| blob | f3ca1866d5643399e80cdce83f9e17ee8da00b2b |
1 2023-05-29 Release Manager
3 * GCC 11.4.0 released.
5 2022-04-28 David Malcolm <dmalcolm@redhat.com>
7 PR analyzer/105365
8 PR analyzer/105366
9 * svalue.cc
10 (cmp_cst): Rename to...
11 (cmp_csts_same_type): ...this. Convert all recursive calls to
12 calls to...
13 (cmp_csts_and_types): ....this new function.
14 (svalue::cmp_ptr): Update for renaming of cmp_cst
16 2022-04-28 David Malcolm <dmalcolm@redhat.com>
18 PR analyzer/105252
19 * svalue.cc (cmp_cst): When comparing VECTOR_CSTs, compare the
20 types of the encoded elements before calling cmp_cst on them.
22 2022-04-21 Release Manager
24 * GCC 11.3.0 released.
26 2021-12-11 David Malcolm <dmalcolm@redhat.com>
28 PR analyzer/101962
29 * region-model.cc (region_model::eval_condition_without_cm):
30 Refactor comparison against zero, adding a check for
31 POINTER_PLUS_EXPR of non-NULL.
33 2021-07-28 Release Manager
35 * GCC 11.2.0 released.
37 2021-07-02 David Malcolm <dmalcolm@redhat.com>
39 * store.cc (binding_cluster::get_any_binding): Make symbolic reads
40 from a cluster with concrete bindings return unknown.
42 2021-07-02 David Malcolm <dmalcolm@redhat.com>
44 * region-model-manager.cc
45 (region_model_manager::get_or_create_int_cst): New.
46 (region_model_manager::maybe_undo_optimize_bit_field_compare): Use
47 it to simplify away a local tree.
48 * region-model.cc (region_model::on_setjmp): Likewise.
49 (region_model::on_longjmp): Likewise.
50 * region-model.h (region_model_manager::get_or_create_int_cst):
51 New decl.
52 * store.cc (binding_cluster::zero_fill_region): Use it to simplify
53 away a local tree.
55 2021-07-02 David Malcolm <dmalcolm@redhat.com>
57 PR analyzer/99212
58 PR analyzer/101082
59 * engine.cc: Include "target.h".
60 (impl_run_checkers): Log BITS_BIG_ENDIAN, BYTES_BIG_ENDIAN, and
61 WORDS_BIG_ENDIAN.
62 * region-model-manager.cc
63 (region_model_manager::maybe_fold_binop): Move support for masking
64 via ARG0 & CST into...
65 (region_model_manager::maybe_undo_optimize_bit_field_compare):
66 ...this new function. Flatten by converting from nested
67 conditionals to a series of early return statements to reject
68 failures. Reject if type is not unsigned_char_type_node.
69 Handle BYTES_BIG_ENDIAN when determining which bits are bound
70 in the binding_map.
71 * region-model.h
72 (region_model_manager::maybe_undo_optimize_bit_field_compare):
73 New decl.
74 * store.cc (bit_range::dump): New function.
75 * store.h (bit_range::dump): New decl.
77 2021-07-02 David Malcolm <dmalcolm@redhat.com>
79 * engine.cc (worklist::key_t::cmp): Move sort by call_string to
80 before SCC.
82 2021-07-02 David Malcolm <dmalcolm@redhat.com>
84 * region-model.cc (region_model::get_lvalue_1): Make const.
85 (region_model::get_lvalue): Likewise.
86 (region_model::get_rvalue_1): Likewise.
87 (region_model::get_rvalue): Likewise.
88 (region_model::deref_rvalue): Likewise.
89 (region_model::get_rvalue_for_bits): Likewise.
90 * region-model.h (region_model::get_lvalue): Likewise.
91 (region_model::get_rvalue): Likewise.
92 (region_model::deref_rvalue): Likewise.
93 (region_model::get_rvalue_for_bits): Likewise.
94 (region_model::get_lvalue_1): Likewise.
95 (region_model::get_rvalue_1): Likewise.
97 2021-07-02 David Malcolm <dmalcolm@redhat.com>
99 PR analyzer/99212
100 * region-model-manager.cc
101 (region_model_manager::maybe_fold_binop): Add support for folding
102 BIT_AND_EXPR of compound_svalue and a mask constant.
103 * region-model.cc (region_model::get_rvalue_1): Implement
104 BIT_FIELD_REF in terms of...
105 (region_model::get_rvalue_for_bits): New function.
106 * region-model.h (region_model::get_rvalue_for_bits): New decl.
107 * store.cc (bit_range::from_mask): New function.
108 (selftest::test_bit_range_intersects_p): New selftest.
109 (selftest::assert_bit_range_from_mask_eq): New.
110 (ASSERT_BIT_RANGE_FROM_MASK_EQ): New macro.
111 (selftest::assert_no_bit_range_from_mask_eq): New.
112 (ASSERT_NO_BIT_RANGE_FROM_MASK): New macro.
113 (selftest::test_bit_range_from_mask): New selftest.
114 (selftest::analyzer_store_cc_tests): Call the new selftests.
115 * store.h (bit_range::intersects_p): New.
116 (bit_range::from_mask): New decl.
117 (concrete_binding::get_bit_range): New accessor.
118 (store_manager::get_concrete_binding): New overload taking
119 const bit_range &.
121 2021-07-02 David Malcolm <dmalcolm@redhat.com>
123 * analyzer.h (int_size_in_bits): New decl.
124 * region.cc (int_size_in_bits): New function.
125 (region::get_bit_size): Reimplement in terms of the above.
127 2021-07-02 David Malcolm <dmalcolm@redhat.com>
129 * store.cc (concrete_binding::dump_to_pp): Move bulk of
130 implementation to...
131 (bit_range::dump_to_pp): ...this new function.
132 (bit_range::cmp): New.
133 (concrete_binding::overlaps_p): Update for use of bit_range.
134 (concrete_binding::cmp_ptr_ptr): Likewise.
135 * store.h (struct bit_range): New.
136 (class concrete_binding): Replace fields m_start_bit_offset and
137 m_size_in_bits with new field m_bit_range.
