): New.
6585 (Wanalyzer-tainted-divisor): New.
6586 (Wanalyzer-tainted-offset): New.
6587 (Wanalyzer-tainted-size): New.
6588 * engine.cc (impl_region_model_context::get_taint_map): New.
6589 * exploded-graph.h (impl_region_model_context::get_taint_map):
6590 New decl.
6591 * program-state.cc (sm_state_map::get_state): Call
6592 alt_get_inherited_state.
6593 (sm_state_map::impl_set_state): Modify states within
6594 compound svalues.
6595 (program_state::impl_call_analyzer_dump_state): Undo casts.
6596 (selftest::test_program_state_1): Update for new context param of
6597 create_region_for_heap_alloc.
6598 (selftest::test_program_state_merging): Likewise.
6599 * region-model-impl-calls.cc (region_model::impl_call_alloca):
6600 Likewise.
6601 (region_model::impl_call_calloc): Likewise.
6602 (region_model::impl_call_malloc): Likewise.
6603 (region_model::impl_call_operator_new): Likewise.
6604 (region_model::impl_call_realloc): Likewise.
6605 * region-model.cc (region_model::check_region_access): Call
6606 check_region_for_taint.
6607 (region_model::get_representative_path_var_1): Handle binops.
6608 (region_model::create_region_for_heap_alloc): Add "ctxt" param and
6609 pass it to set_dynamic_extents.
6610 (region_model::create_region_for_alloca): Likewise.
6611 (region_model::set_dynamic_extents): Add "ctxt" param and use it
6612 to call check_dynamic_size_for_taint.
6613 (selftest::test_state_merging): Update for new context param of
6614 create_region_for_heap_alloc.
6615 (selftest::test_malloc_constraints): Likewise.
6616 (selftest::test_malloc): Likewise.
6617 (selftest::test_alloca): Likewise for create_region_for_alloca.
6618 * region-model.h (region_model::create_region_for_heap_alloc): Add
6619 "ctxt" param.
6620 (region_model::create_region_for_alloca): Likewise.
6621 (region_model::set_dynamic_extents): Likewise.
6622 (region_model::check_dynamic_size_for_taint): New decl.
6623 (region_model::check_region_for_taint): New decl.
6624 (region_model_context::get_taint_map): New vfunc.
6625 (noop_region_model_context::get_taint_map): New.
6626 * sm-taint.cc: Remove include of "diagnostic-event-id.h"; add
6627 includes of "gimple-iterator.h", "tristate.h", "selftest.h",
6628 "ordered-hash-map.h", "cgraph.h", "cfg.h", "digraph.h",
6629 "analyzer/supergraph.h", "analyzer/call-string.h",
6630 "analyzer/program-point.h", "analyzer/store.h",
6631 "analyzer/region-model.h", and "analyzer/program-state.h".
6632 (enum bounds): Move to top of file.
6633 (class taint_diagnostic): New.
6634 (class tainted_array_index): Convert to subclass of taint_diagnostic.
6635 (tainted_array_index::emit): Add CWE-129. Reword warning to use
6636 "attacker-controlled" rather than "tainted".
6637 (tainted_array_index::describe_state_change): Move to
6638 taint_diagnostic::describe_state_change.
6639 (tainted_array_index::describe_final_event): Reword to use
6640 "attacker-controlled" rather than "tainted".
6641 (class tainted_offset): New.
6642 (class tainted_size): New.
6643 (class tainted_divisor): New.
6644 (class tainted_allocation_size): New.
6645 (taint_state_machine::alt_get_inherited_state): New.
6646 (taint_state_machine::on_stmt): In assignment handling, remove
6647 ARRAY_REF handling in favor of check_region_for_taint. Add
6648 detection of tainted divisors.
6649 (taint_state_machine::get_taint): New.
6650 (taint_state_machine::combine_states): New.
6651 (region_model::check_region_for_taint): New.
6652 (region_model::check_dynamic_size_for_taint): New.
6653 * sm.h (state_machine::alt_get_inherited_state): New.
6655 2021-11-12 David Malcolm <dmalcolm@redhat.com>
6657 * engine.cc (exploded_node::on_stmt_pre): Return when handling
6658 "__analyzer_dump_state".
6660 2021-11-11 Richard Biener <rguenther@suse.de>
6662 * supergraph.cc: Include bitmap.h.
6664 2021-11-04 David Malcolm <dmalcolm@redhat.com>
6666 * program-state.cc (sm_state_map::dump): Use default_tree_printer
6667 as format decoder.
6669 2021-09-16 Maxim Blinov <maxim.blinov@embecosm.com>
6671 PR bootstrap/102242
6672 * engine.cc (INCLUDE_UNIQUE_PTR): Define.
6674 2021-09-08 David Malcolm <dmalcolm@redhat.com>
6676 PR analyzer/102225
6677 * analyzer.h (compat_types_p): New decl.
6678 * constraint-manager.cc
6679 (constraint_manager::get_or_add_equiv_class): Guard against NULL
6680 type when checking for pointer types.
6681 * region-model-impl-calls.cc (region_model::impl_call_realloc):
6682 Guard against NULL lhs type/region. Guard against the size value
6683 not being of a compatible type for dynamic extents.
6684 * region-model.cc (compat_types_p): Make non-static.
6686 2021-08-30 David Malcolm <dmalcolm@redhat.com>
6688 PR analyzer/99260
6689 * analyzer.h (class custom_edge_info): New class, adapted from
6690 exploded_edge::custom_info_t. Make member functions const.
6691 Make update_model return bool, converting edge param from
6692 reference to a pointer, and adding a ctxt param.
6693 (class path_context): New class.
6694 * call-info.cc: New file.
6695 * call-info.h: New file.
6696 * engine.cc: Include "analyzer/call-info.h" and <memory>.
6697 (impl_region_model_context::impl_region_model_context): Update for
6698 new m_path_ctxt field.
6699 (impl_region_model_context::bifurcate): New.
6700 (impl_region_model_context::terminate_path): New.
6701 (impl_region_model_context::get_malloc_map): New.
6702 (impl_sm_context::impl_sm_context): Update for new m_path_ctxt
6703 field.
6704 (impl_sm_context::get_fndecl_for_call): Likewise.
6705 (impl_sm_context::set_next_state): Likewise.
6706 (impl_sm_context::warn): Likewise.
6707 (impl_sm_context::is_zero_assignment): Likewise.
6708 (impl_sm_context::get_path_context): New.
6709 (impl_sm_context::m_path_ctxt): New.
6710 (impl_region_model_context::on_condition): Update for new
6711 path_ctxt param. Handle m_enode_for_diag being NULL.
6712 (impl_region_model_context::on_phi): Update for new path_ctxt
6713 param.
6714 (exploded_node::on_stmt): Add path_ctxt param, updating ctor calls
6715 to use it as necessary. Use it to bail out after sm-handling,
6716 if needed.
6717 (exploded_node::detect_leaks): Update for new path_ctxt param.
6718 (dynamic_call_info_t::update_model): Update for conversion of
6719 exploded_edge::custom_info_t to custom_edge_info.
6720 (dynamic_call_info_t::add_events_to_path): Likewise.
6721 (rewind_info_t::update_model): Likewise.
6722 (rewind_info_t::add_events_to_path): Likewise.
6723 (exploded_edge::exploded_edge): Likewise.
6724 (exploded_graph::add_edge): Likewise.
6725 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
6726 Update for new path_ctxt param.
6727 (class impl_path_context): New.
6728 (exploded_graph::process_node): Update for new path_ctxt param.
6729 Create an impl_path_context and pass it to exploded_node::on_stmt.
6730 Use it to terminate iterating stmts if terminate_path is called
6731 on it. After processing a run of stmts, query path_ctxt to
6732 potentially terminate the analysis path, and/or to "bifurcate" the
6733 analysis into multiple additional paths.
6734 (feasibility_state::maybe_update_for_edge): Update for new
6735 update_model ctxt param.
6736 * exploded-graph.h
6737 (impl_region_model_context::impl_region_model_context): Add
6738 path_ctxt param.
6739 (impl_region_model_context::bifurcate): New.
6740 (impl_region_model_context::terminate_path): New
6741 (impl_region_model_context::get_ext_state): New.
6742 (impl_region_model_context::get_malloc_map): New.
6743 (impl_region_model_context::m_path_ctxt): New field.
6744 (exploded_node::on_stmt): Add path_ctxt param.
6745 (class exploded_edge::custom_info_t): Move to analyzer.h, renaming
6746 to custom_edge_info, and making the changes as noted in analyzer.h
6747 above.
6748 (exploded_edge::exploded_edge): Update for these changes to
6749 exploded_edge::custom_info_t.
6750 (exploded_edge::m_custom_info): Likewise.
6751 (class dynamic_call_info_t): Likewise.
6752 (class rewind_info_t): Likewise.
6753 (exploded_graph::add_edge): Likewise.
6754 * program-state.cc (program_state::on_edge): Update for new
6755 path_ctxt param.
6756 (program_state::push_call): Likewise.
6757 (program_state::returning_call): Likewise.
6758 (program_state::prune_for_point): Likewise.
6759 * region-model-impl-calls.cc: Include "analyzer/call-info.h".
6760 (call_details::get_fndecl_for_call): New.
6761 (region_model::impl_call_realloc): Reimplement.
6762 * region-model.cc (region_model::on_call_pre): Move call to
6763 impl_call_realloc to...
6764 (region_model::on_call_post): ...here. Consolidate creation
6765 of call_details instance.
6766 (noop_region_model_context::bifurcate): New.
6767 (noop_region_model_context::terminate_path): New.
6768 * region-model.h (call_details::get_call_stmt): New.
6769 (call_details::get_fndecl_for_call): New.
6770 (region_model::on_realloc_with_move): New.
6771 (region_model_context::bifurcate): New.
6772 (region_model_context::terminate_path): New.
6773 (region_model_context::get_ext_state): New.
6774 (region_model_context::get_malloc_map): New.
6775 (noop_region_model_context::bifurcate): New.
6776 (noop_region_model_context::terminate_path): New.
6777 (noop_region_model_context::get_ext_state): New.
6778 (noop_region_model_context::get_malloc_map): New.
6779 * sm-malloc.cc: Include "analyzer/program-state.h".
6780 (malloc_state_machine::on_realloc_call): Reimplement.
6781 (malloc_state_machine::on_realloc_with_move): New.
6782 (region_model::on_realloc_with_move): New.
6783 * sm-signal.cc (class signal_delivery_edge_info_t): Update for
6784 conversion from exploded_edge::custom_info_t to custom_edge_info.
6785 * sm.h (sm_context::get_path_context): New.
6786 * svalue.cc (svalue::maybe_get_constant): Call
6787 unwrap_any_unmergeable.
6789 2021-08-25 Ankur Saini <arsenic@sourceware.org>
6791 PR analyzer/101980
6792 * engine.cc (exploded_graph::maybe_create_dynamic_call): Don't create
6793 calls if max recursion limit is reached.
6795 2021-08-23 David Malcolm <dmalcolm@redhat.com>
6797 * analyzer.h (struct rejected_constraint): Convert to...
6798 (class rejected_constraint): ...this.
6799 (class bounded_ranges): New forward decl.
6800 (class bounded_ranges_manager): New forward decl.
6801 * constraint-manager.cc: Include "analyzer/analyzer-logging.h" and
6802 "tree-pretty-print.h".
6803 (can_plus_one_p): New.
6804 (plus_one): New.
6805 (can_minus_one_p): New.
6806 (minus_one): New.
6807 (bounded_range::bounded_range): New.
6808 (dump_cst): New.
6809 (bounded_range::dump_to_pp): New.
6810 (bounded_range::dump): New.
6811 (bounded_range::to_json): New.
6812 (bounded_range::set_json_attr): New.
6813 (bounded_range::contains_p): New.
6814 (bounded_range::intersects_p): New.
6815 (bounded_range::operator==): New.
6816 (bounded_range::cmp): New.
6817 (bounded_ranges::bounded_ranges): New.
6818 (bounded_ranges::bounded_ranges): New.
6819 (bounded_ranges::bounded_ranges): New.
6820 (bounded_ranges::canonicalize): New.
6821 (bounded_ranges::validate): New.
6822 (bounded_ranges::operator==): New.
6823 (bounded_ranges::dump_to_pp): New.
6824 (bounded_ranges::dump): New.
6825 (bounded_ranges::to_json): New.
6826 (bounded_ranges::eval_condition): New.
6827 (bounded_ranges::contain_p): New.
6828 (bounded_ranges::cmp): New.
6829 (bounded_ranges_manager::~bounded_ranges_manager): New.
6830 (bounded_ranges_manager::get_or_create_empty): New.
6831 (bounded_ranges_manager::get_or_create_point): New.
6832 (bounded_ranges_manager::get_or_create_range): New.
6833 (bounded_ranges_manager::get_or_create_union): New.
6834 (bounded_ranges_manager::get_or_create_intersection): New.
6835 (bounded_ranges_manager::get_or_create_inverse): New.
6836 (bounded_ranges_manager::consolidate): New.
6837 (bounded_ranges_manager::get_or_create_ranges_for_switch): New.
6838 (bounded_ranges_manager::create_ranges_for_switch): New.
6839 (bounded_ranges_manager::make_case_label_ranges): New.
6840 (bounded_ranges_manager::log_stats): New.
6841 (bounded_ranges_constraint::print): New.
6842 (bounded_ranges_constraint::to_json): New.
6843 (bounded_ranges_constraint::operator==): New.
6844 (bounded_ranges_constraint::add_to_hash): New.
6845 (constraint_manager::constraint_manager): Update for new field
6846 m_bounded_ranges_constraints.
6847 (constraint_manager::operator=): Likewise.
6848 (constraint_manager::hash): Likewise.
6849 (constraint_manager::operator==): Likewise.
6850 (constraint_manager::print): Likewise.
6851 (constraint_manager::dump_to_pp): Likewise.
6852 (constraint_manager::to_json): Likewise.
6853 (constraint_manager::add_unknown_constraint): Update the lhs_ec_id
6854 if necessary in existing constraints when combining equivalence
6855 classes. Add similar code for handling
6856 m_bounded_ranges_constraints.
6857 (constraint_manager::add_constraint_internal): Add comment.
6858 (constraint_manager::add_bounded_ranges): New.
6859 (constraint_manager::eval_condition): Use new field
6860 m_bounded_ranges_constraints.
6861 (constraint_manager::purge): Update bounded_ranges_constraint
6862 instances.
6863 (constraint_manager::canonicalize): Update for new field.
6864 (merger_fact_visitor::on_ranges): New.
6865 (constraint_manager::for_each_fact): Use new field
6866 m_bounded_ranges_constraints.
6867 (constraint_manager::validate): Fix off-by-one error needed due
6868 to bug fixed above in add_unknown_constraint. Validate the EC IDs
6869 in m_bounded_ranges_constraints.
6870 (constraint_manager::get_range_manager): New.
6871 (selftest::assert_dump_bounded_range_eq): New.
6872 (ASSERT_DUMP_BOUNDED_RANGE_EQ): New.
6873 (selftest::test_bounded_range): New.
6874 (selftest::assert_dump_bounded_ranges_eq): New.
6875 (ASSERT_DUMP_BOUNDED_RANGES_EQ): New.
6876 (selftest::test_bounded_ranges): New.
6877 (selftest::run_constraint_manager_tests): Call the new selftests.
6878 * constraint-manager.h (struct bounded_range): New.
6879 (struct bounded_ranges): New.
6880 (template <> struct default_hash_traits<bounded_ranges::key_t>): New.
6881 (class bounded_ranges_manager): New.
6882 (fact_visitor::on_ranges): New pure virtual function.
6883 (class bounded_ranges_constraint): New.
6884 (constraint_manager::add_bounded_ranges): New decl.
6885 (constraint_manager::get_range_manager): New decl.
6886 (constraint_manager::m_bounded_ranges_constraints): New field.
6887 * diagnostic-manager.cc (epath_finder::process_worklist_item):
6888 Transfer ownership of rc to add_feasibility_problem.
6889 * engine.cc (feasibility_problem::dump_to_pp): Use get_model.
6890 * feasible-graph.cc (infeasible_node::dump_dot): Update for
6891 conversion of m_rc to a pointer.
6892 (feasible_graph::add_feasibility_problem): Pass RC by pointer and
6893 take ownership.
6894 * feasible-graph.h (infeasible_node::infeasible_node): Pass RC by
6895 pointer and take ownership.
6896 (infeasible_node::~infeasible_node): New.
6897 (infeasible_node::m_rc): Convert to a pointer.
6898 (feasible_graph::add_feasibility_problem): Pass RC by pointer and
6899 take ownership.
6900 * region-model-manager.cc: Include
6901 "analyzer/constraint-manager.h".
6902 (region_model_manager::region_model_manager): Initializer new
6903 field m_range_mgr.
6904 (region_model_manager::~region_model_manager): Delete it.
6905 (region_model_manager::log_stats): Call log_stats on it.
6906 * region-model.cc (region_model::add_constraint): Use new subclass
6907 rejected_op_constraint.
6908 (region_model::apply_constraints_for_gswitch): Reimplement using
6909 bounded_ranges_manager.
6910 (rejected_constraint::dump_to_pp): Convert to...
6911 (rejected_op_constraint::dump_to_pp): ...this.
6912 (rejected_ranges_constraint::dump_to_pp): New.
6913 * region-model.h (struct purge_stats): Add field
6914 m_num_bounded_ranges_constraints.
6915 (region_model_manager::get_range_manager): New.
6916 (region_model_manager::m_range_mgr): New.
6917 (region_model::get_range_manager): New.
6918 (struct rejected_constraint): Split into...
6919 (class rejected_constraint):...this new abstract base class,
6920 and...
6921 (class rejected_op_constraint): ...this new concrete subclass.
6922 (class rejected_ranges_constraint): New.
6923 * supergraph.cc: Include "tree-cfg.h".
6924 (supergraph::supergraph): Drop idx param from add_cfg_edge.
6925 (supergraph::add_cfg_edge): Drop idx param.
6926 (switch_cfg_superedge::switch_cfg_superedge): Move here from
6927 header. Populate m_case_labels with all cases which go to DST.
6928 (switch_cfg_superedge::dump_label_to_pp): Reimplement to use
6929 m_case_labels.
6930 (switch_cfg_superedge::get_case_label): Delete.
6931 * supergraph.h (supergraphadd_cfg_edge): Drop "idx" param.
6932 (switch_cfg_superedge::switch_cfg_superedge): Drop idx param and
6933 move implementation to supergraph.cc.
6934 (switch_cfg_superedge::get_case_label): Delete.
6935 (switch_cfg_superedge::get_case_labels): New.
6936 (switch_cfg_superedge::m_idx): Delete.
6937 (switch_cfg_superedge::m_case_labels): New field.
6939 2021-08-23 David Malcolm <dmalcolm@redhat.com>
6941 PR analyzer/101875
6942 * sm-file.cc (file_diagnostic::describe_state_change): Handle
6943 change.m_expr being NULL.
6945 2021-08-23 David Malcolm <dmalcolm@redhat.com>
6947 PR analyzer/101837
6948 * analyzer.cc (maybe_reconstruct_from_def_stmt): Bail if fn is
6949 NULL, and assert that it's non-NULL before passing it to
6950 build_call_array_loc.
6952 2021-08-23 David Malcolm <dmalcolm@redhat.com>
6954 PR analyzer/101962
6955 * region-model.cc (region_model::eval_condition_without_cm):
6956 Refactor comparison against zero, adding a check for
6957 POINTER_PLUS_EXPR of non-NULL.
6959 2021-08-23 David Malcolm <dmalcolm@redhat.com>
6961 * store.cc (bit_range::intersects_p): New overload.
6962 (bit_range::operator-): New.
6963 (binding_cluster::maybe_get_compound_binding): Handle the partial
6964 overlap case.
6965 (selftest::test_bit_range_intersects_p): Add test coverage for
6966 new overload of bit_range::intersects_p.
6967 * store.h (bit_range::intersects_p): New overload.
6968 (bit_range::operator-): New.
6970 2021-08-23 Ankur Saini <arsenic@sourceware.org>
6972 PR analyzer/102020
6973 * diagnostic-manager.cc
6974 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Fix typo.
6976 2021-08-21 Ankur Saini <arsenic@sourceware.org>
6978 PR analyzer/101980
6979 * diagnostic-manager.cc
6980 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Use
6981 caller_model only when the supergraph_edge doesn't exixt.
6982 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
6983 Likewise.
6984 * engine.cc (exploded_graph::create_dynamic_call): Rename to...
6985 (exploded_graph::maybe_create_dynamic_call): ...this, return call
6986 creation status.
6987 (exploded_graph::process_node): Handle calls which were not dynamically
6988 discovered.
6989 * exploded-graph.h (exploded_graph::create_dynamic_call): Rename to...
6990 (exploded_graph::maybe_create_dynamic_call): ...this.
6991 * region-model.cc (region_model::update_for_gcall): New param, use it
6992 to push call to frame.
6993 (region_model::update_for_call_superedge): Pass callee function to
6994 update_for_gcall.
6995 * region-model.h (region_model::update_for_gcall): New param.
6997 2021-08-18 Ankur Saini <arsenic@sourceware.org>
6999 PR analyzer/97114
7000 * region-model.cc (region_model::get_rvalue_1): Add case for
7001 OBJ_TYPE_REF.
7003 2021-08-18 Ankur Saini <arsenic@sourceware.org>
7005 PR analyzer/100546
7006 * analysis-plan.cc (analysis_plan::use_summary_p): Don't use call
7007 summaries if there is no callgraph edge
7008 * checker-path.cc (call_event::call_event): Handle calls events that
7009 are not represented by a supergraph call edge
7010 (return_event::return_event): Likewise.
7011 (call_event::get_desc): Work with new call_event structure.
7012 (return_event::get_desc): Likeise.
7013 * checker-path.h (call_event::m_src_snode): New field.
7014 (call_event::m_dest_snode): New field.
7015 (return_event::m_src_snode): New field.
7016 (return_event::m_dest_snode): New field.
7017 * diagnostic-manager.cc
7018 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>:
7019 Refactor to work with edges without callgraph edge.
7020 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
7021 Likewise.
7022 * engine.cc (dynamic_call_info_t::update_model): New function.
7023 (dynamic_call_info_t::add_events_to_path): New function.
7024 (exploded_graph::create_dynamic_call): New function.
7025 (exploded_graph::process_node): Work with dynamically discovered calls.
7026 * exploded-graph.h (class dynamic_call_info_t): New class.
7027 (exploded_graph::create_dynamic_call): New decl.
7028 * program-point.cc (program_point::push_to_call_stack): New function.
7029 (program_point::pop_from_call_stack): New function.
7030 * program-point.h (program_point::push_to_call_stack): New decl.
7031 (program_point::pop_from_call_stack): New decl.
7032 * program-state.cc (program_state::push_call): New function.
7033 (program_state::returning_call): New function.
7034 * program-state.h (program_state::push_call): New decl.
7035 (program_state::returning_call): New decl.
7036 * region-model.cc (region_model::update_for_gcall) New function.
7037 (region_model::update_for_return_gcall): New function.
7038 (egion_model::update_for_call_superedge): Get the underlying gcall and
7039 update for gcall.
7040 (region_model::update_for_return_superedge): Likewise.
7041 * region-model.h (region_model::update_for_gcall): New decl.
7042 (region_model::update_for_return_gcall): New decl.
7043 * state-purge.cc (state_purge_per_ssa_name::process_point): Update to
7044 work with calls without underlying cgraph edge.
7045 * supergraph.cc (supergraph::supergraph) Split snodes at every callsite.
7046 * supergraph.h (supernode::get_returning_call) New accessor.
7048 2021-08-04 David Malcolm <dmalcolm@redhat.com>
7050 PR analyzer/101570
7051 * analyzer.cc (maybe_reconstruct_from_def_stmt): Add GIMPLE_ASM
7052 case.
7053 * analyzer.h (class asm_output_svalue): New forward decl.
7054 (class reachable_regions): New forward decl.
7055 * complexity.cc (complexity::from_vec_svalue): New.
7056 * complexity.h (complexity::from_vec_svalue): New decl.
7057 * engine.cc (feasibility_state::maybe_update_for_edge): Handle
7058 asm stmts by calling on_asm_stmt.
7059 * region-model-asm.cc: New file.
7060 * region-model-manager.cc
7061 (region_model_manager::maybe_fold_asm_output_svalue): New.
7062 (region_model_manager::get_or_create_asm_output_svalue): New.
7063 (region_model_manager::log_stats): Log m_asm_output_values_map.
7064 * region-model.cc (region_model::on_stmt_pre): Handle GIMPLE_ASM.
7065 * region-model.h (visitor::visit_asm_output_svalue): New.
7066 (region_model_manager::get_or_create_asm_output_svalue): New decl.
7067 (region_model_manager::maybe_fold_asm_output_svalue): New decl.
7068 (region_model_manager::asm_output_values_map_t): New typedef.
7069 (region_model_manager::m_asm_output_values_map): New field.
7070 (region_model::on_asm_stmt): New.
7071 * store.cc (binding_cluster::on_asm): New.
7072 * store.h (binding_cluster::on_asm): New decl.
7073 * svalue.cc (svalue::cmp_ptr): Handle SK_ASM_OUTPUT.
7074 (asm_output_svalue::dump_to_pp): New.
7075 (asm_output_svalue::dump_input): New.
7076 (asm_output_svalue::input_idx_to_asm_idx): New.
7077 (asm_output_svalue::accept): New.
7078 * svalue.h (enum svalue_kind): Add SK_ASM_OUTPUT.
7079 (svalue::dyn_cast_asm_output_svalue): New.
7080 (class asm_output_svalue): New.
7081 (is_a_helper <const asm_output_svalue *>::test): New.
7082 (struct default_hash_traits<asm_output_svalue::key_t>): New.
7084 2021-08-03 Jakub Jelinek <jakub@redhat.com>
7086 PR analyzer/101721
7087 * sm-malloc.cc (known_allocator_p): Only check DECL_FUNCTION_CODE on
7088 BUILT_IN_NORMAL builtins.
7090 2021-07-29 Ankur Saini <arsenic@sourceware.org>
7092 * call-string.cc (call_string::element_t::operator==): New operator.
7093 (call_String::element_t::operator!=): New operator.
7094 (call_string::element_t::get_caller_function): New function.
7095 (call_string::element_t::get_callee_function): New function.
7096 (call_string::call_string): Refactor to Initialise m_elements.
7097 (call_string::operator=): Refactor to work with m_elements.
7098 (call_string::operator==): Likewise.
7099 (call_string::to_json): Likewise.
7100 (call_string::hash): Refactor to hash e.m_caller.
7101 (call_string::push_call): Refactor to work with m_elements.
7102 (call_string::push_call): New overload to push call via supernodes.
7103 (call_string::pop): Refactor to work with m_elements.
7104 (call_string::calc_recursion_depth): Likewise.
7105 (call_string::cmp): Likewise.
7106 (call_string::validate): Likewise.
7107 (call_string::operator[]): Likewise.
7108 * call-string.h (class supernode): New forward decl.
7109 (struct call_string::element_t): New struct.
7110 (call_string::call_string): Refactor to initialise m_elements.
7111 (call_string::bool empty_p): Refactor to work with m_elements.
7112 (call_string::get_callee_node): New decl.
7113 (call_string::get_caller_node): New decl.
7114 (m_elements): Replaces m_return_edges.
7115 * program-point.cc (program_point::get_function_at_depth): Refactor to
7116 work with new call-string format.
7117 (program_point::validate): Likewise.
7118 (program_point::on_edge): Likewise.
7120 2021-07-28 David Malcolm <dmalcolm@redhat.com>
7122 * region-model.cc (region_model::on_call_pre): Treat
7123 IFN_UBSAN_BOUNDS, BUILT_IN_STACK_SAVE, and BUILT_IN_STACK_RESTORE
7124 as no-ops, rather than handling them as unknown functions.
7126 2021-07-28 David Malcolm <dmalcolm@redhat.com>
7128 * region-model-impl-calls.cc (region_model::impl_call_alloca):
7129 Drop redundant return value.
7130 (region_model::impl_call_builtin_expect): Likewise.
7131 (region_model::impl_call_calloc): Likewise.
7132 (region_model::impl_call_malloc): Likewise.
7133 (region_model::impl_call_memset): Likewise.
7134 (region_model::impl_call_operator_new): Likewise.
7135 (region_model::impl_call_operator_delete): Likewise.
7136 (region_model::impl_call_strlen): Likewise.
7137 * region-model.cc (region_model::on_call_pre): Fix return value of
7138 known functions that don't have unknown side-effects.
7139 * region-model.h (region_model::impl_call_alloca): Drop redundant
7140 return value.
7141 (region_model::impl_call_builtin_expect): Likewise.
7142 (region_model::impl_call_calloc): Likewise.
7143 (region_model::impl_call_malloc): Likewise.
7144 (region_model::impl_call_memset): Likewise.
7145 (region_model::impl_call_strlen): Likewise.
7146 (region_model::impl_call_operator_new): Likewise.
7147 (region_model::impl_call_operator_delete): Likewise.
7149 2021-07-28 Siddhesh Poyarekar <siddhesh@gotplt.org>
7151 * analyzer.cc (is_named_call_p, is_std_named_call_p): Make
7152 first argument a const_tree.
7153 * analyzer.h (is_named_call_p, -s_std_named_call_p): Likewise.
7154 * sm-malloc.cc (known_allocator_p): New function.
7155 (malloc_state_machine::on_stmt): Use it.
7157 2021-07-28 Siddhesh Poyarekar <siddhesh@gotplt.org>
7159 * sm-malloc.cc
7160 (malloc_state_machine::get_or_create_deallocator): Recognize
7161 __builtin_free.
7163 2021-07-26 David Malcolm <dmalcolm@redhat.com>
7165 * region-model.cc (region_model::on_call_pre): Always set conjured
7166 LHS, not just for SSA names.
7168 2021-07-23 David Malcolm <dmalcolm@redhat.com>
7170 * diagnostic-manager.cc
7171 (class auto_disable_complexity_checks): New.
7172 (epath_finder::explore_feasible_paths): Use it to disable
7173 complexity checks whilst processing the worklist.
7174 * region-model-manager.cc
7175 (region_model_manager::region_model_manager): Initialize
7176 m_check_complexity.
7177 (region_model_manager::reject_if_too_complex): Bail if
7178 m_check_complexity is false.
7179 * region-model.h
7180 (region_model_manager::enable_complexity_check): New.
7181 (region_model_manager::disable_complexity_check): New.
7182 (region_model_manager::m_check_complexity): New.
7184 2021-07-21 David Malcolm <dmalcolm@redhat.com>
7186 PR analyzer/101547
7187 * sm-file.cc (file_leak::emit): Handle m_arg being NULL.
7188 (file_leak::describe_final_event): Handle ev.m_expr being NULL.
7190 2021-07-21 David Malcolm <dmalcolm@redhat.com>
7192 PR analyzer/101522
7193 * store.cc (binding_cluster::purge_state_involving): Don't change
7194 m_map whilst iterating through it.
7196 2021-07-21 David Malcolm <dmalcolm@redhat.com>
7198 * region-model.cc (region_model::handle_phi): Add "old_state"
7199 param and use it.
7200 (region_model::update_for_phis): Update so that all of the phi
7201 stmts are effectively handled simultaneously, rather than in
7202 order.
7203 * region-model.h (region_model::handle_phi): Add "old_state"
7204 param.
7205 * state-purge.cc (self_referential_phi_p): Replace with...
7206 (name_used_by_phis_p): ...this new function.
7207 (state_purge_per_ssa_name::process_point): Update to use the
7208 above, so that all phi stmts at a basic block are effectively
7209 considered simultaneously, and only consider the phi arguments for
7210 the pertinent in-edge.
7211 * supergraph.cc (cfg_superedge::get_phi_arg_idx): New.
7212 (cfg_superedge::get_phi_arg): Use the above.
7213 * supergraph.h (cfg_superedge::get_phi_arg_idx): New decl.
7215 2021-07-21 David Malcolm <dmalcolm@redhat.com>
7217 * state-purge.cc (state_purge_annotator::add_node_annotations):
7218 Rather than erroneously always using the NULL in-edge, determine
7219 each relevant in-edge, and print the appropriate data for each
7220 in-edge. Use print_needed to print the data as comma-separated
7221 lists of SSA names.
7222 (print_vec_of_names): Add "within_table" param and use it.
7223 (state_purge_annotator::add_stmt_annotations): Factor out
7224 collation and printing code into...
7225 (state_purge_annotator::print_needed): ...this new function.
7226 * state-purge.h (state_purge_annotator::print_needed): New decl.
7228 2021-07-21 David Malcolm <dmalcolm@redhat.com>
7230 * program-point.cc (function_point::print): Show src BB index at
7231 BEFORE_SUPERNODE.
7233 2021-07-21 David Malcolm <dmalcolm@redhat.com>
7235 * svalue.cc (infix_p): New.
7236 (binop_svalue::dump_to_pp): Use it to print MIN_EXPR and MAX_EXPR
7237 in prefix form, rather than infix.
7239 2021-07-19 David Malcolm <dmalcolm@redhat.com>
7241 PR analyzer/101503
7242 * constraint-manager.cc (constraint_manager::add_constraint): Use
7243 can_have_associated_state_p rather than testing for unknown.
7244 (constraint_manager::get_or_add_equiv_class): Likewise.
7245 * program-state.cc (sm_state_map::set_state): Likewise.
7246 (sm_state_map::impl_set_state): Add assertion.
7247 * region-model-manager.cc
7248 (region_model_manager::maybe_fold_unaryop): Handle poisoned
7249 values.
7250 (region_model_manager::maybe_fold_binop): Move handling of unknown
7251 values...
7252 (region_model_manager::get_or_create_binop): ...to here, and
7253 generalize to use can_have_associated_state_p.
7254 (region_model_manager::maybe_fold_sub_svalue): Use
7255 can_have_associated_state_p rather than testing for unknown.
7256 (region_model_manager::maybe_fold_repeated_svalue): Use unknown
7257 when the size or repeated value is "unknown"/"poisoned".
7258 * region-model.cc (region_model::purge_state_involving): Reject
7259 attempts to purge unknown/poisoned svalues, as these svalues
7260 should not have state associated with them.
7261 * svalue.cc (sub_svalue::sub_svalue): Assert that we're building
7262 on top of an svalue with can_have_associated_state_p.
7263 (repeated_svalue::repeated_svalue): Likewise.
7264 (bits_within_svalue::bits_within_svalue): Likewise.
7265 * svalue.h (svalue::can_have_associated_state_p): New.
7266 (unknown_svalue::can_have_associated_state_p): New.
7267 (poisoned_svalue::can_have_associated_state_p): New.
7268 (unaryop_svalue::unaryop_svalue): Assert that we're building on
7269 top of an svalue with can_have_associated_state_p.
7270 (binop_svalue::binop_svalue): Likewise.
7271 (widening_svalue::widening_svalue): Likewise.
7273 2021-07-16 David Malcolm <dmalcolm@redhat.com>
7275 * analyzer.h (enum access_direction): New.
7276 * engine.cc (exploded_node::on_longjmp): Update for new param of
7277 get_store_value.
7278 * program-state.cc (program_state::prune_for_point): Likewise.
7279 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
7280 Replace call to check_for_writable_region with call to
7281 check_region_for_write.
7282 (region_model::impl_call_memset): Likewise.
7283 (region_model::impl_call_strcpy): Likewise.
7284 * region-model-reachability.cc (reachable_regions::add): Update
7285 for new param of get_store_value.
7286 * region-model.cc (region_model::get_rvalue_1): Likewise, also for
7287 get_rvalue_for_bits.
7288 (region_model::get_store_value): Add ctxt param and use it to call
7289 check_region_for_read.
7290 (region_model::get_rvalue_for_bits): Add ctxt param and use it to
7291 call get_store_value.
7292 (region_model::check_region_access): New.
7293 (region_model::check_region_for_write): New.
7294 (region_model::check_region_for_read): New.
7295 (region_model::set_value): Update comment. Replace call to
7296 check_for_writable_region with call to check_region_for_write.
7297 * region-model.h (region_model::get_rvalue_for_bits): Add ctxt
7298 param.
7299 (region_model::get_store_value): Add ctxt param.
7300 (region_model::check_region_access): New decl.
7301 (region_model::check_region_for_write): New decl.
7302 (region_model::check_region_for_read): New decl.
7303 * region.cc (region_model::copy_region): Update call to
7304 get_store_value.
7305 * svalue.cc (initial_svalue::implicitly_live_p): Likewise.
7307 2021-07-16 David Malcolm <dmalcolm@redhat.com>
7309 * engine.cc (exploded_node::on_stmt_pre): Handle
7310 __analyzer_dump_state.
7311 * program-state.cc (extrinsic_state::get_sm_idx_by_name): New.
7312 (program_state::impl_call_analyzer_dump_state): New.
7313 * program-state.h (extrinsic_state::get_sm_idx_by_name): New decl.
7314 (program_state::impl_call_analyzer_dump_state): New decl.
7315 * region-model-impl-calls.cc
7316 (call_details::get_arg_string_literal): New.
7317 * region-model.h (call_details::get_arg_string_literal): New decl.
7319 2021-07-16 David Malcolm <dmalcolm@redhat.com>
7321 * program-state.cc (program_state::detect_leaks): Simplify using
7322 svalue::maybe_get_region.
7323 * region-model-impl-calls.cc (region_model::impl_call_fgets): Likewise.
7324 (region_model::impl_call_fread): Likewise.
7325 (region_model::impl_call_free): Likewise.
7326 (region_model::impl_call_operator_delete): Likewise.
7327 * region-model.cc (selftest::test_stack_frames): Likewise.
7328 (selftest::test_state_merging): Likewise.
7329 * svalue.cc (svalue::maybe_get_region): New.