139 2021-07-02 David Malcolm <dmalcolm@redhat.com>
141 * svalue.h (conjured_svalue::iterator_t): Delete.
143 2021-07-02 David Malcolm <dmalcolm@redhat.com>
145 * store.h (store::get_direct_binding): Remove unused decl.
146 (store::get_default_binding): Likewise.
148 2021-07-02 David Malcolm <dmalcolm@redhat.com>
150 * svalue.cc (poisoned_svalue::dump_to_pp): Dump type.
151 (compound_svalue::dump_to_pp): Dump any type.
153 2021-07-02 David Malcolm <dmalcolm@redhat.com>
155 PR analyzer/100615
156 * sm-malloc.cc: Include "analyzer/function-set.h".
157 (malloc_state_machine::on_stmt): Call unaffected_by_call_p and
158 bail on the functions it recognizes.
159 (malloc_state_machine::unaffected_by_call_p): New.
161 2021-07-02 David Malcolm <dmalcolm@redhat.com>
163 PR analyzer/100244
164 * sm-malloc.cc (free_of_non_heap::describe_state_change):
165 Bulletproof against change.m_expr being NULL.
167 2021-04-27 Release Manager
169 * GCC 11.1.0 released.
171 2021-04-13 David Malcolm <dmalcolm@redhat.com>
173 PR analyzer/98599
174 * supergraph.cc (saved_uids::make_uid_unique): New.
175 (saved_uids::restore_uids): New.
176 (supergraph::supergraph): Replace assignments to stmt->uid with
177 calls to m_stmt_uids.make_uid_unique.
178 (supergraph::~supergraph): New.
179 * supergraph.h (class saved_uids): New.
180 (supergraph::~supergraph): New decl.
181 (supergraph::m_stmt_uids): New field.
183 2021-04-10 David Malcolm <dmalcolm@redhat.com>
185 PR analyzer/100011
186 * region-model.cc (region_model::on_assignment): Avoid NULL
187 dereference if ctxt is NULL when assigning from a STRING_CST.
189 2021-04-08 David Malcolm <dmalcolm@redhat.com>
191 PR analyzer/99042
192 PR analyzer/99774
193 * engine.cc
194 (impl_region_model_context::impl_region_model_context): Add
195 uncertainty param and use it to initialize m_uncertainty.
196 (impl_region_model_context::get_uncertainty): New.
197 (impl_sm_context::get_fndecl_for_call): Add NULL for new
198 uncertainty param when constructing impl_region_model_context.
199 (impl_sm_context::get_state): Likewise.
200 (impl_sm_context::set_next_state): Likewise.
201 (impl_sm_context::warn): Likewise.
202 (exploded_node::on_stmt): Add uncertainty param
203 and use it when constructing impl_region_model_context.
204 (exploded_node::on_edge): Add uncertainty param and pass
205 to on_edge call.
206 (exploded_node::detect_leaks): Create uncertainty_t and pass to
207 impl_region_model_context.
208 (exploded_graph::get_or_create_node): Create uncertainty_t and
209 pass to prune_for_point.
210 (maybe_process_run_of_before_supernode_enodes): Create
211 uncertainty_t and pass to impl_region_model_context.
212 (exploded_graph::process_node): Create uncertainty_t instances and
213 pass around as needed.
214 * exploded-graph.h
215 (impl_region_model_context::impl_region_model_context): Add
216 uncertainty param.
217 (impl_region_model_context::get_uncertainty): New decl.
218 (impl_region_model_context::m_uncertainty): New field.
219 (exploded_node::on_stmt): Add uncertainty param.
220 (exploded_node::on_edge): Likewise.
221 * program-state.cc (sm_state_map::on_liveness_change): Get
222 uncertainty from context and use it to unset sm-state from
223 svalues as appropriate.
224 (program_state::on_edge): Add uncertainty param and use it when
225 constructing impl_region_model_context. Fix indentation.
226 (program_state::prune_for_point): Add uncertainty param and use it
227 when constructing impl_region_model_context.
228 (program_state::detect_leaks): Get any uncertainty from ctxt and
229 use it to get maybe-live svalues for dest_state, rather than
230 definitely-live ones; use this when determining which svalues
231 have leaked.
232 (selftest::test_program_state_merging): Create uncertainty_t and
233 pass to impl_region_model_context.
234 * program-state.h (program_state::on_edge): Add uncertainty param.
235 (program_state::prune_for_point): Likewise.
236 * region-model-impl-calls.cc (call_details::get_uncertainty): New.
237 (region_model::impl_call_memcpy): Pass uncertainty to
238 mark_region_as_unknown call.
239 (region_model::impl_call_memset): Likewise.
240 (region_model::impl_call_strcpy): Likewise.
241 * region-model-reachability.cc (reachable_regions::handle_sval):
242 Also add sval to m_mutable_svals.
243 * region-model.cc (region_model::on_assignment): Pass any
244 uncertainty from ctxt to the store::set_value call.
245 (region_model::handle_unrecognized_call): Get any uncertainty from
246 ctxt and use it to record mutable svalues at the unknown call.
247 (region_model::get_reachable_svalues): Add uncertainty param and
248 use it to mark any maybe-bound svalues as being reachable.
249 (region_model::set_value): Pass any uncertainty from ctxt to the
250 store::set_value call.
251 (region_model::mark_region_as_unknown): Add uncertainty param and
252 pass it on to the store::mark_region_as_unknown call.
253 (region_model::update_for_call_summary): Add uncertainty param and
254 pass it on to the region_model::mark_region_as_unknown call.
255 * region-model.h (call_details::get_uncertainty): New decl.
256 (region_model::get_reachable_svalues): Add uncertainty param.
257 (region_model::mark_region_as_unknown): Add uncertainty param.
258 (region_model_context::get_uncertainty): New vfunc.
259 (noop_region_model_context::get_uncertainty): New vfunc
260 implementation.
261 * store.cc (dump_svalue_set): New.
262 (uncertainty_t::dump_to_pp): New.
263 (uncertainty_t::dump): New.
264 (binding_cluster::clobber_region): Pass NULL for uncertainty to
265 remove_overlapping_bindings.
266 (binding_cluster::mark_region_as_unknown): Add uncertainty param
267 and pass it to remove_overlapping_bindings.
268 (binding_cluster::remove_overlapping_bindings): Add uncertainty param.
269 Use it to record any svalues that were in clobbered bindings.
270 (store::set_value): Add uncertainty param. Pass it to
271 binding_cluster::mark_region_as_unknown when handling symbolic
272 regions.
273 (store::mark_region_as_unknown): Add uncertainty param and pass it
274 to binding_cluster::mark_region_as_unknown.
275 (store::remove_overlapping_bindings): Add uncertainty param and
276 pass it to binding_cluster::remove_overlapping_bindings.
277 * store.h (binding_cluster::mark_region_as_unknown): Add
278 uncertainty param.
279 (binding_cluster::remove_overlapping_bindings): Likewise.
280 (store::set_value): Likewise.
281 (store::mark_region_as_unknown): Likewise.
283 2021-04-05 David Malcolm <dmalcolm@redhat.com>
285 PR analyzer/99906
286 * analyzer.cc (maybe_reconstruct_from_def_stmt): Fix NULL
287 dereference on calls with zero arguments.
288 * sm-malloc.cc (malloc_state_machine::on_stmt): When handling
289 __attribute__((nonnull)), only call get_diagnostic_tree if the
290 result will be used.
292 2021-04-05 David Malcolm <dmalcolm@redhat.com>
294 PR analyzer/99886
295 * diagnostic-manager.cc
296 (diagnostic_manager::prune_interproc_events): Use signed integers
297 when subtracting one from path->num_events ().
298 (diagnostic_manager::consolidate_conditions): Likewise. Convert
299 next_idx to a signed int.
301 2021-04-01 David Malcolm <dmalcolm@redhat.com>
303 * diagnostic-manager.cc (diagnostic_manager::add_diagnostic): Make
304 enode param non-constant, and call add_diagnostic on it. Add
305 enode index to log message.
306 (diagnostic_manager::add_diagnostic): Make enode param
307 non-constant.
308 * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
309 Likewise for both decls.
310 * engine.cc
311 (impl_region_model_context::impl_region_model_context): Likewise
312 for enode_for_diag.
313 (impl_sm_context::impl_sm_context): Likewise.
314 (impl_sm_context::m_enode_for_diag): Likewise.
315 (exploded_node::dump_dot): Don't pass the diagnostic manager
316 to dump_saved_diagnostics.
317 (exploded_node::dump_saved_diagnostics): Drop param. Iterate
318 directly through all saved diagnostics for the enode, rather
319 than all saved diagnostics in the diagnostic_manager and
320 filtering.
321 (exploded_node::on_stmt): Make non-const.
322 (exploded_node::on_edge): Likewise.
323 (exploded_node::on_longjmp): Likewise.
324 (exploded_node::detect_leaks): Likewise.
325 (exploded_graph::get_or_create_node): Make enode_for_diag param
326 non-const.
327 (exploded_graph_annotator::print_enode): Iterate
328 directly through all saved diagnostics for the enode, rather
329 than all saved diagnostics in the diagnostic_manager and
330 filtering.
331 * exploded-graph.h
332 (impl_region_model_context::impl_region_model_context): Make
333 enode_for_diag param non-constant.
334 (impl_region_model_context::m_enode_for_diag): Likewise.
335 (exploded_node::dump_saved_diagnostics): Drop param.
336 (exploded_node::on_stmt): Make non-const.
337 (exploded_node::on_edge): Likewise.
338 (exploded_node::on_longjmp): Likewise.
339 (exploded_node::detect_leaks): Likewise.
340 (exploded_node::add_diagnostic): New.
341 (exploded_node::get_num_diagnostics): New.
342 (exploded_node::get_saved_diagnostic): New.
343 (exploded_node::m_saved_diagnostics): New.
344 (exploded_graph::get_or_create_node): Make enode_for_diag param
345 non-constant.
346 * feasible-graph.cc (feasible_node::dump_dot): Drop
347 diagnostic_manager from call to dump_saved_diagnostics.
348 * program-state.cc (program_state::on_edge): Convert enode param
349 to non-const pointer.
350 (program_state::prune_for_point): Likewise for enode_for_diag
351 param.
352 * program-state.h (program_state::on_edge): Convert enode param
353 to non-const pointer.
354 (program_state::prune_for_point): Likewise for enode_for_diag
355 param.
357 2021-03-31 David Malcolm <dmalcolm@redhat.com>
359 PR analyzer/99771
360 * analyzer.cc (maybe_reconstruct_from_def_stmt): New.
361 (fixup_tree_for_diagnostic_1): New.
362 (fixup_tree_for_diagnostic): New.
363 * analyzer.h (fixup_tree_for_diagnostic): New decl.
364 * checker-path.cc (call_event::get_desc): Call
365 fixup_tree_for_diagnostic and use it for the call_with_state call.
366 (warning_event::get_desc): Likewise for the final_event and
367 make_label_text calls.
368 * engine.cc (impl_region_model_context::on_state_leak): Likewise
369 for the on_leak and add_diagnostic calls.
370 * region-model.cc (region_model::get_representative_tree):
371 Likewise for the result.
373 2021-03-30 David Malcolm <dmalcolm@redhat.com>
375 * region.h (region::dump_to_pp): Remove old decl.
377 2021-03-30 David Malcolm <dmalcolm@redhat.com>
379 * sm-file.cc (fileptr_state_machine::on_stmt): Only call
380 get_diagnostic_tree if the result will be used.
381 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
382 (malloc_state_machine::on_deallocator_call): Likewise.
383 (malloc_state_machine::on_realloc_call): Likewise.
384 (malloc_state_machine::on_realloc_call): Likewise.
385 * sm-sensitive.cc
386 (sensitive_state_machine::warn_for_any_exposure): Likewise.
387 * sm-taint.cc (taint_state_machine::on_stmt): Likewise.