7330 * svalue.h (svalue::maybe_get_region): New decl.
7332 2021-07-15 David Malcolm <dmalcolm@redhat.com>
7334 * svalue.h (is_a_helper <placeholder_svalue *>::test): Make
7335 param and template param const.
7336 (is_a_helper <widening_svalue *>::test): Likewise.
7337 (is_a_helper <compound_svalue *>::test): Likewise.
7338 (is_a_helper <conjured_svalue *>::test): Likewise.
7340 2021-07-15 David Malcolm <dmalcolm@redhat.com>
7342 PR analyzer/95006
7343 PR analyzer/94713
7344 PR analyzer/94714
7345 * analyzer.cc (maybe_reconstruct_from_def_stmt): Split out
7346 GIMPLE_ASSIGN case into...
7347 (get_diagnostic_tree_for_gassign_1): New.
7348 (get_diagnostic_tree_for_gassign): New.
7349 * analyzer.h (get_diagnostic_tree_for_gassign): New decl.
7350 * analyzer.opt (Wanalyzer-write-to-string-literal): New.
7351 * constraint-manager.cc (class svalue_purger): New.
7352 (constraint_manager::purge_state_involving): New.
7353 * constraint-manager.h
7354 (constraint_manager::purge_state_involving): New.
7355 * diagnostic-manager.cc (saved_diagnostic::supercedes_p): New.
7356 (dedupe_winners::handle_interactions): New.
7357 (diagnostic_manager::emit_saved_diagnostics): Call it.
7358 * diagnostic-manager.h (saved_diagnostic::supercedes_p): New decl.
7359 * engine.cc (impl_region_model_context::warn): Convert return type
7360 to bool. Return false if the diagnostic isn't saved.
7361 (impl_region_model_context::purge_state_involving): New.
7362 (impl_sm_context::get_state): Use NULL ctxt when querying old
7363 rvalue.
7364 (impl_sm_context::set_next_state): Use new sval when querying old
7365 state.
7366 (class dump_path_diagnostic): Move to region-model.cc
7367 (exploded_node::on_stmt): Move to on_stmt_pre and on_stmt_post.
7368 Remove call to purge_state_involving.
7369 (exploded_node::on_stmt_pre): New, based on the above. Move most
7370 of it to region_model::on_stmt_pre.
7371 (exploded_node::on_stmt_post): Likewise, moving to
7372 region_model::on_stmt_post.
7373 (class stale_jmp_buf): Fix parent class to use curiously recurring
7374 template pattern.
7375 (feasibility_state::maybe_update_for_edge): Call on_call_pre and
7376 on_call_post on gcalls.
7377 * exploded-graph.h (impl_region_model_context::warn): Return bool.
7378 (impl_region_model_context::purge_state_involving): New decl.
7379 (exploded_node::on_stmt_pre): New decl.
7380 (exploded_node::on_stmt_post): New decl.
7381 * pending-diagnostic.h (pending_diagnostic::use_of_uninit_p): New.
7382 (pending_diagnostic::supercedes_p): New.
7383 * program-state.cc (sm_state_map::get_state): Inherit state for
7384 conjured_svalue as well as initial_svalue.
7385 (sm_state_map::purge_state_involving): Also support SK_CONJURED.
7386 * region-model-impl-calls.cc (call_details::get_uncertainty):
7387 Handle m_ctxt being NULL.
7388 (call_details::get_or_create_conjured_svalue): New.
7389 (region_model::impl_call_fgets): New.
7390 (region_model::impl_call_fread): New.
7391 * region-model-manager.cc
7392 (region_model_manager::get_or_create_initial_value): Return an
7393 uninitialized poisoned value for regions that can't have initial
7394 values.
7395 * region-model-reachability.cc
7396 (reachable_regions::mark_escaped_clusters): Handle ctxt being
7397 NULL.
7398 * region-model.cc (region_to_value_map::purge_state_involving): New.
7399 (poisoned_value_diagnostic::use_of_uninit_p): New.
7400 (poisoned_value_diagnostic::emit): Handle POISON_KIND_UNINIT.
7401 (poisoned_value_diagnostic::describe_final_event): Likewise.
7402 (region_model::check_for_poison): New.
7403 (region_model::on_assignment): Call it.
7404 (class dump_path_diagnostic): Move here from engine.cc.
7405 (region_model::on_stmt_pre): New, based on exploded_node::on_stmt.
7406 (region_model::on_call_pre): Move the setting of the LHS to a
7407 conjured svalue to before the checks for specific functions.
7408 Handle "fgets", "fgets_unlocked", and "fread".
7409 (region_model::purge_state_involving): New.
7410 (region_model::handle_unrecognized_call): Handle ctxt being NULL.
7411 (region_model::get_rvalue): Call check_for_poison.
7412 (selftest::test_stack_frames): Use NULL for context when getting
7413 uninitialized rvalue.
7414 (selftest::test_alloca): Likewise.
7415 * region-model.h (region_to_value_map::purge_state_involving): New
7416 decl.
7417 (call_details::get_or_create_conjured_svalue): New decl.
7418 (region_model::on_stmt_pre): New decl.
7419 (region_model::purge_state_involving): New decl.
7420 (region_model::impl_call_fgets): New decl.
7421 (region_model::impl_call_fread): New decl.
7422 (region_model::check_for_poison): New decl.
7423 (region_model_context::warn): Return bool.
7424 (region_model_context::purge_state_involving): New.
7425 (noop_region_model_context::warn): Return bool.
7426 (noop_region_model_context::purge_state_involving): New.
7427 (test_region_model_context:: warn): Return bool.
7428 * region.cc (region::get_memory_space): New.
7429 (region::can_have_initial_svalue_p): New.
7430 (region::involves_p): New.
7431 * region.h (enum memory_space): New.
7432 (region::get_memory_space): New decl.
7433 (region::can_have_initial_svalue_p): New decl.
7434 (region::involves_p): New decl.
7435 * sm-malloc.cc (use_after_free::supercedes_p): New.
7436 * store.cc (binding_cluster::purge_state_involving): New.
7437 (store::purge_state_involving): New.
7438 * store.h (class symbolic_binding): New forward decl.
7439 (binding_key::dyn_cast_symbolic_binding): New.
7440 (symbolic_binding::dyn_cast_symbolic_binding): New.
7441 (binding_cluster::purge_state_involving): New.
7442 (store::purge_state_involving): New.
7443 * svalue.cc (svalue::can_merge_p): Reject attempts to merge
7444 poisoned svalues with other svalues, so that we identify
7445 paths in which a variable is conditionally uninitialized.
7446 (involvement_visitor::visit_conjured_svalue): New.
7447 (svalue::involves_p): Also handle SK_CONJURED.
7448 (poison_kind_to_str): Handle POISON_KIND_UNINIT.
7449 (poisoned_svalue::maybe_fold_bits_within): New.
7450 * svalue.h (enum poison_kind): Add POISON_KIND_UNINIT.
7451 (poisoned_svalue::maybe_fold_bits_within): New decl.
7453 2021-07-15 David Malcolm <dmalcolm@redhat.com>
7455 * analyzer.opt (fdump-analyzer-exploded-paths): New.
7456 * diagnostic-manager.cc
7457 (diagnostic_manager::emit_saved_diagnostic): Implement it.
7458 * engine.cc (exploded_path::dump_to_pp): Add ext_state param and
7459 use it to dump states if non-NULL.
7460 (exploded_path::dump): Likewise.
7461 (exploded_path::dump_to_file): New.
7462 * exploded-graph.h (exploded_path::dump_to_pp): Add ext_state
7463 param.
7464 (exploded_path::dump): Likewise.
7465 (exploded_path::dump): Likewise.
7466 (exploded_path::dump_to_file): New.
7468 2021-07-15 David Malcolm <dmalcolm@redhat.com>
7470 * analyzer.cc (fixup_tree_for_diagnostic_1): Use DECL_DEBUG_EXPR
7471 if it's available.
7472 * engine.cc (readability): Likewise.
7474 2021-07-15 David Malcolm <dmalcolm@redhat.com>
7476 * state-purge.cc (self_referential_phi_p): New.
7477 (state_purge_per_ssa_name::process_point): Don't purge an SSA name
7478 at its def-stmt if the def-stmt is self-referential.
7480 2021-07-07 David Malcolm <dmalcolm@redhat.com>
7482 * diagnostic-manager.cc (null_assignment_sm_context::get_state):
7483 New overload.
7484 (null_assignment_sm_context::set_next_state): New overload.
7485 (null_assignment_sm_context::get_diagnostic_tree): New.
7486 * engine.cc (impl_sm_context::get_state): New overload.
7487 (impl_sm_context::set_next_state): New overload.
7488 (impl_sm_context::get_diagnostic_tree): New overload.
7489 (impl_region_model_context::on_condition): Convert params from
7490 tree to const svalue *.
7491 * exploded-graph.h (impl_region_model_context::on_condition):
7492 Likewise.
7493 * region-model.cc (region_model::on_call_pre): Move handling of
7494 internal calls to before checking for get_fndecl_for_call.
7495 (region_model::add_constraints_from_binop): New.
7496 (region_model::add_constraint): Split out into a new overload
7497 working on const svalue * rather than tree. Call
7498 add_constraints_from_binop. Drop call to
7499 add_any_constraints_from_ssa_def_stmt.
7500 (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
7501 (region_model::add_any_constraints_from_gassign): Delete.
7502 (region_model::add_any_constraints_from_gcall): Delete.
7503 * region-model.h
7504 (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
7505 (region_model::add_any_constraints_from_gassign): Delete.
7506 (region_model::add_any_constraints_from_gcall): Delete.
7507 (region_model::add_constraint): Add overload decl.
7508 (region_model::add_constraints_from_binop): New decl.
7509 (region_model_context::on_condition): Convert params from tree to
7510 const svalue *.
7511 (noop_region_model_context::on_condition): Likewise.
7512 * sm-file.cc (fileptr_state_machine::condition): Likewise.
7513 * sm-malloc.cc (malloc_state_machine::on_condition): Likewise.
7514 * sm-pattern-test.cc: Include tristate.h, selftest.h,
7515 analyzer/call-string.h, analyzer/program-point.h,
7516 analyzer/store.h, and analyzer/region-model.h.
7517 (pattern_test_state_machine::on_condition): Convert params from tree to
7518 const svalue *.
7519 * sm-sensitive.cc (sensitive_state_machine::on_condition): Delete.
7520 * sm-signal.cc (signal_state_machine::on_condition): Delete.
7521 * sm-taint.cc (taint_state_machine::on_condition): Convert params
7522 from tree to const svalue *.
7523 * sm.cc: Include tristate.h, selftest.h, analyzer/call-string.h,
7524 analyzer/program-point.h, analyzer/store.h, and
7525 analyzer/region-model.h.
7526 (any_pointer_p): Add overload taking const svalue *sval.
7527 * sm.h (any_pointer_p): Add overload taking const svalue *sval.
7528 (state_machine::on_condition): Convert params from tree to
7529 const svalue *. Provide no-op default implementation.
7530 (sm_context::get_state): Add overload taking const svalue *sval.
7531 (sm_context::set_next_state): Likewise.
7532 (sm_context::on_transition): Likewise.
7533 (sm_context::get_diagnostic_tree): Likewise.
7534 * svalue.cc (svalue::all_zeroes_p): New.
7535 (constant_svalue::all_zeroes_p): New.
7536 (repeated_svalue::all_zeroes_p): Convert to vfunc.
7537 * svalue.h (svalue::all_zeroes_p): New decl.
7538 (constant_svalue::all_zeroes_p): New decl.
7539 (repeated_svalue::all_zeroes_p): Convert decl to vfunc.
7541 2021-06-30 David Malcolm <dmalcolm@redhat.com>
7543 PR analyzer/95006
7544 * analyzer.h (class repeated_svalue): New forward decl.
7545 (class bits_within_svalue): New forward decl.
7546 (class sized_region): New forward decl.
7547 (get_field_at_bit_offset): New forward decl.
7548 * engine.cc (exploded_graph::get_or_create_node): Validate the
7549 merged state.
7550 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
7551 Validate the states at each stage.
7552 * program-state.cc (program_state::validate): Validate
7553 m_region_model.
7554 * region-model-impl-calls.cc (region_model::impl_call_memset):
7555 Replace special-case logic for handling constant sizes with
7556 a call to fill_region of a sized_region with the given fill value.
7557 * region-model-manager.cc (maybe_undo_optimize_bit_field_compare):
7558 Drop DK_direct.
7559 (region_model_manager::maybe_fold_sub_svalue): Fold element-based
7560 subregions of an initial value into initial values of an element.
7561 Fold subvalues of repeated svalues.
7562 (region_model_manager::maybe_fold_repeated_svalue): New.
7563 (region_model_manager::get_or_create_repeated_svalue): New.
7564 (get_bit_range_for_field): New.
7565 (get_byte_range_for_field): New.
7566 (get_field_at_byte_range): New.
7567 (region_model_manager::maybe_fold_bits_within_svalue): New.
7568 (region_model_manager::get_or_create_bits_within): New.
7569 (region_model_manager::get_sized_region): New.
7570 (region_model_manager::log_stats): Update for addition of
7571 m_repeated_values_map, m_bits_within_values_map, and
7572 m_sized_regions.
7573 * region-model.cc (region_model::validate): New.
7574 (region_model::on_assignment): Drop enum binding_kind.
7575 (region_model::get_initial_value_for_global): Likewise.
7576 (region_model::get_rvalue_for_bits): Replace body with call to
7577 get_or_create_bits_within.
7578 (region_model::get_capacity): Handle RK_SIZED.
7579 (region_model::set_value): Drop enum binding_kind.
7580 (region_model::fill_region): New.
7581 (region_model::get_representative_path_var_1): Handle RK_SIZED.
7582 * region-model.h (visitor::visit_repeated_svalue): New.
7583 (visitor::visit_bits_within_svalue): New.
7584 (region_model_manager::get_or_create_repeated_svalue): New decl.
7585 (region_model_manager::get_or_create_bits_within): New decl.
7586 (region_model_manager::get_sized_region): New decl.
7587 (region_model_manager::maybe_fold_repeated_svalue): New decl.
7588 (region_model_manager::maybe_fold_bits_within_svalue): New decl.
7589 (region_model_manager::repeated_values_map_t): New typedef.
7590 (region_model_manager::m_repeated_values_map): New field.
7591 (region_model_manager::bits_within_values_map_t): New typedef.
7592 (region_model_manager::m_bits_within_values_map): New field.
7593 (region_model_manager::m_sized_regions): New field.
7594 (region_model::fill_region): New decl.
7595 * region.cc (region::get_base_region): Handle RK_SIZED.
7596 (region::base_region_p): Likewise.
7597 (region::get_byte_size_sval): New.
7598 (get_field_at_bit_offset): Make non-static.
7599 (region::calc_offset): Move implementation of cases to
7600 get_relative_concrete_offset vfunc implementations. Handle
7601 RK_SIZED.
7602 (region::get_relative_concrete_offset): New.
7603 (decl_region::get_svalue_for_initializer): Drop enum binding_kind.
7604 (field_region::get_relative_concrete_offset): New, from
7605 region::calc_offset.
7606 (element_region::get_relative_concrete_offset): Likewise.
7607 (offset_region::get_relative_concrete_offset): Likewise.
7608 (sized_region::accept): New.
7609 (sized_region::dump_to_pp): New.
7610 (sized_region::get_byte_size): New.
7611 (sized_region::get_bit_size): New.
7612 * region.h (enum region_kind): Add RK_SIZED.
7613 (region::dyn_cast_sized_region): New.
7614 (region::get_byte_size): Make virtual.
7615 (region::get_bit_size): Likewise.
7616 (region::get_byte_size_sval): New decl.
7617 (region::get_relative_concrete_offset): New decl.
7618 (field_region::get_relative_concrete_offset): New decl.
7619 (element_region::get_relative_concrete_offset): Likewise.
7620 (offset_region::get_relative_concrete_offset): Likewise.
7621 (class sized_region): New.
7622 * store.cc (binding_kind_to_string): Delete.
7623 (binding_key::make): Drop enum binding_kind.
7624 (binding_key::dump_to_pp): Delete.
7625 (binding_key::cmp_ptrs): Drop enum binding_kind.
7626 (bit_range::contains_p): New.
7627 (byte_range::dump): New.
7628 (byte_range::contains_p): New.
7629 (byte_range::cmp): New.
7630 (concrete_binding::dump_to_pp): Drop enum binding_kind.
7631 (concrete_binding::cmp_ptr_ptr): Likewise.
7632 (symbolic_binding::dump_to_pp): Likewise.
7633 (symbolic_binding::cmp_ptr_ptr): Likewise.
7634 (binding_map::apply_ctor_val_to_range): Likewise.
7635 (binding_map::apply_ctor_pair_to_child_region): Likewise.
7636 (binding_map::get_overlapping_bindings): New.
7637 (binding_map::remove_overlapping_bindings): New.
7638 (binding_cluster::validate): New.
7639 (binding_cluster::bind): Drop enum binding_kind.
7640 (binding_cluster::bind_compound_sval): Likewise.
7641 (binding_cluster::purge_region): Likewise.
7642 (binding_cluster::zero_fill_region): Reimplement in terms of...
7643 (binding_cluster::fill_region): New.
7644 (binding_cluster::mark_region_as_unknown): Drop enum binding_kind.
7645 (binding_cluster::get_binding): Likewise.
7646 (binding_cluster::get_binding_recursive): Likewise.
7647 (binding_cluster::get_any_binding): Likewise.
7648 (binding_cluster::maybe_get_compound_binding): Reimplement.
7649 (binding_cluster::get_overlapping_bindings): Delete.
7650 (binding_cluster::remove_overlapping_bindings): Reimplement in
7651 terms of binding_map::remove_overlapping_bindings.
7652 (binding_cluster::can_merge_p): Update for removal of
7653 enum binding_kind.
7654 (binding_cluster::on_unknown_fncall): Drop enum binding_kind.
7655 (binding_cluster::maybe_get_simple_value): Likewise.
7656 (store_manager::get_concrete_binding): Likewise.
7657 (store_manager::get_symbolic_binding): Likewise.
7658 (store::validate): New.
7659 (store::set_value): Drop enum binding_kind.
7660 (store::zero_fill_region): Reimplement in terms of...
7661 (store::fill_region): New.
7662 (selftest::test_binding_key_overlap): Drop enum binding_kind.
7663 * store.h (enum binding_kind): Delete.
7664 (binding_kind_to_string): Delete decl.
7665 (binding_key::make): Drop enum binding_kind.
7666 (binding_key::dump_to_pp): Make pure virtual.
7667 (binding_key::get_kind): Delete.
7668 (binding_key::mark_deleted): Delete.
7669 (binding_key::mark_empty): Delete.
7670 (binding_key::is_deleted): Delete.
7671 (binding_key::is_empty): Delete.
7672 (binding_key::binding_key): Delete.
7673 (binding_key::impl_hash): Delete.
7674 (binding_key::impl_eq): Delete.
7675 (binding_key::m_kind): Delete.
7676 (bit_range::get_last_bit_offset): New.
7677 (bit_range::contains_p): New.
7678 (byte_range::contains_p): New.
7679 (byte_range::operator==): New.
7680 (byte_range::get_start_byte_offset): New.
7681 (byte_range::get_next_byte_offset): New.
7682 (byte_range::get_last_byte_offset): New.
7683 (byte_range::as_bit_range): New.
7684 (byte_range::cmp): New.
7685 (concrete_binding::concrete_binding): Drop enum binding_kind.
7686 (concrete_binding::hash): Likewise.
7687 (concrete_binding::operator==): Likewise.
7688 (concrete_binding::mark_deleted): New.
7689 (concrete_binding::mark_empty): New.
7690 (concrete_binding::is_deleted): New.
7691 (concrete_binding::is_empty): New.
7692 (default_hash_traits<ana::concrete_binding>::empty_zero_p): Make false.
7693 (symbolic_binding::symbolic_binding): Drop enum binding_kind.
7694 (symbolic_binding::hash): Likewise.
7695 (symbolic_binding::operator==): Likewise.
7696 (symbolic_binding::mark_deleted): New.
7697 (symbolic_binding::mark_empty): New.
7698 (symbolic_binding::is_deleted): New.
7699 (symbolic_binding::is_empty): New.
7700 (binding_map::remove_overlapping_bindings): New decl.
7701 (binding_map::get_overlapping_bindings): New decl.
7702 (binding_cluster::validate): New decl.
7703 (binding_cluster::bind): Drop enum binding_kind.
7704 (binding_cluster::fill_region): New decl.
7705 (binding_cluster::get_binding): Drop enum binding_kind.
7706 (binding_cluster::get_binding_recursive): Likewise.
7707 (binding_cluster::get_overlapping_bindings): Delete.
7708 (store::validate): New decl.
7709 (store::set_value): Drop enum binding_kind.
7710 (store::fill_region): New decl.
7711 (store_manager::get_concrete_binding): Drop enum binding_kind.
7712 (store_manager::get_symbolic_binding): Likewise.
7713 * svalue.cc (svalue::cmp_ptr): Handle SK_REPEATED and
7714 SK_BITS_WITHIN.
7715 (svalue::extract_bit_range): New.
7716 (svalue::maybe_fold_bits_within): New.
7717 (constant_svalue::maybe_fold_bits_within): New.
7718 (unknown_svalue::maybe_fold_bits_within): New.
7719 (unaryop_svalue::maybe_fold_bits_within): New.
7720 (repeated_svalue::repeated_svalue): New.
7721 (repeated_svalue::dump_to_pp): New.
7722 (repeated_svalue::accept): New.
7723 (repeated_svalue::all_zeroes_p): New.
7724 (repeated_svalue::maybe_fold_bits_within): New.
7725 (bits_within_svalue::bits_within_svalue): New.
7726 (bits_within_svalue::dump_to_pp): New.
7727 (bits_within_svalue::maybe_fold_bits_within): New.
7728 (bits_within_svalue::accept): New.
7729 (bits_within_svalue::implicitly_live_p): New.
7730 (compound_svalue::maybe_fold_bits_within): New.
7731 * svalue.h (enum svalue_kind): Add SK_REPEATED and SK_BITS_WITHIN.
7732 (svalue::dyn_cast_repeated_svalue): New.
7733 (svalue::dyn_cast_bits_within_svalue): New.
7734 (svalue::extract_bit_range): New decl.
7735 (svalue::maybe_fold_bits_within): New vfunc decl.
7736 (region_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
7737 (region_svalue::key_t::is_empty): Likewise.
7738 (default_hash_traits<region_svalue::key_t>::empty_zero_p): Make false.
7739 (constant_svalue::maybe_fold_bits_within): New.
7740 (unknown_svalue::maybe_fold_bits_within): New.
7741 (poisoned_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
7742 (poisoned_svalue::key_t::is_empty): Likewise.
7743 (default_hash_traits<poisoned_svalue::key_t>::empty_zero_p): Make
7744 false.
7745 (setjmp_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
7746 (setjmp_svalue::key_t::is_empty): Likewise.
7747 (default_hash_traits<setjmp_svalue::key_t>::empty_zero_p): Make
7748 false.
7749 (unaryop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
7750 (unaryop_svalue::key_t::is_empty): Likewise.
7751 (unaryop_svalue::maybe_fold_bits_within): New.
7752 (default_hash_traits<unaryop_svalue::key_t>::empty_zero_p): Make
7753 false.
7754 (binop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
7755 (binop_svalue::key_t::is_empty): Likewise.
7756 (default_hash_traits<binop_svalue::key_t>::empty_zero_p): Make
7757 false.
7758 (sub_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
7759 (sub_svalue::key_t::is_empty): Likewise.
7760 (default_hash_traits<sub_svalue::key_t>::empty_zero_p): Make
7761 false.
7762 (class repeated_svalue): New.
7763 (is_a_helper <const repeated_svalue *>::test): New.
7764 (struct default_hash_traits<repeated_svalue::key_t>): New.
7765 (class bits_within_svalue): New.
7766 (is_a_helper <const bits_within_svalue *>::test): New.
7767 (struct default_hash_traits<bits_within_svalue::key_t>): New.
7768 (widening_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
7769 (widening_svalue::key_t::is_empty): Likewise.
7770 (default_hash_traits<widening_svalue::key_t>::empty_zero_p): Make
7771 false.
7772 (compound_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
7773 (compound_svalue::key_t::is_empty): Likewise.
7774 (compound_svalue::maybe_fold_bits_within): New.
7775 (default_hash_traits<compound_svalue::key_t>::empty_zero_p): Make
7776 false.
7778 2021-06-28 David Malcolm <dmalcolm@redhat.com>
7780 * analyzer.h (byte_offset_t): New typedef.
7781 * store.cc (bit_range::dump_to_pp): Dump as a byte range if
7782 possible.
7783 (bit_range::as_byte_range): New.
7784 (byte_range::dump_to_pp): New.
7785 * store.h (class byte_range): New forward decl.
7786 (struct bit_range): Add comment.
7787 (bit_range::as_byte_range): New decl.
7788 (struct byte_range): New.
7790 2021-06-22 David Malcolm <dmalcolm@redhat.com>
7792 PR analyzer/101143
7793 * region-model.cc (compat_types_p): New function.
7794 (region_model::create_region_for_heap_alloc): Convert assertion to
7795 an error check.
7796 (region_model::create_region_for_alloca): Likewise.
7798 2021-06-18 David Malcolm <dmalcolm@redhat.com>
7800 * store.cc (binding_cluster::get_any_binding): Make symbolic reads
7801 from a cluster with concrete bindings return unknown.
7803 2021-06-18 David Malcolm <dmalcolm@redhat.com>
7805 * region-model-manager.cc
7806 (region_model_manager::get_or_create_int_cst): New.
7807 (region_model_manager::maybe_undo_optimize_bit_field_compare): Use
7808 it to simplify away a local tree.
7809 * region-model.cc (region_model::on_setjmp): Likewise.
7810 (region_model::on_longjmp): Likewise.
7811 * region-model.h (region_model_manager::get_or_create_int_cst):
7812 New decl.
7813 * store.cc (binding_cluster::zero_fill_region): Use it to simplify
7814 away a local tree.
7816 2021-06-18 David Malcolm <dmalcolm@redhat.com>
7818 * checker-path.cc (class custom_event): Make abstract to allow for
7819 custom vfuncs, splitting existing implementation into...
7820 (class precanned_custom_event): New subclass.
7821 (custom_event::get_desc): Move to...
7822 (precanned_custom_event::get_desc): ...subclass.
7823 * checker-path.h (class custom_event): Make abstract to allow for
7824 custom vfuncs, splitting existing implementation into...
7825 (class precanned_custom_event): New subclass.
7826 * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
7827 Use precanned_custom_event.
7828 * engine.cc
7829 (stale_jmp_buf::maybe_add_custom_events_for_superedge): Likewise.
7830 * sm-signal.cc (signal_delivery_edge_info_t::add_events_to_path):
7831 Likewise.
7833 2021-06-15 David Malcolm <dmalcolm@redhat.com>
7835 PR analyzer/99212
7836 PR analyzer/101082
7837 * engine.cc: Include "target.h".
7838 (impl_run_checkers): Log BITS_BIG_ENDIAN, BYTES_BIG_ENDIAN, and
7839 WORDS_BIG_ENDIAN.
7840 * region-model-manager.cc
7841 (region_model_manager::maybe_fold_binop): Move support for masking
7842 via ARG0 & CST into...
7843 (region_model_manager::maybe_undo_optimize_bit_field_compare):
7844 ...this new function. Flatten by converting from nested
7845 conditionals to a series of early return statements to reject
7846 failures. Reject if type is not unsigned_char_type_node.
7847 Handle BYTES_BIG_ENDIAN when determining which bits are bound
7848 in the binding_map.
7849 * region-model.h
7850 (region_model_manager::maybe_undo_optimize_bit_field_compare):
7851 New decl.
7852 * store.cc (bit_range::dump): New function.
7853 * store.h (bit_range::dump): New decl.
7855 2021-06-15 David Malcolm <dmalcolm@redhat.com>
7857 * engine.cc (exploded_node::on_stmt): Handle __analyzer_dump_capacity.
7858 (exploded_node::on_stmt): Drop m_sm_changes from on_stmt_flags.
7859 (state_change_requires_new_enode_p): New function...
7860 (exploded_graph::process_node): Call it, rather than querying
7861 flags.m_sm_changes, so that dynamic-extent differences can also
7862 trigger the splitting of nodes.
7863 * exploded-graph.h (struct on_stmt_flags): Drop field m_sm_changes.
7864 * program-state.cc (program_state::detect_leaks): Purge dead
7865 heap-allocated regions from dynamic extents.
7866 (selftest::test_program_state_1): Fix type of "size_in_bytes".
7867 (selftest::test_program_state_merging): Likewise.
7868 * region-model-impl-calls.cc
7869 (region_model::impl_call_analyzer_dump_capacity): New.
7870 (region_model::impl_call_free): Remove dynamic extents from the
7871 freed region.
7872 * region-model-reachability.h
7873 (reachable_regions::begin_mutable_base_regs): New.
7874 (reachable_regions::end_mutable_base_regs): New.
7875 * region-model.cc: Include "tree-object-size.h".
7876 (region_model::region_model): Support new field m_dynamic_extents.
7877 (region_model::operator=): Likewise.
7878 (region_model::operator==): Likewise.
7879 (region_model::dump_to_pp): Dump sizes of dynamic regions.
7880 (region_model::handle_unrecognized_call): Purge dynamic extents
7881 from any regions that have escaped mutably:.
7882 (region_model::get_capacity): New function.
7883 (region_model::add_constraint): Unset dynamic extents when a
7884 heap-allocated region's address is NULL.
7885 (region_model::unbind_region_and_descendents): Purge dynamic
7886 extents of unbound regions.
7887 (region_model::can_merge_with_p): Call
7888 m_dynamic_extents.can_merge_with_p.
7889 (region_model::create_region_for_heap_alloc): Assert that
7890 size_in_bytes's type is compatible with size_type_node. Update
7891 for renaming of record_dynamic_extents to set_dynamic_extents.
7892 (region_model::create_region_for_alloca): Likewise.
7893 (region_model::record_dynamic_extents): Rename to...
7894 (region_model::set_dynamic_extents): ...this. Assert that
7895 size_in_bytes's type is compatible with size_type_node. Add it
7896 to the m_dynamic_extents map.
7897 (region_model::get_dynamic_extents): New.
7898 (region_model::unset_dynamic_extents): New.
7899 (selftest::test_state_merging): Fix type of "size".
7900 (selftest::test_malloc_constraints): Likewise.
7901 (selftest::test_malloc): Verify dynamic extents.
7902 (selftest::test_alloca): Likewise.
7903 * region-model.h (region_to_value_map::is_empty): New.
7904 (region_model::dynamic_extents_t): New typedef.
7905 (region_model::impl_call_analyzer_dump_capacity): New decl.
7906 (region_model::get_dynamic_extents): New function.
7907 (region_model::get_dynamic_extents): New decl.
7908 (region_model::set_dynamic_extents): New decl.
7909 (region_model::unset_dynamic_extents): New decl.
7910 (region_model::get_capacity): New decl.
7911 (region_model::record_dynamic_extents): Rename to set_dynamic_extents.
7912 (region_model::m_dynamic_extents): New field.
7914 2021-06-15 David Malcolm <dmalcolm@redhat.com>
7916 * region-model.cc (region_to_value_map::operator=): New.
7917 (region_to_value_map::operator==): New.
7918 (region_to_value_map::dump_to_pp): New.
7919 (region_to_value_map::dump): New.
7920 (region_to_value_map::can_merge_with_p): New.
7921 * region-model.h (class region_to_value_map): New class.
7923 2021-06-13 Trevor Saunders <tbsaunde@tbsaunde.org>
7925 * call-string.cc (call_string::call_string): Use range based for
7926 to iterate over vec<>.
7927 (call_string::to_json): Likewise.
7928 (call_string::hash): Likewise.
7929 (call_string::calc_recursion_depth): Likewise.
7930 * checker-path.cc (checker_path::fixup_locations): Likewise.
7931 * constraint-manager.cc (equiv_class::equiv_class): Likewise.
7932 (equiv_class::to_json): Likewise.
7933 (equiv_class::hash): Likewise.
7934 (constraint_manager::to_json): Likewise.
7935 * engine.cc (impl_region_model_context::on_svalue_leak):
7936 Likewise.
7937 (on_liveness_change): Likewise.
7938 (impl_region_model_context::on_unknown_change): Likewise.
7939 * program-state.cc (sm_state_map::set_state): Likewise.
7940 * region-model.cc (test_canonicalization_4): Likewise.
7942 2021-06-11 David Malcolm <dmalcolm@redhat.com>
7944 * engine.cc (worklist::key_t::cmp): Move sort by call_string to
7945 before SCC.
7947 2021-06-09 David Malcolm <dmalcolm@redhat.com>
7949 * region-model.cc (region_model::get_lvalue_1): Make const.
7950 (region_model::get_lvalue): Likewise.
7951 (region_model::get_rvalue_1): Likewise.
7952 (region_model::get_rvalue): Likewise.
7953 (region_model::deref_rvalue): Likewise.
7954 (region_model::get_rvalue_for_bits): Likewise.
7955 * region-model.h (region_model::get_lvalue): Likewise.
7956 (region_model::get_rvalue): Likewise.
7957 (region_model::deref_rvalue): Likewise.
7958 (region_model::get_rvalue_for_bits): Likewise.
7959 (region_model::get_lvalue_1): Likewise.
7960 (region_model::get_rvalue_1): Likewise.
7962 2021-06-08 David Malcolm <dmalcolm@redhat.com>
7964 PR analyzer/99212
7965 * region-model-manager.cc
7966 (region_model_manager::maybe_fold_binop): Add support for folding
7967 BIT_AND_EXPR of compound_svalue and a mask constant.
7968 * region-model.cc (region_model::get_rvalue_1): Implement
7969 BIT_FIELD_REF in terms of...
7970 (region_model::get_rvalue_for_bits): New function.
7971 * region-model.h (region_model::get_rvalue_for_bits): New decl.
7972 * store.cc (bit_range::from_mask): New function.
7973 (selftest::test_bit_range_intersects_p): New selftest.
7974 (selftest::assert_bit_range_from_mask_eq): New.
7975 (ASSERT_BIT_RANGE_FROM_MASK_EQ): New macro.
7976 (selftest::assert_no_bit_range_from_mask_eq): New.
7977 (ASSERT_NO_BIT_RANGE_FROM_MASK): New macro.
7978 (selftest::test_bit_range_from_mask): New selftest.
7979 (selftest::analyzer_store_cc_tests): Call the new selftests.
7980 * store.h (bit_range::intersects_p): New.
7981 (bit_range::from_mask): New decl.
7982 (concrete_binding::get_bit_range): New accessor.
7983 (store_manager::get_concrete_binding): New overload taking
7984 const bit_range &.
7986 2021-06-08 David Malcolm <dmalcolm@redhat.com>
7988 * analyzer.h (int_size_in_bits): New decl.
7989 * region.cc (int_size_in_bits): New function.
7990 (region::get_bit_size): Reimplement in terms of the above.
7992 2021-06-08 David Malcolm <dmalcolm@redhat.com>
7994 * store.cc (concrete_binding::dump_to_pp): Move bulk of
7995 implementation to...
7996 (bit_range::dump_to_pp): ...this new function.
7997 (bit_range::cmp): New.
7998 (concrete_binding::overlaps_p): Update for use of bit_range.
7999 (concrete_binding::cmp_ptr_ptr): Likewise.
8000 * store.h (struct bit_range): New.
8001 (class concrete_binding): Replace fields m_start_bit_offset and
8002 m_size_in_bits with new field m_bit_range.
8004 2021-06-08 David Malcolm <dmalcolm@redhat.com>
8006 * svalue.h (conjured_svalue::iterator_t): Delete.
8008 2021-06-03 David Malcolm <dmalcolm@redhat.com>
8010 * store.h (store::get_direct_binding): Remove unused decl.
8011 (store::get_default_binding): Likewise.
8013 2021-06-03 David Malcolm <dmalcolm@redhat.com>
8015 * svalue.cc (poisoned_svalue::dump_to_pp): Dump type.
8016 (compound_svalue::dump_to_pp): Dump any type.
8018 2021-05-18 David Malcolm <dmalcolm@redhat.com>
8020 PR analyzer/100615
8021 * sm-malloc.cc: Include "analyzer/function-set.h".
8022 (malloc_state_machine::on_stmt): Call unaffected_by_call_p and
8023 bail on the functions it recognizes.
8024 (malloc_state_machine::unaffected_by_call_p): New.
8026 2021-05-10 Martin Liska <mliska@suse.cz>
8028 * sm-file.cc (is_file_using_fn_p): Use startswith
8029 function instead of strncmp.
8031 2021-05-10 Martin Liska <mliska@suse.cz>
8033 * program-state.cc (program_state::operator=): Remove
8034 __cplusplus >= 201103.
8035 (program_state::program_state): Likewise.
8036 * program-state.h: Likewise.
8037 * region-model.h (class region_model): Remove dead code.
8039 2021-04-24 David Malcolm <dmalcolm@redhat.com>
8041 PR analyzer/100244
8042 * sm-malloc.cc (free_of_non_heap::describe_state_change):
8043 Bulletproof against change.m_expr being NULL.
8045 2021-04-13 David Malcolm <dmalcolm@redhat.com>
8047 PR analyzer/98599
8048 * supergraph.cc (saved_uids::make_uid_unique): New.
8049 (saved_uids::restore_uids): New.
8050 (supergraph::supergraph): Replace assignments to stmt->uid with
8051 calls to m_stmt_uids.make_uid_unique.
8052 (supergraph::~supergraph): New.
8053 * supergraph.h (class saved_uids): New.
8054 (supergraph::~supergraph): New decl.
8055 (supergraph::m_stmt_uids): New field.
8057 2021-04-10 David Malcolm <dmalcolm@redhat.com>
8059 PR analyzer/100011
8060 * region-model.cc (region_model::on_assignment): Avoid NULL
8061 dereference if ctxt is NULL when assigning from a STRING_CST.
8063 2021-04-08 David Malcolm <dmalcolm@redhat.com>
8065 PR analyzer/99042
8066 PR analyzer/99774
8067 * engine.cc
8068 (impl_region_model_context::impl_region_model_context): Add
8069 uncertainty param and use it to initialize m_uncertainty.
8070 (impl_region_model_context::get_uncertainty): New.
8071 (impl_sm_context::get_fndecl_for_call): Add NULL for new
8072 uncertainty param when constructing impl_region_model_context.
8073 (impl_sm_context::get_state): Likewise.
8074 (impl_sm_context::set_next_state): Likewise.
8075 (impl_sm_context::warn): Likewise.
8076 (exploded_node::on_stmt): Add uncertainty param
8077 and use it when constructing impl_region_model_context.
8078 (exploded_node::on_edge): Add uncertainty param and pass
8079 to on_edge call.
8080 (exploded_node::detect_leaks): Create uncertainty_t and pass to
8081 impl_region_model_context.
8082 (exploded_graph::get_or_create_node): Create uncertainty_t and
8083 pass to prune_for_point.
8084 (maybe_process_run_of_before_supernode_enodes): Create
8085 uncertainty_t and pass to impl_region_model_context.
8086 (exploded_graph::process_node): Create uncertainty_t instances and
8087 pass around as needed.
8088 * exploded-graph.h
8089 (impl_region_model_context::impl_region_model_context): Add
8090 uncertainty param.
8091 (impl_region_model_context::get_uncertainty): New decl.
8092 (impl_region_model_context::m_uncertainty): New field.
8093 (exploded_node::on_stmt): Add uncertainty param.
8094 (exploded_node::on_edge): Likewise.
8095 * program-state.cc (sm_state_map::on_liveness_change): Get
8096 uncertainty from context and use it to unset sm-state from
8097 svalues as appropriate.
8098 (program_state::on_edge): Add uncertainty param and use it when
8099 constructing impl_region_model_context. Fix indentation.
8100 (program_state::prune_for_point): Add uncertainty param and use it
8101 when constructing impl_region_model_context.
8102 (program_state::detect_leaks): Get any uncertainty from ctxt and
8103 use it to get maybe-live svalues for dest_state, rather than
8104 definitely-live ones; use this when determining which svalues
8105 have leaked.
8106 (selftest::test_program_state_merging): Create uncertainty_t and
8107 pass to impl_region_model_context.
8108 * program-state.h (program_state::on_edge): Add uncertainty param.
8109 (program_state::prune_for_point): Likewise.
8110 * region-model-impl-calls.cc (call_details::get_uncertainty): New.
8111 (region_model::impl_call_memcpy): Pass uncertainty to
8112 mark_region_as_unknown call.
8113 (region_model::impl_call_memset): Likewise.
8114 (region_model::impl_call_strcpy): Likewise.
8115 * region-model-reachability.cc (reachable_regions::handle_sval):
8116 Also add sval to m_mutable_svals.
8117 * region-model.cc (region_model::on_assignment): Pass any
8118 uncertainty from ctxt to the store::set_value call.
8119 (region_model::handle_unrecognized_call): Get any uncertainty from
8120 ctxt and use it to record mutable svalues at the unknown call.
8121 (region_model::get_reachable_svalues): Add uncertainty param and
8122 use it to mark any maybe-bound svalues as being reachable.
8123 (region_model::set_value): Pass any uncertainty from ctxt to the
8124 store::set_value call.
8125 (region_model::mark_region_as_unknown): Add uncertainty param and
8126 pass it on to the store::mark_region_as_unknown call.
8127 (region_model::update_for_call_summary): Add uncertainty param and
8128 pass it on to the region_model::mark_region_as_unknown call.
8129 * region-model.h (call_details::get_uncertainty): New decl.
8130 (region_model::get_reachable_svalues): Add uncertainty param.
8131 (region_model::mark_region_as_unknown): Add uncertainty param.
8132 (region_model_context::get_uncertainty): New vfunc.
8133 (noop_region_model_context::get_uncertainty): New vfunc
8134 implementation.
8135 * store.cc (dump_svalue_set): New.
8136 (uncertainty_t::dump_to_pp): New.
8137 (uncertainty_t::dump): New.
8138 (binding_cluster::clobber_region): Pass NULL for uncertainty to
8139 remove_overlapping_bindings.
8140 (binding_cluster::mark_region_as_unknown): Add uncertainty param
8141 and pass it to remove_overlapping_bindings.
8142 (binding_cluster::remove_overlapping_bindings): Add uncertainty param.
8143 Use it to record any svalues that were in clobbered bindings.
8144 (store::set_value): Add uncertainty param. Pass it to
8145 binding_cluster::mark_region_as_unknown when handling symbolic
8146 regions.
8147 (store::mark_region_as_unknown): Add uncertainty param and pass it
8148 to binding_cluster::mark_region_as_unknown.
8149 (store::remove_overlapping_bindings): Add uncertainty param and
8150 pass it to binding_cluster::remove_overlapping_bindings.
8151 * store.h (binding_cluster::mark_region_as_unknown): Add
8152 uncertainty param.
8153 (binding_cluster::remove_overlapping_bindings): Likewise.
8154 (store::set_value): Likewise.
8155 (store::mark_region_as_unknown): Likewise.
8157 2021-04-05 David Malcolm <dmalcolm@redhat.com>
8159 PR analyzer/99906
8160 * analyzer.cc (maybe_reconstruct_from_def_stmt): Fix NULL
8161 dereference on calls with zero arguments.
8162 * sm-malloc.cc (malloc_state_machine::on_stmt): When handling
8163 __attribute__((nonnull)), only call get_diagnostic_tree if the
8164 result will be used.
8166 2021-04-05 David Malcolm <dmalcolm@redhat.com>
8168 PR analyzer/99886
8169 * diagnostic-manager.cc
8170 (diagnostic_manager::prune_interproc_events): Use signed integers
8171 when subtracting one from path->num_events ().
8172 (diagnostic_manager::consolidate_conditions): Likewise. Convert
8173 next_idx to a signed int.
8175 2021-04-01 David Malcolm <dmalcolm@redhat.com>
8177 * diagnostic-manager.cc (diagnostic_manager::add_diagnostic): Make
8178 enode param non-constant, and call add_diagnostic on it. Add
8179 enode index to log message.
8180 (diagnostic_manager::add_diagnostic): Make enode param
8181 non-constant.
8182 * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
8183 Likewise for both decls.
8184 * engine.cc
8185 (impl_region_model_context::impl_region_model_context): Likewise
8186 for enode_for_diag.
8187 (impl_sm_context::impl_sm_context): Likewise.
8188 (impl_sm_context::m_enode_for_diag): Likewise.
8189 (exploded_node::dump_dot): Don't pass the diagnostic manager
8190 to dump_saved_diagnostics.
8191 (exploded_node::dump_saved_diagnostics): Drop param. Iterate
8192 directly through all saved diagnostics for the enode, rather
8193 than all saved diagnostics in the diagnostic_manager and
8194 filtering.
8195 (exploded_node::on_stmt): Make non-const.
8196 (exploded_node::on_edge): Likewise.
8197 (exploded_node::on_longjmp): Likewise.
8198 (exploded_node::detect_leaks): Likewise.
8199 (exploded_graph::get_or_create_node): Make enode_for_diag param
8200 non-const.
8201 (exploded_graph_annotator::print_enode): Iterate
8202 directly through all saved diagnostics for the enode, rather
8203 than all saved diagnostics in the diagnostic_manager and
8204 filtering.
8205 * exploded-graph.h
8206 (impl_region_model_context::impl_region_model_context): Make
8207 enode_for_diag param non-constant.
8208 (impl_region_model_context::m_enode_for_diag): Likewise.
8209 (exploded_node::dump_saved_diagnostics): Drop param.
8210 (exploded_node::on_stmt): Make non-const.
8211 (exploded_node::on_edge): Likewise.
8212 (exploded_node::on_longjmp): Likewise.
8213 (exploded_node::detect_leaks): Likewise.
8214 (exploded_node::add_diagnostic): New.
8215 (exploded_node::get_num_diagnostics): New.
8216 (exploded_node::get_saved_diagnostic): New.
8217 (exploded_node::m_saved_diagnostics): New.
8218 (exploded_graph::get_or_create_node): Make enode_for_diag param
8219 non-constant.
8220 * feasible-graph.cc (feasible_node::dump_dot): Drop
8221 diagnostic_manager from call to dump_saved_diagnostics.
8222 * program-state.cc (program_state::on_edge): Convert enode param
8223 to non-const pointer.
8224 (program_state::prune_for_point): Likewise for enode_for_diag
8225 param.
8226 * program-state.h (program_state::on_edge): Convert enode param
8227 to non-const pointer.
8228 (program_state::prune_for_point): Likewise for enode_for_diag
8229 param.
8231 2021-03-31 David Malcolm <dmalcolm@redhat.com>
8233 PR analyzer/99771
8234 * analyzer.cc (maybe_reconstruct_from_def_stmt): New.
8235 (fixup_tree_for_diagnostic_1): New.
8236 (fixup_tree_for_diagnostic): New.
8237 * analyzer.h (fixup_tree_for_diagnostic): New decl.
8238 * checker-path.cc (call_event::get_desc): Call
8239 fixup_tree_for_diagnostic and use it for the call_with_state call.
8240 (warning_event::get_desc): Likewise for the final_event and
8241 make_label_text calls.
8242 * engine.cc (impl_region_model_context::on_state_leak): Likewise
8243 for the on_leak and add_diagnostic calls.
8244 * region-model.cc (region_model::get_representative_tree):
8245 Likewise for the result.
8247 2021-03-30 David Malcolm <dmalcolm@redhat.com>
8249 * region.h (region::dump_to_pp): Remove old decl.
8251 2021-03-30 David Malcolm <dmalcolm@redhat.com>
8253 * sm-file.cc (fileptr_state_machine::on_stmt): Only call
8254 get_diagnostic_tree if the result will be used.
8255 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
8256 (malloc_state_machine::on_deallocator_call): Likewise.
8257 (malloc_state_machine::on_realloc_call): Likewise.
8258 (malloc_state_machine::on_realloc_call): Likewise.
8259 * sm-sensitive.cc
8260 (sensitive_state_machine::warn_for_any_exposure): Likewise.
8261 * sm-taint.cc (taint_state_machine::on_stmt): Likewise.
8263 2021-03-25 David Malcolm <dmalcolm@redhat.com>
8265 PR analyzer/93695
8266 PR analyzer/99044
8267 PR analyzer/99716
8268 * engine.cc (exploded_node::on_stmt): Clear sm-state involving
8269 an SSA name at the def-stmt of that SSA name.
8270 * program-state.cc (sm_state_map::purge_state_involving): New.
8271 * program-state.h (sm_state_map::purge_state_involving): New decl.
8272 * region-model.cc (selftest::test_involves_p): New.
8273 (selftest::analyzer_region_model_cc_tests): Call it.
8274 * svalue.cc (class involvement_visitor): New class
8275 (svalue::involves_p): New.
8276 * svalue.h (svalue::involves_p): New decl.
8278 2021-03-19 David Malcolm <dmalcolm@redhat.com>
8280 PR analyzer/99614
8281 * diagnostic-manager.cc (class epath_finder): Add
8282 DISABLE_COPY_AND_ASSIGN.
8284 2021-03-15 Martin Liska <mliska@suse.cz>
8286 * sm-file.cc (get_file_using_fns): Add missing comma in initializer.
8288 2021-03-11 David Malcolm <dmalcolm@redhat.com>
8290 PR analyzer/96374
8291 * analyzer.opt (-param=analyzer-max-infeasible-edges=): New param.
8292 (fdump-analyzer-feasibility): New flag.
8293 * diagnostic-manager.cc: Include "analyzer/trimmed-graph.h" and
8294 "analyzer/feasible-graph.h".
8295 (epath_finder::epath_finder): Convert m_sep to a pointer and
8296 only create it if !flag_analyzer_feasibility.
8297 (epath_finder::~epath_finder): New.
8298 (epath_finder::m_sep): Convert to a pointer.
8299 (epath_finder::get_best_epath): Add param "diag_idx" and use it
8300 when logging. Rather than finding the shortest path and then
8301 checking feasibility, instead use explore_feasible_paths unless
8302 !flag_analyzer_feasibility, in which case simply use the shortest
8303 path, and note if it is infeasible. Update for m_sep becoming a
8304 pointer.
8305 (class feasible_worklist): New.
8306 (epath_finder::explore_feasible_paths): New.
8307 (epath_finder::process_worklist_item): New.
8308 (class dump_eg_with_shortest_path): New.
8309 (epath_finder::dump_trimmed_graph): New.
8310 (epath_finder::dump_feasible_graph): New.
8311 (saved_diagnostic::saved_diagnostic): Add "idx" param, using it
8312 on new field m_idx.
8313 (saved_diagnostic::to_json): Dump m_idx.
8314 (saved_diagnostic::calc_best_epath): Pass m_idx to get_best_epath.
8315 Remove assertion that m_problem was set when m_best_epath is NULL.
8316 (diagnostic_manager::add_diagnostic): Pass an index when created
8317 saved_diagnostic instances.
8318 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add
8319 "idx" param.
8320 (saved_diagnostic::get_index): New accessor.
8321 (saved_diagnostic::m_idx): New field.
8322 * engine.cc (exploded_node::dump_dot): Call args.dump_extra_info.
8323 Move code to...
8324 (exploded_node::dump_processed_stmts): ...this new function and...
8325 (exploded_node::dump_saved_diagnostics): ...this new function.
8326 Add index of each diagnostic.
8327 (exploded_edge::dump_dot): Move bulk of code to...
8328 (exploded_edge::dump_dot_label): ...this new function.
8329 * exploded-graph.h (eg_traits::dump_args_t::dump_extra_info): New
8330 vfunc.
8331 (exploded_node::dump_processed_stmts): New decl.
8332 (exploded_node::dump_saved_diagnostics): New decl.
8333 (exploded_edge::dump_dot_label): New decl.
8334 * feasible-graph.cc: New file.
8335 * feasible-graph.h: New file.
8336 * trimmed-graph.cc: New file.
8337 * trimmed-graph.h: New file.
8339 2021-03-11 David Malcolm <dmalcolm@redhat.com>
8341 * diagnostic-manager.cc (epath_finder::epath_finder):
8342 Update shortest_paths init for new param.
8344 2021-03-10 David Malcolm <dmalcolm@redhat.com>
8346 PR analyzer/96374
8347 * engine.cc (exploded_path::feasible_p): Move "snodes_visited" and
8348 "model" locals into a new class feasibility_state. Move heart
8349 of per-edge processing into
8350 feasibility_state::maybe_update_for_edge.
8351 (feasibility_state::feasibility_state): New.
8352 (feasibility_state::maybe_update_for_edge): New, based on loop
8353 body in exploded_path::feasible_p.
8354 * exploded-graph.h (class feasibility_state): New.
8356 2021-03-10 David Malcolm <dmalcolm@redhat.com>
8358 * supergraph.h
8359 (callgraph_superedge::dyn_cast_callgraph_superedge): New.
8360 (call_superedge::dyn_cast_callgraph_superedge): Delete.
8361 (return_superedge::dyn_cast_callgraph_superedge): Delete.
8363 2021-03-02 Martin Liska <mliska@suse.cz>
8365 * diagnostic-manager.cc (diagnostic_manager::emit_saved_diagnostics):
8366 Do not pass engine.
8368 2021-02-26 David Malcolm <dmalcolm@redhat.com>
8370 * engine.cc (exploded_path::exploded_path): New copy-ctor.
8371 * exploded-graph.h (exploded_path::operator=): Drop decl.
8373 2021-02-26 David Malcolm <dmalcolm@redhat.com>
8375 PR analyzer/96374
8376 * diagnostic-manager.cc (class epath_finder): New.
8377 (epath_finder::get_best_epath): New.
8378 (saved_diagnostic::saved_diagnostic): Update for replacement of
8379 m_state and m_epath_length with m_best_epath.
8380 (saved_diagnostic::~saved_diagnostic): Delete m_best_epath.
8381 (saved_diagnostic::to_json): Update "path_length" to be optional.
8382 (saved_diagnostic::calc_best_epath): New, based on
8383 dedupe_winners::add and parts of dedupe_key::dedupe_key.
8384 (saved_diagnostic::get_epath_length): New.
8385 (saved_diagnostic::add_duplicate): New.
8386 (dedupe_key::dedupe_key): Drop epath param. Move invocation of
8387 stmt_finder to saved_diagnostic::calc_best_epath.
8388 (class dedupe_candidate): Delete.
8389 (class dedupe_hash_map_traits): Update to use saved_diagnotic *
8390 rather than dedupe_candidate * as the value_type/compare_type.
8391 (dedupe_winners::~dedupe_winners): Don't delete the values.
8392 (dedupe_winners::add): Convert param from shortest_exploded_paths to
8393 epath_finder. Drop "eg" param. Drop dedupe_candidate, moving
8394 path generation and feasiblity checking to
8395 epath_finder::get_best_epath. Update winner-selection for move
8396 of epaths from dedupe_candidate to saved_diagnostic.
8397 (dedupe_winners::emit_best): Update for removal of class
8398 dedupe_candidate.
8399 (dedupe_winners::map_t): Update to use saved_diagnotic * rather
8400 than dedupe_candidate * as the value_type/compare_type.
8401 (diagnostic_manager::emit_saved_diagnostics): Move
8402 shortest_exploded_paths instance into epath_finder and pass that
8403 around instead.
8404 (diagnostic_manager::emit_saved_diagnostic): Drop epath, stmt
8405 and num_dupes params, instead getting these from the
8406 saved_diagnostic. Use correct location in inform_n call.
8407 * diagnostic-manager.h (class epath_finder): New forward decl.
8408 (saved_diagnostic::status): Drop enum.
8409 (saved_diagnostic::set_feasible): Drop.
8410 (saved_diagnostic::set_infeasible): Drop.
8411 (saved_diagnostic::get_status): Drop.
8412 (saved_diagnostic::calc_best_epath): New decl.
8413 (saved_diagnostic::get_best_epath): New decl.
8414 (saved_diagnostic::get_epath_length): New decl.
8415 (saved_diagnostic::set_epath_length): Drop.
8416 (saved_diagnostic::get_epath_length): Drop inline implementation.
8417 (saved_diagnostic::add_duplicate): New.
8418 (saved_diagnostic::get_num_dupes): New.
8419 (saved_diagnostic::m_d): Document ownership.
8420 (saved_diagnostic::m_trailing_eedge): Make const.
8421 (saved_diagnostic::m_status): Drop field.
8422 (saved_diagnostic::m_epath_length): Drop field.
8423 (saved_diagnostic::m_best_epath): New field.
8424 (saved_diagnostic::m_problem): Document ownership.
8425 (saved_diagnostic::m_duplicates): New field.
8426 (diagnostic_manager::emit_saved_diagnostic): Drop params epath,
8427 stmt, and num_dupes.
8428 * engine.cc (exploded_graph_annotator::print_saved_diagnostic):
8429 Update for changes to saved_diagnostic class.
8430 * exploded-graph.h (exploded_path::feasible_p): Drop unused
8431 overloaded decl.
8433 2021-02-25 David Malcolm <dmalcolm@redhat.com>
8435 PR analyzer/99193
8436 * region-model-impl-calls.cc (region_model::impl_call_realloc): New.
8437 * region-model.cc (region_model::on_call_pre): Call it.
8438 * region-model.h (region_model::impl_call_realloc): New decl.
8439 * sm-malloc.cc (enum wording): Add WORDING_REALLOCATED.
8440 (malloc_state_machine::m_realloc): New field.
8441 (use_after_free::describe_state_change): Add case for
8442 WORDING_REALLOCATED.
8443 (use_after_free::describe_final_event): Likewise.
8444 (malloc_state_machine::malloc_state_machine): Initialize
8445 m_realloc.
8446 (malloc_state_machine::on_stmt): Handle realloc by calling...
8447 (malloc_state_machine::on_realloc_call): New.
8449 2021-02-22 David Malcolm <dmalcolm@redhat.com>
8451 PR analyzer/99196
8452 * engine.cc (exploded_node::on_stmt): Provide terminate_path
8453 flag as a way for on_call_pre to terminate the current analysis
8454 path.
8455 * region-model-impl-calls.cc (call_details::num_args): New.
8456 (region_model::impl_call_error): New.
8457 * region-model.cc (region_model::on_call_pre): Add param
8458 "out_terminate_path". Handle "error" and "error_at_line".
8459 * region-model.h (call_details::num_args): New decl.
8460 (region_model::on_call_pre): Add param "out_terminate_path".
8461 (region_model::impl_call_error): New decl.
8463 2021-02-17 David Malcolm <dmalcolm@redhat.com>
8465 PR analyzer/98969
8466 * constraint-manager.cc (dead_svalue_purger::should_purge_p):
8467 Update for change to svalue::live_p.
8468 * program-state.cc (sm_state_map::on_liveness_change): Likewise.
8469 (program_state::detect_leaks): Likewise.
8470 * region-model-reachability.cc (reachable_regions::init_cluster):
8471 When dealing with a symbolic region, if the underlying pointer is
8472 implicitly live, add the region to the reachable regions.
8473 * region-model.cc (region_model::compare_initial_and_pointer):
8474 Move logic for detecting initial values of params to
8475 initial_svalue::initial_value_of_param_p.
8476 * svalue.cc (svalue::live_p): Convert "live_svalues" from a
8477 reference to a pointer; support it being NULL.
8478 (svalue::implicitly_live_p): Convert first param from a
8479 refererence to a pointer.
8480 (region_svalue::implicitly_live_p): Likewise.
8481 (constant_svalue::implicitly_live_p): Likewise.
8482 (initial_svalue::implicitly_live_p): Likewise. Treat the initial
8483 values of params for the top level frame as still live.
8484 (initial_svalue::initial_value_of_param_p): New function, taken
8485 from a test in region_model::compare_initial_and_pointer.
8486 (unaryop_svalue::implicitly_live_p): Convert first param from a
8487 refererence to a pointer.
8488 (binop_svalue::implicitly_live_p): Likewise.
8489 (sub_svalue::implicitly_live_p): Likewise.
8490 (unmergeable_svalue::implicitly_live_p): Likewise.
8491 * svalue.h (svalue::live_p): Likewise.
8492 (svalue::implicitly_live_p): Likewise.
8493 (region_svalue::implicitly_live_p): Likewise.
8494 (constant_svalue::implicitly_live_p): Likewise.
8495 (initial_svalue::implicitly_live_p): Likewise.
8496 (initial_svalue::initial_value_of_param_p): New decl.
8497 (unaryop_svalue::implicitly_live_p): Convert first param from a
8498 refererence to a pointer.
8499 (binop_svalue::implicitly_live_p): Likewise.
8500 (sub_svalue::implicitly_live_p): Likewise.
8501 (unmergeable_svalue::implicitly_live_p): Likewise.
8503 2021-02-12 David Malcolm <dmalcolm@redhat.com>
8505 PR analyzer/98969
8506 * engine.cc (readability): Add names for the various arbitrary
8507 values. Handle NOP_EXPR and INTEGER_CST.
8508 (readability_comparator): Combine the readability tests for
8509 tree and stack depth, rather than performing them sequentially.
8510 (impl_region_model_context::on_state_leak): Strip off top-level
8511 casts.
8512 * region-model.cc (region_model::get_representative_path_var): Add
8513 type-checking, moving the bulk of the implementation to...
8514 (region_model::get_representative_path_var_1): ...here. Respect
8515 types in casts by recursing and re-adding the cast, rather than
8516 merely stripping them off. Use the correct type when handling
8517 region_svalue.
8518 (region_model::get_representative_tree): Strip off any top-level
8519 cast.
8520 (region_model::get_representative_path_var): Add type-checking,
8521 moving the bulk of the implementation to...
8522 (region_model::get_representative_path_var_1): ...here.
8523 * region-model.h (region_model::get_representative_path_var_1):
8524 New decl
8525 (region_model::get_representative_path_var_1): New decl.
8526 * store.cc (append_pathvar_with_type): New.
8527 (binding_cluster::get_representative_path_vars): Cast path_vars
8528 to the correct type when adding them to *OUT_PVS.
8530 2021-02-09 David Malcolm <dmalcolm@redhat.com>
8532 PR analyzer/98575
8533 * sm-file.cc (is_file_using_fn_p): Support "_IO_"-prefixed
8534 variants.
8536 2021-02-09 David Malcolm <dmalcolm@redhat.com>
8538 PR analyzer/98575
8539 * store.cc (store::set_value): Treat a pointer written to *UNKNOWN
8540 as having escaped.
8542 2021-02-02 David Malcolm <dmalcolm@redhat.com>
8544 PR analyzer/93355
8545 PR analyzer/96374
8546 * engine.cc (toplevel_function_p): Simplify so that
8547 we only reject functions with a "__analyzer_" prefix.
8548 (add_any_callbacks): Delete.
8549 (exploded_graph::build_initial_worklist): Update for
8550 dropped param of toplevel_function_p.
8551 (exploded_graph::build_initial_worklist): Don't bother
8552 looking for callbacks that are reachable from global
8553 initializers.
8555 2021-02-01 David Malcolm <dmalcolm@redhat.com>
8557 PR analyzer/98918
8558 * region-model-manager.cc
8559 (region_model_manager::get_or_create_initial_value):
8560 Fold the initial value of *UNKNOWN_PTR to an UNKNOWN value.
8561 (region_model_manager::get_field_region): Fold the value
8562 of UNKNOWN_PTR->FIELD to *UNKNOWN_PTR_OF_&FIELD_TYPE.
8564 2021-01-29 David Malcolm <dmalcolm@redhat.com>
8566 * checker-path.cc (event_kind_to_string): Handle
8567 EK_START_CONSOLIDATED_CFG_EDGES and
8568 EK_END_CONSOLIDATED_CFG_EDGES.
8569 (start_consolidated_cfg_edges_event::get_desc): New.
8570 (checker_path::cfg_edge_pair_at_p): New.
8571 * checker-path.h (enum event_kind): Add
8572 EK_START_CONSOLIDATED_CFG_EDGES and
8573 EK_END_CONSOLIDATED_CFG_EDGES.
8574 (class start_consolidated_cfg_edges_event): New class.
8575 (class end_consolidated_cfg_edges_event): New class.
8576 (checker_path::delete_events): New.
8577 (checker_path::replace_event): New.
8578 (checker_path::cfg_edge_pair_at_p): New decl.
8579 * diagnostic-manager.cc (diagnostic_manager::prune_path): Call
8580 consolidate_conditions.
8581 (same_line_as_p): New.
8582 (diagnostic_manager::consolidate_conditions): New.
8583 * diagnostic-manager.h
8584 (diagnostic_manager::consolidate_conditions): New decl.
8586 2021-01-18 David Malcolm <dmalcolm@redhat.com>
8588 * analyzer.h (is_std_named_call_p): New decl.
8589 * diagnostic-manager.cc (path_builder::get_sm): New.
8590 (state_change_event_creator::state_change_event_creator): Add "pb"
8591 param.
8592 (state_change_event_creator::on_global_state_change): Don't consider
8593 state changes affecting other state_machines.
8594 (state_change_event_creator::on_state_change): Likewise.
8595 (state_change_event_creator::m_pb): New field.
8596 (diagnostic_manager::add_events_for_eedge): Pass pb to visitor
8597 ctor.
8598 * region-model-impl-calls.cc
8599 (region_model::impl_deallocation_call): New.
8600 * region-model.cc: Include "attribs.h".
8601 (region_model::on_call_post): Handle fndecls referenced by
8602 __attribute__((deallocated_by(FOO))).
8603 * region-model.h (region_model::impl_deallocation_call): New decl.
8604 * sm-malloc.cc: Include "stringpool.h" and "attribs.h". Add
8605 leading comment.
8606 (class api): Delete.
8607 (enum resource_state): Update comment for change from api to
8608 deallocator and deallocator_set.
8609 (allocation_state::allocation_state): Drop api param. Add
8610 "deallocators" and "deallocator".
8611 (allocation_state::m_api): Drop field in favor of...
8612 (allocation_state::m_deallocators): New field.
8613 (allocation_state::m_deallocator): New field.
8614 (enum wording): Add WORDING_DEALLOCATED.
8615 (struct deallocator): New.
8616 (struct standard_deallocator): New.
8617 (struct custom_deallocator): New.
8618 (struct deallocator_set): New.
8619 (struct custom_deallocator_set): New.
8620 (struct standard_deallocator_set): New.
8621 (struct deallocator_set_map_traits): New.
8622 (malloc_state_machine::m_malloc): Drop field
8623 (malloc_state_machine::m_scalar_new): Likewise.
8624 (malloc_state_machine::m_vector_new): Likewise.
8625 (malloc_state_machine::m_free): New field
8626 (malloc_state_machine::m_scalar_delete): Likewise.
8627 (malloc_state_machine::m_vector_delete): Likewise.
8628 (malloc_state_machine::deallocator_map_t): New typedef.
8629 (malloc_state_machine::m_deallocator_map): New field.
8630 (malloc_state_machine::deallocator_set_cache_t): New typedef.
8631 (malloc_state_machine::m_custom_deallocator_set_cache): New field.
8632 (malloc_state_machine::custom_deallocator_set_map_t): New typedef.
8633 (malloc_state_machine::m_custom_deallocator_set_map): New field.
8634 (malloc_state_machine::m_dynamic_sets): New field.
8635 (malloc_state_machine::m_dynamic_deallocators): New field.
8636 (api::api): Delete.
8637 (deallocator::deallocator): New ctor.
8638 (deallocator::hash): New.
8639 (deallocator::dump_to_pp): New.
8640 (deallocator::cmp): New.
8641 (deallocator::cmp_ptr_ptr): New.
8642 (standard_deallocator::standard_deallocator): New ctor.
8643 (deallocator_set::deallocator_set): New ctor.
8644 (deallocator_set::dump): New.
8645 (custom_deallocator_set::custom_deallocator_set): New ctor.
8646 (custom_deallocator_set::contains_p): New.
8647 (custom_deallocator_set::maybe_get_single): New.
8648 (custom_deallocator_set::dump_to_pp): New.
8649 (standard_deallocator_set::standard_deallocator_set): New ctor.
8650 (standard_deallocator_set::contains_p): New.
8651 (standard_deallocator_set::maybe_get_single): New.
8652 (standard_deallocator_set::dump_to_pp): New.
8653 (start_p): New.
8654 (class mismatching_deallocation): Update for conversion from api
8655 to deallocator_set and deallocator.
8656 (double_free::emit): Use %qs.
8657 (class use_after_free): Update for conversion from api to
8658 deallocator_set and deallocator.
8659 (malloc_leak::describe_state_change): Only emit "allocated here" on
8660 a start->nonnull transition, rather than on other transitions to
8661 nonnull.
8662 (allocation_state::dump_to_pp): Update for conversion from api to
8663 deallocator_set.
8664 (allocation_state::get_nonnull): Likewise.
8665 (malloc_state_machine::malloc_state_machine): Likewise.
8666 (malloc_state_machine::~malloc_state_machine): New.
8667 (malloc_state_machine::add_state): Update for conversion from api
8668 to deallocator_set.
8669 (malloc_state_machine::get_or_create_custom_deallocator_set): New.
8670 (malloc_state_machine::maybe_create_custom_deallocator_set): New.
8671 (malloc_state_machine::get_or_create_deallocator): New.
8672 (malloc_state_machine::on_stmt): Update for conversion from api
8673 to deallocator_set. Handle "__attribute__((malloc(FOO)))", and
8674 the special attribute set on FOO.
8675 (malloc_state_machine::on_allocator_call): Update for conversion
8676 from api to deallocator_set. Add "returns_nonnull" param and use
8677 it to affect which state to transition to.
8678 (malloc_state_machine::on_deallocator_call): Update for conversion
8679 from api to deallocator_set.
8681 2021-01-14 David Malcolm <dmalcolm@redhat.com>
8683 * engine.cc (strongly_connected_components::to_json): New.
8684 (worklist::to_json): New.
8685 (exploded_graph::to_json): JSON-ify the worklist.
8686 * exploded-graph.h (strongly_connected_components::to_json): New
8687 decl.
8688 (worklist::to_json): New decl.
8689 * store.cc (store::to_json): Fix comment.
8690 * supergraph.cc (supernode::to_json): Fix reference to
8691 "returning_call" in comment. Add optional "fun" to JSON.
8692 (edge_kind_to_string): New.
8693 (superedge::to_json): Add "kind" to JSON.
8695 2021-01-14 David Malcolm <dmalcolm@redhat.com>
8697 PR analyzer/98679
8698 * analyzer.h (region_offset::operator==): Make const.
8699 * pending-diagnostic.h (pending_diagnostic::equal_p): Likewise.
8700 * store.h (binding_cluster::for_each_value): Likewise.
8701 (binding_cluster::for_each_binding): Likewise.
8703 2021-01-12 David Malcolm <dmalcolm@redhat.com>
8705 PR analyzer/98628
8706 * store.cc (binding_cluster::make_unknown_relative_to): Don't mark
8707 dereferenced unknown pointers as having escaped.
8709 2021-01-07 David Malcolm <dmalcolm@redhat.com>
8711 PR analyzer/98580
8712 * region.cc (decl_region::get_svalue_for_initializer): Gracefully
8713 handle when LTO writes out DECL_INITIAL as error_mark_node.
8715 2021-01-07 David Malcolm <dmalcolm@redhat.com>
8717 PR analyzer/97074
8718 * store.cc (binding_cluster::can_merge_p): Add "out_store" param
8719 and pass to calls to binding_cluster::make_unknown_relative_to.
8720 (binding_cluster::make_unknown_relative_to): Add "out_store"
8721 param. Use it to mark base regions that are pointed to by
8722 pointers that become unknown as having escaped.
8723 (store::can_merge_p): Pass out_store to
8724 binding_cluster::can_merge_p.
8725 * store.h (binding_cluster::can_merge_p): Add "out_store" param.
8726 (binding_cluster::make_unknown_relative_to): Likewise.
8727 * svalue.cc (region_svalue::implicitly_live_p): New vfunc.
8728 * svalue.h (region_svalue::implicitly_live_p): New vfunc decl.
8730 2021-01-07 David Malcolm <dmalcolm@redhat.com>
8732 PR analyzer/98564
8733 * engine.cc (exploded_path::feasible_p): Add missing call to
8734 bitmap_clear.
8736 2021-01-06 David Malcolm <dmalcolm@redhat.com>
8738 PR analyzer/97072
8739 * region-model-reachability.cc (reachable_regions::init_cluster):
8740 Convert symbolic region handling to a switch statement. Add cases
8741 to handle SK_UNKNOWN and SK_CONJURED.
8743 2021-01-05 David Malcolm <dmalcolm@redhat.com>
8745 PR analyzer/98293
8746 * store.cc (binding_map::apply_ctor_to_region): When "index" is
8747 NULL, iterate through the fields for RECORD_TYPEs, rather than
8748 creating an INTEGER_CST index.
8750 2020-11-30 David Malcolm <dmalcolm@redhat.com>
8752 * analyzer-pass.cc: Include "analyzer/analyzer.h" for the
8753 declaration of sorry_no_analyzer; include "tree.h" and
8754 "function.h" as these are needed by it.
8756 2020-11-30 David Malcolm <dmalcolm@redhat.com>
8758 * analyzer-pass.cc (pass_analyzer::execute): Move sorry call to...
8759 (sorry_no_analyzer): New.
8760 * analyzer.h (class state_machine): New forward decl.
8761 (class logger): New forward decl.
8762 (class plugin_analyzer_init_iface): New.
8763 (sorry_no_analyzer): New decl.
8764 * checker-path.cc (checker_path::fixup_locations): New.
8765 * checker-path.h (checker_event::set_location): New.
8766 (checker_path::fixup_locations): New decl.
8767 * diagnostic-manager.cc
8768 (diagnostic_manager::emit_saved_diagnostic): Call
8769 checker_path::fixup_locations, and call fixup_location
8770 on the primary location.
8771 * engine.cc: Include "plugin.h".
8772 (class plugin_analyzer_init_impl): New.
8773 (impl_run_checkers): Invoke PLUGIN_ANALYZER_INIT callbacks.
8774 * pending-diagnostic.h (pending_diagnostic::fixup_location): New
8775 vfunc.
8777 2020-11-18 David Malcolm <dmalcolm@redhat.com>
8779 PR analyzer/97893
8780 * sm-malloc.cc (null_deref::emit): Use CWE-476 rather than
8781 CWE-690, as this isn't due to an unchecked return value.
8782 (null_arg::emit): Likewise.
8784 2020-11-12 David Malcolm <dmalcolm@redhat.com>
8786 * checker-path.h (checker_event::get_id_ptr): New.
8787 * diagnostic-manager.cc (path_builder::path_builder): Add "sd"
8788 param and use it to initialize new field "m_sd".
8789 (path_builder::get_pending_diagnostic): New.
8790 (path_builder::m_sd): New field.
8791 (diagnostic_manager::emit_saved_diagnostic): Pass sd to
8792 path_builder ctor.
8793 (diagnostic_manager::add_events_for_superedge): Call new
8794 maybe_add_custom_events_for_superedge vfunc.
8795 * engine.cc (stale_jmp_buf::stale_jmp_buf): Add "setjmp_point"
8796 param and use it to initialize new field "m_setjmp_point".
8797 Initialize new field "m_stack_pop_event".
8798 (stale_jmp_buf::maybe_add_custom_events_for_superedge): New vfunc
8799 implementation.
8800 (stale_jmp_buf::describe_final_event): New vfunc implementation.