389 2021-03-25 David Malcolm <dmalcolm@redhat.com>
391 PR analyzer/93695
392 PR analyzer/99044
393 PR analyzer/99716
394 * engine.cc (exploded_node::on_stmt): Clear sm-state involving
395 an SSA name at the def-stmt of that SSA name.
396 * program-state.cc (sm_state_map::purge_state_involving): New.
397 * program-state.h (sm_state_map::purge_state_involving): New decl.
398 * region-model.cc (selftest::test_involves_p): New.
399 (selftest::analyzer_region_model_cc_tests): Call it.
400 * svalue.cc (class involvement_visitor): New class
401 (svalue::involves_p): New.
402 * svalue.h (svalue::involves_p): New decl.
404 2021-03-19 David Malcolm <dmalcolm@redhat.com>
406 PR analyzer/99614
407 * diagnostic-manager.cc (class epath_finder): Add
408 DISABLE_COPY_AND_ASSIGN.
410 2021-03-15 Martin Liska <mliska@suse.cz>
412 * sm-file.cc (get_file_using_fns): Add missing comma in initializer.
414 2021-03-11 David Malcolm <dmalcolm@redhat.com>
416 PR analyzer/96374
417 * analyzer.opt (-param=analyzer-max-infeasible-edges=): New param.
418 (fdump-analyzer-feasibility): New flag.
419 * diagnostic-manager.cc: Include "analyzer/trimmed-graph.h" and
420 "analyzer/feasible-graph.h".
421 (epath_finder::epath_finder): Convert m_sep to a pointer and
422 only create it if !flag_analyzer_feasibility.
423 (epath_finder::~epath_finder): New.
424 (epath_finder::m_sep): Convert to a pointer.
425 (epath_finder::get_best_epath): Add param "diag_idx" and use it
426 when logging. Rather than finding the shortest path and then
427 checking feasibility, instead use explore_feasible_paths unless
428 !flag_analyzer_feasibility, in which case simply use the shortest
429 path, and note if it is infeasible. Update for m_sep becoming a
430 pointer.
431 (class feasible_worklist): New.
432 (epath_finder::explore_feasible_paths): New.
433 (epath_finder::process_worklist_item): New.
434 (class dump_eg_with_shortest_path): New.
435 (epath_finder::dump_trimmed_graph): New.
436 (epath_finder::dump_feasible_graph): New.
437 (saved_diagnostic::saved_diagnostic): Add "idx" param, using it
438 on new field m_idx.
439 (saved_diagnostic::to_json): Dump m_idx.
440 (saved_diagnostic::calc_best_epath): Pass m_idx to get_best_epath.
441 Remove assertion that m_problem was set when m_best_epath is NULL.
442 (diagnostic_manager::add_diagnostic): Pass an index when created
443 saved_diagnostic instances.
444 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add
445 "idx" param.
446 (saved_diagnostic::get_index): New accessor.
447 (saved_diagnostic::m_idx): New field.
448 * engine.cc (exploded_node::dump_dot): Call args.dump_extra_info.
449 Move code to...
450 (exploded_node::dump_processed_stmts): ...this new function and...
451 (exploded_node::dump_saved_diagnostics): ...this new function.
452 Add index of each diagnostic.
453 (exploded_edge::dump_dot): Move bulk of code to...
454 (exploded_edge::dump_dot_label): ...this new function.
455 * exploded-graph.h (eg_traits::dump_args_t::dump_extra_info): New
456 vfunc.
457 (exploded_node::dump_processed_stmts): New decl.
458 (exploded_node::dump_saved_diagnostics): New decl.
459 (exploded_edge::dump_dot_label): New decl.
460 * feasible-graph.cc: New file.
461 * feasible-graph.h: New file.
462 * trimmed-graph.cc: New file.
463 * trimmed-graph.h: New file.
465 2021-03-11 David Malcolm <dmalcolm@redhat.com>
467 * diagnostic-manager.cc (epath_finder::epath_finder):
468 Update shortest_paths init for new param.
470 2021-03-10 David Malcolm <dmalcolm@redhat.com>
472 PR analyzer/96374
473 * engine.cc (exploded_path::feasible_p): Move "snodes_visited" and
474 "model" locals into a new class feasibility_state. Move heart
475 of per-edge processing into
476 feasibility_state::maybe_update_for_edge.
477 (feasibility_state::feasibility_state): New.
478 (feasibility_state::maybe_update_for_edge): New, based on loop
479 body in exploded_path::feasible_p.
480 * exploded-graph.h (class feasibility_state): New.
482 2021-03-10 David Malcolm <dmalcolm@redhat.com>
484 * supergraph.h
485 (callgraph_superedge::dyn_cast_callgraph_superedge): New.
486 (call_superedge::dyn_cast_callgraph_superedge): Delete.
487 (return_superedge::dyn_cast_callgraph_superedge): Delete.
489 2021-03-02 Martin Liska <mliska@suse.cz>
491 * diagnostic-manager.cc (diagnostic_manager::emit_saved_diagnostics):
492 Do not pass engine.
494 2021-02-26 David Malcolm <dmalcolm@redhat.com>
496 * engine.cc (exploded_path::exploded_path): New copy-ctor.
497 * exploded-graph.h (exploded_path::operator=): Drop decl.
499 2021-02-26 David Malcolm <dmalcolm@redhat.com>
501 PR analyzer/96374
502 * diagnostic-manager.cc (class epath_finder): New.
503 (epath_finder::get_best_epath): New.
504 (saved_diagnostic::saved_diagnostic): Update for replacement of
505 m_state and m_epath_length with m_best_epath.
506 (saved_diagnostic::~saved_diagnostic): Delete m_best_epath.
507 (saved_diagnostic::to_json): Update "path_length" to be optional.
508 (saved_diagnostic::calc_best_epath): New, based on
509 dedupe_winners::add and parts of dedupe_key::dedupe_key.
510 (saved_diagnostic::get_epath_length): New.
511 (saved_diagnostic::add_duplicate): New.
512 (dedupe_key::dedupe_key): Drop epath param. Move invocation of
513 stmt_finder to saved_diagnostic::calc_best_epath.