8801 (stale_jmp_buf::m_setjmp_point): New field.
8802 (stale_jmp_buf::m_stack_pop_event): New field.
8803 (exploded_node::on_longjmp): Pass setjmp_point to stale_jmp_buf
8804 ctor.
8805 * pending-diagnostic.h
8806 (pending_diagnostic::maybe_add_custom_events_for_superedge): New
8807 vfunc.
8809 2020-11-12 David Malcolm <dmalcolm@redhat.com>
8811 PR tree-optimization/97424
8812 * analyzer.opt (Wanalyzer-shift-count-negative): New.
8813 (Wanalyzer-shift-count-overflow): New.
8814 * region-model.cc (class shift_count_negative_diagnostic): New.
8815 (class shift_count_overflow_diagnostic): New.
8816 (region_model::get_gassign_result): Complain about shift counts that
8817 are negative or are >= the operand's type's width.
8819 2020-11-10 Martin Liska <mliska@suse.cz>
8821 * constraint-manager.cc (constraint_manager::merge): Remove
8822 unused code.
8823 * constraint-manager.h: Likewise.
8824 * program-state.cc (sm_state_map::sm_state_map): Likewise.
8825 (program_state::program_state): Likewise.
8826 (test_sm_state_map): Likewise.
8827 * program-state.h: Likewise.
8828 * region-model-reachability.cc (reachable_regions::reachable_regions): Likewise.
8829 * region-model-reachability.h: Likewise.
8830 * region-model.cc (region_model::handle_unrecognized_call): Likewise.
8831 (region_model::get_reachable_svalues): Likewise.
8832 (region_model::can_merge_with_p): Likewise.
8834 2020-11-05 David Malcolm <dmalcolm@redhat.com>
8836 PR analyzer/97668
8837 * svalue.cc (cmp_cst): Handle COMPLEX_CST.
8839 2020-10-29 David Malcolm <dmalcolm@redhat.com>
8841 * program-state.cc (sm_state_map::on_liveness_change): Sort the
8842 leaking svalues before calling on_state_leak.
8843 (program_state::detect_leaks): Likewise when calling
8844 on_svalue_leak.
8845 * region-model-reachability.cc
8846 (reachable_regions::mark_escaped_clusters): Likewise when
8847 calling on_escaped_function.
8849 2020-10-29 David Malcolm <dmalcolm@redhat.com>
8851 PR analyzer/97608
8852 * region-model-reachability.cc (reachable_regions::handle_sval):
8853 Operands of reachable reversible operations are reachable.
8855 2020-10-29 David Malcolm <dmalcolm@redhat.com>
8857 * analyzer.h (class state_machine): New forward decl.
8858 (class logger): Likewise.
8859 (class visitor): Likewise.
8860 * complexity.cc: New file, taken from svalue.cc.
8861 * complexity.h: New file, taken from region-model.h.
8862 * region-model.h: Include "analyzer/svalue.h" and
8863 "analyzer/region.h". Move struct complexity to complexity.h.
8864 Move svalue, its subclasses and supporting decls to svalue.h.
8865 Move region, its subclasses and supporting decls to region.h.
8866 * region.cc: Include "analyzer/region.h".
8867 (symbolic_region::symbolic_region): Move here from region-model.h.
8868 * region.h: New file, based on material from region-model.h.
8869 * svalue.cc: Include "analyzer/svalue.h".
8870 (complexity::complexity): Move to complexity.cc.
8871 (complexity::from_pair): Likewise.
8872 * svalue.h: New file, based on material from region-model.h.
8874 2020-10-29 David Malcolm <dmalcolm@redhat.com>
8876 * program-state.cc (sm_state_map::print): Guard the printing of
8877 the origin pointer with !flag_dump_noaddr.
8878 * region.cc (string_region::dump_to_pp): Likewise for
8879 m_string_cst.
8881 2020-10-27 David Malcolm <dmalcolm@redhat.com>
8883 PR analyzer/97568
8884 * region-model.cc (region_model::get_initial_value_for_global):
8885 Move check that !DECL_EXTERNAL from here to...
8886 * region.cc (decl_region::get_svalue_for_initializer): ...here,
8887 using it to reject zero initialization.
8889 2020-10-27 Markus Böck <markus.boeck02@gmail.com>
8891 PR analyzer/96608
8892 * store.h (hash): Cast to intptr_t instead of long
8894 2020-10-27 David Malcolm <dmalcolm@redhat.com>
8896 * constraint-manager.cc (svalue_cmp_by_ptr): Delete.
8897 (equiv_class::canonicalize): Use svalue::cmp_ptr_ptr instead.
8898 (equiv_class_cmp): Eliminate pointer comparison.
8899 * diagnostic-manager.cc (dedupe_key::comparator): If they are at
8900 the same location, also compare epath ength and pending_diagnostic
8901 kind.
8902 * engine.cc (readability_comparator): If two path_vars have the
8903 same readability, then impose an arbitrary ordering on them.
8904 (worklist::key_t::cmp): If two points have the same plan ordering,
8905 continue the comparison. Call sm_state_map::cmp rather than
8906 comparing hash values.
8907 * program-state.cc (sm_state_map::entry_t::cmp): New.
8908 (sm_state_map::cmp): New.
8909 * program-state.h (sm_state_map::entry_t::cmp): New decl.
8910 (sm_state_map::elements): New.
8911 (sm_state_map::cmp): New.
8913 2020-10-27 David Malcolm <dmalcolm@redhat.com>
8915 * engine.cc (setjmp_record::cmp): New.
8916 (supernode_cluster::dump_dot): Avoid embedding pointer in cluster
8917 name.
8918 (supernode_cluster::cmp_ptr_ptr): New.
8919 (function_call_string_cluster::dump_dot): Avoid embedding pointer
8920 in cluster name. Sort m_map when dumping child clusters.
8921 (function_call_string_cluster::cmp_ptr_ptr): New.
8922 (root_cluster::dump_dot): Sort m_map when dumping child clusters.
8923 * program-point.cc (function_point::cmp): New.
8924 (function_point::cmp_ptr): New.
8925 * program-point.h (function_point::cmp): New decl.
8926 (function_point::cmp_ptr): New decl.
8927 * program-state.cc (sm_state_map::print): Sort the values. Guard
8928 the printing of pointers with !flag_dump_noaddr.
8929 (program_state::prune_for_point): Sort the regions.
8930 (log_set_of_svalues): Sort the values. Guard the printing of
8931 pointers with !flag_dump_noaddr.
8932 * region-model-manager.cc (log_uniq_map): Sort the values.
8933 * region-model-reachability.cc (dump_set): New function template.
8934 (reachable_regions::dump_to_pp): Use it.
8935 * region-model.h (svalue::cmp_ptr): New decl.
8936 (svalue::cmp_ptr_ptr): New decl.
8937 (setjmp_record::cmp): New decl.
8938 (placeholder_svalue::get_name): New accessor.
8939 (widening_svalue::get_point): New accessor.
8940 (compound_svalue::get_map): New accessor.
8941 (conjured_svalue::get_stmt): New accessor.
8942 (conjured_svalue::get_id_region): New accessor.
8943 (region::cmp_ptrs): Rename to...
8944 (region::cmp_ptr_ptr): ...this.
8945 * region.cc (region::cmp_ptrs): Rename to...
8946 (region::cmp_ptr_ptr): ...this.
8947 * state-purge.cc
8948 (state_purge_per_ssa_name::state_purge_per_ssa_name): Sort
8949 m_points_needing_name when dumping.
8950 * store.cc (concrete_binding::cmp_ptr_ptr): New.
8951 (symbolic_binding::cmp_ptr_ptr): New.
8952 (binding_map::cmp): New.
8953 (get_sorted_parent_regions): Update for renaming of
8954 region::cmp_ptrs to region::cmp_ptr_ptr.
8955 (store::dump_to_pp): Likewise.
8956 (store::to_json): Likewise.
8957 (store::can_merge_p): Sort the base regions before considering
8958 them.
8959 * store.h (concrete_binding::cmp_ptr_ptr): New decl.
8960 (symbolic_binding::cmp_ptr_ptr): New decl.
8961 (binding_map::cmp): New decl.
8962 * supergraph.cc (supergraph::supergraph): Assign UIDs to the
8963 gimple stmts.
8964 * svalue.cc (cmp_cst): New.
8965 (svalue::cmp_ptr): New.
8966 (svalue::cmp_ptr_ptr): New.
8968 2020-10-27 David Malcolm <dmalcolm@redhat.com>
8970 * engine.cc (exploded_graph::get_or_create_node): Fix off-by-one
8971 when imposing param_analyzer_max_enodes_per_program_point limit.
8973 2020-10-27 David Malcolm <dmalcolm@redhat.com>
8975 * region-model.cc (region_model::get_representative_path_var):
8976 Implement case RK_LABEL.
8977 * region-model.h (label_region::get_label): New accessor.
8979 2020-10-22 David Malcolm <dmalcolm@redhat.com>
8981 PR analyzer/97514
8982 * engine.cc (exploded_graph::add_function_entry): Handle failure
8983 to create an enode, rather than asserting.
8985 2020-10-22 David Malcolm <dmalcolm@redhat.com>
8987 PR analyzer/97489
8988 * engine.cc (exploded_graph::add_function_entry): Assert that we
8989 have a function body.
8990 (exploded_graph::on_escaped_function): Reject fndecls that don't
8991 have a function body.
8993 2020-10-14 David Malcolm <dmalcolm@redhat.com>
8995 PR analyzer/93388
8996 * region-model.cc (region_model::get_initial_value_for_global):
8997 Fall back to returning an initial_svalue if
8998 decl_region::get_svalue_for_initializer fails.
8999 * region.cc (decl_region::get_svalue_for_initializer): Don't
9000 attempt to create a compound_svalue if the region has an unknown
9001 size.
9003 2020-10-14 David Malcolm <dmalcolm@redhat.com>
9005 PR analyzer/93723
9006 * store.cc (binding_map::apply_ctor_to_region): Remove redundant
9007 assertion.
9009 2020-10-12 David Malcolm <dmalcolm@redhat.com>
9011 PR analyzer/97258
9012 * engine.cc (impl_region_model_context::on_escaped_function): New
9013 vfunc.
9014 (exploded_graph::add_function_entry): Use m_functions_with_enodes
9015 to implement idempotency.
9016 (add_any_callbacks): New.
9017 (exploded_graph::build_initial_worklist): Use the above to find
9018 callbacks that are reachable from global initializers.
9019 (exploded_graph::on_escaped_function): New.
9020 * exploded-graph.h
9021 (impl_region_model_context::on_escaped_function): New decl.
9022 (exploded_graph::on_escaped_function): New decl.
9023 (exploded_graph::m_functions_with_enodes): New field.
9024 * region-model-reachability.cc
9025 (reachable_regions::reachable_regions): Replace "store" param with
9026 "model" param; use it to initialize m_model.
9027 (reachable_regions::add): When getting the svalue for the region,
9028 call get_store_value on the model rather than using an initial
9029 value.
9030 (reachable_regions::mark_escaped_clusters): Add ctxt param and
9031 use it to call on_escaped_function when a function_region escapes.
9032 * region-model-reachability.h
9033 (reachable_regions::reachable_regions): Replace "store" param with
9034 "model" param.
9035 (reachable_regions::mark_escaped_clusters): Add ctxt param.
9036 (reachable_regions::m_model): New field.
9037 * region-model.cc (region_model::handle_unrecognized_call): Update
9038 for change in reachable_regions ctor.
9039 (region_model::handle_unrecognized_call): Pass ctxt to
9040 mark_escaped_clusters.
9041 (region_model::get_reachable_svalues): Update for change in
9042 reachable_regions ctor.
9043 (region_model::get_initial_value_for_global): Read-only variables
9044 keep their initial values.
9045 * region-model.h (region_model_context::on_escaped_function): New
9046 vfunc.
9047 (noop_region_model_context::on_escaped_function): New.
9049 2020-10-12 David Malcolm <dmalcolm@redhat.com>
9051 * analyzer.opt (Wanalyzer-write-to-const): New.
9052 (Wanalyzer-write-to-string-literal): New.
9053 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
9054 Call check_for_writable_region.
9055 (region_model::impl_call_memset): Likewise.
9056 (region_model::impl_call_strcpy): Likewise.
9057 * region-model.cc (class write_to_const_diagnostic): New.
9058 (class write_to_string_literal_diagnostic): New.
9059 (region_model::check_for_writable_region): New.
9060 (region_model::set_value): Call check_for_writable_region.
9061 * region-model.h (region_model::check_for_writable_region): New
9062 decl.
9064 2020-10-07 David Malcolm <dmalcolm@redhat.com>
9066 PR analyzer/97116
9067 * sm-malloc.cc (method_p): New.
9068 (describe_argument_index): New.
9069 (inform_nonnull_attribute): Use describe_argument_index.
9070 (possible_null_arg::describe_final_event): Likewise.
9071 (null_arg::describe_final_event): Likewise.
9073 2020-09-29 David Malcolm <dmalcolm@redhat.com>
9075 PR analyzer/95188
9076 * engine.cc (stmt_requires_new_enode_p): Split enodes before
9077 "signal" calls.
9079 2020-09-29 David Malcolm <dmalcolm@redhat.com>
9081 * constraint-manager.cc
9082 (constraint_manager::add_constraint_internal): Whitespace fixes.
9083 Silence -Wsign-compare warning.
9084 * engine.cc (maybe_process_run_of_before_supernode_enodes):
9085 Silence -Wsign-compare warning.
9087 2020-09-28 David Malcolm <dmalcolm@redhat.com>
9089 * region-model.h (binop_svalue::dyn_cast_binop_svalue): Remove
9090 redundant "virtual". Add FINAL OVERRIDE.
9091 (widening_svalue::dyn_cast_widening_svalue): Add FINAL OVERRIDE.
9092 (compound_svalue::dyn_cast_compound_svalue): Likewise.
9093 (conjured_svalue::dyn_cast_conjured_svalue): Likewise.
9095 2020-09-28 David Malcolm <dmalcolm@redhat.com>
9097 * diagnostic-manager.cc (null_assignment_sm_context::m_visitor):
9098 Remove unused field.
9100 2020-09-28 David Malcolm <dmalcolm@redhat.com>
9102 PR analyzer/97233
9103 * analyzer.cc (is_longjmp_call_p): Require the initial argument
9104 to be a pointer.
9105 * engine.cc (exploded_node::on_longjmp): Likewise.
9107 2020-09-28 David Malcolm <dmalcolm@redhat.com>
9109 * program-state.cc (sm_state_map::print): Update check
9110 for m_global_state being the start state.
9112 2020-09-26 David Malcolm <dmalcolm@redhat.com>
9114 PR analyzer/96646
9115 PR analyzer/96841
9116 * region-model.cc (region_model::get_representative_path_var):
9117 When handling offset_region, wrap the MEM_REF's first argument in
9118 an ADDR_EXPR of pointer type, rather than simply using the tree
9119 for the parent region. Require the MEM_REF's second argument to
9120 be an integer constant.
9122 2020-09-24 David Malcolm <dmalcolm@redhat.com>
9124 * analyzer.h (struct rejected_constraint): New decl.
9125 * analyzer.opt (fanalyzer-feasibility): New option.
9126 * diagnostic-manager.cc (path_builder::path_builder): Add
9127 "problem" param and use it to initialize new field.
9128 (path_builder::get_feasibility_problem): New accessor.
9129 (path_builder::m_feasibility_problem): New field.
9130 (dedupe_winners::add): Remove inversion of logic in "if" clause,
9131 swapping if/else suites. In the !feasible_p suite, inspect
9132 flag_analyzer_feasibility and add code to handle when this
9133 is off, accepting the infeasible path, but recording the
9134 feasibility_problem.
9135 (diagnostic_manager::emit_saved_diagnostic): Pass the
9136 feasibility_problem to the path_builder.
9137 (diagnostic_manager::add_events_for_eedge): If we have
9138 a feasibility_problem at this edge, use it to add a custom event.
9139 * engine.cc (exploded_path::feasible_p): Pass a
9140 rejected_constraint ** to model.maybe_update_for_edge and transfer
9141 ownership of any created instance to any feasibility_problem.
9142 (feasibility_problem::dump_to_pp): New.
9143 * exploded-graph.h (feasibility_problem::feasibility_problem):
9144 Drop "model" param; add rejected_constraint * param.
9145 (feasibility_problem::~feasibility_problem): New.
9146 (feasibility_problem::dump_to_pp): New decl.
9147 (feasibility_problem::m_model): Drop field.
9148 (feasibility_problem::m_rc): New field.
9149 * program-point.cc (function_point::get_location): Handle
9150 PK_BEFORE_SUPERNODE and PK_AFTER_SUPERNODE.
9151 * program-state.cc (program_state::on_edge): Pass NULL to new
9152 param of region_model::maybe_update_for_edge.
9153 * region-model.cc (region_model::add_constraint): New overload
9154 adding a rejected_constraint ** param.
9155 (region_model::maybe_update_for_edge): Add rejected_constraint **
9156 param and pass it to the various apply_constraints_for_ calls.
9157 (region_model::apply_constraints_for_gcond): Add
9158 rejected_constraint ** param and pass it to add_constraint calls.
9159 (region_model::apply_constraints_for_gswitch): Likewise.
9160 (region_model::apply_constraints_for_exception): Likewise.
9161 (rejected_constraint::dump_to_pp): New.
9162 * region-model.h (region_model::maybe_update_for_edge):
9163 Add rejected_constraint ** param.
9164 (region_model::add_constraint): New overload adding a
9165 rejected_constraint ** param.
9166 (region_model::apply_constraints_for_gcond): Add
9167 rejected_constraint ** param.
9168 (region_model::apply_constraints_for_gswitch): Likewise.
9169 (region_model::apply_constraints_for_exception): Likewise.
9170 (struct rejected_constraint): New.
9172 2020-09-23 David Malcolm <dmalcolm@redhat.com>
9174 PR analyzer/97178
9175 * engine.cc (impl_run_checkers): Update for change to ext_state
9176 ctor.
9177 * program-state.cc (selftest::test_sm_state_map): Pass an engine
9178 instance to ext_state ctor.
9179 (selftest::test_program_state_1): Likewise.
9180 (selftest::test_program_state_2): Likewise.
9181 (selftest::test_program_state_merging): Likewise.
9182 (selftest::test_program_state_merging_2): Likewise.
9183 * program-state.h (extrinsic_state::extrinsic_state): Remove NULL
9184 default value for "eng" param.
9186 2020-09-23 Tobias Burnus <tobias@codesourcery.com>
9188 * analyzer-logging.cc: Guard '#pragma ... ignored "-Wformat-diag"'
9189 by '#if __GNUC__ >= 10'
9190 * analyzer.h: Likewise.
9191 * call-string.cc: Likewise.
9193 2020-09-23 David Malcolm <dmalcolm@redhat.com>
9195 * engine.cc (exploded_node::on_stmt): Replace sequence of dyn_cast
9196 with switch.
9198 2020-09-22 David Malcolm <dmalcolm@redhat.com>
9200 * analysis-plan.cc: Include "json.h".
9201 * analyzer.opt (fdump-analyzer-json): New.
9202 * call-string.cc: Include "json.h".
9203 (call_string::to_json): New.
9204 * call-string.h (call_string::to_json): New decl.
9205 * checker-path.cc: Include "json.h".
9206 * constraint-manager.cc: Include "json.h".
9207 (equiv_class::to_json): New.
9208 (constraint::to_json): New.
9209 (constraint_manager::to_json): New.
9210 * constraint-manager.h (equiv_class::to_json): New decl.
9211 (constraint::to_json): New decl.
9212 (constraint_manager::to_json): New decl.
9213 * diagnostic-manager.cc: Include "json.h".
9214 (saved_diagnostic::to_json): New.
9215 (diagnostic_manager::to_json): New.
9216 * diagnostic-manager.h (saved_diagnostic::to_json): New decl.
9217 (diagnostic_manager::to_json): New decl.
9218 * engine.cc: Include "json.h", <zlib.h>.
9219 (exploded_node::status_to_str): New.
9220 (exploded_node::to_json): New.
9221 (exploded_edge::to_json): New.
9222 (exploded_graph::to_json): New.
9223 (dump_analyzer_json): New.
9224 (impl_run_checkers): Call it.
9225 * exploded-graph.h (exploded_node::status_to_str): New decl.
9226 (exploded_node::to_json): New.
9227 (exploded_edge::to_json): New.
9228 (exploded_graph::to_json): New.
9229 * pending-diagnostic.cc: Include "json.h".
9230 * program-point.cc: Include "json.h".
9231 (program_point::to_json): New.
9232 * program-point.h (program_point::to_json): New decl.
9233 * program-state.cc: Include "json.h".
9234 (extrinsic_state::to_json): New.
9235 (sm_state_map::to_json): New.
9236 (program_state::to_json): New.
9237 * program-state.h (extrinsic_state::to_json): New decl.
9238 (sm_state_map::to_json): New decl.
9239 (program_state::to_json): New decl.
9240 * region-model-impl-calls.cc: Include "json.h".
9241 * region-model-manager.cc: Include "json.h".
9242 * region-model-reachability.cc: Include "json.h".
9243 * region-model.cc: Include "json.h".
9244 * region-model.h (svalue::to_json): New decl.
9245 (region::to_json): New decl.
9246 * region.cc: Include "json.h".
9247 (region::to_json: New.
9248 * sm-file.cc: Include "json.h".
9249 * sm-malloc.cc: Include "json.h".
9250 * sm-pattern-test.cc: Include "json.h".
9251 * sm-sensitive.cc: Include "json.h".
9252 * sm-signal.cc: Include "json.h".
9253 (signal_delivery_edge_info_t::to_json): New.
9254 * sm-taint.cc: Include "json.h".
9255 * sm.cc: Include "diagnostic.h", "tree-diagnostic.h", and
9256 "json.h".
9257 (state_machine::state::to_json): New.
9258 (state_machine::to_json): New.
9259 * sm.h (state_machine::state::to_json): New.
9260 (state_machine::to_json): New.
9261 * state-purge.cc: Include "json.h".
9262 * store.cc: Include "json.h".
9263 (binding_key::get_desc): New.
9264 (binding_map::to_json): New.
9265 (binding_cluster::to_json): New.
9266 (store::to_json): New.
9267 * store.h (binding_key::get_desc): New decl.
9268 (binding_map::to_json): New decl.
9269 (binding_cluster::to_json): New decl.
9270 (store::to_json): New decl.
9271 * supergraph.cc: Include "json.h".
9272 (supergraph::to_json): New.
9273 (supernode::to_json): New.
9274 (superedge::to_json): New.
9275 * supergraph.h (supergraph::to_json): New decl.
9276 (supernode::to_json): New decl.
9277 (superedge::to_json): New decl.
9278 * svalue.cc: Include "json.h".
9279 (svalue::to_json): New.
9281 2020-09-21 David Malcolm <dmalcolm@redhat.com>
9283 PR analyzer/97130
9284 * region-model-impl-calls.cc (call_details::get_arg_type): New.
9285 * region-model.cc (region_model::on_call_pre): Check that the
9286 initial arg is a pointer before calling impl_call_memset and
9287 impl_call_strlen.
9288 * region-model.h (call_details::get_arg_type): New decl.
9290 2020-09-21 David Malcolm <dmalcolm@redhat.com>
9292 PR analyzer/93355
9293 * sm-malloc.cc (malloc_state_machine::get_default_state): Look at
9294 the base region when considering pointers. Treat pointers to
9295 decls as being non-heap.
9297 2020-09-18 David Malcolm <dmalcolm@redhat.com>
9299 * checker-path.cc (warning_event::get_desc): Handle global state
9300 changes.
9302 2020-09-18 David Malcolm <dmalcolm@redhat.com>
9304 * sm-malloc.cc (malloc_state_machine::on_stmt): Handle strdup and
9305 strndup as being malloc-like allocators.
9307 2020-09-16 David Malcolm <dmalcolm@redhat.com>
9309 * engine.cc (strongly_connected_components::strong_connect): Only
9310 consider intraprocedural edges when creating SCCs.
9311 (worklist::key_t::cmp): Add comment. Treat call_string
9312 differences as more important than differences of program_point
9313 within a supernode.
9315 2020-09-16 David Malcolm <dmalcolm@redhat.com>
9317 * engine.cc (supernode_cluster::dump_dot): Show the SCC id
9318 in the per-supernode clusters in FILENAME.eg.dot output.
9319 (exploded_graph_annotator::add_node_annotations):
9320 Show the SCC of the supernode in FILENAME.supernode.eg.dot output.
9321 * exploded-graph.h (worklist::scc_id): New.
9322 (exploded_graph::get_scc_id): New.
9324 2020-09-16 David Malcolm <dmalcolm@redhat.com>
9326 * engine.cc (exploded_node::dump_dot): Show STATUS_BULK_MERGED.
9327 (exploded_graph::process_worklist): Call
9328 maybe_process_run_of_before_supernode_enodes.
9329 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
9330 New.
9331 (exploded_graph_annotator::print_enode): Show STATUS_BULK_MERGED.
9332 * exploded-graph.h (enum exploded_node::status): Add
9333 STATUS_BULK_MERGED.
9335 2020-09-16 David Malcolm <dmalcolm@redhat.com>
9337 * engine.cc
9338 (exploded_graph::process_node) <case PK_BEFORE_SUPERNODE>:
9339 Simplify by using program_point::get_next.
9340 * program-point.cc (program_point::get_next): New.
9341 * program-point.h (program_point::get_next): New decl.
9343 2020-09-16 David Malcolm <dmalcolm@redhat.com>
9345 * engine.cc (exploded_graph::get_or_create_node): Show the
9346 program point when issuing -Wanalyzer-too-complex due to hitting
9347 the per-program-point limit.
9349 2020-09-16 David Malcolm <dmalcolm@redhat.com>
9351 * region-model.cc (region_model::on_call_pre): Treat getchar as
9352 having no side-effects.
9354 2020-09-15 David Malcolm <dmalcolm@redhat.com>
9356 PR analyzer/96650
9357 * constraint-manager.cc (merger_fact_visitor::on_fact): Replace
9358 assertion that add_constraint succeeded with an assertion that
9359 if it fails, -fanalyzer-transitivity is off.
9361 2020-09-14 David Malcolm <dmalcolm@redhat.com>
9363 * analyzer.opt (-param=analyzer-max-constraints=): New param.
9364 * constraint-manager.cc
9365 (constraint_manager::add_constraint_internal): Silently reject
9366 attempts to add constraints when the above limit is reached.
9368 2020-09-14 David Malcolm <dmalcolm@redhat.com>
9370 PR analyzer/96653
9371 * constraint-manager.cc
9372 (constraint_manager::get_or_add_equiv_class): Don't accumulate
9373 transitive closure of all constraints on constants.
9375 2020-09-14 David Malcolm <dmalcolm@redhat.com>
9377 PR analyzer/97029
9378 * analyzer.cc (is_setjmp_call_p): Require the initial arg to be a
9379 pointer.
9380 * region-model.cc (region_model::deref_rvalue): Assert that the
9381 svalue is of pointer type.
9383 2020-09-11 David Malcolm <dmalcolm@redhat.com>
9385 PR analyzer/96798
9386 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
9387 New.
9388 (region_model::impl_call_strcpy): New.
9389 * region-model.cc (region_model::on_call_pre): Flag unhandled
9390 builtins that are non-pure as having unknown side-effects.
9391 Implement BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_STRCPY,
9392 BUILT_IN_STRCPY_CHK, BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED,
9393 BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_FPUTC,
9394 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
9395 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
9396 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR,
9397 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED,
9398 BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF.
9399 * region-model.h (region_model::impl_call_memcpy): New decl.
9400 (region_model::impl_call_strcpy): New decl.
9402 2020-09-09 David Malcolm <dmalcolm@redhat.com>
9404 PR analyzer/94355
9405 * analyzer.opt (Wanalyzer-mismatching-deallocation): New warning.
9406 * region-model-impl-calls.cc
9407 (region_model::impl_call_operator_new): New.
9408 (region_model::impl_call_operator_delete): New.
9409 * region-model.cc (region_model::on_call_pre): Detect operator new
9410 and operator delete.
9411 (region_model::on_call_post): Likewise.
9412 (region_model::maybe_update_for_edge): Detect EH edges and call...
9413 (region_model::apply_constraints_for_exception): New function.
9414 * region-model.h (region_model::impl_call_operator_new): New decl.
9415 (region_model::impl_call_operator_delete): New decl.
9416 (region_model::apply_constraints_for_exception): New decl.
9417 * sm-malloc.cc (enum resource_state): New.
9418 (struct allocation_state): New state subclass.
9419 (enum wording): New.
9420 (struct api): New.
9421 (malloc_state_machine::custom_data_t): New typedef.
9422 (malloc_state_machine::add_state): New decl.
9423 (malloc_state_machine::m_unchecked)
9424 (malloc_state_machine::m_nonnull)
9425 (malloc_state_machine::m_freed): Delete these states in favor
9426 of...
9427 (malloc_state_machine::m_malloc)
9428 (malloc_state_machine::m_scalar_new)
9429 (malloc_state_machine::m_vector_new): ...this new api instances,
9430 which own their own versions of these states.
9431 (malloc_state_machine::on_allocator_call): New decl.
9432 (malloc_state_machine::on_deallocator_call): New decl.
9433 (api::api): New ctor.
9434 (dyn_cast_allocation_state): New.
9435 (as_a_allocation_state): New.
9436 (get_rs): New.
9437 (unchecked_p): New.
9438 (nonnull_p): New.
9439 (freed_p): New.
9440 (malloc_diagnostic::describe_state_change): Use unchecked_p and
9441 nonnull_p.
9442 (class mismatching_deallocation): New.
9443 (double_free::double_free): Add funcname param for initializing
9444 m_funcname.
9445 (double_free::emit): Use m_funcname in warning message rather
9446 than hardcoding "free".
9447 (double_free::describe_state_change): Likewise. Use freed_p.
9448 (double_free::describe_call_with_state): Use freed_p.
9449 (double_free::describe_final_event): Use m_funcname in message
9450 rather than hardcoding "free".
9451 (double_free::m_funcname): New field.
9452 (possible_null::describe_state_change): Use unchecked_p.
9453 (possible_null::describe_return_of_state): Likewise.
9454 (use_after_free::use_after_free): Add param for initializing m_api.
9455 (use_after_free::emit): Use m_api->m_dealloc_funcname in message
9456 rather than hardcoding "free".
9457 (use_after_free::describe_state_change): Use freed_p. Change the
9458 wording of the message based on the API.
9459 (use_after_free::describe_final_event): Use
9460 m_api->m_dealloc_funcname in message rather than hardcoding
9461 "free". Change the wording of the message based on the API.
9462 (use_after_free::m_api): New field.
9463 (malloc_leak::describe_state_change): Use unchecked_p. Update
9464 for renaming of m_malloc_event to m_alloc_event.
9465 (malloc_leak::describe_final_event): Update for renaming of
9466 m_malloc_event to m_alloc_event.
9467 (malloc_leak::m_malloc_event): Rename...
9468 (malloc_leak::m_alloc_event): ...to this.
9469 (free_of_non_heap::free_of_non_heap): Add param for initializing
9470 m_funcname.
9471 (free_of_non_heap::emit): Use m_funcname in message rather than
9472 hardcoding "free".
9473 (free_of_non_heap::describe_final_event): Likewise.
9474 (free_of_non_heap::m_funcname): New field.
9475 (allocation_state::dump_to_pp): New.
9476 (allocation_state::get_nonnull): New.
9477 (malloc_state_machine::malloc_state_machine): Update for changes
9478 to state fields and new api fields.
9479 (malloc_state_machine::add_state): New.
9480 (malloc_state_machine::on_stmt): Move malloc/calloc handling to
9481 on_allocator_call and call it, passing in the API pointer.
9482 Likewise for free, moving it to on_deallocator_call. Handle calls
9483 to operator new and delete in an analogous way. Use unchecked_p
9484 when testing for possibly-null-arg and possibly-null-deref, and
9485 transition to the non-null for the correct API. Remove redundant
9486 node param from call to on_zero_assignment. Use freed_p for
9487 use-after-free check, and pass in API.
9488 (malloc_state_machine::on_allocator_call): New, based on code in
9489 on_stmt.
9490 (malloc_state_machine::on_deallocator_call): Likewise.
9491 (malloc_state_machine::on_phi): Mark node param with
9492 ATTRIBUTE_UNUSED; don't pass it to on_zero_assignment.
9493 (malloc_state_machine::on_condition): Mark node param with
9494 ATTRIBUTE_UNUSED. Replace on_transition calls with get_state and
9495 set_next_state pairs, transitioning to the non-null state for the
9496 appropriate API.
9497 (malloc_state_machine::can_purge_p): Port to new state approach.
9498 (malloc_state_machine::on_zero_assignment): Replace on_transition
9499 calls with get_state and set_next_state pairs. Drop redundant
9500 node param.
9501 * sm.h (state_machine::add_custom_state): New.
9503 2020-09-09 David Malcolm <dmalcolm@redhat.com>
9505 * diagnostic-manager.cc
9506 (null_assignment_sm_context::warn_for_state): Replace with...
9507 (null_assignment_sm_context::warn): ...this.
9508 * engine.cc (impl_sm_context::warn_for_state): Replace with...
9509 (impl_sm_context::warn): ...this.
9510 * sm-file.cc (fileptr_state_machine::on_stmt): Replace
9511 warn_for_state and on_transition calls with a get_state
9512 test guarding warn and set_next_state calls.
9513 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
9514 * sm-pattern-test.cc (pattern_test_state_machine::on_condition):
9515 Replace warn_for_state call with warn call.
9516 * sm-sensitive.cc
9517 (sensitive_state_machine::warn_for_any_exposure): Replace
9518 warn_for_state call with a get_state test guarding a warn call.
9519 * sm-signal.cc (signal_state_machine::on_stmt): Likewise.
9520 * sm-taint.cc (taint_state_machine::on_stmt): Replace
9521 warn_for_state and on_transition calls with a get_state
9522 test guarding warn and set_next_state calls.
9523 * sm.h (sm_context::warn_for_state): Replace with...
9524 (sm_context::warn): ...this.
9526 2020-09-09 David Malcolm <dmalcolm@redhat.com>
9528 * diagnostic-manager.cc
9529 (null_assignment_sm_context::null_assignment_sm_context): Add old_state
9530 and ext_state params, initializing m_old_state and m_ext_state.
9531 (null_assignment_sm_context::on_transition): Split into...
9532 (null_assignment_sm_context::get_state): ...this new vfunc
9533 implementation and...
9534 (null_assignment_sm_context::set_next_state): ...this new vfunc
9535 implementation.
9536 (null_assignment_sm_context::m_old_state): New field.
9537 (null_assignment_sm_context::m_ext_state): New field.
9538 (diagnostic_manager::add_events_for_eedge): Pass in old state and
9539 ext_state when creating sm_ctxt.
9540 * engine.cc (impl_sm_context::on_transition): Split into...
9541 (impl_sm_context::get_state): ...this new vfunc
9542 implementation and...
9543 (impl_sm_context::set_next_state): ...this new vfunc
9544 implementation.
9545 * sm.h (sm_context::get_state): New pure virtual function.
9546 (sm_context::set_next_state): Likewise.
9547 (sm_context::on_transition): Convert from a pure virtual function
9548 to a regular function implemented in terms of get_state and
9549 set_next_state.
9551 2020-09-09 David Malcolm <dmalcolm@redhat.com>
9553 * checker-path.cc (state_change_event::get_desc): Update
9554 state_machine::get_state_name calls to state::get_name.
9555 (warning_event::get_desc): Likewise.
9556 * diagnostic-manager.cc
9557 (null_assignment_sm_context::on_transition): Update comparison
9558 against 0 with comparison with m_sm.get_start_state.
9559 (diagnostic_manager::prune_for_sm_diagnostic): Update
9560 state_machine::get_state_name calls to state::get_name.
9561 * engine.cc (impl_sm_context::on_transition): Likewise.
9562 (exploded_node::get_dot_fillcolor): Use get_id when summing
9563 the sm states.
9564 * program-state.cc (sm_state_map::sm_state_map): Don't hardcode
9565 0 as the start state when initializing m_global_state.
9566 (sm_state_map::print): Use dump_to_pp rather than get_state_name
9567 when dumping states.
9568 (sm_state_map::is_empty_p): Don't hardcode 0 as the start state
9569 when examining m_global_state.
9570 (sm_state_map::hash): Use get_id when hashing states.
9571 (selftest::test_sm_state_map): Use state objects rather than
9572 arbitrary hardcoded integers.
9573 (selftest::test_program_state_merging): Likewise.
9574 (selftest::test_program_state_merging_2): Likewise.
9575 * sm-file.cc (fileptr_state_machine::m_start): Move to base class.
9576 (file_diagnostic::describe_state_change): Use get_start_state.
9577 (fileptr_state_machine::fileptr_state_machine): Drop m_start
9578 initialization.
9579 * sm-malloc.cc (malloc_state_machine::m_start): Move to base
9580 class.
9581 (malloc_diagnostic::describe_state_change): Use get_start_state.
9582 (possible_null::describe_state_change): Likewise.
9583 (malloc_state_machine::malloc_state_machine): Drop m_start
9584 initialization.
9585 * sm-pattern-test.cc (pattern_test_state_machine::m_start): Move
9586 to base class.
9587 (pattern_test_state_machine::pattern_test_state_machine): Drop
9588 m_start initialization.
9589 * sm-sensitive.cc (sensitive_state_machine::m_start): Move to base
9590 class.
9591 (sensitive_state_machine::sensitive_state_machine): Drop m_start
9592 initialization.
9593 * sm-signal.cc (signal_state_machine::m_start): Move to base
9594 class.
9595 (signal_state_machine::signal_state_machine): Drop m_start
9596 initialization.
9597 * sm-taint.cc (taint_state_machine::m_start): Move to base class.
9598 (taint_state_machine::taint_state_machine): Drop m_start
9599 initialization.
9600 * sm.cc (state_machine::state::dump_to_pp): New.
9601 (state_machine::state_machine): Move here from sm.h. Initialize
9602 m_next_state_id and m_start.
9603 (state_machine::add_state): Reimplement in terms of state objects.
9604 (state_machine::get_state_name): Delete.
9605 (state_machine::get_state_by_name): Reimplement in terms of state
9606 objects. Make const.
9607 (state_machine::validate): Delete.
9608 (state_machine::dump_to_pp): Reimplement in terms of state
9609 objects.
9610 * sm.h (state_machine::state): New class.
9611 (state_machine::state_t): Convert typedef from "unsigned" to
9612 "const state_machine::state *".
9613 (state_machine::state_machine): Move to sm.cc.
9614 (state_machine::get_default_state): Use m_start rather than
9615 hardcoding 0.
9616 (state_machine::get_state_name): Delete.
9617 (state_machine::get_state_by_name): Make const.
9618 (state_machine::get_start_state): New accessor.
9619 (state_machine::alloc_state_id): New.
9620 (state_machine::m_state_names): Drop in favor of...
9621 (state_machine::m_states): New field
9622 (state_machine::m_start): New field
9623 (start_start_p): Delete.
9625 2020-09-08 David Malcolm <dmalcolm@redhat.com>
9627 PR analyzer/96949
9628 * store.cc (binding_map::apply_ctor_val_to_range): Add
9629 error-handling for the cases where we have symbolic offsets.
9631 2020-09-08 David Malcolm <dmalcolm@redhat.com>
9633 PR analyzer/96950
9634 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
9635 where min_index == max_index.
9636 (binding_map::apply_ctor_val_to_range): Replace assertion that we
9637 don't have a CONSTRUCTOR value with error-handling.
9639 2020-09-08 David Malcolm <dmalcolm@redhat.com>
9641 PR analyzer/96962
9642 * region-model.cc (region_model::on_call_pre): Fix guard on switch
9643 on built-ins to only consider BUILT_IN_NORMAL, rather than other
9644 kinds of build-ins.
9646 2020-09-01 David Malcolm <dmalcolm@redhat.com>
9648 PR analyzer/96792
9649 * region-model.cc (region_model::deref_rvalue): Add the constraint
9650 that PTR_SVAL is non-NULL.
9652 2020-08-31 David Malcolm <dmalcolm@redhat.com>
9654 PR analyzer/96798
9655 * region-model.cc (region_model::on_call_pre): Handle
9656 BUILT_IN_MEMSET_CHK.
9658 2020-08-31 David Malcolm <dmalcolm@redhat.com>
9660 * region-model.cc (region_model::on_call_pre): Gather handling of
9661 builtins and of internal fns into switch statements. Handle
9662 "alloca" and BUILT_IN_ALLOCA_WITH_ALIGN.
9664 2020-08-31 David Malcolm <dmalcolm@redhat.com>
9666 PR analyzer/96860
9667 * region.cc (decl_region::get_svalue_for_constructor): Support
9668 apply_ctor_to_region failing.
9669 * store.cc (binding_map::apply_ctor_to_region): Add failure
9670 handling.
9671 (binding_map::apply_ctor_val_to_range): Likewise.
9672 (binding_map::apply_ctor_pair_to_child_region): Likewise. Replace
9673 assertion that child_base_offset is not symbolic with error
9674 handling.
9675 * store.h (binding_map::apply_ctor_to_region): Convert return type
9676 from void to bool.
9677 (binding_map::apply_ctor_val_to_range): Likewise.
9678 (binding_map::apply_ctor_pair_to_child_region): Likewise.
9680 2020-08-31 David Malcolm <dmalcolm@redhat.com>
9682 PR analyzer/96763
9683 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
9684 by calling a new binding_map::apply_ctor_val_to_range subroutine.
9685 Split out the existing non-CONSTRUCTOR-handling code to a new
9686 apply_ctor_pair_to_child_region subroutine.
9687 (binding_map::apply_ctor_val_to_range): New.
9688 (binding_map::apply_ctor_pair_to_child_region): New, split out
9689 from binding_map::apply_ctor_to_region as noted above.
9690 * store.h (binding_map::apply_ctor_val_to_range): New decl.
9691 (binding_map::apply_ctor_pair_to_child_region): New decl.
9693 2020-08-31 David Malcolm <dmalcolm@redhat.com>
9695 PR analyzer/96764
9696 * region-model-manager.cc
9697 (region_model_manager::maybe_fold_unaryop): Handle VIEW_CONVERT_EXPR.
9698 (region_model_manager::get_or_create_cast): Move logic for
9699 real->integer casting to...
9700 (get_code_for_cast): ...this new function, and add logic for
9701 real->non-integer casts.
9702 (region_model_manager::maybe_fold_sub_svalue): Handle
9703 VIEW_CONVERT_EXPR.
9704 * region-model.cc
9705 (region_model::add_any_constraints_from_gassign): Likewise.
9706 * svalue.cc (svalue::maybe_undo_cast): Likewise.
9707 (unaryop_svalue::dump_to_pp): Likewise.
9709 2020-08-26 David Malcolm <dmalcolm@redhat.com>
9711 PR analyzer/94858
9712 * region-model-manager.cc
9713 (region_model_manager::get_or_create_widening_svalue): Assert that
9714 neither of the inputs are themselves widenings.
9715 * store.cc (store::eval_alias_1): The initial value of a pointer
9716 can't point to a region that was allocated on the heap after the
9717 beginning of the path. A widened pointer value can't alias anything
9718 that the initial pointer value can't alias.
9719 * svalue.cc (svalue::can_merge_p): Merge BINOP (X, OP, CST) with X
9720 to a widening svalue. Merge
9721 BINOP(WIDENING(BASE, BINOP(BASE, X)), X) and BINOP(BASE, X) to
9722 to the LHS of the first BINOP.
9724 2020-08-26 David Malcolm <dmalcolm@redhat.com>
9726 PR analyzer/96777
9727 * region-model.h (class compound_svalue): Document that all keys
9728 must be concrete.
9729 (compound_svalue::compound_svalue): Move definition to svalue.cc.
9730 * store.cc (binding_map::apply_ctor_to_region): Handle
9731 initializers for trailing arrays with incomplete size.
9732 * svalue.cc (compound_svalue::compound_svalue): Move definition
9733 here from region-model.h. Add assertion that all keys are
9734 concrete.
9736 2020-08-22 David Malcolm <dmalcolm@redhat.com>
9738 PR analyzer/94851
9739 * region-model-manager.cc
9740 (region_model_manager::maybe_fold_binop): Fold bitwise "& 0" to 0.
9742 2020-08-22 David Malcolm <dmalcolm@redhat.com>
9744 * store.cc (store::eval_alias): Make const. Split out 2nd half
9745 into store::eval_alias_1 and call it twice for symmetry, avoiding
9746 test duplication.
9747 (store::eval_alias_1): New function, split out from the above.
9748 * store.h (store::eval_alias): Make const.
9749 (store::eval_alias_1): New decl.
9751 2020-08-22 David Malcolm <dmalcolm@redhat.com>
9753 * region-model.cc (region_model::push_frame): Bind the default
9754 SSA name for each parm if it exists, falling back to the parm
9755 itself otherwise, rather than doing both.
9757 2020-08-20 David Malcolm <dmalcolm@redhat.com>
9759 PR analyzer/96723
9760 * region-model-manager.cc
9761 (region_model_manager::get_field_region): Assert that field is a
9762 FIELD_DECL.
9763 * region.cc (region::get_subregions_for_binding): In
9764 union-handling, filter the TYPE_FIELDS traversal to just FIELD_DECLs.
9766 2020-08-20 David Malcolm <dmalcolm@redhat.com>
9768 PR analyzer/96713
9769 * region-model.cc (region_model::get_gassign_result): For
9770 comparisons, only use eval_condition when the lhs has boolean
9771 type, and use get_or_create_constant_svalue on the boolean
9772 constants directly rather than via get_rvalue.
9774 2020-08-19 David Malcolm <dmalcolm@redhat.com>
9776 PR analyzer/96643
9777 * region-model.cc (region_model::deref_rvalue): Rather than
9778 attempting to handle all svalue kinds in the switch, only cover
9779 the special cases, and move symbolic-region handling to after
9780 the switch, thus implicitly handling the missing case SK_COMPOUND.
9782 2020-08-19 David Malcolm <dmalcolm@redhat.com>
9784 PR analyzer/96705
9785 * region-model-manager.cc
9786 (region_model_manager::maybe_fold_binop): Check that we have an
9787 integral type before calling build_int_cst.
9789 2020-08-19 David Malcolm <dmalcolm@redhat.com>
9791 PR analyzer/96699
9792 * region-model-manager.cc
9793 (region_model_manager::get_or_create_cast): Use FIX_TRUNC_EXPR for
9794 casting from REAL_TYPE to INTEGER_TYPE.
9796 2020-08-19 David Malcolm <dmalcolm@redhat.com>
9798 PR analyzer/96651
9799 * region-model.cc (region_model::called_from_main_p): New.
9800 (region_model::get_store_value): Move handling for globals into...
9801 (region_model::get_initial_value_for_global): ...this new
9802 function, and add logic for extracting values from decl
9803 initializers.
9804 * region-model.h (decl_region::get_svalue_for_constructor): New
9805 decl.
9806 (decl_region::get_svalue_for_initializer): New decl.
9807 (region_model::called_from_main_p): New decl.
9808 (region_model::get_initial_value_for_global): New.
9809 * region.cc (decl_region::maybe_get_constant_value): Move logic
9810 for getting an svalue from a CONSTRUCTOR node to...
9811 (decl_region::get_svalue_for_constructor): ...this new function.
9812 (decl_region::get_svalue_for_initializer): New.
9813 * store.cc (get_svalue_for_ctor_val): Rewrite in terms of
9814 region_model::get_rvalue.
9815 * store.h (binding_cluster::get_map): New accessor.
9817 2020-08-19 David Malcolm <dmalcolm@redhat.com>
9819 PR analyzer/96648
9820 * region.cc (get_field_at_bit_offset): Gracefully handle negative
9821 values for bit_offset.
9823 2020-08-18 David Malcolm <dmalcolm@redhat.com>
9825 * region-model.cc (region_model::get_rvalue_1): Fix name of local.
9827 2020-08-18 David Malcolm <dmalcolm@redhat.com>
9829 PR analyzer/96641
9830 * region-model.cc (region_model::get_rvalue_1): Handle
9831 unrecognized tree codes by returning "UNKNOWN.
9833 2020-08-18 David Malcolm <dmalcolm@redhat.com>
9835 PR analyzer/96640
9836 * region-model.cc (region_model::get_gassign_result): Handle various
9837 VEC_* tree codes by returning UNKNOWN.
9838 (region_model::on_assignment): Handle unrecognized tree codes by
9839 setting lhs to an unknown value, rather than issuing a "sorry" and
9840 asserting.
9842 2020-08-17 David Malcolm <dmalcolm@redhat.com>
9844 PR analyzer/96644
9845 * region-model-manager.cc (get_region_for_unexpected_tree_code):
9846 Handle ctxt being NULL.
9848 2020-08-17 David Malcolm <dmalcolm@redhat.com>
9850 PR analyzer/96639
9851 * region.cc (region::get_subregions_for_binding): Check for "type"
9852 being NULL.
9854 2020-08-17 David Malcolm <dmalcolm@redhat.com>
9856 PR analyzer/96642
9857 * store.cc (get_svalue_for_ctor_val): New.
9858 (binding_map::apply_ctor_to_region): Call it.
9860 2020-08-14 David Malcolm <dmalcolm@redhat.com>
9862 PR testsuite/96609
9863 PR analyzer/96616
9864 * region-model.cc (region_model::get_store_value): Call
9865 maybe_get_constant_value on decl_regions first.
9866 * region-model.h (decl_region::maybe_get_constant_value): New decl.
9867 * region.cc (decl_region::get_stack_depth): Likewise.
9868 (decl_region::maybe_get_constant_value): New.
9869 * store.cc (get_subregion_within_ctor): New.
9870 (binding_map::apply_ctor_to_region): New.
9871 * store.h (binding_map::apply_ctor_to_region): New decl.
9873 2020-08-14 David Malcolm <dmalcolm@redhat.com>
9875 PR analyzer/96611
9876 * store.cc (store::mark_as_escaped): Reject attempts to
9877 get a cluster for an unknown pointer.
9879 2020-08-13 David Malcolm <dmalcolm@redhat.com>
9881 PR analyzer/93032
9882 PR analyzer/93938
9883 PR analyzer/94011
9884 PR analyzer/94099
9885 PR analyzer/94399
9886 PR analyzer/94458
9887 PR analyzer/94503
9888 PR analyzer/94640
9889 PR analyzer/94688
9890 PR analyzer/94689
9891 PR analyzer/94839
9892 PR analyzer/95026
9893 PR analyzer/95042
9894 PR analyzer/95240
9895 * analyzer-logging.cc: Ignore "-Wformat-diag".
9896 (logger::enter_scope): Use inc_indent in both overloads.
9897 (logger::exit_scope): Use dec_indent.
9898 * analyzer-logging.h (logger::inc_indent): New.
9899 (logger::dec_indent): New.
9900 * analyzer-selftests.cc (run_analyzer_selftests): Call
9901 analyzer_store_cc_tests.
9902 * analyzer-selftests.h (analyzer_store_cc_tests): New decl.
9903 * analyzer.cc (get_stmt_location): New function.
9904 * analyzer.h (class initial_svalue): New forward decl.
9905 (class unaryop_svalue): New forward decl.
9906 (class binop_svalue): New forward decl.
9907 (class sub_svalue): New forward decl.
9908 (class unmergeable_svalue): New forward decl.
9909 (class placeholder_svalue): New forward decl.
9910 (class widening_svalue): New forward decl.
9911 (class compound_svalue): New forward decl.
9912 (class conjured_svalue): New forward decl.
9913 (svalue_set): New typedef.
9914 (class map_region): Delete.
9915 (class array_region): Delete.
9916 (class frame_region): New forward decl.
9917 (class function_region): New forward decl.
9918 (class label_region): New forward decl.
9919 (class decl_region): New forward decl.
9920 (class element_region): New forward decl.
9921 (class offset_region): New forward decl.
9922 (class cast_region): New forward decl.
9923 (class field_region): New forward decl.
9924 (class string_region): New forward decl.
9925 (class region_model_manager): New forward decl.
9926 (class store_manager): New forward decl.
9927 (class store): New forward decl.
9928 (class call_details): New forward decl.
9929 (struct svalue_id_merger_mapping): Delete.
9930 (struct canonicalization): Delete.
9931 (class function_point): New forward decl.
9932 (class engine): New forward decl.
9933 (dump_tree): New function decl.
9934 (print_quoted_type): New function decl.
9935 (readability_comparator): New function decl.
9936 (tree_cmp): New function decl.
9937 (class path_var): Move here from region-model.h
9938 (bit_offset_t, bit_size_t, byte_size_t): New typedefs.
9939 (class region_offset): New class.
9940 (get_stmt_location): New decl.
9941 (struct member_function_hash_traits): New struct.
9942 (class consolidation_map): New class.
9943 Ignore "-Wformat-diag".
9944 * analyzer.opt (-param=analyzer-max-svalue-depth=): New param.
9945 (-param=analyzer-max-enodes-for-full-dump=): New param.
9946 * call-string.cc: Ignore -Wformat-diag.
9947 * checker-path.cc: Move includes of "analyzer/call-string.h" and
9948 "analyzer/program-point.h" to before "analyzer/region-model.h",
9949 and also include "analyzer/store.h" before it.
9950 (state_change_event::state_change_event): Replace "tree var" param
9951 with "const svalue *sval". Convert "origin" param from tree to
9952 "const svalue *".
9953 (state_change_event::get_desc): Call get_representative_tree to
9954 convert the var and origin from const svalue * to tree. Use
9955 svalue::get_desc rather than %qE when describing state changes.
9956 (checker_path::add_final_event): Use get_stmt_location.
9957 * checker-path.h (state_change_event::state_change_event): Port
9958 from tree to const svalue *.
9959 (state_change_event::get_lvalue): Delete.
9960 (state_change_event::get_dest_function): New.
9961 (state_change_event::m_var): Replace with...
9962 (state_change_event::m_sval): ...this.
9963 (state_change_event::m_origin): Convert from tree to
9964 const svalue *.
9965 * constraint-manager.cc: Include "analyzer/call-string.h",
9966 "analyzer/program-point.h", and "analyzer/store.h" before
9967 "analyzer/region-model.h".
9968 (struct bound, struct range): Move to constraint-manager.h.
9969 (compare_constants): New function.
9970 (range::dump): Rename to...
9971 (range::dump_to_pp): ...this. Support NULL constants.
9972 (range::dump): Reintroduce for dumping to stderr.
9973 (range::constrained_to_single_element): Return result, rather than
9974 writing to *OUT.
9975 (range::eval_condition): New.
9976 (range::below_lower_bound): New.
9977 (range::above_upper_bound): New.
9978 (equiv_class::equiv_class): Port from svalue_id to const svalue *.
9979 (equiv_class::print): Likewise.
9980 (equiv_class::hash): Likewise.
9981 (equiv_class::operator==): Port from svalue_id to const svalue *.
9982 (equiv_class::add): Port from svalue_id to const svalue *. Drop
9983 "cm" param.
9984 (equiv_class::del): Port from svalue_id to const svalue *.
9985 (equiv_class::get_representative): Likewise.
9986 (equiv_class::remap_svalue_ids): Delete.
9987 (svalue_id_cmp_by_id): Rename to...
9988 (svalue_cmp_by_ptr): ...this, porting from svalue_id to
9989 const svalue *.
9990 (equiv_class::canonicalize): Update qsort comparator.
9991 (constraint::implied_by): New.
9992 (constraint_manager::constraint_manager): Copy m_mgr in copy ctor.
9993 (constraint_manager::dump_to_pp): Add "multiline" param
9994 (constraint_manager::dump): Pass "true" for "multiline".
9995 (constraint_manager::add_constraint): Port from svalue_id to
9996 const svalue *. Split out second part into...
9997 (constraint_manager::add_unknown_constraint): ...this new
9998 function. Remove self-constraints when merging equivalence
9999 classes.
10000 (constraint_manager::add_constraint_internal): Remove constraints
10001 that would be implied by the new constraint. Port from svalue_id
10002 to const svalue *.
10003 (constraint_manager::get_equiv_class_by_sid): Rename to...
10004 (constraint_manager::get_equiv_class_by_svalue): ...this, porting
10005 from svalue_id to const svalue *.
10006 (constraint_manager::get_or_add_equiv_class): Port from svalue_id
10007 to const svalue *.
10008 (constraint_manager::eval_condition): Make const. Call
10009 compare_constants and return early if it provides a known result.
10010 (constraint_manager::get_ec_bounds): New.
10011 (constraint_manager::eval_condition): New overloads. Make
10012 existing one const, and use compare_constants.
10013 (constraint_manager::purge): Convert "p" param to a template
10014 rather that an abstract base class. Port from svalue_id to
10015 const svalue *.
10016 (class dead_svalue_purger): New class.
10017 (constraint_manager::remap_svalue_ids): Delete.
10018 (constraint_manager::on_liveness_change): New.
10019 (equiv_class_cmp): Port from svalue_id to const svalue *.
10020 (constraint_manager::canonicalize): Likewise. Combine with
10021 purging of redundant equivalence classes and constraints.
10022 (class cleaned_constraint_manager): Delete.
10023 (class merger_fact_visitor): Make "m_cm_b" const. Add "m_merger"
10024 field.
10025 (merger_fact_visitor::fact): Port from svalue_id to const svalue *.
10026 Add special case for widening.
10027 (constraint_manager::merge): Port from svalue_id to const svalue *.
10028 (constraint_manager::clean_merger_input): Delete.
10029 (constraint_manager::for_each_fact): Port from svalue_id to
10030 const svalue *.
10031 (constraint_manager::validate): Likewise.
10032 (selftest::test_constraint_conditions): Provide a
10033 region_model_manager when creating region_model instances.
10034 Add test for self-equality not creating equivalence classes.
10035 (selftest::test_transitivity): Provide a region_model_manager when
10036 creating region_model instances. Verify that EC-merging happens
10037 when constraints are implied.
10038 (selftest::test_constant_comparisons): Provide a
10039 region_model_manager when creating region_model instances.
10040 (selftest::test_constraint_impl): Likewise. Remove over-specified
10041 assertions.
10042 (selftest::test_equality): Provide a region_model_manager when
10043 creating region_model instances.
10044 (selftest::test_many_constants): Likewise. Provide a
10045 program_point when testing merging.
10046 (selftest::run_constraint_manager_tests): Move call to
10047 test_constant_comparisons to outside the transitivity guard.
10048 * constraint-manager.h (struct bound): Move here from
10049 constraint-manager.cc.
10050 (struct range): Likewise.
10051 (struct::eval_condition): New decl.
10052 (struct::below_lower_bound): New decl.
10053 (struct::above_upper_bound): New decl.
10054 (equiv_class::add): Port from svalue_id to const svalue *.
10055 (equiv_class::del): Likewise.
10056 (equiv_class::get_representative): Likewise.
10057 (equiv_class::remap_svalue_ids): Drop.
10058 (equiv_class::m_cst_sid): Convert to..
10059 (equiv_class::m_cst_sval): ...this.
10060 (equiv_class::m_vars): Port from svalue_id to const svalue *.
10061 (constraint::bool implied_by): New decl.
10062 (fact_visitor::on_fact): Port from svalue_id to const svalue *.
10063 (constraint_manager::constraint_manager): Add mgr param.
10064 (constraint_manager::clone): Delete.
10065 (constraint_manager::maybe_get_constant): Delete.
10066 (constraint_manager::get_sid_for_constant): Delete.
10067 (constraint_manager::get_num_svalues): Delete.
10068 (constraint_manager::dump_to_pp): Add "multiline" param.
10069 (constraint_manager::get_equiv_class): Port from svalue_id to
10070 const svalue *.
10071 (constraint_manager::add_constraint): Likewise.
10072 (constraint_manager::get_equiv_class_by_sid): Rename to...
10073 (constraint_manager::get_equiv_class_by_svalue): ...this, porting
10074 from svalue_id to const svalue *.
10075 (constraint_manager::add_unknown_constraint): New decl.
10076 (constraint_manager::get_or_add_equiv_class): Port from svalue_id
10077 to const svalue *.
10078 (constraint_manager::eval_condition): Likewise. Add overloads.
10079 (constraint_manager::get_ec_bounds): New decl.
10080 (constraint_manager::purge): Convert to template.
10081 (constraint_manager::remap_svalue_ids): Delete.
10082 (constraint_manager::on_liveness_change): New decl.
10083 (constraint_manager::canonicalize): Drop param.
10084 (constraint_manager::clean_merger_input): Delete.
10085 (constraint_manager::m_mgr): New field.
10086 * diagnostic-manager.cc: Move includes of
10087 "analyzer/call-string.h" and "analyzer/program-point.h" to before
10088 "analyzer/region-model.h", and also include "analyzer/store.h"
10089 before it.
10090 (saved_diagnostic::saved_diagnostic): Add "sval" param.
10091 (diagnostic_manager::diagnostic_manager): Add engine param.
10092 (diagnostic_manager::add_diagnostic): Add "sval" param, passing it
10093 to saved_diagnostic ctor. Update overload to pass NULL for it.
10094 (dedupe_winners::dedupe_winners): Add engine param.
10095 (dedupe_winners::add): Add "eg" param. Pass m_engine to
10096 feasible_p.
10097 (dedupe_winner::m_engine): New field.
10098 (diagnostic_manager::emit_saved_diagnostics): Pass engine to
10099 dedupe_winners. Pass &eg when adding candidates. Pass svalue
10100 rather than tree to prune_path. Use get_stmt_location to get
10101 primary location of diagnostic.
10102 (diagnostic_manager::emit_saved_diagnostic): Likewise.
10103 (get_any_origin): Drop.
10104 (state_change_event_creator::on_global_state_change): Pass NULL
10105 const svalue * rather than NULL_TREE trees to state_change_event
10106 ctor.
10107 (state_change_event_creator::on_state_change): Port from tree and
10108 svalue_id to const svalue *.
10109 (for_each_state_change): Port from svalue_id to const svalue *.
10110 (struct null_assignment_sm_context): New.
10111 (diagnostic_manager::add_events_for_eedge): Add state change
10112 events for assignment to NULL.
10113 (diagnostic_manager::prune_path): Update param from tree to
10114 const svalue *.
10115 (diagnostic_manager::prune_for_sm_diagnostic): Port from tracking
10116 by tree to by const svalue *.
10117 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add sval
10118 param.
10119 (saved_diagnostic::m_sval): New field.
10120 (diagnostic_manager::diagnostic_manager): Add engine param.
10121 (diagnostic_manager::get_engine): New.
10122 (diagnostic_manager::add_diagnostic): Add "sval" param.
10123 (diagnostic_manager::prune_path): Likewise.
10124 (diagnostic_manager::prune_for_sm_diagnostic): New overload.
10125 (diagnostic_manager::m_eng): New field.
10126 * engine.cc: Move includes of "analyzer/call-string.h" and
10127 "analyzer/program-point.h" to before "analyzer/region-model.h",
10128 and also include "analyzer/store.h" before it.
10129 (impl_region_model_context::impl_region_model_context): Update for
10130 removal of m_change field.
10131 (impl_region_model_context::remap_svalue_ids): Delete.
10132 (impl_region_model_context::on_svalue_leak): New.
10133 (impl_region_model_context::on_svalue_purge): Delete.
10134 (impl_region_model_context::on_liveness_change): New.
10135 (impl_region_model_context::on_unknown_change): Update param
10136 from svalue_id to const svalue *. Add is_mutable param.
10137 (setjmp_svalue::compare_fields): Delete.
10138 (setjmp_svalue::accept): New.
10139 (setjmp_svalue::add_to_hash): Delete.
10140 (setjmp_svalue::dump_to_pp): New.
10141 (setjmp_svalue::print_details): Delete.
10142 (impl_sm_context::impl_sm_context): Drop "change" param.
10143 (impl_sm_context::get_fndecl_for_call): Drop "m_change".
10144 (impl_sm_context::on_transition): Drop ATTRIBUTE_UNUSED from
10145 "stmt" param. Drop m_change. Port from svalue_id to
10146 const svalue *.
10147 (impl_sm_context::warn_for_state): Drop m_change. Port from
10148 svalue_id to const svalue *.
10149 (impl_sm_context::get_readable_tree): Rename to...
10150 (impl_sm_context::get_diagnostic_tree): ...this. Port from
10151 svalue_id to const svalue *.
10152 (impl_sm_context::is_zero_assignment): New.
10153 (impl_sm_context::m_change): Delete field.
10154 (leak_stmt_finder::find_stmt): Handle m_var being NULL.
10155 (readability): Increase penalty for MEM_REF. For SSA_NAMEs,
10156 slightly favor the underlying var over the SSA name. Heavily
10157 penalize temporaries. Handle RESULT_DECL.
10158 (readability_comparator): Make non-static. Consider stack depths.
10159 (impl_region_model_context::on_state_leak): Convert from svalue_id
10160 to const svalue *, updating for region_model changes. Use
10161 id_equal.
10162 (impl_region_model_context::on_inherited_svalue): Delete.
10163 (impl_region_model_context::on_cast): Delete.
10164 (impl_region_model_context::on_condition): Drop m_change.
10165 (impl_region_model_context::on_phi): Likewise.
10166 (impl_region_model_context::on_unexpected_tree_code): Handle t
10167 being NULL.
10168 (point_and_state::validate): Update stack checking for
10169 region_model changes.
10170 (eg_traits::dump_args_t::show_enode_details_p): New.
10171 (exploded_node::exploded_node): Initialize m_num_processed_stmts.
10172 (exploded_node::get_processed_stmt): New function.
10173 (exploded_node::get_dot_fillcolor): Add more colors.
10174 (exploded_node::dump_dot): Guard the printing of the point and
10175 state with show_enode_details_p. Print the processed stmts for
10176 this enode after the initial state.
10177 (exploded_node::dump_to_pp): Pass true for new multiline param
10178 of program_state::dump_to_pp.
10179 (exploded_node::on_stmt): Drop "change" param. Log the stmt.
10180 Set input_location. Implement __analyzer_describe. Update
10181 implementation of __analyzer_dump and __analyzer_eval.
10182 Remove purging of sm-state for unknown fncalls from here.
10183 (exploded_node::on_edge): Drop "change" param.
10184 (exploded_node::on_longjmp): Port from region_id/svalue_id to
10185 const region */const svalue *. Call program_state::detect_leaks.
10186 Drop state_change.
10187 (exploded_node::detect_leaks): Update for changes to region_model.
10188 Call program_state::detect_leaks.
10189 (exploded_edge::exploded_edge): Drop ext_state and change params.
10190 (exploded_edge::dump_dot): "args" is no longer used. Drop dumping
10191 of m_change.
10192 (exploded_graph::exploded_graph): Pass engine to
10193 m_diagnostic_manager ctor. Use program_point::origin.
10194 (exploded_graph::add_function_entry): Drop ctxt. Use
10195 program_state::push_frame. Drop state_change.
10196 (exploded_graph::get_or_create_node): Drop "change" param. Add
10197 "enode_for_diag" param. Update dumping calls for API changes.
10198 Pass point to can_merge_with_p. Show enode indices
10199 within -Wanalyzer-too-complex diagnostic for hitting the per-point
10200 limit.
10201 (exploded_graph::add_edge): Drop "change" param. Log which nodes
10202 are being connected. Update for changes to exploded_edge ctor.
10203 (exploded_graph::get_per_program_point_data): New.
10204 (exploded_graph::process_worklist): Pass point to
10205 can_merge_with_p. Drop state_change. Update dumping call for API
10206 change.
10207 (exploded_graph::process_node): Drop state_change. Split the
10208 node in-place if an sm-state-change occurs. Update
10209 m_num_processed_stmts. Update dumping calls for API change.
10210 (exploded_graph::log_stats): Call engine::log_stats.
10211 (exploded_graph::dump_states_for_supernode): Update dumping
10212 call.
10213 (exploded_path::feasible_p): Add "eng" and "eg" params.
10214 Rename "i" to "end_idx". Pass the manager to the region_model
10215 ctor. Update for every processed stmt in the enode, not just the
10216 first. Keep track of which snodes have been visited, and call
10217 loop_replay_fixup when revisiting one.
10218 (enode_label::get_text): Update dump call for new param.
10219 (exploded_graph::dump_exploded_nodes): Likewise.
10220 (exploded_graph::get_node_by_index): New.
10221 (impl_run_checkers): Create engine instance and pass its address
10222 to extrinsic_state ctor.
10223 * exploded-graph.h
10224 (impl_region_model_context::impl_region_model_context): Drop
10225 "change" params.
10226 (impl_region_model_context::void remap_svalue_ids): Delete.
10227 (impl_region_model_context::on_svalue_purge): Delete.
10228 (impl_region_model_context::on_svalue_leak): New.
10229 (impl_region_model_context::on_liveness_change): New.
10230 (impl_region_model_context::on_state_leak): Update signature.
10231 (impl_region_model_context::on_inherited_svalue): Delete.
10232 (impl_region_model_context::on_cast): Delete.
10233 (impl_region_model_context::on_unknown_change): Update signature.
10234 (impl_region_model_context::m_change): Delete.
10235 (eg_traits::dump_args_t::show_enode_details_p): New.
10236 (exploded_node::on_stmt): Drop "change" param.
10237 (exploded_node::on_edge): Likewise.
10238 (exploded_node::get_processed_stmt): New decl.
10239 (exploded_node::m_num_processed_stmts): New field.
10240 (exploded_edge::exploded_edge): Drop ext_state and change params.
10241 (exploded_edge::m_change): Delete.
10242 (exploded_graph::get_engine): New accessor.
10243 (exploded_graph::get_or_create_node): Drop "change" param. Add
10244 "enode_for_diag" param.
10245 (exploded_graph::add_edge): Drop "change" param.
10246 (exploded_graph::get_per_program_point_data): New decl.
10247 (exploded_graph::get_node_by_index): New decl.
10248 (exploded_path::feasible_p): Add "eng" and "eg" params.
10249 * program-point.cc: Include "analyzer/store.h" before including
10250 "analyzer/region-model.h".
10251 (function_point::function_point): Move here from
10252 program-point.h.
10253 (function_point::get_function): Likewise.
10254 (function_point::from_function_entry): Likewise.
10255 (function_point::before_supernode): Likewise.
10256 (function_point::next_stmt): New function.
10257 * program-point.h (function_point::function_point): Move
10258 implementation from here to program-point.cc.
10259 (function_point::get_function): Likewise.
10260 (function_point::from_function_entry): Likewise.
10261 (function_point::before_supernode): Likewise.
10262 (function_point::next_stmt): New decl.
10263 (program_point::operator!=): New.
10264 (program_point::origin): New.
10265 (program_point::next_stmt): New.
10266 (program_point::m_function_point): Make non-const.
10267 * program-state.cc: Move includes of "analyzer/call-string.h" and
10268 "analyzer/program-point.h" to before "analyzer/region-model.h",
10269 and also include "analyzer/store.h" before it.
10270 (extrinsic_state::get_model_manager): New.
10271 (sm_state_map::sm_state_map): Pass in sm and sm_idx to ctor,
10272 rather than pass the around.
10273 (sm_state_map::clone_with_remapping): Delete.
10274 (sm_state_map::print): Remove "sm" param in favor of "m_sm". Add
10275 "simple" and "multiline" params and support multiline vs single
10276 line dumping.
10277 (sm_state_map::dump): Remove "sm" param in favor of "m_sm". Add
10278 "simple" param.
10279 (sm_state_map::hash): Port from svalue_id to const svalue *.
10280 (sm_state_map::operator==): Likewise.
10281 (sm_state_map::get_state): Likewise. Call canonicalize_svalue on
10282 input. Handle inheritance of sm-state. Call get_default_state.
10283 (sm_state_map::get_origin): Port from svalue_id to const svalue *.
10284 (sm_state_map::set_state): Likewise. Pass in ext_state. Reject
10285 attempts to set state on UNKNOWN.
10286 (sm_state_map::impl_set_state): Port from svalue_id to
10287 const svalue *. Pass in ext_state. Call canonicalize_svalue on
10288 input.
10289 (sm_state_map::purge_for_unknown_fncall): Delete.
10290 (sm_state_map::on_svalue_leak): New.
10291 (sm_state_map::remap_svalue_ids): Delete.
10292 (sm_state_map::on_liveness_change): New.
10293 (sm_state_map::on_unknown_change): Reimplement.
10294 (sm_state_map::on_svalue_purge): Delete.
10295 (sm_state_map::on_inherited_svalue): Delete.
10296 (sm_state_map::on_cast): Delete.
10297 (sm_state_map::validate): Delete.
10298 (sm_state_map::canonicalize_svalue): New.
10299 (program_state::program_state): Update to pass manager to
10300 region_model's ctor. Constify num_states and pass state machine
10301 and index to sm_state_map ctor.
10302 (program_state::print): Update for changes to dump API.
10303 (program_state::dump_to_pp): Ignore the summarize param. Add
10304 "multiline" param.
10305 (program_state::dump_to_file): Add "multiline" param.
10306 (program_state::dump): Pass "true" for new "multiline" param.
10307 (program_state::push_frame): New.
10308 (program_state::on_edge): Drop "change" param. Call
10309 program_state::detect_leaks.
10310 (program_state::prune_for_point): Add enode_for_diag param.
10311 Reimplement based on store class. Call detect_leaks
10312 (program_state::remap_svalue_ids): Delete.
10313 (program_state::get_representative_tree): Port from svalue_id to
10314 const svalue *.
10315 (program_state::can_merge_with_p): Add "point" param. Add early
10316 reject for sm-differences. Drop id remapping.
10317 (program_state::validate): Drop region model and sm_state_map
10318 validation.
10319 (state_change::sm_change::dump): Delete.
10320 (state_change::sm_change::remap_svalue_ids): Delete.
10321 (state_change::sm_change::on_svalue_purge): Delete.
10322 (log_set_of_svalues): New.
10323 (state_change::sm_change::validate): Delete.
10324 (state_change::state_change): Delete.
10325 (state_change::add_sm_change): Delete.
10326 (state_change::affects_p): Delete.
10327 (state_change::dump): Delete.
10328 (state_change::remap_svalue_ids): Delete.
10329 (state_change::on_svalue_purge): Delete.
10330 (state_change::validate): Delete.
10331 (selftest::assert_dump_eq): Delete.
10332 (ASSERT_DUMP_EQ): Delete.
10333 (selftest::test_sm_state_map): Update for changes to region_model
10334 and sm_state_map, porting from svalue_id to const svalue *.
10335 (selftest::test_program_state_dumping): Likewise. Drop test of
10336 dumping, renaming to...
10337 (selftest::test_program_state_1): ...this.
10338 (selftest::test_program_state_dumping_2): Likewise, renaming to...
10339 (selftest::test_program_state_2): ...this.
10340 (selftest::test_program_state_merging): Update for changes to
10341 region_model.
10342 (selftest::test_program_state_merging_2): Likewise.
10343 (selftest::analyzer_program_state_cc_tests): Update for renamed
10344 tests.
10345 * program-state.h (extrinsic_state::extrinsic_state): Add logger
10346 and engine params.
10347 (extrinsic_state::get_logger): New accessor.
10348 (extrinsic_state::get_engine): New accessor.
10349 (extrinsic_state::get_model_manager): New accessor.
10350 (extrinsic_state::m_logger): New field.
10351 (extrinsic_state::m_engine): New field.
10352 (struct default_hash_traits<svalue_id>): Delete.