514 (class dedupe_candidate): Delete.
515 (class dedupe_hash_map_traits): Update to use saved_diagnotic *
516 rather than dedupe_candidate * as the value_type/compare_type.
517 (dedupe_winners::~dedupe_winners): Don't delete the values.
518 (dedupe_winners::add): Convert param from shortest_exploded_paths to
519 epath_finder. Drop "eg" param. Drop dedupe_candidate, moving
520 path generation and feasiblity checking to
521 epath_finder::get_best_epath. Update winner-selection for move
522 of epaths from dedupe_candidate to saved_diagnostic.
523 (dedupe_winners::emit_best): Update for removal of class
524 dedupe_candidate.
525 (dedupe_winners::map_t): Update to use saved_diagnotic * rather
526 than dedupe_candidate * as the value_type/compare_type.
527 (diagnostic_manager::emit_saved_diagnostics): Move
528 shortest_exploded_paths instance into epath_finder and pass that
529 around instead.
530 (diagnostic_manager::emit_saved_diagnostic): Drop epath, stmt
531 and num_dupes params, instead getting these from the
532 saved_diagnostic. Use correct location in inform_n call.
533 * diagnostic-manager.h (class epath_finder): New forward decl.
534 (saved_diagnostic::status): Drop enum.
535 (saved_diagnostic::set_feasible): Drop.
536 (saved_diagnostic::set_infeasible): Drop.
537 (saved_diagnostic::get_status): Drop.
538 (saved_diagnostic::calc_best_epath): New decl.
539 (saved_diagnostic::get_best_epath): New decl.
540 (saved_diagnostic::get_epath_length): New decl.
541 (saved_diagnostic::set_epath_length): Drop.
542 (saved_diagnostic::get_epath_length): Drop inline implementation.
543 (saved_diagnostic::add_duplicate): New.
544 (saved_diagnostic::get_num_dupes): New.
545 (saved_diagnostic::m_d): Document ownership.
546 (saved_diagnostic::m_trailing_eedge): Make const.
547 (saved_diagnostic::m_status): Drop field.
548 (saved_diagnostic::m_epath_length): Drop field.
549 (saved_diagnostic::m_best_epath): New field.
550 (saved_diagnostic::m_problem): Document ownership.
551 (saved_diagnostic::m_duplicates): New field.
552 (diagnostic_manager::emit_saved_diagnostic): Drop params epath,
553 stmt, and num_dupes.
554 * engine.cc (exploded_graph_annotator::print_saved_diagnostic):
555 Update for changes to saved_diagnostic class.
556 * exploded-graph.h (exploded_path::feasible_p): Drop unused
557 overloaded decl.
559 2021-02-25 David Malcolm <dmalcolm@redhat.com>
561 PR analyzer/99193
562 * region-model-impl-calls.cc (region_model::impl_call_realloc): New.
563 * region-model.cc (region_model::on_call_pre): Call it.
564 * region-model.h (region_model::impl_call_realloc): New decl.
565 * sm-malloc.cc (enum wording): Add WORDING_REALLOCATED.
566 (malloc_state_machine::m_realloc): New field.
567 (use_after_free::describe_state_change): Add case for
568 WORDING_REALLOCATED.
569 (use_after_free::describe_final_event): Likewise.
570 (malloc_state_machine::malloc_state_machine): Initialize
571 m_realloc.
572 (malloc_state_machine::on_stmt): Handle realloc by calling...
573 (malloc_state_machine::on_realloc_call): New.
575 2021-02-22 David Malcolm <dmalcolm@redhat.com>
577 PR analyzer/99196
578 * engine.cc (exploded_node::on_stmt): Provide terminate_path
579 flag as a way for on_call_pre to terminate the current analysis
580 path.
581 * region-model-impl-calls.cc (call_details::num_args): New.
582 (region_model::impl_call_error): New.
583 * region-model.cc (region_model::on_call_pre): Add param
584 "out_terminate_path". Handle "error" and "error_at_line".
585 * region-model.h (call_details::num_args): New decl.
586 (region_model::on_call_pre): Add param "out_terminate_path".
587 (region_model::impl_call_error): New decl.
589 2021-02-17 David Malcolm <dmalcolm@redhat.com>
591 PR analyzer/98969
592 * constraint-manager.cc (dead_svalue_purger::should_purge_p):
593 Update for change to svalue::live_p.
594 * program-state.cc (sm_state_map::on_liveness_change): Likewise.
595 (program_state::detect_leaks): Likewise.
596 * region-model-reachability.cc (reachable_regions::init_cluster):
597 When dealing with a symbolic region, if the underlying pointer is
598 implicitly live, add the region to the reachable regions.
599 * region-model.cc (region_model::compare_initial_and_pointer):
600 Move logic for detecting initial values of params to
601 initial_svalue::initial_value_of_param_p.
602 * svalue.cc (svalue::live_p): Convert "live_svalues" from a
603 reference to a pointer; support it being NULL.
604 (svalue::implicitly_live_p): Convert first param from a
605 refererence to a pointer.
606 (region_svalue::implicitly_live_p): Likewise.
607 (constant_svalue::implicitly_live_p): Likewise.
608 (initial_svalue::implicitly_live_p): Likewise. Treat the initial
609 values of params for the top level frame as still live.
610 (initial_svalue::initial_value_of_param_p): New function, taken
611 from a test in region_model::compare_initial_and_pointer.
612 (unaryop_svalue::implicitly_live_p): Convert first param from a
613 refererence to a pointer.
614 (binop_svalue::implicitly_live_p): Likewise.
615 (sub_svalue::implicitly_live_p): Likewise.
616 (unmergeable_svalue::implicitly_live_p): Likewise.
617 * svalue.h (svalue::live_p): Likewise.
618 (svalue::implicitly_live_p): Likewise.
619 (region_svalue::implicitly_live_p): Likewise.
620 (constant_svalue::implicitly_live_p): Likewise.
621 (initial_svalue::implicitly_live_p): Likewise.
622 (initial_svalue::initial_value_of_param_p): New decl.
623 (unaryop_svalue::implicitly_live_p): Convert first param from a
624 refererence to a pointer.