10353 (pod_hash_traits<svalue_id>::hash): Delete.
10354 (pod_hash_traits<svalue_id>::equal): Delete.
10355 (pod_hash_traits<svalue_id>::mark_deleted): Delete.
10356 (pod_hash_traits<svalue_id>::mark_empty): Delete.
10357 (pod_hash_traits<svalue_id>::is_deleted): Delete.
10358 (pod_hash_traits<svalue_id>::is_empty): Delete.
10359 (sm_state_map::entry_t::entry_t): Port from svalue_id to
10360 const svalue *.
10361 (sm_state_map::entry_t::m_origin): Likewise.
10362 (sm_state_map::map_t): Likewise.
10363 (sm_state_map::sm_state_map): Add state_machine and index params.
10364 (sm_state_map::clone_with_remapping): Delete.
10365 (sm_state_map::print): Drop sm param; add simple and multiline
10366 params.
10367 (sm_state_map::dump): Drop sm param; add simple param.
10368 (sm_state_map::get_state): Port from svalue_id to const svalue *.
10369 Add ext_state param.
10370 (sm_state_map::get_origin): Likewise.
10371 (sm_state_map::set_state): Likewise.
10372 (sm_state_map::impl_set_state): Likewise.
10373 (sm_state_map::purge_for_unknown_fncall): Delete.
10374 (sm_state_map::remap_svalue_ids): Delete.
10375 (sm_state_map::on_svalue_purge): Delete.
10376 (sm_state_map::on_svalue_leak): New.
10377 (sm_state_map::on_liveness_change): New.
10378 (sm_state_map::on_inherited_svalue): Delete.
10379 (sm_state_map::on_cast): Delete.
10380 (sm_state_map::validate): Delete.
10381 (sm_state_map::on_unknown_change): Port from svalue_id to
10382 const svalue *. Add is_mutable and ext_state params.
10383 (sm_state_map::canonicalize_svalue): New.
10384 (sm_state_map::m_sm): New field.
10385 (sm_state_map::m_sm_idx): New field.
10386 (program_state::operator=): Delete.
10387 (program_state::dump_to_pp): Drop "summarize" param, adding
10388 "simple" and "multiline".
10389 (program_state::dump_to_file): Likewise.
10390 (program_state::dump): Rename "summarize" to "simple".
10391 (program_state::push_frame): New.
10392 (program_state::get_current_function): New.
10393 (program_state::on_edge): Drop "change" param.
10394 (program_state::prune_for_point): Likewise. Add enode_for_diag
10395 param.
10396 (program_state::remap_svalue_ids): Delete.
10397 (program_state::get_representative_tree): Port from svalue_id to
10398 const svalue *.
10399 (program_state::can_purge_p): Likewise. Pass ext_state to get_state.
10400 (program_state::can_merge_with_p): Add point param.
10401 (program_state::detect_leaks): New.
10402 (state_change_visitor::on_state_change): Port from tree and
10403 svalue_id to a pair of const svalue *.
10404 (class state_change): Delete.
10405 * region.cc: New file.
10406 * region-model-impl-calls.cc: New file.
10407 * region-model-manager.cc: New file.
10408 * region-model-reachability.cc: New file.
10409 * region-model-reachability.h: New file.
10410 * region-model.cc: Include "analyzer/call-string.h",
10411 "analyzer/program-point.h", and "analyzer/store.h" before
10412 "analyzer/region-model.h". Include
10413 "analyzer/region-model-reachability.h".
10414 (dump_tree): Make non-static.
10415 (dump_quoted_tree): Make non-static.
10416 (print_quoted_type): Make non-static.
10417 (path_var::dump): Delete.
10418 (dump_separator): Delete.
10419 (class impl_constraint_manager): Delete.
10420 (svalue_id::print): Delete.
10421 (svalue_id::dump_node_name_to_pp): Delete.
10422 (svalue_id::validate): Delete.
10423 (region_id::print): Delete.
10424 (region_id::dump_node_name_to_pp): Delete.
10425 (region_id::validate): Delete.
10426 (region_id_set::region_id_set): Delete.
10427 (svalue_id_set::svalue_id_set): Delete.
10428 (svalue::operator==): Delete.
10429 (svalue::hash): Delete.
10430 (svalue::print): Delete.
10431 (svalue::dump_dot_to_pp): Delete.
10432 (svalue::remap_region_ids): Delete.
10433 (svalue::walk_for_canonicalization): Delete.
10434 (svalue::get_child_sid): Delete.
10435 (svalue::maybe_get_constant): Delete.
10436 (region_svalue::compare_fields): Delete.
10437 (region_svalue::add_to_hash): Delete.
10438 (region_svalue::print_details): Delete.
10439 (region_svalue::dump_dot_to_pp): Delete.
10440 (region_svalue::remap_region_ids): Delete.
10441 (region_svalue::merge_values): Delete.
10442 (region_svalue::walk_for_canonicalization): Delete.
10443 (region_svalue::eval_condition): Delete.
10444 (constant_svalue::compare_fields): Delete.
10445 (constant_svalue::add_to_hash): Delete.
10446 (constant_svalue::merge_values): Delete.
10447 (constant_svalue::eval_condition): Move to svalue.cc.
10448 (constant_svalue::print_details): Delete.
10449 (constant_svalue::get_child_sid): Delete.
10450 (unknown_svalue::compare_fields): Delete.
10451 (unknown_svalue::add_to_hash): Delete.
10452 (unknown_svalue::print_details): Delete.
10453 (poison_kind_to_str): Move to svalue.cc.
10454 (poisoned_svalue::compare_fields): Delete.
10455 (poisoned_svalue::add_to_hash): Delete.
10456 (poisoned_svalue::print_details): Delete.
10457 (region_kind_to_str): Move to region.cc and reimplement.
10458 (region::operator==): Delete.
10459 (region::get_parent_region): Delete.
10460 (region::set_value): Delete.
10461 (region::become_active_view): Delete.
10462 (region::deactivate_any_active_view): Delete.
10463 (region::deactivate_view): Delete.
10464 (region::get_value): Delete.
10465 (region::get_inherited_child_sid): Delete.
10466 (region_model::copy_region): Delete.
10467 (region_model::copy_struct_region): Delete.
10468 (region_model::copy_union_region): Delete.
10469 (region_model::copy_array_region): Delete.
10470 (region::hash): Delete.
10471 (region::print): Delete.
10472 (region::dump_dot_to_pp): Delete.
10473 (region::dump_to_pp): Delete.
10474 (region::dump_child_label): Delete.
10475 (region::validate): Delete.
10476 (region::remap_svalue_ids): Delete.
10477 (region::remap_region_ids): Delete.
10478 (region::add_view): Delete.
10479 (region::get_view): Delete.
10480 (region::region): Move to region.cc.
10481 (region::add_to_hash): Delete.
10482 (region::print_fields): Delete.
10483 (region::non_null_p): Delete.
10484 (primitive_region::clone): Delete.
10485 (primitive_region::walk_for_canonicalization): Delete.
10486 (map_region::map_region): Delete.
10487 (map_region::compare_fields): Delete.
10488 (map_region::print_fields): Delete.
10489 (map_region::validate): Delete.
10490 (map_region::dump_dot_to_pp): Delete.
10491 (map_region::dump_child_label): Delete.
10492 (map_region::get_or_create): Delete.
10493 (map_region::get): Delete.
10494 (map_region::add_to_hash): Delete.
10495 (map_region::remap_region_ids): Delete.
10496 (map_region::unbind): Delete.
10497 (map_region::get_tree_for_child_region): Delete.
10498 (map_region::get_tree_for_child_region): Delete.
10499 (tree_cmp): Move to region.cc.
10500 (map_region::can_merge_p): Delete.
10501 (map_region::walk_for_canonicalization): Delete.
10502 (map_region::get_value_by_name): Delete.
10503 (struct_or_union_region::valid_key_p): Delete.
10504 (struct_or_union_region::compare_fields): Delete.
10505 (struct_region::clone): Delete.
10506 (struct_region::compare_fields): Delete.
10507 (union_region::clone): Delete.
10508 (union_region::compare_fields): Delete.
10509 (frame_region::compare_fields): Delete.
10510 (frame_region::clone): Delete.
10511 (frame_region::valid_key_p): Delete.
10512 (frame_region::print_fields): Delete.
10513 (frame_region::add_to_hash): Delete.
10514 (globals_region::compare_fields): Delete.
10515 (globals_region::clone): Delete.
10516 (globals_region::valid_key_p): Delete.
10517 (code_region::compare_fields): Delete.
10518 (code_region::clone): Delete.
10519 (code_region::valid_key_p): Delete.
10520 (array_region::array_region): Delete.
10521 (array_region::get_element): Delete.
10522 (array_region::clone): Delete.
10523 (array_region::compare_fields): Delete.
10524 (array_region::print_fields): Delete.
10525 (array_region::validate): Delete.
10526 (array_region::dump_dot_to_pp): Delete.
10527 (array_region::dump_child_label): Delete.
10528 (array_region::get_or_create): Delete.
10529 (array_region::get): Delete.
10530 (array_region::add_to_hash): Delete.
10531 (array_region::remap_region_ids): Delete.
10532 (array_region::get_key_for_child_region): Delete.
10533 (array_region::key_cmp): Delete.
10534 (array_region::walk_for_canonicalization): Delete.
10535 (array_region::key_from_constant): Delete.
10536 (array_region::constant_from_key): Delete.
10537 (function_region::compare_fields): Delete.
10538 (function_region::clone): Delete.
10539 (function_region::valid_key_p): Delete.
10540 (stack_region::stack_region): Delete.
10541 (stack_region::compare_fields): Delete.
10542 (stack_region::clone): Delete.
10543 (stack_region::print_fields): Delete.
10544 (stack_region::dump_child_label): Delete.
10545 (stack_region::validate): Delete.
10546 (stack_region::push_frame): Delete.
10547 (stack_region::get_current_frame_id): Delete.
10548 (stack_region::pop_frame): Delete.
10549 (stack_region::add_to_hash): Delete.
10550 (stack_region::remap_region_ids): Delete.
10551 (stack_region::can_merge_p): Delete.
10552 (stack_region::walk_for_canonicalization): Delete.
10553 (stack_region::get_value_by_name): Delete.
10554 (heap_region::heap_region): Delete.
10555 (heap_region::compare_fields): Delete.
10556 (heap_region::clone): Delete.
10557 (heap_region::walk_for_canonicalization): Delete.
10558 (root_region::root_region): Delete.
10559 (root_region::compare_fields): Delete.
10560 (root_region::clone): Delete.
10561 (root_region::print_fields): Delete.
10562 (root_region::validate): Delete.
10563 (root_region::dump_child_label): Delete.
10564 (root_region::push_frame): Delete.
10565 (root_region::get_current_frame_id): Delete.
10566 (root_region::pop_frame): Delete.
10567 (root_region::ensure_stack_region): Delete.
10568 (root_region::get_stack_region): Delete.
10569 (root_region::ensure_globals_region): Delete.
10570 (root_region::get_code_region): Delete.
10571 (root_region::ensure_code_region): Delete.
10572 (root_region::get_globals_region): Delete.
10573 (root_region::ensure_heap_region): Delete.
10574 (root_region::get_heap_region): Delete.
10575 (root_region::remap_region_ids): Delete.
10576 (root_region::can_merge_p): Delete.
10577 (root_region::add_to_hash): Delete.
10578 (root_region::walk_for_canonicalization): Delete.
10579 (root_region::get_value_by_name): Delete.
10580 (symbolic_region::symbolic_region): Delete.
10581 (symbolic_region::compare_fields): Delete.
10582 (symbolic_region::clone): Delete.
10583 (symbolic_region::walk_for_canonicalization): Delete.
10584 (symbolic_region::print_fields): Delete.
10585 (region_model::region_model): Add region_model_manager * param.
10586 Reimplement in terms of store, dropping impl_constraint_manager
10587 subclass.
10588 (region_model::operator=): Reimplement in terms of store
10589 (region_model::operator==): Likewise.
10590 (region_model::hash): Likewise.
10591 (region_model::print): Delete.
10592 (region_model::print_svalue): Delete.
10593 (region_model::dump_dot_to_pp): Delete.
10594 (region_model::dump_dot_to_file): Delete.
10595 (region_model::dump_dot): Delete.
10596 (region_model::dump_to_pp): Replace "summarize" param with
10597 "simple" and "multiline". Port to store-based implementation.
10598 (region_model::dump): Replace "summarize" param with "simple" and
10599 "multiline".
10600 (dump_vec_of_tree): Delete.
10601 (region_model::dump_summary_of_rep_path_vars): Delete.
10602 (region_model::validate): Delete.
10603 (svalue_id_cmp_by_constant_svalue_model): Delete.
10604 (svalue_id_cmp_by_constant_svalue): Delete.
10605 (region_model::canonicalize): Drop "ctxt" param. Reimplement in
10606 terms of store and constraints.
10607 (region_model::canonicalized_p): Remove NULL arg to canonicalize.
10608 (region_model::loop_replay_fixup): New.
10609 (poisoned_value_diagnostic::emit): Tweak wording of warnings.
10610 (region_model::check_for_poison): Delete.
10611 (region_model::get_gassign_result): New.
10612 (region_model::on_assignment): Port to store-based implementation.
10613 (region_model::on_call_pre): Delete calls to check_for_poison.
10614 Move implementations to region-model-impl-calls.c and port to
10615 store-based implementation.
10616 (region_model::on_call_post): Likewise.
10617 (class reachable_regions): Move to region-model-reachability.h/cc
10618 and port to store-based implementation.
10619 (region_model::handle_unrecognized_call): Port to store-based
10620 implementation.
10621 (region_model::get_reachable_svalues): New.
10622 (region_model::on_setjmp): Port to store-based implementation.
10623 (region_model::on_longjmp): Likewise.
10624 (region_model::handle_phi): Drop is_back_edge param and the logic
10625 using it.
10626 (region_model::get_lvalue_1): Port from region_id to const region *.
10627 (region_model::make_region_for_unexpected_tree_code): Delete.
10628 (assert_compat_types): If the check fails, use internal_error to
10629 show the types.
10630 (region_model::get_lvalue): Port from region_id to const region *.
10631 (region_model::get_rvalue_1): Port from svalue_id to const svalue *.
10632 (region_model::get_rvalue): Likewise.
10633 (region_model::get_or_create_ptr_svalue): Delete.
10634 (region_model::get_or_create_constant_svalue): Delete.
10635 (region_model::get_svalue_for_fndecl): Delete.
10636 (region_model::get_region_for_fndecl): Delete.
10637 (region_model::get_svalue_for_label): Delete.
10638 (region_model::get_region_for_label): Delete.
10639 (build_cast): Delete.
10640 (region_model::maybe_cast_1): Delete.
10641 (region_model::maybe_cast): Delete.
10642 (region_model::get_field_region): Delete.
10643 (region_model::get_store_value): New.
10644 (region_model::region_exists_p): New.
10645 (region_model::deref_rvalue): Port from svalue_id to const svalue *.
10646 (region_model::set_value): Likewise.
10647 (region_model::clobber_region): New.
10648 (region_model::purge_region): New.
10649 (region_model::zero_fill_region): New.
10650 (region_model::mark_region_as_unknown): New.
10651 (region_model::eval_condition): Port from svalue_id to
10652 const svalue *.
10653 (region_model::eval_condition_without_cm): Likewise.
10654 (region_model::compare_initial_and_pointer): New.
10655 (region_model::add_constraint): Port from svalue_id to
10656 const svalue *.
10657 (region_model::maybe_get_constant): Delete.
10658 (region_model::get_representative_path_var): New.
10659 (region_model::add_new_malloc_region): Delete.
10660 (region_model::get_representative_tree): Port to const svalue *.
10661 (region_model::get_representative_path_var): Port to
10662 const region *.
10663 (region_model::get_path_vars_for_svalue): Delete.
10664 (region_model::set_to_new_unknown_value): Delete.
10665 (region_model::update_for_phis): Don't pass is_back_edge to handle_phi.
10666 (region_model::update_for_call_superedge): Port from svalue_id to
10667 const svalue *.
10668 (region_model::update_for_return_superedge): Port to store-based
10669 implementation.
10670 (region_model::update_for_call_summary): Replace
10671 set_to_new_unknown_value with mark_region_as_unknown.
10672 (region_model::get_root_region): Delete.
10673 (region_model::get_stack_region_id): Delete.
10674 (region_model::push_frame): Delete.
10675 (region_model::get_current_frame_id): Delete.
10676 (region_model::get_current_function): Delete.
10677 (region_model::pop_frame): Delete.
10678 (region_model::on_top_level_param): New.
10679 (region_model::get_stack_depth): Delete.
10680 (region_model::get_function_at_depth): Delete.
10681 (region_model::get_globals_region_id): Delete.
10682 (region_model::add_svalue): Delete.
10683 (region_model::replace_svalue): Delete.
10684 (region_model::add_region): Delete.
10685 (region_model::get_svalue): Delete.
10686 (region_model::get_region): Delete.
10687 (make_region_for_type): Delete.
10688 (region_model::add_region_for_type): Delete.
10689 (region_model::on_top_level_param): New.
10690 (class restrict_to_used_svalues): Delete.
10691 (region_model::purge_unused_svalues): Delete.
10692 (region_model::push_frame): New.
10693 (region_model::remap_svalue_ids): Delete.
10694 (region_model::remap_region_ids): Delete.
10695 (region_model::purge_regions): Delete.
10696 (region_model::get_descendents): Delete.
10697 (region_model::delete_region_and_descendents): Delete.
10698 (region_model::poison_any_pointers_to_bad_regions): Delete.
10699 (region_model::can_merge_with_p): Delete.
10700 (region_model::get_current_function): New.
10701 (region_model::get_value_by_name): Delete.
10702 (region_model::convert_byte_offset_to_array_index): Delete.
10703 (region_model::pop_frame): New.
10704 (region_model::get_or_create_mem_ref): Delete.
10705 (region_model::get_stack_depth): New.
10706 (region_model::get_frame_at_index): New.
10707 (region_model::unbind_region_and_descendents): New.
10708 (struct bad_pointer_finder): New.
10709 (region_model::get_or_create_pointer_plus_expr): Delete.
10710 (region_model::poison_any_pointers_to_descendents): New.
10711 (region_model::get_or_create_view): Delete.
10712 (region_model::can_merge_with_p): New.
10713 (region_model::get_fndecl_for_call): Port from svalue_id to
10714 const svalue *.
10715 (struct append_ssa_names_cb_data): New.
10716 (get_ssa_name_regions_for_current_frame): New.
10717 (region_model::append_ssa_names_cb): New.
10718 (model_merger::dump_to_pp): Add "simple" param. Drop dumping of
10719 remappings.
10720 (model_merger::dump): Add "simple" param to both overloads.
10721 (model_merger::can_merge_values_p): Delete.
10722 (model_merger::record_regions): Delete.
10723 (model_merger::record_svalues): Delete.
10724 (svalue_id_merger_mapping::svalue_id_merger_mapping): Delete.
10725 (svalue_id_merger_mapping::dump_to_pp): Delete.
10726 (svalue_id_merger_mapping::dump): Delete.
10727 (region_model::create_region_for_heap_alloc): New.
10728 (region_model::create_region_for_alloca): New.
10729 (region_model::record_dynamic_extents): New.
10730 (canonicalization::canonicalization): Delete.
10731 (canonicalization::walk_rid): Delete.
10732 (canonicalization::walk_sid): Delete.
10733 (canonicalization::dump_to_pp): Delete.
10734 (canonicalization::dump): Delete.
10735 (inchash::add): Delete overloads for svalue_id and region_id.
10736 (engine::log_stats): New.
10737 (assert_condition): Add overload comparing svalues.
10738 (assert_dump_eq): Pass "true" for multiline.
10739 (selftest::test_dump): Update for rewrite of region_model.
10740 (selftest::test_dump_2): Rename to...
10741 (selftest::test_struct): ...this. Provide a region_model_manager
10742 when creating region_model instance. Remove dump test. Add
10743 checks for get_offset.
10744 (selftest::test_dump_3): Rename to...
10745 (selftest::test_array_1): ...this. Provide a region_model_manager
10746 when creating region_model instance. Remove dump test.
10747 (selftest::test_get_representative_tree): Port from svalue_id to
10748 new API. Add test coverage for various expressions.
10749 (selftest::test_unique_constants): Provide a region_model_manager
10750 for the region_model. Add test coverage for comparing const vs
10751 non-const.
10752 (selftest::test_svalue_equality): Delete.
10753 (selftest::test_region_equality): Delete.
10754 (selftest::test_unique_unknowns): New.
10755 (class purge_all_svalue_ids): Delete.
10756 (class purge_one_svalue_id): Delete.
10757 (selftest::test_purging_by_criteria): Delete.
10758 (selftest::test_initial_svalue_folding): New.
10759 (selftest::test_unaryop_svalue_folding): New.
10760 (selftest::test_binop_svalue_folding): New.
10761 (selftest::test_sub_svalue_folding): New.
10762 (selftest::test_purge_unused_svalues): Delete.
10763 (selftest::test_descendent_of_p): New.
10764 (selftest::test_assignment): Provide a region_model_manager for
10765 the region_model. Drop the dump test.
10766 (selftest::test_compound_assignment): Likewise.
10767 (selftest::test_stack_frames): Port to new implementation.
10768 (selftest::test_get_representative_path_var): Likewise.
10769 (selftest::test_canonicalization_1): Rename to...
10770 (selftest::test_equality_1): ...this. Port to new API, and add
10771 (selftest::test_canonicalization_2): Provide a
10772 region_model_manager when creating region_model instances.
10773 Remove redundant canicalization.
10774 (selftest::test_canonicalization_3): Provide a
10775 region_model_manager when creating region_model instances.
10776 Remove param from calls to region_model::canonicalize.
10777 (selftest::test_canonicalization_4): Likewise.
10778 (selftest::assert_region_models_merge): Constify
10779 out_merged_svalue. Port to new API.
10780 (selftest::test_state_merging): Provide a
10781 region_model_manager when creating region_model instances.
10782 Provide a program_point point when merging them. Replace
10783 set_to_new_unknown_value with usage of placeholder_svalues.
10784 Drop get_value_by_name. Port from svalue_id to const svalue *.
10785 Add test of heap allocation.
10786 (selftest::test_constraint_merging): Provide a
10787 region_model_manager when creating region_model instances.
10788 Provide a program_point point when merging them. Eliminate use
10789 of set_to_new_unknown_value.
10790 (selftest::test_widening_constraints): New.
10791 (selftest::test_iteration_1): New.
10792 (selftest::test_malloc_constraints): Port to store-based
10793 implementation.
10794 (selftest::test_var): New test.
10795 (selftest::test_array_2): New test.
10796 (selftest::test_mem_ref): New test.
10797 (selftest::test_POINTER_PLUS_EXPR_then_MEM_REF): New.
10798 (selftest::test_malloc): New.
10799 (selftest::test_alloca): New.
10800 (selftest::analyzer_region_model_cc_tests): Update for renamings.
10801 Call new functions.
10802 * region-model.h (class path_var): Move to analyzer.h.
10803 (class svalue_id): Delete.
10804 (class region_id): Delete.
10805 (class id_map): Delete.
10806 (svalue_id_map): Delete.
10807 (region_id_map): Delete.
10808 (id_map<T>::id_map): Delete.
10809 (id_map<T>::put): Delete.
10810 (id_map<T>::get_dst_for_src): Delete.
10811 (id_map<T>::get_src_for_dst): Delete.
10812 (id_map<T>::dump_to_pp): Delete.
10813 (id_map<T>::dump): Delete.
10814 (id_map<T>::update): Delete.
10815 (one_way_svalue_id_map): Delete.
10816 (one_way_region_id_map): Delete.
10817 (class region_id_set): Delete.
10818 (class svalue_id_set): Delete.
10819 (struct complexity): New.
10820 (class visitor): New.
10821 (enum svalue_kind): Add SK_SETJMP, SK_INITIAL, SK_UNARYOP,
10822 SK_BINOP, SK_SUB,SK_UNMERGEABLE, SK_PLACEHOLDER, SK_WIDENING,
10823 SK_COMPOUND, and SK_CONJURED.
10824 (svalue::operator==): Delete.
10825 (svalue::operator!=): Delete.
10826 (svalue::clone): Delete.
10827 (svalue::hash): Delete.
10828 (svalue::dump_dot_to_pp): Delete.
10829 (svalue::dump_to_pp): New.
10830 (svalue::dump): New.
10831 (svalue::get_desc): New.
10832 (svalue::dyn_cast_initial_svalue): New.
10833 (svalue::dyn_cast_unaryop_svalue): New.
10834 (svalue::dyn_cast_binop_svalue): New.
10835 (svalue::dyn_cast_sub_svalue): New.
10836 (svalue::dyn_cast_unmergeable_svalue): New.
10837 (svalue::dyn_cast_widening_svalue): New.
10838 (svalue::dyn_cast_compound_svalue): New.
10839 (svalue::dyn_cast_conjured_svalue): New.
10840 (svalue::maybe_undo_cast): New.
10841 (svalue::unwrap_any_unmergeable): New.
10842 (svalue::remap_region_ids): Delete
10843 (svalue::can_merge_p): New.
10844 (svalue::walk_for_canonicalization): Delete
10845 (svalue::get_complexity): New.
10846 (svalue::get_child_sid): Delete
10847 (svalue::accept): New.
10848 (svalue::live_p): New.
10849 (svalue::implicitly_live_p): New.
10850 (svalue::svalue): Add complexity param.
10851 (svalue::add_to_hash): Delete
10852 (svalue::print_details): Delete
10853 (svalue::m_complexity): New field.
10854 (region_svalue::key_t): New struct.
10855 (region_svalue::region_svalue): Port from region_id to
10856 const region_id *. Add complexity.
10857 (region_svalue::compare_fields): Delete.
10858 (region_svalue::clone): Delete.
10859 (region_svalue::dump_dot_to_pp): Delete.
10860 (region_svalue::get_pointee): Port from region_id to
10861 const region_id *.
10862 (region_svalue::remap_region_ids): Delete.
10863 (region_svalue::merge_values): Delete.
10864 (region_svalue::dump_to_pp): New.
10865 (region_svalue::accept): New.
10866 (region_svalue::walk_for_canonicalization): Delete.
10867 (region_svalue::eval_condition): Make params const.
10868 (region_svalue::add_to_hash): Delete.
10869 (region_svalue::print_details): Delete.
10870 (region_svalue::m_rid): Replace with...
10871 (region_svalue::m_reg): ...this.
10872 (is_a_helper <region_svalue *>::test): Convert to...
10873 (is_a_helper <const region_svalue *>::test): ...this.
10874 (template <> struct default_hash_traits<region_svalue::key_t>):
10875 New.
10876 (constant_svalue::constant_svalue): Add complexity.
10877 (constant_svalue::compare_fields): Delete.
10878 (constant_svalue::clone): Delete.
10879 (constant_svalue::add_to_hash): Delete.
10880 (constant_svalue::dump_to_pp): New.
10881 (constant_svalue::accept): New.
10882 (constant_svalue::implicitly_live_p): New.
10883 (constant_svalue::merge_values): Delete.
10884 (constant_svalue::eval_condition): Make params const.
10885 (constant_svalue::get_child_sid): Delete.
10886 (constant_svalue::print_details): Delete.
10887 (is_a_helper <constant_svalue *>::test): Convert to...
10888 (is_a_helper <const constant_svalue *>::test): ...this.
10889 (class unknown_svalue): Update leading comment.
10890 (unknown_svalue::unknown_svalue): Add complexity.
10891 (unknown_svalue::compare_fields): Delete.
10892 (unknown_svalue::add_to_hash): Delete.
10893 (unknown_svalue::dyn_cast_unknown_svalue): Delete.
10894 (unknown_svalue::print_details): Delete.
10895 (unknown_svalue::dump_to_pp): New.
10896 (unknown_svalue::accept): New.
10897 (poisoned_svalue::key_t): New struct.
10898 (poisoned_svalue::poisoned_svalue): Add complexity.
10899 (poisoned_svalue::compare_fields): Delete.
10900 (poisoned_svalue::clone): Delete.
10901 (poisoned_svalue::add_to_hash): Delete.
10902 (poisoned_svalue::dump_to_pp): New.
10903 (poisoned_svalue::accept): New.
10904 (poisoned_svalue::print_details): Delete.
10905 (is_a_helper <poisoned_svalue *>::test): Convert to...
10906 (is_a_helper <const poisoned_svalue *>::test): ...this.
10907 (template <> struct default_hash_traits<poisoned_svalue::key_t>):
10908 New.
10909 (setjmp_record::add_to_hash): New.
10910 (setjmp_svalue::key_t): New struct.
10911 (setjmp_svalue::compare_fields): Delete.
10912 (setjmp_svalue::clone): Delete.
10913 (setjmp_svalue::add_to_hash): Delete.
10914 (setjmp_svalue::setjmp_svalue): Add complexity.
10915 (setjmp_svalue::dump_to_pp): New.
10916 (setjmp_svalue::accept): New.
10917 (setjmp_svalue::void print_details): Delete.
10918 (is_a_helper <const setjmp_svalue *>::test): New.
10919 (template <> struct default_hash_traits<setjmp_svalue::key_t>): New.
10920 (class initial_svalue : public svalue): New.
10921 (is_a_helper <const initial_svalue *>::test): New.
10922 (class unaryop_svalue): New.
10923 (is_a_helper <const unaryop_svalue *>::test): New.
10924 (template <> struct default_hash_traits<unaryop_svalue::key_t>): New.
10925 (class binop_svalue): New.
10926 (is_a_helper <const binop_svalue *>::test): New.
10927 (template <> struct default_hash_traits<binop_svalue::key_t>): New.
10928 (class sub_svalue): New.
10929 (is_a_helper <const sub_svalue *>::test): New.
10930 (template <> struct default_hash_traits<sub_svalue::key_t>): New.
10931 (class unmergeable_svalue): New.
10932 (is_a_helper <const unmergeable_svalue *>::test): New.
10933 (class placeholder_svalue): New.
10934 (is_a_helper <placeholder_svalue *>::test): New.
10935 (class widening_svalue): New.
10936 (is_a_helper <widening_svalue *>::test): New.
10937 (template <> struct default_hash_traits<widening_svalue::key_t>): New.
10938 (class compound_svalue): New.
10939 (is_a_helper <compound_svalue *>::test): New.
10940 (template <> struct default_hash_traits<compound_svalue::key_t>): New.
10941 (class conjured_svalue): New.
10942 (is_a_helper <conjured_svalue *>::test): New.
10943 (template <> struct default_hash_traits<conjured_svalue::key_t>): New.
10944 (enum region_kind): Delete RK_PRIMITIVE, RK_STRUCT, RK_UNION, and
10945 RK_ARRAY. Add RK_LABEL, RK_DECL, RK_FIELD, RK_ELEMENT, RK_OFFSET,
10946 RK_CAST, RK_HEAP_ALLOCATED, RK_ALLOCA, RK_STRING, and RK_UNKNOWN.
10947 (region_kind_to_str): Delete.
10948 (region::~region): Move implementation to region.cc.
10949 (region::operator==): Delete.
10950 (region::operator!=): Delete.
10951 (region::clone): Delete.
10952 (region::get_id): New.
10953 (region::cmp_ids): New.
10954 (region::dyn_cast_map_region): Delete.
10955 (region::dyn_cast_array_region): Delete.
10956 (region::region_id get_parent): Delete.
10957 (region::get_parent_region): Convert to a simple accessor.
10958 (region::void set_value): Delete.
10959 (region::svalue_id get_value): Delete.
10960 (region::svalue_id get_value_direct): Delete.
10961 (region::svalue_id get_inherited_child_sid): Delete.
10962 (region::dyn_cast_frame_region): New.
10963 (region::dyn_cast_function_region): New.
10964 (region::dyn_cast_decl_region): New.
10965 (region::dyn_cast_field_region): New.
10966 (region::dyn_cast_element_region): New.
10967 (region::dyn_cast_offset_region): New.
10968 (region::dyn_cast_cast_region): New.
10969 (region::dyn_cast_string_region): New.
10970 (region::accept): New.
10971 (region::get_base_region): New.
10972 (region::base_region_p): New.
10973 (region::descendent_of_p): New.
10974 (region::maybe_get_frame_region): New.
10975 (region::maybe_get_decl): New.
10976 (region::hash): Delete.
10977 (region::rint): Delete.
10978 (region::dump_dot_to_pp): Delete.
10979 (region::get_desc): New.
10980 (region::dump_to_pp): Convert to vfunc, changing signature.
10981 (region::dump_child_label): Delete.
10982 (region::remap_svalue_ids): Delete.
10983 (region::remap_region_ids): Delete.
10984 (region::dump): New.
10985 (region::walk_for_canonicalization): Delete.
10986 (region::non_null_p): Drop region_model param.
10987 (region::add_view): Delete.
10988 (region::get_view): Delete.
10989 (region::get_active_view): Delete.
10990 (region::is_view_p): Delete.
10991 (region::cmp_ptrs): New.
10992 (region::validate): Delete.
10993 (region::get_offset): New.
10994 (region::get_byte_size): New.
10995 (region::get_bit_size): New.
10996 (region::get_subregions_for_binding): New.
10997 (region::region): Add complexity param. Convert parent from
10998 region_id to const region *. Drop svalue_id. Drop copy ctor.
10999 (region::symbolic_for_unknown_ptr_p): New.
11000 (region::add_to_hash): Delete.
11001 (region::print_fields): Delete.
11002 (region::get_complexity): New accessor.
11003 (region::become_active_view): Delete.
11004 (region::deactivate_any_active_view): Delete.
11005 (region::deactivate_view): Delete.
11006 (region::calc_offset): New.
11007 (region::m_parent_rid): Delete.
11008 (region::m_sval_id): Delete.
11009 (region::m_complexity): New.
11010 (region::m_id): New.
11011 (region::m_parent): New.
11012 (region::m_view_rids): Delete.
11013 (region::m_is_view): Delete.
11014 (region::m_active_view_rid): Delete.
11015 (region::m_cached_offset): New.
11016 (is_a_helper <region *>::test): Convert to...
11017 (is_a_helper <const region *>::test): ... this.
11018 (class primitive_region): Delete.
11019 (class space_region): New.
11020 (class map_region): Delete.
11021 (is_a_helper <map_region *>::test): Delete.
11022 (class frame_region): Reimplement.
11023 (template <> struct default_hash_traits<frame_region::key_t>):
11024 New.
11025 (class globals_region): Reimplement.
11026 (is_a_helper <globals_region *>::test): Convert to...
11027 (is_a_helper <const globals_region *>::test): ...this.
11028 (class struct_or_union_region): Delete.
11029 (is_a_helper <struct_or_union_region *>::test): Delete.
11030 (class code_region): Reimplement.
11031 (is_a_helper <const code_region *>::test): New.
11032 (class struct_region): Delete.
11033 (is_a_helper <struct_region *>::test): Delete.
11034 (class function_region): Reimplement.
11035 (is_a_helper <function_region *>::test): Convert to...
11036 (is_a_helper <const function_region *>::test): ...this.
11037 (class union_region): Delete.
11038 (is_a_helper <union_region *>::test): Delete.
11039 (class label_region): New.
11040 (is_a_helper <const label_region *>::test): New.
11041 (class scope_region): Delete.
11042 (class stack_region): Reimplement.
11043 (is_a_helper <stack_region *>::test): Convert to...
11044 (is_a_helper <const stack_region *>::test): ...this.
11045 (class heap_region): Reimplement.
11046 (is_a_helper <heap_region *>::test): Convert to...
11047 (is_a_helper <const heap_region *>::test): ...this.
11048 (class root_region): Reimplement.
11049 (is_a_helper <root_region *>::test): Convert to...
11050 (is_a_helper <const root_region *>::test): ...this.
11051 (class symbolic_region): Reimplement.
11052 (is_a_helper <const symbolic_region *>::test): New.
11053 (template <> struct default_hash_traits<symbolic_region::key_t>):
11054 New.
11055 (class decl_region): New.
11056 (is_a_helper <const decl_region *>::test): New.
11057 (class field_region): New.
11058 (template <> struct default_hash_traits<field_region::key_t>): New.
11059 (class array_region): Delete.
11060 (class element_region): New.
11061 (is_a_helper <array_region *>::test): Delete.
11062 (is_a_helper <const element_region *>::test): New.
11063 (template <> struct default_hash_traits<element_region::key_t>):
11064 New.
11065 (class offset_region): New.
11066 (is_a_helper <const offset_region *>::test): New.
11067 (template <> struct default_hash_traits<offset_region::key_t>):
11068 New.
11069 (class cast_region): New.
11070 (is_a_helper <const cast_region *>::test): New.
11071 (template <> struct default_hash_traits<cast_region::key_t>): New.
11072 (class heap_allocated_region): New.
11073 (class alloca_region): New.
11074 (class string_region): New.
11075 (is_a_helper <const string_region *>::test): New.
11076 (class unknown_region): New.
11077 (class region_model_manager): New.
11078 (struct append_ssa_names_cb_data): New.
11079 (class call_details): New.
11080 (region_model::region_model): Add region_model_manager param.
11081 (region_model::print_svalue): Delete.
11082 (region_model::dump_dot_to_pp): Delete.
11083 (region_model::dump_dot_to_file): Delete.
11084 (region_model::dump_dot): Delete.
11085 (region_model::dump_to_pp): Drop summarize param in favor of
11086 simple and multiline.
11087 (region_model::dump): Likewise.
11088 (region_model::summarize_to_pp): Delete.
11089 (region_model::summarize): Delete.
11090 (region_model::void canonicalize): Drop ctxt param.
11091 (region_model::void check_for_poison): Delete.
11092 (region_model::get_gassign_result): New.
11093 (region_model::impl_call_alloca): New.
11094 (region_model::impl_call_analyzer_describe): New.
11095 (region_model::impl_call_analyzer_eval): New.
11096 (region_model::impl_call_builtin_expect): New.
11097 (region_model::impl_call_calloc): New.
11098 (region_model::impl_call_free): New.
11099 (region_model::impl_call_malloc): New.
11100 (region_model::impl_call_memset): New.
11101 (region_model::impl_call_strlen): New.
11102 (region_model::get_reachable_svalues): New.
11103 (region_model::handle_phi): Drop is_back_edge param.
11104 (region_model::region_id get_root_rid): Delete.
11105 (region_model::root_region *get_root_region): Delete.
11106 (region_model::region_id get_stack_region_id): Delete.
11107 (region_model::push_frame): Convert from region_id and svalue_id
11108 to const region * and const svalue *.
11109 (region_model::get_current_frame_id): Replace with...
11110 (region_model::get_current_frame): ...this.
11111 (region_model::pop_frame): Convert from region_id to
11112 const region *. Drop purge and stats param. Add out_result.
11113 (region_model::function *get_function_at_depth): Delete.
11114 (region_model::get_globals_region_id): Delete.
11115 (region_model::add_svalue): Delete.
11116 (region_model::replace_svalue): Delete.
11117 (region_model::add_region): Delete.
11118 (region_model::add_region_for_type): Delete.
11119 (region_model::get_svalue): Delete.
11120 (region_model::get_region): Delete.
11121 (region_model::get_lvalue): Convert from region_id to
11122 const region *.
11123 (region_model::get_rvalue): Convert from svalue_id to
11124 const svalue *.
11125 (region_model::get_or_create_ptr_svalue): Delete.
11126 (region_model::get_or_create_constant_svalue): Delete.
11127 (region_model::get_svalue_for_fndecl): Delete.
11128 (region_model::get_svalue_for_label): Delete.
11129 (region_model::get_region_for_fndecl): Delete.
11130 (region_model::get_region_for_label): Delete.
11131 (region_model::get_frame_at_index (int index) const;): New.
11132 (region_model::maybe_cast): Delete.
11133 (region_model::maybe_cast_1): Delete.
11134 (region_model::get_field_region): Delete.
11135 (region_model::id deref_rvalue): Convert from region_id and
11136 svalue_id to const region * and const svalue *. Drop overload,
11137 passing in both a tree and an svalue.
11138 (region_model::set_value): Convert from region_id and svalue_id to
11139 const region * and const svalue *.
11140 (region_model::set_to_new_unknown_value): Delete.
11141 (region_model::clobber_region (const region *reg);): New.
11142 (region_model::purge_region (const region *reg);): New.
11143 (region_model::zero_fill_region (const region *reg);): New.
11144 (region_model::mark_region_as_unknown (const region *reg);): New.
11145 (region_model::copy_region): Convert from region_id to
11146 const region *.
11147 (region_model::eval_condition): Convert from svalue_id to
11148 const svalue *.
11149 (region_model::eval_condition_without_cm): Likewise.
11150 (region_model::compare_initial_and_pointer): New.
11151 (region_model:maybe_get_constant): Delete.
11152 (region_model::add_new_malloc_region): Delete.
11153 (region_model::get_representative_tree): Convert from svalue_id to
11154 const svalue *.
11155 (region_model::get_representative_path_var): Delete decl taking a
11156 region_id in favor of two decls, for svalue vs region, with an
11157 svalue_set to ensure termination.
11158 (region_model::get_path_vars_for_svalue): Delete.
11159 (region_model::create_region_for_heap_alloc): New.
11160 (region_model::create_region_for_alloca): New.
11161 (region_model::purge_unused_svalues): Delete.
11162 (region_model::remap_svalue_ids): Delete.
11163 (region_model::remap_region_ids): Delete.
11164 (region_model::purge_regions): Delete.
11165 (region_model::get_num_svalues): Delete.
11166 (region_model::get_num_regions): Delete.
11167 (region_model::get_descendents): Delete.
11168 (region_model::get_store): New.
11169 (region_model::delete_region_and_descendents): Delete.
11170 (region_model::get_manager): New.
11171 (region_model::unbind_region_and_descendents): New.
11172 (region_model::can_merge_with_p): Add point param. Drop
11173 svalue_id_merger_mapping.
11174 (region_model::get_value_by_name): Delete.
11175 (region_model::convert_byte_offset_to_array_index): Delete.
11176 (region_model::get_or_create_mem_ref): Delete.
11177 (region_model::get_or_create_pointer_plus_expr): Delete.
11178 (region_model::get_or_create_view): Delete.
11179 (region_model::get_lvalue_1): Convert from region_id to
11180 const region *.
11181 (region_model::get_rvalue_1): Convert from svalue_id to
11182 const svalue *.
11183 (region_model::get_ssa_name_regions_for_current_frame): New.
11184 (region_model::append_ssa_names_cb): New.
11185 (region_model::get_store_value): New.
11186 (region_model::copy_struct_region): Delete.
11187 (region_model::copy_union_region): Delete.
11188 (region_model::copy_array_region): Delete.
11189 (region_model::region_exists_p): New.
11190 (region_model::make_region_for_unexpected_tree_code): Delete.
11191 (region_model::loop_replay_fixup): New.
11192 (region_model::poison_any_pointers_to_bad_regions): Delete.
11193 (region_model::poison_any_pointers_to_descendents): New.
11194 (region_model::dump_summary_of_rep_path_vars): Delete.
11195 (region_model::on_top_level_param): New.
11196 (region_model::record_dynamic_extents): New.
11197 (region_model::m_mgr;): New.
11198 (region_model::m_store;): New.
11199 (region_model::m_svalues;): Delete.
11200 (region_model::m_regions;): Delete.
11201 (region_model::m_root_rid;): Delete.
11202 (region_model::m_current_frame;): New.
11203 (region_model_context::remap_svalue_ids): Delete.
11204 (region_model_context::can_purge_p): Delete.
11205 (region_model_context::on_svalue_leak): New.
11206 (region_model_context::on_svalue_purge): Delete.
11207 (region_model_context::on_liveness_change): New.
11208 (region_model_context::on_inherited_svalue): Delete.
11209 (region_model_context::on_cast): Delete.
11210 (region_model_context::on_unknown_change): Convert from svalue_id to
11211 const svalue * and add is_mutable.
11212 (class noop_region_model_context): Update for region_model_context
11213 changes.
11214 (model_merger::model_merger): Add program_point. Drop
11215 svalue_id_merger_mapping.
11216 (model_merger::dump_to_pp): Add "simple" param.
11217 (model_merger::dump): Likewise.
11218 (model_merger::get_region_a): Delete.
11219 (model_merger::get_region_b): Delete.
11220 (model_merger::can_merge_values_p): Delete.
11221 (model_merger::record_regions): Delete.
11222 (model_merger::record_svalues): Delete.
11223 (model_merger::m_point): New field.
11224 (model_merger::m_map_regions_from_a_to_m): Delete.
11225 (model_merger::m_map_regions_from_b_to_m): Delete.
11226 (model_merger::m_sid_mapping): Delete.
11227 (struct svalue_id_merger_mapping): Delete.
11228 (class engine): New.
11229 (struct canonicalization): Delete.
11230 (inchash::add): Delete decls for hashing svalue_id and region_id.
11231 (test_region_model_context::on_unexpected_tree_code): Require t to
11232 be non-NULL.
11233 (selftest::assert_condition): Add overload comparing a pair of
11234 const svalue *.
11235 * sm-file.cc: Include "tristate.h", "selftest.h",
11236 "analyzer/call-string.h", "analyzer/program-point.h",
11237 "analyzer/store.h", and "analyzer/region-model.h".
11238 (fileptr_state_machine::get_default_state): New.
11239 (fileptr_state_machine::on_stmt): Remove calls to
11240 get_readable_tree in favor of get_diagnostic_tree.
11241 * sm-malloc.cc: Include "tristate.h", "selftest.h",
11242 "analyzer/call-string.h", "analyzer/program-point.h",
11243 "analyzer/store.h", and "analyzer/region-model.h".
11244 (malloc_state_machine::get_default_state): New.
11245 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New.
11246 (malloc_diagnostic::describe_state_change): Handle change.m_expr
11247 being NULL.
11248 (null_arg::emit): Avoid printing "NULL '0'".
11249 (null_arg::describe_final_event): Avoid printing "(0) NULL".
11250 (malloc_leak::emit): Handle m_arg being NULL.
11251 (malloc_leak::describe_final_event): Handle ev.m_expr being NULL.
11252 (malloc_state_machine::on_stmt): Don't call get_readable_tree.
11253 Call get_diagnostic_tree when creating pending diagnostics.
11254 Update for is_zero_assignment becoming a member function of
11255 sm_ctxt.
11256 Don't transition to m_non_heap for ADDR_EXPR(MEM_REF()).
11257 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New
11258 vfunc implementation.
11259 * sm-sensitive.cc (sensitive_state_machine::warn_for_any_exposure): Call
11260 get_diagnostic_tree and pass the result to warn_for_state.
11261 * sm-signal.cc: Move includes of "analyzer/call-string.h" and
11262 "analyzer/program-point.h" to before "analyzer/region-model.h",
11263 and also include "analyzer/store.h" before it.
11264 (signal_unsafe_call::describe_state_change): Use
11265 get_dest_function to get handler.
11266 (update_model_for_signal_handler): Pass manager to region_model
11267 ctor.
11268 (register_signal_handler::impl_transition): Update for changes to
11269 get_or_create_node and add_edge.
11270 * sm-taint.cc (taint_state_machine::on_stmt): Remove calls to
11271 get_readable_tree, replacing them when calling warn_for_state with
11272 calls to get_diagnostic_tree.
11273 * sm.cc (is_zero_assignment): Delete.
11274 (any_pointer_p): Move to within namespace ana.
11275 * sm.h (is_zero_assignment): Remove decl.
11276 (any_pointer_p): Move decl to within namespace ana.
11277 (state_machine::get_default_state): New vfunc.
11278 (state_machine::reset_when_passed_to_unknown_fn_p): New vfunc.
11279 (sm_context::get_readable_tree): Rename to...
11280 (sm_context::get_diagnostic_tree): ...this.
11281 (sm_context::is_zero_assignment): New vfunc.
11282 * store.cc: New file.
11283 * store.h: New file.
11284 * svalue.cc: New file.
11286 2020-05-22 Mark Wielaard <mark@klomp.org>
11288 * sm-signal.cc(signal_unsafe_call::emit): Possibly add
11289 gcc_rich_location note for replacement.
11290 (signal_unsafe_call::get_replacement_fn): New private function.
11291 (get_async_signal_unsafe_fns): Add "exit".
11293 2020-04-28 David Malcolm <dmalcolm@redhat.com>
11295 PR analyzer/94816
11296 * engine.cc (impl_region_model_context::on_unexpected_tree_code):
11297 Handle NULL tree.
11298 * region-model.cc (region_model::add_region_for_type): Handle
11299 NULL type.
11300 * region-model.h
11301 (test_region_model_context::on_unexpected_tree_code): Handle NULL
11302 tree.
11304 2020-04-28 David Malcolm <dmalcolm@redhat.com>
11306 PR analyzer/94447
11307 PR analyzer/94639
11308 PR analyzer/94732
11309 PR analyzer/94754
11310 * analyzer.opt (Wanalyzer-use-of-uninitialized-value): Delete.
11311 * program-state.cc (selftest::test_program_state_dumping): Update
11312 expected dump result for removal of "uninit".
11313 * region-model.cc (poison_kind_to_str): Delete POISON_KIND_UNINIT
11314 case.
11315 (root_region::ensure_stack_region): Initialize stack with null
11316 svalue_id rather than with a typeless POISON_KIND_UNINIT value.
11317 (root_region::ensure_heap_region): Likewise for the heap.
11318 (region_model::dump_summary_of_rep_path_vars): Remove
11319 summarization of uninit values.
11320 (region_model::validate): Remove check that the stack has a
11321 POISON_KIND_UNINIT value.
11322 (poisoned_value_diagnostic::emit): Remove POISON_KIND_UNINIT
11323 case.
11324 (poisoned_value_diagnostic::describe_final_event): Likewise.
11325 (selftest::test_dump): Update expected dump result for removal of
11326 "uninit".
11327 (selftest::test_svalue_equality): Remove "uninit" and "freed".
11328 * region-model.h (enum poison_kind): Remove POISON_KIND_UNINIT.
11330 2020-04-01 David Malcolm <dmalcolm@redhat.com>
11332 PR analyzer/94378
11333 * checker-path.cc: Include "bitmap.h".
11334 * constraint-manager.cc: Likewise.
11335 * diagnostic-manager.cc: Likewise.
11336 * engine.cc: Likewise.
11337 (exploded_node::detect_leaks): Pass null region_id to pop_frame.
11338 * program-point.cc: Include "bitmap.h".
11339 * program-state.cc: Likewise.
11340 * region-model.cc (id_set<region_id>::id_set): Convert to...
11341 (region_id_set::region_id_set): ...this.
11342 (svalue_id_set::svalue_id_set): New ctor.
11343 (region_model::copy_region): New function.
11344 (region_model::copy_struct_region): New function.
11345 (region_model::copy_union_region): New function.
11346 (region_model::copy_array_region): New function.
11347 (stack_region::pop_frame): Drop return value. Add
11348 "result_dst_rid" param; if it is non-null, use copy_region to copy
11349 the result to it. Rather than capture and pass a single "known
11350 used" return value to be used by purge_unused_values, instead
11351 gather and pass a set of known used return values.
11352 (root_region::pop_frame): Drop return value. Add "result_dst_rid"
11353 param.
11354 (region_model::on_assignment): Use copy_region.
11355 (region_model::on_return): Likewise for the result.
11356 (region_model::on_longjmp): Pass null for pop_frame's
11357 result_dst_rid.
11358 (region_model::update_for_return_superedge): Pass the region for the
11359 return value of the call, if any, to pop_frame, rather than setting
11360 the lvalue for the lhs of the result.
11361 (region_model::pop_frame): Drop return value. Add
11362 "result_dst_rid" param.
11363 (region_model::purge_unused_svalues): Convert third param from an
11364 svalue_id * to an svalue_id_set *, updating the initial populating
11365 of the "used" bitmap accordingly. Don't remap it when done.
11366 (struct selftest::coord_test): New selftest fixture, extracted from...
11367 (selftest::test_dump_2): ...here.
11368 (selftest::test_compound_assignment): New selftest.
11369 (selftest::test_stack_frames): Pass null to new param of pop_frame.
11370 (selftest::analyzer_region_model_cc_tests): Call the new selftest.
11371 * region-model.h (class id_set): Delete template.
11372 (class region_id_set): Reimplement, using old id_set implementation.
11373 (class svalue_id_set): Likewise. Convert from auto_sbitmap to
11374 auto_bitmap.
11375 (region::get_active_view): New accessor.
11376 (stack_region::pop_frame): Drop return value. Add
11377 "result_dst_rid" param.
11378 (root_region::pop_frame): Likewise.
11379 (region_model::pop_frame): Likewise.
11380 (region_model::copy_region): New decl.
11381 (region_model::purge_unused_svalues): Convert third param from an
11382 svalue_id * to an svalue_id_set *.
11383 (region_model::copy_struct_region): New decl.
11384 (region_model::copy_union_region): New decl.
11385 (region_model::copy_array_region): New decl.
11387 2020-03-27 David Malcolm <dmalcolm@redhat.com>
11389 * program-state.cc (selftest::test_program_state_dumping): Update
11390 expected dump to include symbolic_region's possibly_null field.
11391 * region-model.cc (symbolic_region::print_fields): New vfunc
11392 implementation.
11393 (region_model::add_constraint): Clear m_possibly_null from
11394 symbolic_regions now known to be non-NULL.
11395 (selftest::test_malloc_constraints): New selftest.
11396 (selftest::analyzer_region_model_cc_tests): Call it.
11397 * region-model.h (region::dyn_cast_symbolic_region): Add non-const
11398 overload.
11399 (symbolic_region::dyn_cast_symbolic_region): Implement it.
11400 (symbolic_region::print_fields): New vfunc override decl.
11402 2020-03-27 David Malcolm <dmalcolm@redhat.com>
11404 * analyzer.h (class feasibility_problem): New forward decl.
11405 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
11406 Initialize new fields m_status, m_epath_length, and m_problem.
11407 (saved_diagnostic::~saved_diagnostic): Delete m_problem.
11408 (dedupe_candidate::dedupe_candidate): Convert "sd" param from a
11409 const ref to a mutable ptr.
11410 (dedupe_winners::add): Convert "sd" param from a const ref to a
11411 mutable ptr. Record the length of the exploded_path. Record the
11412 feasibility/infeasibility of sd into sd, capturing a
11413 feasibility_problem when feasible_p fails, and storing it in sd.
11414 (diagnostic_manager::emit_saved_diagnostics): Update for pass by
11415 ptr rather than by const ref.
11416 * diagnostic-manager.h (class saved_diagnostic): Add new enum
11417 status. Add fields m_status, m_epath_length and m_problem.
11418 (saved_diagnostic::set_feasible): New member function.
11419 (saved_diagnostic::set_infeasible): New member function.
11420 (saved_diagnostic::get_feasibility_problem): New accessor.
11421 (saved_diagnostic::get_status): New accessor.
11422 (saved_diagnostic::set_epath_length): New member function.
11423 (saved_diagnostic::get_epath_length): New accessor.
11424 * engine.cc: Include "gimple-pretty-print.h".
11425 (exploded_path::feasible_p): Add OUT param and, if non-NULL, write
11426 a new feasibility_problem to it on failure.
11427 (viz_callgraph_node::dump_dot): Convert begin_tr calls to
11428 begin_trtd. Convert end_tr calls to end_tdtr.
11429 (class exploded_graph_annotator): New subclass of dot_annotator.
11430 (impl_run_checkers): Add a second -fdump-analyzer-supergraph dump
11431 after the analysis runs, using exploded_graph_annotator. dumping
11432 to DUMP_BASE_NAME.supergraph-eg.dot.
11433 * exploded-graph.h (exploded_node::get_dot_fillcolor): Make
11434 public.
11435 (exploded_path::feasible_p): Add OUT param.
11436 (class feasibility_problem): New class.
11437 * state-purge.cc (state_purge_annotator::add_node_annotations):
11438 Return a bool, add a "within_table" param.
11439 (print_vec_of_names): Convert begin_tr calls to begin_trtd.
11440 Convert end_tr calls to end_tdtr.
11441 (state_purge_annotator::add_stmt_annotations): Add "within_row"
11442 param.
11443 * state-purge.h ((state_purge_annotator::add_node_annotations):
11444 Return a bool, add a "within_table" param.
11445 (state_purge_annotator::add_stmt_annotations): Add "within_row"
11446 param.
11447 * supergraph.cc (supernode::dump_dot): Call add_node_annotations
11448 twice: as before, passing false for "within_table", then again
11449 with true when within the TABLE element. Convert some begin_tr
11450 calls to begin_trtd, and some end_tr calls to end_tdtr.
11451 Repeat each add_stmt_annotations call, distinguishing between
11452 calls that add TRs and those that add TDs to an existing TR.
11453 Add a call to add_after_node_annotations.
11454 * supergraph.h (dot_annotator::add_node_annotations): Add a
11455 "within_table" param.
11456 (dot_annotator::add_stmt_annotations): Add a "within_row" param.
11457 (dot_annotator::add_after_node_annotations): New vfunc.
11459 2020-03-27 David Malcolm <dmalcolm@redhat.com>
11461 * diagnostic-manager.cc (dedupe_winners::add): Show the
11462 exploded_node index in the log messages.
11463 (diagnostic_manager::emit_saved_diagnostics): Log a summary of
11464 m_saved_diagnostics at entry.
11466 2020-03-27 David Malcolm <dmalcolm@redhat.com>
11468 * supergraph.cc (superedge::dump): Add space before description;
11469 move newline to non-pretty_printer overload.
11471 2020-03-18 David Malcolm <dmalcolm@redhat.com>
11473 * region-model.cc: Include "stor-layout.h".
11474 (region_model::dump_to_pp): Rather than calling
11475 dump_summary_of_map on each of the current frame and the globals,
11476 instead get a vec of representative path_vars for all regions,
11477 and then dump a summary of all of them.
11478 (region_model::dump_summary_of_map): Delete, rewriting into...
11479 (region_model::dump_summary_of_rep_path_vars): ...this new
11480 function, working on a vec of path_vars.
11481 (region_model::set_value): New overload.
11482 (region_model::get_representative_path_var): Rename
11483 "parent_region" local to "parent_reg" and consolidate with other
11484 local. Guard test for grandparent being stack on parent_reg being
11485 non-NULL. Move handling for parent being an array_region to
11486 within guard for parent_reg being non-NULL.
11487 (selftest::make_test_compound_type): New function.
11488 (selftest::test_dump_2): New selftest.
11489 (selftest::test_dump_3): New selftest.
11490 (selftest::test_stack_frames): Update expected output from
11491 simplified dump to show "a" and "b" from parent frame and "y" in
11492 child frame.
11493 (selftest::analyzer_region_model_cc_tests): Call test_dump_2 and
11494 test_dump_3.
11495 * region-model.h (region_model::set_value): New overload decl.
11496 (region_model::dump_summary_of_map): Delete.
11497 (region_model::dump_summary_of_rep_path_vars): New.
11499 2020-03-18 David Malcolm <dmalcolm@redhat.com>
11501 * region-model.h (class noop_region_model_context): New subclass
11502 of region_model_context.
11503 (class tentative_region_model_context): Inherit from
11504 noop_region_model_context rather than from region_model_context;
11505 drop redundant vfunc implementations.
11506 (class test_region_model_context): Likewise.
11508 2020-03-18 David Malcolm <dmalcolm@redhat.com>
11510 * engine.cc (exploded_node::exploded_node): Move implementation
11511 here from header; accept point_and_state by const reference rather
11512 than by value.
11513 * exploded-graph.h (exploded_node::exploded_node): Pass
11514 point_and_state by const reference rather than by value. Move
11515 body to engine.cc.
11517 2020-03-18 Jakub Jelinek <jakub@redhat.com>
11519 * sm-malloc.cc (malloc_state_machine::on_stmt): Fix up duplicated word
11520 issue in a comment.
11521 * region-model.cc (region_model::make_region_for_unexpected_tree_code,
11522 region_model::delete_region_and_descendents): Likewise.
11523 * engine.cc (class exploded_cluster): Likewise.
11524 * diagnostic-manager.cc (class path_builder): Likewise.
11526 2020-03-13 David Malcolm <dmalcolm@redhat.com>
11528 PR analyzer/94099
11529 PR analyzer/94105
11530 * diagnostic-manager.cc (for_each_state_change): Bulletproof
11531 against errors in get_rvalue by passing a
11532 tentative_region_model_context and rejecting if there's an error.
11533 * region-model.cc (region_model::get_lvalue_1): When handling
11534 ARRAY_REF, handle results of error-handling. Handle NOP_EXPR.
11536 2020-03-06 David Malcolm <dmalcolm@redhat.com>
11538 * analyzer.h (class array_region): New forward decl.
11539 * program-state.cc (selftest::test_program_state_dumping_2): New.
11540 (selftest::analyzer_program_state_cc_tests): Call it.
11541 * region-model.cc (array_region::constant_from_key): New.
11542 (region_model::get_representative_tree): Handle region_svalue by
11543 generating an ADDR_EXPR.
11544 (region_model::get_representative_path_var): In view handling,
11545 remove erroneous TREE_TYPE when determining the type of the tree.
11546 Handle array regions and STRING_CST.
11547 (selftest::assert_dump_tree_eq): New.
11548 (ASSERT_DUMP_TREE_EQ): New macro.
11549 (selftest::test_get_representative_tree): New selftest.
11550 (selftest::analyzer_region_model_cc_tests): Call it.
11551 * region-model.h (region::dyn_cast_array_region): New vfunc.
11552 (array_region::dyn_cast_array_region): New vfunc implementation.
11553 (array_region::constant_from_key): New decl.
11555 2020-03-06 David Malcolm <dmalcolm@redhat.com>
11557 * analyzer.h (dump_quoted_tree): New decl.
11558 * engine.cc (exploded_node::dump_dot): Pass region model to
11559 sm_state_map::print.
11560 * program-state.cc: Include diagnostic-core.h.
11561 (sm_state_map::print): Add "model" param and use it to print
11562 representative trees. Only print origin information if non-null.
11563 (sm_state_map::dump): Pass NULL for model to print call.
11564 (program_state::print): Pass region model to sm_state_map::print.
11565 (program_state::dump_to_pp): Use spaces rather than newlines when
11566 summarizing. Pass region_model to sm_state_map::print.
11567 (ana::selftest::assert_dump_eq): New function.
11568 (ASSERT_DUMP_EQ): New macro.
11569 (ana::selftest::test_program_state_dumping): New function.
11570 (ana::selftest::analyzer_program_state_cc_tests): Call it.
11571 * program-state.h (program_state::print): Add model param.
11572 * region-model.cc (dump_quoted_tree): New function.
11573 (map_region::print_fields): Use dump_quoted_tree rather than
11574 %qE to avoid lang-dependent output.
11575 (map_region::dump_child_label): Likewise.
11576 (region_model::dump_summary_of_map): For SK_REGION, when
11577 get_representative_path_var fails, print the region id rather than
11578 erroneously printing NULL.
11579 * sm.cc (state_machine::get_state_by_name): New function.
11580 * sm.h (state_machine::get_state_by_name): New decl.
11582 2020-03-04 David Malcolm <dmalcolm@redhat.com>
11584 * region-model.cc (region::validate): Convert model param from ptr
11585 to reference. Update comment to reflect that it's now a vfunc.
11586 (map_region::validate): New vfunc implementation.
11587 (array_region::validate): New vfunc implementation.
11588 (stack_region::validate): New vfunc implementation.
11589 (root_region::validate): New vfunc implementation.
11590 (region_model::validate): Pass a reference rather than a pointer
11591 to the region::validate vfunc.
11592 * region-model.h (region::validate): Make virtual. Convert model
11593 param from ptr to reference.
11594 (map_region::validate): New vfunc decl.
11595 (array_region::validate): New vfunc decl.
11596 (stack_region::validate): New vfunc decl.
11597 (root_region::validate): New vfunc decl.
11599 2020-03-04 David Malcolm <dmalcolm@redhat.com>
11601 PR analyzer/93993
11602 * region-model.cc (region_model::on_call_pre): Handle
11603 BUILT_IN_EXPECT and its variants.
11604 (region_model::add_any_constraints_from_ssa_def_stmt): Split out
11605 gassign handling into add_any_constraints_from_gassign; add gcall
11606 handling.
11607 (region_model::add_any_constraints_from_gassign): New function,
11608 based on the above. Add handling for NOP_EXPR.
11609 (region_model::add_any_constraints_from_gcall): New function.
11610 (region_model::get_representative_path_var): Handle views.
11611 * region-model.h
11612 (region_model::add_any_constraints_from_ssa_def_stmt): New decl.
11613 (region_model::add_any_constraints_from_gassign): New decl.
11615 2020-03-04 David Malcolm <dmalcolm@redhat.com>
11617 PR analyzer/93993
11618 * checker-path.h (state_change_event::get_lvalue): Add ctxt param
11619 and pass it to region_model::get_value call.
11620 * diagnostic-manager.cc (get_any_origin): Pass a
11621 tentative_region_model_context to the calls to get_lvalue and reject
11622 the comparison if errors occur.
11623 (can_be_expr_of_interest_p): New function.
11624 (diagnostic_manager::prune_for_sm_diagnostic): Replace checks for
11625 CONSTANT_CLASS_P with calls to update_for_unsuitable_sm_exprs.
11626 Pass a tentative_region_model_context to the calls to
11627 state_change_event::get_lvalue and reject the comparison if errors
11628 occur.
11629 (diagnostic_manager::update_for_unsuitable_sm_exprs): New.
11630 * diagnostic-manager.h
11631 (diagnostic_manager::update_for_unsuitable_sm_exprs): New decl.
11632 * region-model.h (class tentative_region_model_context): New class.
11634 2020-03-04 David Malcolm <dmalcolm@redhat.com>
11636 * engine.cc (worklist::worklist): Remove unused field m_eg.
11637 (class viz_callgraph_edge): Remove unused field m_call_sedge.
11638 (class viz_callgraph): Remove unused field m_sg.
11639 * exploded-graph.h (worklist::::m_eg): Remove unused field.
11641 2020-03-02 David Malcolm <dmalcolm@redhat.com>
11643 * analyzer.opt (fanalyzer-show-duplicate-count): New option.
11644 * diagnostic-manager.cc
11645 (diagnostic_manager::emit_saved_diagnostic): Use the above to
11646 guard the printing of the duplicate count.
11648 2020-03-02 David Malcolm <dmalcolm@redhat.com>
11650 PR analyzer/93959
11651 * analyzer.cc (is_std_function_p): New function.
11652 (is_std_named_call_p): New functions.
11653 * analyzer.h (is_std_named_call_p): New decl.
11654 * sm-malloc.cc (malloc_state_machine::on_stmt): Check for "std::"
11655 variants when checking for malloc, calloc and free.
11657 2020-02-26 David Malcolm <dmalcolm@redhat.com>
11659 PR analyzer/93950
11660 * diagnostic-manager.cc
11661 (diagnostic_manager::prune_for_sm_diagnostic): Assert that var is
11662 either NULL or not a constant. When updating var, bulletproof
11663 against constant values.
11665 2020-02-26 David Malcolm <dmalcolm@redhat.com>
11667 PR analyzer/93947
11668 * region-model.cc (region_model::get_fndecl_for_call): Gracefully
11669 fail for fn_decls that don't have a cgraph_node.
11671 2020-02-26 David Malcolm <dmalcolm@redhat.com>
11673 * bar-chart.cc: New file.
11674 * bar-chart.h: New file.
11675 * engine.cc: Include "analyzer/bar-chart.h".
11676 (stats::log): Only log the m_num_nodes kinds that are non-zero.
11677 (stats::dump): Likewise when dumping.
11678 (stats::get_total_enodes): New.
11679 (exploded_graph::get_or_create_node): Increment the per-point-data
11680 m_excess_enodes when hitting the per-program-point limit on
11681 enodes.
11682 (exploded_graph::print_bar_charts): New.
11683 (exploded_graph::log_stats): Log the number of unprocessed enodes
11684 in the worklist. Call print_bar_charts.
11685 (exploded_graph::dump_stats): Print the number of unprocessed
11686 enodes in the worklist.
11687 * exploded-graph.h (stats::get_total_enodes): New decl.
11688 (struct per_program_point_data): Add field m_excess_enodes.
11689 (exploded_graph::print_bar_charts): New decl.
11690 * supergraph.cc (superedge::dump): New.
11691 (superedge::dump): New.
11692 * supergraph.h (supernode::get_function): New.
11693 (superedge::dump): New decl.
11694 (superedge::dump): New decl.
11696 2020-02-24 David Malcolm <dmalcolm@redhat.com>
11698 * engine.cc (exploded_graph::get_or_create_node): Dump the
11699 program_state to the pp, rather than to stderr.
11701 2020-02-24 David Malcolm <dmalcolm@redhat.com>
11703 PR analyzer/93032
11704 * sm.cc (make_checkers): Require the "taint" checker to be
11705 explicitly enabled.
11707 2020-02-24 David Malcolm <dmalcolm@redhat.com>
11709 PR analyzer/93899
11710 * engine.cc
11711 (impl_region_model_context::impl_region_model_context): Add logger
11712 param.
11713 * engine.cc (exploded_graph::add_function_entry): Create an
11714 impl_region_model_context and pass it to the push_frame call.
11715 Bail if the resulting state is invalid.
11716 (exploded_graph::build_initial_worklist): Likewise.
11717 (exploded_graph::build_initial_worklist): Handle the case where
11718 add_function_entry fails.
11719 * exploded-graph.h
11720 (impl_region_model_context::impl_region_model_context): Add logger
11721 param.
11722 * region-model.cc (map_region::get_or_create): Add ctxt param and
11723 pass it to add_region_for_type.
11724 (map_region::can_merge_p): Pass NULL as a ctxt to call to
11725 get_or_create.
11726 (array_region::get_element): Pass ctxt to call to get_or_create.
11727 (array_region::get_or_create): Add ctxt param and pass it to
11728 add_region_for_type.
11729 (root_region::push_frame): Pass ctxt to get_or_create calls.
11730 (region_model::get_lvalue_1): Likewise.
11731 (region_model::make_region_for_unexpected_tree_code): Assert that
11732 ctxt is non-NULL.
11733 (region_model::get_rvalue_1): Pass ctxt to get_svalue_for_fndecl
11734 and get_svalue_for_label calls.
11735 (region_model::get_svalue_for_fndecl): Add ctxt param and pass it
11736 to get_region_for_fndecl.
11737 (region_model::get_region_for_fndecl): Add ctxt param and pass it
11738 to get_or_create.
11739 (region_model::get_svalue_for_label): Add ctxt param and pass it
11740 to get_region_for_label.
11741 (region_model::get_region_for_label): Add ctxt param and pass it
11742 to get_region_for_fndecl and get_or_create.
11743 (region_model::get_field_region): Add ctxt param and pass it to
11744 get_or_create_view and get_or_create.
11745 (make_region_for_type): Replace gcc_unreachable with return NULL.
11746 (region_model::add_region_for_type): Add ctxt param. Handle a
11747 return of NULL from make_region_for_type by calling
11748 make_region_for_unexpected_tree_code.
11749 (region_model::get_or_create_mem_ref): Pass ctxt to calls to
11750 get_or_create_view.
11751 (region_model::get_or_create_view): Add ctxt param and pass it to
11752 add_region_for_type.
11753 (selftest::test_state_merging): Pass ctxt to get_or_create_view.
11754 * region-model.h (region_model::get_or_create): Add ctxt param.
11755 (region_model::add_region_for_type): Likewise.
11756 (region_model::get_svalue_for_fndecl): Likewise.
11757 (region_model::get_svalue_for_label): Likewise.
11758 (region_model::get_region_for_fndecl): Likewise.
11759 (region_model::get_region_for_label): Likewise.
11760 (region_model::get_field_region): Likewise.
11761 (region_model::get_or_create_view): Likewise.
11763 2020-02-24 David Malcolm <dmalcolm@redhat.com>
11765 * checker-path.cc (superedge_event::should_filter_p): Update
11766 filter for empty descriptions to cover verbosity level 3 as well
11767 as 2.
11768 * diagnostic-manager.cc: Include "analyzer/reachability.h".
11769 (class path_builder): New class.
11770 (diagnostic_manager::emit_saved_diagnostic): Create a path_builder
11771 and pass it to build_emission_path, rather passing eg; similarly
11772 for add_events_for_eedge and ext_state.
11773 (diagnostic_manager::build_emission_path): Replace "eg" param
11774 with a path_builder, pass it to add_events_for_eedge.
11775 (diagnostic_manager::add_events_for_eedge): Replace ext_state
11776 param with path_builder; pass it to add_events_for_superedge.
11777 (diagnostic_manager::significant_edge_p): New.
11778 (diagnostic_manager::add_events_for_superedge): Add path_builder
11779 param. Reject insignificant edges at verbosity levels below 3.
11780 (diagnostic_manager::prune_for_sm_diagnostic): Update highest
11781 verbosity level to 4.
11782 * diagnostic-manager.h (class path_builder): New forward decl.
11783 (diagnostic_manager::build_emission_path): Replace "eg" param
11784 with a path_builder.
11785 (diagnostic_manager::add_events_for_eedge): Replace ext_state
11786 param with path_builder.
11787 (diagnostic_manager::significant_edge_p): New.
11788 (diagnostic_manager::add_events_for_superedge): Add path_builder
11789 param.
11790 * reachability.h: New file.
11792 2020-02-18 David Malcolm <dmalcolm@redhat.com>
11794 PR analyzer/93692
11795 * analyzer.opt (fdump-analyzer-callgraph): Rewrite description.
11797 2020-02-18 David Malcolm <dmalcolm@redhat.com>
11799 PR analyzer/93777
11800 * region-model.cc (region_model::maybe_cast_1): Replace assertion
11801 that build_cast returns non-NULL with a conditional, falling
11802 through to the logic which returns a new unknown value of the
11803 desired type if it fails.
11805 2020-02-18 David Malcolm <dmalcolm@redhat.com>
11807 PR analyzer/93778
11808 * engine.cc (impl_region_model_context::on_unknown_tree_code):
11809 Rename to...
11810 (impl_region_model_context::on_unexpected_tree_code): ...this and
11811 convert first argument from path_var to tree.
11812 (exploded_node::on_stmt): Pass ctxt to purge_for_unknown_fncall.
11813 * exploded-graph.h (region_model_context::on_unknown_tree_code):
11814 Rename to...
11815 (region_model_context::on_unexpected_tree_code): ...this and
11816 convert first argument from path_var to tree.
11817 * program-state.cc (sm_state_map::purge_for_unknown_fncall): Add
11818 ctxt param and pass on to calls to get_rvalue.
11819 * program-state.h (sm_state_map::purge_for_unknown_fncall): Add
11820 ctxt param.
11821 * region-model.cc (region_model::handle_unrecognized_call): Pass
11822 ctxt on to call to get_rvalue.
11823 (region_model::get_lvalue_1): Move body of default case to
11824 region_model::make_region_for_unexpected_tree_code and call it.
11825 Within COMPONENT_REF case, reject attempts to handle types other
11826 than RECORD_TYPE and UNION_TYPE.
11827 (region_model::make_region_for_unexpected_tree_code): New
11828 function, based on default case of region_model::get_lvalue_1.
11829 * region-model.h
11830 (region_model::make_region_for_unexpected_tree_code): New decl.
11831 (region_model::on_unknown_tree_code): Rename to...
11832 (region_model::on_unexpected_tree_code): ...this and convert first
11833 argument from path_var to tree.