625 (binop_svalue::implicitly_live_p): Likewise.
626 (sub_svalue::implicitly_live_p): Likewise.
627 (unmergeable_svalue::implicitly_live_p): Likewise.
629 2021-02-12 David Malcolm <dmalcolm@redhat.com>
631 PR analyzer/98969
632 * engine.cc (readability): Add names for the various arbitrary
633 values. Handle NOP_EXPR and INTEGER_CST.
634 (readability_comparator): Combine the readability tests for
635 tree and stack depth, rather than performing them sequentially.
636 (impl_region_model_context::on_state_leak): Strip off top-level
637 casts.
638 * region-model.cc (region_model::get_representative_path_var): Add
639 type-checking, moving the bulk of the implementation to...
640 (region_model::get_representative_path_var_1): ...here. Respect
641 types in casts by recursing and re-adding the cast, rather than
642 merely stripping them off. Use the correct type when handling
643 region_svalue.
644 (region_model::get_representative_tree): Strip off any top-level
645 cast.
646 (region_model::get_representative_path_var): Add type-checking,
647 moving the bulk of the implementation to...
648 (region_model::get_representative_path_var_1): ...here.
649 * region-model.h (region_model::get_representative_path_var_1):
650 New decl
651 (region_model::get_representative_path_var_1): New decl.
652 * store.cc (append_pathvar_with_type): New.
653 (binding_cluster::get_representative_path_vars): Cast path_vars
654 to the correct type when adding them to *OUT_PVS.
656 2021-02-09 David Malcolm <dmalcolm@redhat.com>
658 PR analyzer/98575
659 * sm-file.cc (is_file_using_fn_p): Support "_IO_"-prefixed
660 variants.
662 2021-02-09 David Malcolm <dmalcolm@redhat.com>
664 PR analyzer/98575
665 * store.cc (store::set_value): Treat a pointer written to *UNKNOWN
666 as having escaped.
668 2021-02-02 David Malcolm <dmalcolm@redhat.com>
670 PR analyzer/93355
671 PR analyzer/96374
672 * engine.cc (toplevel_function_p): Simplify so that
673 we only reject functions with a "__analyzer_" prefix.
674 (add_any_callbacks): Delete.
675 (exploded_graph::build_initial_worklist): Update for
676 dropped param of toplevel_function_p.
677 (exploded_graph::build_initial_worklist): Don't bother
678 looking for callbacks that are reachable from global
679 initializers.
681 2021-02-01 David Malcolm <dmalcolm@redhat.com>
683 PR analyzer/98918
684 * region-model-manager.cc
685 (region_model_manager::get_or_create_initial_value):
686 Fold the initial value of *UNKNOWN_PTR to an UNKNOWN value.
687 (region_model_manager::get_field_region): Fold the value
688 of UNKNOWN_PTR->FIELD to *UNKNOWN_PTR_OF_&FIELD_TYPE.
690 2021-01-29 David Malcolm <dmalcolm@redhat.com>
692 * checker-path.cc (event_kind_to_string): Handle
693 EK_START_CONSOLIDATED_CFG_EDGES and
694 EK_END_CONSOLIDATED_CFG_EDGES.
695 (start_consolidated_cfg_edges_event::get_desc): New.
696 (checker_path::cfg_edge_pair_at_p): New.
697 * checker-path.h (enum event_kind): Add
698 EK_START_CONSOLIDATED_CFG_EDGES and
699 EK_END_CONSOLIDATED_CFG_EDGES.
700 (class start_consolidated_cfg_edges_event): New class.
701 (class end_consolidated_cfg_edges_event): New class.
702 (checker_path::delete_events): New.
703 (checker_path::replace_event): New.
704 (checker_path::cfg_edge_pair_at_p): New decl.
705 * diagnostic-manager.cc (diagnostic_manager::prune_path): Call
706 consolidate_conditions.
707 (same_line_as_p): New.
708 (diagnostic_manager::consolidate_conditions): New.
709 * diagnostic-manager.h
710 (diagnostic_manager::consolidate_conditions): New decl.
712 2021-01-18 David Malcolm <dmalcolm@redhat.com>
714 * analyzer.h (is_std_named_call_p): New decl.
715 * diagnostic-manager.cc (path_builder::get_sm): New.
716 (state_change_event_creator::state_change_event_creator): Add "pb"
717 param.
718 (state_change_event_creator::on_global_state_change): Don't consider
719 state changes affecting other state_machines.
720 (state_change_event_creator::on_state_change): Likewise.
721 (state_change_event_creator::m_pb): New field.
722 (diagnostic_manager::add_events_for_eedge): Pass pb to visitor
723 ctor.
724 * region-model-impl-calls.cc
725 (region_model::impl_deallocation_call): New.
726 * region-model.cc: Include "attribs.h".
727 (region_model::on_call_post): Handle fndecls referenced by
728 __attribute__((deallocated_by(FOO))).
729 * region-model.h (region_model::impl_deallocation_call): New decl.
730 * sm-malloc.cc: Include "stringpool.h" and "attribs.h". Add
731 leading comment.
732 (class api): Delete.
733 (enum resource_state): Update comment for change from api to
734 deallocator and deallocator_set.
735 (allocation_state::allocation_state): Drop api param. Add
736 "deallocators" and "deallocator".
737 (allocation_state::m_api): Drop field in favor of...
738 (allocation_state::m_deallocators): New field.
739 (allocation_state::m_deallocator): New field.
740 (enum wording): Add WORDING_DEALLOCATED.
741 (struct deallocator): New.
742 (struct standard_deallocator): New.
743 (struct custom_deallocator): New.
744 (struct deallocator_set): New.
745 (struct custom_deallocator_set): New.
746 (struct standard_deallocator_set): New.
747 (struct deallocator_set_map_traits): New.
748 (malloc_state_machine::m_malloc): Drop field
749 (malloc_state_machine::m_scalar_new): Likewise.
750 (malloc_state_machine::m_vector_new): Likewise.
751 (malloc_state_machine::m_free): New field
752 (malloc_state_machine::m_scalar_delete): Likewise.