11834 (class test_region_model_context): Update vfunc implementation for
11835 above change.
11837 2020-02-18 David Malcolm <dmalcolm@redhat.com>
11839 PR analyzer/93774
11840 * region-model.cc
11841 (region_model::convert_byte_offset_to_array_index): Use
11842 int_size_in_bytes before calling size_in_bytes, to gracefully fail
11843 on incomplete types.
11845 2020-02-17 David Malcolm <dmalcolm@redhat.com>
11847 PR analyzer/93775
11848 * region-model.cc (region_model::get_fndecl_for_call): Handle the
11849 case where the code_region's get_tree_for_child_region returns
11850 NULL.
11852 2020-02-17 David Malcolm <dmalcolm@redhat.com>
11854 PR analyzer/93388
11855 * engine.cc (impl_region_model_context::on_unknown_tree_code):
11856 New.
11857 (exploded_graph::get_or_create_node): Reject invalid states.
11858 * exploded-graph.h
11859 (impl_region_model_context::on_unknown_tree_code): New decl.
11860 (point_and_state::point_and_state): Assert that the state is
11861 valid.
11862 * program-state.cc (program_state::program_state): Initialize
11863 m_valid to true.
11864 (program_state::operator=): Copy m_valid.
11865 (program_state::program_state): Likewise for move constructor.
11866 (program_state::print): Print m_valid.
11867 (program_state::dump_to_pp): Likewise.
11868 * program-state.h (program_state::m_valid): New field.
11869 * region-model.cc (region_model::get_lvalue_1): Implement the
11870 default case by returning a new symbolic region and calling
11871 the context's on_unknown_tree_code, rather than issuing an
11872 internal_error. Implement VIEW_CONVERT_EXPR.
11873 * region-model.h (region_model_context::on_unknown_tree_code): New
11874 vfunc.
11875 (test_region_model_context::on_unknown_tree_code): New.
11877 2020-02-17 David Malcolm <dmalcolm@redhat.com>
11879 * sm-malloc.cc (malloc_diagnostic::describe_state_change): For
11880 transition to the "null" state, only say "assuming" when
11881 transitioning from the "unchecked" state.
11883 2020-02-17 David Malcolm <dmalcolm@redhat.com>
11885 * diagnostic-manager.h (diagnostic_manager::get_saved_diagnostic):
11886 Add const overload.
11887 * engine.cc (exploded_node::dump_dot): Dump saved_diagnostics.
11888 * exploded-graph.h (exploded_graph::get_diagnostic_manager): Add
11889 const overload.
11891 2020-02-11 David Malcolm <dmalcolm@redhat.com>
11893 PR analyzer/93288
11894 * analysis-plan.cc (analysis_plan::use_summary_p): Look through
11895 the ultimate_alias_target when getting the called function.
11896 * engine.cc (exploded_node::on_stmt): Rename second "ctxt" to
11897 "sm_ctxt". Use the region_model's get_fndecl_for_call rather than
11898 gimple_call_fndecl.
11899 * region-model.cc (region_model::get_fndecl_for_call): Use
11900 ultimate_alias_target on fndecl.
11901 * supergraph.cc (get_ultimate_function_for_cgraph_edge): New
11902 function.
11903 (supergraph_call_edge): Use it when rejecting edges without
11904 functions.
11905 (supergraph::supergraph): Use it to get the function for the
11906 cgraph_edge when building interprocedural superedges.
11907 (callgraph_superedge::get_callee_function): Use it.
11908 * supergraph.h (supergraph::get_num_snodes): Make param const.
11909 (supergraph::function_to_num_snodes_t): Make first type param
11910 const.
11912 2020-02-11 David Malcolm <dmalcolm@redhat.com>
11914 PR analyzer/93374
11915 * engine.cc (exploded_edge::exploded_edge): Add ext_state param
11916 and pass it to change.validate.
11917 (exploded_graph::get_or_create_node): Move purging of change
11918 svalues to also cover the case of reusing an existing enode.
11919 (exploded_graph::add_edge): Pass m_ext_state to exploded_edge's
11920 ctor.
11921 * exploded-graph.h (exploded_edge::exploded_edge): Add ext_state
11922 param.
11923 * program-state.cc (state_change::sm_change::validate): Likewise.
11924 Assert that m_sm_idx is sane. Use ext_state to validate
11925 m_old_state and m_new_state.
11926 (state_change::validate): Add ext_state param and pass it to
11927 the sm_change validate calls.
11928 * program-state.h (state_change::sm_change::validate): Add
11929 ext_state param.
11930 (state_change::validate): Likewise.
11932 2020-02-11 David Malcolm <dmalcolm@redhat.com>
11934 PR analyzer/93669
11935 * engine.cc (exploded_graph::dump_exploded_nodes): Handle missing
11936 case of STATUS_WORKLIST in implementation of
11937 "__analyzer_dump_exploded_nodes".
11939 2020-02-11 David Malcolm <dmalcolm@redhat.com>
11941 PR analyzer/93649
11942 * constraint-manager.cc (constraint_manager::add_constraint): When
11943 merging equivalence classes and updating m_constant, also update
11944 m_cst_sid.
11945 (constraint_manager::validate): If m_constant is non-NULL assert
11946 that m_cst_sid is non-null and is valid.
11948 2020-02-11 David Malcolm <dmalcolm@redhat.com>
11950 PR analyzer/93657
11951 * analyzer.opt (fdump-analyzer): Reword description.
11952 (fdump-analyzer-stderr): Likewise.
11954 2020-02-11 David Malcolm <dmalcolm@redhat.com>
11956 * region-model.cc (print_quoted_type): New function.
11957 (svalue::print): Use it to replace %qT.
11958 (region::dump_to_pp): Likewise.
11959 (region::dump_child_label): Likewise.
11960 (region::print_fields): Likewise.
11962 2020-02-10 David Malcolm <dmalcolm@redhat.com>
11964 PR analyzer/93659
11965 * analyzer.opt (-param=analyzer-max-recursion-depth=): Fix "tha"
11966 -> "that" typo.
11967 (Wanalyzer-use-of-uninitialized-value): Fix "initialized" ->
11968 "uninitialized" typo.
11970 2020-02-10 David Malcolm <dmalcolm@redhat.com>
11972 PR analyzer/93350
11973 * region-model.cc (region_model::get_lvalue_1):
11974 Handle BIT_FIELD_REF.
11975 (make_region_for_type): Handle VECTOR_TYPE.
11977 2020-02-10 David Malcolm <dmalcolm@redhat.com>
11979 PR analyzer/93647
11980 * diagnostic-manager.cc
11981 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof against
11982 VAR being constant.
11983 * region-model.cc (region_model::get_lvalue_1): Provide a better
11984 error message when encountering an unhandled tree code.
11986 2020-02-10 David Malcolm <dmalcolm@redhat.com>
11988 PR analyzer/93405
11989 * region-model.cc (region_model::get_lvalue_1): Implement
11990 CONST_DECL.
11992 2020-02-06 David Malcolm <dmalcolm@redhat.com>
11994 * region-model.cc (region_model::maybe_cast_1): Attempt to provide
11995 a region_svalue if either type is a pointer, rather than if both
11996 types are pointers.
11998 2020-02-05 David Malcolm <dmalcolm@redhat.com>
12000 * engine.cc (exploded_node::dump_dot): Show merger enodes.
12001 (worklist::add_node): Assert that the node's m_status is
12002 STATUS_WORKLIST.
12003 (exploded_graph::process_worklist): Likewise for nodes from the
12004 worklist. Set status of merged nodes to STATUS_MERGER.
12005 (exploded_graph::process_node): Set status of node to
12006 STATUS_PROCESSED.
12007 (exploded_graph::dump_exploded_nodes): Rework handling of
12008 "__analyzer_dump_exploded_nodes", splitting enodes by status into
12009 "processed" and "merger", showing the count of just the processed
12010 enodes at the call, rather than the count of all enodes.
12011 * exploded-graph.h (exploded_node::status): New enum.
12012 (exploded_node::exploded_node): Initialize m_status to
12013 STATUS_WORKLIST.
12014 (exploded_node::get_status): New getter.
12015 (exploded_node::set_status): New setter.
12017 2020-02-04 David Malcolm <dmalcolm@redhat.com>
12019 PR analyzer/93543
12020 * engine.cc (pod_hash_traits<function_call_string>::mark_empty):
12021 Eliminate reinterpret_cast.
12022 (pod_hash_traits<function_call_string>::is_empty): Likewise.
12024 2020-02-03 David Malcolm <dmalcolm@redhat.com>
12026 * constraint-manager.cc (range::constrained_to_single_element):
12027 Replace fold_build2 with fold_binary. Remove unnecessary newline.
12028 (constraint_manager::get_or_add_equiv_class): Replace fold_build2
12029 with fold_binary in two places, and remove out-of-date comment.
12030 (constraint_manager::eval_condition): Replace fold_build2 with
12031 fold_binary.
12032 * region-model.cc (constant_svalue::eval_condition): Likewise.
12033 (region_model::on_assignment): Likewise.
12035 2020-02-03 David Malcolm <dmalcolm@redhat.com>
12037 PR analyzer/93544
12038 * diagnostic-manager.cc
12039 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof
12040 against bad choices due to bad paths.
12041 * engine.cc (impl_region_model_context::on_phi): New.
12042 * exploded-graph.h (impl_region_model_context::on_phi): New decl.
12043 * region-model.cc (region_model::on_longjmp): Likewise.
12044 (region_model::handle_phi): Add phi param. Call the ctxt's on_phi
12045 vfunc.
12046 (region_model::update_for_phis): Pass phi to handle_phi.
12047 * region-model.h (region_model::handle_phi): Add phi param.
12048 (region_model_context::on_phi): New vfunc.
12049 (test_region_model_context::on_phi): New.
12050 * sm-malloc.cc (malloc_state_machine::on_phi): New.
12051 (malloc_state_machine::on_zero_assignment): New.
12052 * sm.h (state_machine::on_phi): New vfunc.
12054 2020-02-03 David Malcolm <dmalcolm@redhat.com>
12056 * engine.cc (supernode_cluster::dump_dot): Show BB index as
12057 well as SN index.
12058 * supergraph.cc (supernode::dump_dot): Likewise.
12060 2020-02-03 David Malcolm <dmalcolm@redhat.com>
12062 PR analyzer/93546
12063 * region-model.cc (region_model::on_call_pre): Update for new
12064 param of symbolic_region ctor.
12065 (region_model::deref_rvalue): Likewise.
12066 (region_model::add_new_malloc_region): Likewise.
12067 (make_region_for_type): Likewise, preserving type.
12068 * region-model.h (symbolic_region::symbolic_region): Add "type"
12069 param and pass it to base class ctor.
12071 2020-02-03 David Malcolm <dmalcolm@redhat.com>
12073 PR analyzer/93547
12074 * constraint-manager.cc
12075 (constraint_manager::get_or_add_equiv_class): Ensure types are
12076 compatible before comparing constants.
12078 2020-01-31 David Malcolm <dmalcolm@redhat.com>
12080 PR analyzer/93457
12081 * region-model.cc (make_region_for_type): Use VOID_TYPE_P rather
12082 than checking against void_type_node.
12084 2020-01-31 David Malcolm <dmalcolm@redhat.com>
12086 PR analyzer/93373
12087 * region-model.cc (ASSERT_COMPAT_TYPES): Convert to...
12088 (assert_compat_types): ...this, and bail when either type is NULL,
12089 or when VOID_TYPE_P (dst_type).
12090 (region_model::get_lvalue): Update for above conversion.
12091 (region_model::get_rvalue): Likewise.
12093 2020-01-31 David Malcolm <dmalcolm@redhat.com>
12095 PR analyzer/93379
12096 * region-model.cc (region_model::update_for_return_superedge):
12097 Move check for null result so that it also guards setting the
12098 lhs.
12100 2020-01-31 David Malcolm <dmalcolm@redhat.com>
12102 PR analyzer/93438
12103 * region-model.cc (stack_region::can_merge_p): Split into a two
12104 pass approach, creating all stack regions first, then populating
12105 them.
12106 (selftest::test_state_merging): Add test coverage for (a) the case
12107 of self-merging a model in which a local in an older stack frame
12108 points to a local in a more recent stack frame (which previously
12109 would ICE), and (b) the case of self-merging a model in which a
12110 local points to a global (which previously worked OK).
12112 2020-01-31 David Malcolm <dmalcolm@redhat.com>
12114 * analyzer.cc (is_named_call_p): Replace tests for fndecl being
12115 extern at file scope and having a non-NULL DECL_NAME with a call
12116 to maybe_special_function_p.
12117 * function-set.cc (function_set::contains_decl_p): Add call to
12118 maybe_special_function_p.
12120 2020-01-31 David Malcolm <dmalcolm@redhat.com>
12122 PR analyzer/93450
12123 * constraint-manager.cc
12124 (constraint_manager::get_or_add_equiv_class): Only compare constants
12125 if their types are compatible.
12126 * region-model.cc (constant_svalue::eval_condition): Replace check
12127 for identical types with call to types_compatible_p.
12129 2020-01-30 David Malcolm <dmalcolm@redhat.com>
12131 * program-state.cc (extrinsic_state::dump_to_pp): New.
12132 (extrinsic_state::dump_to_file): New.
12133 (extrinsic_state::dump): New.
12134 * program-state.h (extrinsic_state::dump_to_pp): New decl.
12135 (extrinsic_state::dump_to_file): New decl.
12136 (extrinsic_state::dump): New decl.
12137 * sm.cc: Include "pretty-print.h".
12138 (state_machine::dump_to_pp): New.
12139 * sm.h (state_machine::dump_to_pp): New decl.
12141 2020-01-30 David Malcolm <dmalcolm@redhat.com>
12143 * diagnostic-manager.cc (for_each_state_change): Use
12144 extrinsic_state::get_num_checkers rather than accessing m_checkers
12145 directly.
12146 * program-state.cc (program_state::program_state): Likewise.
12147 * program-state.h (extrinsic_state::m_checkers): Make private.
12149 2020-01-30 David Malcolm <dmalcolm@redhat.com>
12151 PR analyzer/93356
12152 * region-model.cc (region_model::eval_condition): In both
12153 overloads, bail out immediately on floating-point types.
12154 (region_model::eval_condition_without_cm): Likewise.
12155 (region_model::add_constraint): Likewise.
12157 2020-01-30 David Malcolm <dmalcolm@redhat.com>
12159 PR analyzer/93450
12160 * program-state.cc (sm_state_map::set_state): For the overload
12161 taking an svalue_id, bail out if the set_state on the ec does
12162 nothing. Convert the latter's return type from void to bool,
12163 returning true if anything changed.
12164 (sm_state_map::impl_set_state): Convert the return type from void
12165 to bool, returning true if the state changed.
12166 * program-state.h (sm_state_map::set_state): Convert return type
12167 from void to bool.
12168 (sm_state_map::impl_set_state): Likewise.
12169 * region-model.cc (constant_svalue::eval_condition): Only call
12170 fold_build2 if the types are the same.
12172 2020-01-29 Jakub Jelinek <jakub@redhat.com>
12174 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Remove.
12175 * constraint-manager.cc: Include diagnostic-core.h before graphviz.h.
12176 (range::dump, equiv_class::print): Don't use PUSH_IGNORE_WFORMAT or
12177 POP_IGNORE_WFORMAT.
12178 * state-purge.cc: Include diagnostic-core.h before
12179 gimple-pretty-print.h.
12180 (state_purge_annotator::add_node_annotations, print_vec_of_names):
12181 Don't use PUSH_IGNORE_WFORMAT or POP_IGNORE_WFORMAT.
12182 * region-model.cc: Move diagnostic-core.h include before graphviz.h.
12183 (path_var::dump, svalue::print, constant_svalue::print_details,
12184 region::dump_to_pp, region::dump_child_label, region::print_fields,
12185 map_region::print_fields, map_region::dump_dot_to_pp,
12186 map_region::dump_child_label, array_region::print_fields,
12187 array_region::dump_dot_to_pp): Don't use PUSH_IGNORE_WFORMAT or
12188 POP_IGNORE_WFORMAT.
12190 2020-01-28 David Malcolm <dmalcolm@redhat.com>
12192 PR analyzer/93316
12193 * engine.cc (rewind_info_t::update_model): Get the longjmp call
12194 stmt via get_longjmp_call () rather than assuming it is the last
12195 stmt in the longjmp's supernode.
12196 (rewind_info_t::add_events_to_path): Get the location_t for the
12197 rewind_from_longjmp_event via get_longjmp_call () rather than from
12198 the supernode's get_end_location ().
12200 2020-01-28 David Malcolm <dmalcolm@redhat.com>
12202 * region-model.cc (poisoned_value_diagnostic::emit): Update for
12203 renaming of warning_at overload to warning_meta.
12204 * sm-file.cc (file_leak::emit): Likewise.
12205 * sm-malloc.cc (double_free::emit): Likewise.
12206 (possible_null_deref::emit): Likewise.
12207 (possible_null_arg::emit): Likewise.
12208 (null_deref::emit): Likewise.
12209 (null_arg::emit): Likewise.
12210 (use_after_free::emit): Likewise.
12211 (malloc_leak::emit): Likewise.
12212 (free_of_non_heap::emit): Likewise.
12213 * sm-sensitive.cc (exposure_through_output_file::emit): Likewise.
12214 * sm-signal.cc (signal_unsafe_call::emit): Likewise.
12215 * sm-taint.cc (tainted_array_index::emit): Likewise.
12217 2020-01-27 David Malcolm <dmalcolm@redhat.com>
12219 PR analyzer/93451
12220 * region-model.cc (tree_cmp): For the REAL_CST case, impose an
12221 arbitrary order on NaNs relative to other NaNs and to non-NaNs;
12222 const-correctness tweak.
12223 (ana::selftests::build_real_cst_from_string): New function.
12224 (ana::selftests::append_interesting_constants): New function.
12225 (ana::selftests::test_tree_cmp_on_constants): New test.
12226 (ana::selftests::test_canonicalization_4): New test.
12227 (ana::selftests::analyzer_region_model_cc_tests): Call the new
12228 tests.
12230 2020-01-27 David Malcolm <dmalcolm@redhat.com>
12232 PR analyzer/93349
12233 * engine.cc (run_checkers): Save and restore input_location.
12235 2020-01-27 David Malcolm <dmalcolm@redhat.com>
12237 * call-string.cc (call_string::cmp_1): Delete, moving body to...
12238 (call_string::cmp): ...here.
12239 * call-string.h (call_string::cmp_1): Delete decl.
12240 * engine.cc (worklist::key_t::cmp_1): Delete, moving body to...
12241 (worklist::key_t::cmp): ...here. Implement hash comparisons
12242 via comparison rather than subtraction to avoid overflow issues.
12243 * exploded-graph.h (worklist::key_t::cmp_1): Delete decl.
12244 * region-model.cc (tree_cmp): Eliminate buggy checking for
12245 symmetry.
12247 2020-01-27 David Malcolm <dmalcolm@redhat.com>
12249 * analyzer.cc (is_named_call_p): Check that fndecl is "extern"
12250 and at file scope. Potentially disregard prefix _ or __ in
12251 fndecl's name. Bail if the identifier is NULL.
12252 (is_setjmp_call_p): Expect a gcall rather than plain gimple.
12253 Remove special-case check for leading prefix, and also check for
12254 sigsetjmp.
12255 (is_longjmp_call_p): Also check for siglongjmp.
12256 (get_user_facing_name): New function.
12257 * analyzer.h (is_setjmp_call_p): Expect a gcall rather than plain
12258 gimple.
12259 (get_user_facing_name): New decl.
12260 * checker-path.cc (setjmp_event::get_desc): Use
12261 get_user_facing_name to avoid hardcoding the function name.
12262 (rewind_event::rewind_event): Add rewind_info param, using it to
12263 initialize new m_rewind_info field, and strengthen the assertion.
12264 (rewind_from_longjmp_event::get_desc): Use get_user_facing_name to
12265 avoid hardcoding the function name.
12266 (rewind_to_setjmp_event::get_desc): Likewise.
12267 * checker-path.h (setjmp_event::setjmp_event): Add setjmp_call
12268 param and use it to initialize...
12269 (setjmp_event::m_setjmp_call): New field.
12270 (rewind_event::rewind_event): Add rewind_info param.
12271 (rewind_event::m_rewind_info): New protected field.
12272 (rewind_from_longjmp_event::rewind_from_longjmp_event): Add
12273 rewind_info param.
12274 (class rewind_to_setjmp_event): Move rewind_info field to parent
12275 class.
12276 * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
12277 Update setjmp-handling for is_setjmp_call_p requiring a gcall;
12278 pass the call to the new setjmp_event.
12279 * engine.cc (exploded_node::on_stmt): Update for is_setjmp_call_p
12280 requiring a gcall.
12281 (stale_jmp_buf::emit): Use get_user_facing_name to avoid
12282 hardcoding the function names.
12283 (exploded_node::on_longjmp): Pass the longjmp_call when
12284 constructing rewind_info.
12285 (rewind_info_t::add_events_to_path): Pass the rewind_info_t to the
12286 rewind_from_longjmp_event's ctor.
12287 * exploded-graph.h (rewind_info_t::rewind_info_t): Add
12288 longjmp_call param.
12289 (rewind_info_t::get_longjmp_call): New.
12290 (rewind_info_t::m_longjmp_call): New.
12291 * region-model.cc (region_model::on_setjmp): Update comment to
12292 indicate this is also for sigsetjmp.
12293 * region-model.h (struct setjmp_record): Likewise.
12294 (class setjmp_svalue): Likewise.
12296 2020-01-27 David Malcolm <dmalcolm@redhat.com>
12298 PR analyzer/93276
12299 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Guard these
12300 macros with GCC_VERSION >= 4006, making them no-op otherwise.
12301 * engine.cc (exploded_edge::exploded_edge): Specify template for
12302 base class initializer.
12303 (exploded_graph::add_edge): Specify template when chaining up to
12304 base class add_edge implementation.
12305 (viz_callgraph_node::dump_dot): Drop redundant "typename".
12306 (viz_callgraph_edge::viz_callgraph_edge): Specify template for
12307 base class initializer.
12308 * program-state.cc (sm_state_map::clone_with_remapping): Drop
12309 redundant "typename".
12310 (sm_state_map::print): Likewise.
12311 (sm_state_map::hash): Likewise.
12312 (sm_state_map::operator==): Likewise.
12313 (sm_state_map::remap_svalue_ids): Likewise.
12314 (sm_state_map::on_svalue_purge): Likewise.
12315 (sm_state_map::validate): Likewise.
12316 * program-state.h (sm_state_map::iterator_t): Likewise.
12317 * supergraph.h (superedge::superedge): Specify template for base
12318 class initializer.
12320 2020-01-23 David Malcolm <dmalcolm@redhat.com>
12322 PR analyzer/93375
12323 * supergraph.cc (callgraph_superedge::get_arg_for_parm): Fail
12324 gracefully is the number of parameters at the callee exceeds the
12325 number of arguments at the call stmt.
12326 (callgraph_superedge::get_parm_for_arg): Likewise.
12328 2020-01-22 David Malcolm <dmalcolm@redhat.com>
12330 PR analyzer/93382
12331 * program-state.cc (sm_state_map::on_svalue_purge): If the
12332 entry survives, but the origin is being purged, then reset the
12333 origin to null.
12335 2020-01-22 David Malcolm <dmalcolm@redhat.com>
12337 * sm-signal.cc: Fix nesting of CHECKING_P and namespace ana.
12339 2020-01-22 David Malcolm <dmalcolm@redhat.com>
12341 PR analyzer/93378
12342 * engine.cc (setjmp_svalue::compare_fields): Update for
12343 replacement of m_enode with m_setjmp_record.
12344 (setjmp_svalue::add_to_hash): Likewise.
12345 (setjmp_svalue::get_index): Rename...
12346 (setjmp_svalue::get_enode_index): ...to this.
12347 (setjmp_svalue::print_details): Update for replacement of m_enode
12348 with m_setjmp_record.
12349 (exploded_node::on_longjmp): Likewise.
12350 * exploded-graph.h (rewind_info_t::m_enode_origin): Replace...
12351 (rewind_info_t::m_setjmp_record): ...with this.
12352 (rewind_info_t::rewind_info_t): Update for replacement of m_enode
12353 with m_setjmp_record.
12354 (rewind_info_t::get_setjmp_point): Likewise.
12355 (rewind_info_t::get_setjmp_call): Likewise.
12356 * region-model.cc (region_model::dump_summary_of_map): Likewise.
12357 (region_model::on_setjmp): Likewise.
12358 * region-model.h (struct setjmp_record): New struct.
12359 (setjmp_svalue::m_enode): Replace...
12360 (setjmp_svalue::m_setjmp_record): ...with this.
12361 (setjmp_svalue::setjmp_svalue): Update for replacement of m_enode
12362 with m_setjmp_record.
12363 (setjmp_svalue::clone): Likewise.
12364 (setjmp_svalue::get_index): Rename...
12365 (setjmp_svalue::get_enode_index): ...to this.
12366 (setjmp_svalue::get_exploded_node): Replace...
12367 (setjmp_svalue::get_setjmp_record): ...with this.
12369 2020-01-22 David Malcolm <dmalcolm@redhat.com>
12371 PR analyzer/93316
12372 * analyzer.cc (is_setjmp_call_p): Check for "setjmp" as well as
12373 "_setjmp".
12375 2020-01-22 David Malcolm <dmalcolm@redhat.com>
12377 PR analyzer/93307
12378 * analysis-plan.h: Wrap everything namespace "ana".
12379 * analyzer-logging.cc: Likewise.
12380 * analyzer-logging.h: Likewise.
12381 * analyzer-pass.cc (pass_analyzer::execute): Update for "ana"
12382 namespace.
12383 * analyzer-selftests.cc: Wrap everything namespace "ana".
12384 * analyzer-selftests.h: Likewise.
12385 * analyzer.h: Likewise for forward decls of types.
12386 * call-string.h: Likewise.
12387 * checker-path.cc: Likewise.
12388 * checker-path.h: Likewise.
12389 * constraint-manager.cc: Likewise.
12390 * constraint-manager.h: Likewise.
12391 * diagnostic-manager.cc: Likewise.
12392 * diagnostic-manager.h: Likewise.
12393 * engine.cc: Likewise.
12394 * engine.h: Likewise.
12395 * exploded-graph.h: Likewise.
12396 * function-set.cc: Likewise.
12397 * function-set.h: Likewise.
12398 * pending-diagnostic.cc: Likewise.
12399 * pending-diagnostic.h: Likewise.
12400 * program-point.cc: Likewise.
12401 * program-point.h: Likewise.
12402 * program-state.cc: Likewise.
12403 * program-state.h: Likewise.
12404 * region-model.cc: Likewise.
12405 * region-model.h: Likewise.
12406 * sm-file.cc: Likewise.
12407 * sm-malloc.cc: Likewise.
12408 * sm-pattern-test.cc: Likewise.
12409 * sm-sensitive.cc: Likewise.
12410 * sm-signal.cc: Likewise.
12411 * sm-taint.cc: Likewise.
12412 * sm.cc: Likewise.
12413 * sm.h: Likewise.
12414 * state-purge.h: Likewise.
12415 * supergraph.cc: Likewise.
12416 * supergraph.h: Likewise.
12418 2020-01-21 David Malcolm <dmalcolm@redhat.com>
12420 PR analyzer/93352
12421 * region-model.cc (int_cmp): Rename to...
12422 (array_region::key_cmp): ...this, using key_t rather than int.
12423 Rewrite in terms of comparisons rather than subtraction to
12424 ensure qsort is anti-symmetric when handling extreme values.
12425 (array_region::walk_for_canonicalization): Update for above
12426 renaming.
12427 * region-model.h (array_region::key_cmp): New decl.
12429 2020-01-17 David Malcolm <dmalcolm@redhat.com>
12431 PR analyzer/93290
12432 * region-model.cc (region_model::eval_condition_without_cm): Avoid
12433 gcc_unreachable for unexpected operations for the case where
12434 we're comparing an svalue against itself.
12436 2020-01-17 David Malcolm <dmalcolm@redhat.com>
12438 PR analyzer/93281
12439 * region-model.cc
12440 (region_model::convert_byte_offset_to_array_index): Convert to
12441 ssizetype before dividing by byte_size. Use fold_binary rather
12442 than fold_build2 to avoid needlessly constructing a tree for the
12443 non-const case.
12445 2020-01-15 David Malcolm <dmalcolm@redhat.com>
12447 * engine.cc (class impl_region_model_context): Fix comment.
12449 2020-01-14 David Malcolm <dmalcolm@redhat.com>
12451 PR analyzer/93212
12452 * region-model.cc (make_region_for_type): Use
12453 FUNC_OR_METHOD_TYPE_P rather than comparing against FUNCTION_TYPE.
12454 * region-model.h (function_region::function_region): Likewise.
12456 2020-01-14 David Malcolm <dmalcolm@redhat.com>
12458 * program-state.cc (sm_state_map::clone_with_remapping): Copy
12459 m_global_state.
12460 (selftest::test_program_state_merging_2): New selftest.
12461 (selftest::analyzer_program_state_cc_tests): Call it.
12463 2020-01-14 David Malcolm <dmalcolm@redhat.com>
12465 * checker-path.h (checker_path::get_checker_event): New function.
12466 (checker_path): Add DISABLE_COPY_AND_ASSIGN; make fields private.
12467 * diagnostic-manager.cc
12468 (diagnostic_manager::prune_for_sm_diagnostic): Replace direct
12469 access to checker_path::m_events with accessor functions. Fix
12470 overlong line.
12471 (diagnostic_manager::prune_interproc_events): Replace direct
12472 access to checker_path::m_events with accessor functions.
12473 (diagnostic_manager::finish_pruning): Likewise.
12475 2020-01-14 David Malcolm <dmalcolm@redhat.com>
12477 * checker-path.h (checker_event::clone): Delete vfunc decl.
12478 (debug_event::clone): Delete vfunc impl.
12479 (custom_event::clone): Delete vfunc impl.
12480 (statement_event::clone): Delete vfunc impl.
12481 (function_entry_event::clone): Delete vfunc impl.
12482 (state_change_event::clone): Delete vfunc impl.
12483 (start_cfg_edge_event::clone): Delete vfunc impl.
12484 (end_cfg_edge_event::clone): Delete vfunc impl.
12485 (call_event::clone): Delete vfunc impl.
12486 (return_event::clone): Delete vfunc impl.
12487 (setjmp_event::clone): Delete vfunc impl.
12488 (rewind_from_longjmp_event::clone): Delete vfunc impl.
12489 (rewind_to_setjmp_event::clone): Delete vfunc impl.
12490 (warning_event::clone): Delete vfunc impl.
12492 2020-01-14 David Malcolm <dmalcolm@redhat.com>
12494 * supergraph.cc (supernode::dump_dot): Ensure that the TABLE
12495 element has at least one TR.
12497 2020-01-14 David Malcolm <dmalcolm@redhat.com>
12499 PR analyzer/58237
12500 * engine.cc (leak_stmt_finder::find_stmt): Use get_pure_location
12501 when comparing against UNKNOWN_LOCATION.
12502 (stmt_requires_new_enode_p): Likewise.
12503 (exploded_graph::dump_exploded_nodes): Likewise.
12504 * supergraph.cc (supernode::get_start_location): Likewise.
12505 (supernode::get_end_location): Likewise.
12507 2020-01-14 David Malcolm <dmalcolm@redhat.com>
12509 PR analyzer/58237
12510 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
12511 selftest::analyzer_sm_file_cc_tests.
12512 * analyzer-selftests.h (selftest::analyzer_sm_file_cc_tests): New
12513 decl.
12514 * sm-file.cc: Include "analyzer/function-set.h" and
12515 "analyzer/analyzer-selftests.h".
12516 (get_file_using_fns): New function.
12517 (is_file_using_fn_p): New function.
12518 (fileptr_state_machine::on_stmt): Return true for known functions.
12519 (selftest::analyzer_sm_file_cc_tests): New function.
12521 2020-01-14 David Malcolm <dmalcolm@redhat.com>
12523 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
12524 selftest::analyzer_sm_signal_cc_tests.
12525 * analyzer-selftests.h (selftest::analyzer_sm_signal_cc_tests):
12526 New decl.
12527 * sm-signal.cc: Include "analyzer/function-set.h" and
12528 "analyzer/analyzer-selftests.h".
12529 (get_async_signal_unsafe_fns): New function.
12530 (signal_unsafe_p): Reimplement in terms of the above.
12531 (selftest::analyzer_sm_signal_cc_tests): New function.
12533 2020-01-14 David Malcolm <dmalcolm@redhat.com>
12535 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
12536 selftest::analyzer_function_set_cc_tests.
12537 * analyzer-selftests.h (selftest::analyzer_function_set_cc_tests):
12538 New decl.
12539 * function-set.cc: New file.
12540 * function-set.h: New file.
12542 2020-01-14 David Malcolm <dmalcolm@redhat.com>
12544 * analyzer.h (fndecl_has_gimple_body_p): New decl.
12545 * engine.cc (impl_region_model_context::on_unknown_change): New
12546 function.
12547 (fndecl_has_gimple_body_p): Make non-static.
12548 (exploded_node::on_stmt): Treat __analyzer_dump_exploded_nodes as
12549 known. Track whether we have a call with unknown side-effects and
12550 pass it to on_call_post.
12551 * exploded-graph.h (impl_region_model_context::on_unknown_change):
12552 New decl.
12553 * program-state.cc (sm_state_map::on_unknown_change): New function.
12554 * program-state.h (sm_state_map::on_unknown_change): New decl.
12555 * region-model.cc: Include "bitmap.h".
12556 (region_model::on_call_pre): Return a bool, capturing whether the
12557 call has unknown side effects.
12558 (region_model::on_call_post): Add arg "bool unknown_side_effects"
12559 and if true, call handle_unrecognized_call.
12560 (class reachable_regions): New class.
12561 (region_model::handle_unrecognized_call): New function.
12562 * region-model.h (region_model::on_call_pre): Return a bool.
12563 (region_model::on_call_post): Add arg "bool unknown_side_effects".
12564 (region_model::handle_unrecognized_call): New decl.
12565 (region_model_context::on_unknown_change): New vfunc.
12566 (test_region_model_context::on_unknown_change): New function.
12568 2020-01-14 David Malcolm <dmalcolm@redhat.com>
12570 * diagnostic-manager.cc (saved_diagnostic::operator==): Move here
12571 from header. Replace pointer equality test on m_var with call to
12572 pending_diagnostic::same_tree_p.
12573 * diagnostic-manager.h (saved_diagnostic::operator==): Move to
12574 diagnostic-manager.cc.
12575 * pending-diagnostic.cc (pending_diagnostic::same_tree_p): New.
12576 * pending-diagnostic.h (pending_diagnostic::same_tree_p): New.
12577 * sm-file.cc (file_diagnostic::subclass_equal_p): Replace pointer
12578 equality on m_arg with call to pending_diagnostic::same_tree_p.
12579 * sm-malloc.cc (malloc_diagnostic::subclass_equal_p): Likewise.
12580 (possible_null_arg::subclass_equal_p): Likewise.
12581 (null_arg::subclass_equal_p): Likewise.
12582 (free_of_non_heap::subclass_equal_p): Likewise.
12583 * sm-pattern-test.cc (pattern_match::operator==): Likewise.
12584 * sm-sensitive.cc (exposure_through_output_file::operator==):
12585 Likewise.
12586 * sm-taint.cc (tainted_array_index::operator==): Likewise.
12588 2020-01-14 David Malcolm <dmalcolm@redhat.com>
12590 * diagnostic-manager.cc (dedupe_winners::add): Add logging
12591 of deduplication decisions made.
12593 2020-01-14 David Malcolm <dmalcolm@redhat.com>
12595 * ChangeLog: New file.
12596 * analyzer-selftests.cc: New file.
12597 * analyzer-selftests.h: New file.
12598 * analyzer.opt: New file.
12599 * analysis-plan.cc: New file.
12600 * analysis-plan.h: New file.
12601 * analyzer-logging.cc: New file.
12602 * analyzer-logging.h: New file.
12603 * analyzer-pass.cc: New file.
12604 * analyzer.cc: New file.
12605 * analyzer.h: New file.
12606 * call-string.cc: New file.
12607 * call-string.h: New file.
12608 * checker-path.cc: New file.
12609 * checker-path.h: New file.
12610 * constraint-manager.cc: New file.
12611 * constraint-manager.h: New file.
12612 * diagnostic-manager.cc: New file.
12613 * diagnostic-manager.h: New file.
12614 * engine.cc: New file.
12615 * engine.h: New file.
12616 * exploded-graph.h: New file.
12617 * pending-diagnostic.cc: New file.
12618 * pending-diagnostic.h: New file.
12619 * program-point.cc: New file.
12620 * program-point.h: New file.
12621 * program-state.cc: New file.
12622 * program-state.h: New file.
12623 * region-model.cc: New file.
12624 * region-model.h: New file.
12625 * sm-file.cc: New file.
12626 * sm-malloc.cc: New file.
12627 * sm-malloc.dot: New file.
12628 * sm-pattern-test.cc: New file.
12629 * sm-sensitive.cc: New file.
12630 * sm-signal.cc: New file.
12631 * sm-taint.cc: New file.
12632 * sm.cc: New file.
12633 * sm.h: New file.
12634 * state-purge.cc: New file.
12635 * state-purge.h: New file.
12636 * supergraph.cc: New file.
12637 * supergraph.h: New file.
12639 2019-12-13 David Malcolm <dmalcolm@redhat.com>
12641 * Initial creation
12643 \f
12644 Copyright (C) 2019-2024 Free Software Foundation, Inc.
12646 Copying and distribution of this file, with or without modification,
12647 are permitted in any medium without royalty provided the copyright
12648 notice and this notice are preserved.