753 (malloc_state_machine::m_vector_delete): Likewise.
754 (malloc_state_machine::deallocator_map_t): New typedef.
755 (malloc_state_machine::m_deallocator_map): New field.
756 (malloc_state_machine::deallocator_set_cache_t): New typedef.
757 (malloc_state_machine::m_custom_deallocator_set_cache): New field.
758 (malloc_state_machine::custom_deallocator_set_map_t): New typedef.
759 (malloc_state_machine::m_custom_deallocator_set_map): New field.
760 (malloc_state_machine::m_dynamic_sets): New field.
761 (malloc_state_machine::m_dynamic_deallocators): New field.
762 (api::api): Delete.
763 (deallocator::deallocator): New ctor.
764 (deallocator::hash): New.
765 (deallocator::dump_to_pp): New.
766 (deallocator::cmp): New.
767 (deallocator::cmp_ptr_ptr): New.
768 (standard_deallocator::standard_deallocator): New ctor.
769 (deallocator_set::deallocator_set): New ctor.
770 (deallocator_set::dump): New.
771 (custom_deallocator_set::custom_deallocator_set): New ctor.
772 (custom_deallocator_set::contains_p): New.
773 (custom_deallocator_set::maybe_get_single): New.
774 (custom_deallocator_set::dump_to_pp): New.
775 (standard_deallocator_set::standard_deallocator_set): New ctor.
776 (standard_deallocator_set::contains_p): New.
777 (standard_deallocator_set::maybe_get_single): New.
778 (standard_deallocator_set::dump_to_pp): New.
779 (start_p): New.
780 (class mismatching_deallocation): Update for conversion from api
781 to deallocator_set and deallocator.
782 (double_free::emit): Use %qs.
783 (class use_after_free): Update for conversion from api to
784 deallocator_set and deallocator.
785 (malloc_leak::describe_state_change): Only emit "allocated here" on
786 a start->nonnull transition, rather than on other transitions to
787 nonnull.
788 (allocation_state::dump_to_pp): Update for conversion from api to
789 deallocator_set.
790 (allocation_state::get_nonnull): Likewise.
791 (malloc_state_machine::malloc_state_machine): Likewise.
792 (malloc_state_machine::~malloc_state_machine): New.
793 (malloc_state_machine::add_state): Update for conversion from api
794 to deallocator_set.
795 (malloc_state_machine::get_or_create_custom_deallocator_set): New.
796 (malloc_state_machine::maybe_create_custom_deallocator_set): New.
797 (malloc_state_machine::get_or_create_deallocator): New.
798 (malloc_state_machine::on_stmt): Update for conversion from api
799 to deallocator_set. Handle "__attribute__((malloc(FOO)))", and
800 the special attribute set on FOO.
801 (malloc_state_machine::on_allocator_call): Update for conversion
802 from api to deallocator_set. Add "returns_nonnull" param and use
803 it to affect which state to transition to.
804 (malloc_state_machine::on_deallocator_call): Update for conversion
805 from api to deallocator_set.
807 2021-01-14 David Malcolm <dmalcolm@redhat.com>
809 * engine.cc (strongly_connected_components::to_json): New.
810 (worklist::to_json): New.
811 (exploded_graph::to_json): JSON-ify the worklist.
812 * exploded-graph.h (strongly_connected_components::to_json): New
813 decl.
814 (worklist::to_json): New decl.
815 * store.cc (store::to_json): Fix comment.
816 * supergraph.cc (supernode::to_json): Fix reference to
817 "returning_call" in comment. Add optional "fun" to JSON.
818 (edge_kind_to_string): New.
819 (superedge::to_json): Add "kind" to JSON.
821 2021-01-14 David Malcolm <dmalcolm@redhat.com>
823 PR analyzer/98679
824 * analyzer.h (region_offset::operator==): Make const.
825 * pending-diagnostic.h (pending_diagnostic::equal_p): Likewise.
826 * store.h (binding_cluster::for_each_value): Likewise.
827 (binding_cluster::for_each_binding): Likewise.
829 2021-01-12 David Malcolm <dmalcolm@redhat.com>
831 PR analyzer/98628
832 * store.cc (binding_cluster::make_unknown_relative_to): Don't mark
833 dereferenced unknown pointers as having escaped.
835 2021-01-07 David Malcolm <dmalcolm@redhat.com>
837 PR analyzer/98580
838 * region.cc (decl_region::get_svalue_for_initializer): Gracefully
839 handle when LTO writes out DECL_INITIAL as error_mark_node.
841 2021-01-07 David Malcolm <dmalcolm@redhat.com>
843 PR analyzer/97074
844 * store.cc (binding_cluster::can_merge_p): Add "out_store" param
845 and pass to calls to binding_cluster::make_unknown_relative_to.
846 (binding_cluster::make_unknown_relative_to): Add "out_store"
847 param. Use it to mark base regions that are pointed to by
848 pointers that become unknown as having escaped.
849 (store::can_merge_p): Pass out_store to
850 binding_cluster::can_merge_p.
851 * store.h (binding_cluster::can_merge_p): Add "out_store" param.
852 (binding_cluster::make_unknown_relative_to): Likewise.
853 * svalue.cc (region_svalue::implicitly_live_p): New vfunc.
854 * svalue.h (region_svalue::implicitly_live_p): New vfunc decl.
856 2021-01-07 David Malcolm <dmalcolm@redhat.com>
858 PR analyzer/98564
859 * engine.cc (exploded_path::feasible_p): Add missing call to
860 bitmap_clear.
862 2021-01-06 David Malcolm <dmalcolm@redhat.com>
864 PR analyzer/97072
865 * region-model-reachability.cc (reachable_regions::init_cluster):
866 Convert symbolic region handling to a switch statement. Add cases
867 to handle SK_UNKNOWN and SK_CONJURED.
869 2021-01-05 David Malcolm <dmalcolm@redhat.com>
871 PR analyzer/98293
872 * store.cc (binding_map::apply_ctor_to_region): When "index" is
873 NULL, iterate through the fields for RECORD_TYPEs, rather than
874 creating an INTEGER_CST index.
876 2020-11-30 David Malcolm <dmalcolm@redhat.com>
878 * analyzer-pass.cc: Include "analyzer/analyzer.h" for the
879 declaration of sorry_no_analyzer; include "tree.h" and
880 "function.h" as these are needed by it.
882 2020-11-30 David Malcolm <dmalcolm@redhat.com>
884 * analyzer-pass.cc (pass_analyzer::execute): Move sorry call to...
885 (sorry_no_analyzer): New.
886 * analyzer.h (class state_machine): New forward decl.
887 (class logger): New forward decl.
888 (class plugin_analyzer_init_iface): New.
889 (sorry_no_analyzer): New decl.
890 * checker-path.cc (checker_path::fixup_locations): New.
891 * checker-path.h (checker_event::set_location): New.
892 (checker_path::fixup_locations): New decl.
893 * diagnostic-manager.cc
894 (diagnostic_manager::emit_saved_diagnostic): Call
895 checker_path::fixup_locations, and call fixup_location
896 on the primary location.
897 * engine.cc: Include "plugin.h".
898 (class plugin_analyzer_init_impl): New.
899 (impl_run_checkers): Invoke PLUGIN_ANALYZER_INIT callbacks.
900 * pending-diagnostic.h (pending_diagnostic::fixup_location): New
901 vfunc.
903 2020-11-18 David Malcolm <dmalcolm@redhat.com>
905 PR analyzer/97893
906 * sm-malloc.cc (null_deref::emit): Use CWE-476 rather than
907 CWE-690, as this isn't due to an unchecked return value.
908 (null_arg::emit): Likewise.
910 2020-11-12 David Malcolm <dmalcolm@redhat.com>
912 * checker-path.h (checker_event::get_id_ptr): New.
913 * diagnostic-manager.cc (path_builder::path_builder): Add "sd"
914 param and use it to initialize new field "m_sd".
915 (path_builder::get_pending_diagnostic): New.
916 (path_builder::m_sd): New field.
917 (diagnostic_manager::emit_saved_diagnostic): Pass sd to
918 path_builder ctor.
919 (diagnostic_manager::add_events_for_superedge): Call new
920 maybe_add_custom_events_for_superedge vfunc.
921 * engine.cc (stale_jmp_buf::stale_jmp_buf): Add "setjmp_point"
922 param and use it to initialize new field "m_setjmp_point".
923 Initialize new field "m_stack_pop_event".
924 (stale_jmp_buf::maybe_add_custom_events_for_superedge): New vfunc
925 implementation.
926 (stale_jmp_buf::describe_final_event): New vfunc implementation.
927 (stale_jmp_buf::m_setjmp_point): New field.
928 (stale_jmp_buf::m_stack_pop_event): New field.
929 (exploded_node::on_longjmp): Pass setjmp_point to stale_jmp_buf
930 ctor.
931 * pending-diagnostic.h
932 (pending_diagnostic::maybe_add_custom_events_for_superedge): New
933 vfunc.
935 2020-11-12 David Malcolm <dmalcolm@redhat.com>
937 PR tree-optimization/97424
938 * analyzer.opt (Wanalyzer-shift-count-negative): New.
939 (Wanalyzer-shift-count-overflow): New.
940 * region-model.cc (class shift_count_negative_diagnostic): New.
941 (class shift_count_overflow_diagnostic): New.
942 (region_model::get_gassign_result): Complain about shift counts that
943 are negative or are >= the operand's type's width.
945 2020-11-10 Martin Liska <mliska@suse.cz>
947 * constraint-manager.cc (constraint_manager::merge): Remove
948 unused code.
949 * constraint-manager.h: Likewise.
950 * program-state.cc (sm_state_map::sm_state_map): Likewise.
951 (program_state::program_state): Likewise.
952 (test_sm_state_map): Likewise.
953 * program-state.h: Likewise.
954 * region-model-reachability.cc (reachable_regions::reachable_regions): Likewise.
955 * region-model-reachability.h: Likewise.
956 * region-model.cc (region_model::handle_unrecognized_call): Likewise.
957 (region_model::get_reachable_svalues): Likewise.
958 (region_model::can_merge_with_p): Likewise.
960 2020-11-05 David Malcolm <dmalcolm@redhat.com>
962 PR analyzer/97668
963 * svalue.cc (cmp_cst): Handle COMPLEX_CST.
965 2020-10-29 David Malcolm <dmalcolm@redhat.com>
967 * program-state.cc (sm_state_map::on_liveness_change): Sort the
968 leaking svalues before calling on_state_leak.
969 (program_state::detect_leaks): Likewise when calling
970 on_svalue_leak.
971 * region-model-reachability.cc
972 (reachable_regions::mark_escaped_clusters): Likewise when
973 calling on_escaped_function.
975 2020-10-29 David Malcolm <dmalcolm@redhat.com>
977 PR analyzer/97608
978 * region-model-reachability.cc (reachable_regions::handle_sval):
979 Operands of reachable reversible operations are reachable.
981 2020-10-29 David Malcolm <dmalcolm@redhat.com>
983 * analyzer.h (class state_machine): New forward decl.
984 (class logger): Likewise.
985 (class visitor): Likewise.
986 * complexity.cc: New file, taken from svalue.cc.
987 * complexity.h: New file, taken from region-model.h.
988 * region-model.h: Include "analyzer/svalue.h" and
989 "analyzer/region.h". Move struct complexity to complexity.h.
990 Move svalue, its subclasses and supporting decls to svalue.h.
991 Move region, its subclasses and supporting decls to region.h.
992 * region.cc: Include "analyzer/region.h".
993 (symbolic_region::symbolic_region): Move here from region-model.h.
994 * region.h: New file, based on material from region-model.h.
995 * svalue.cc: Include "analyzer/svalue.h".
996 (complexity::complexity): Move to complexity.cc.
997 (complexity::from_pair): Likewise.
998 * svalue.h: New file, based on material from region-model.h.
1000 2020-10-29 David Malcolm <dmalcolm@redhat.com>
1002 * program-state.cc (sm_state_map::print): Guard the printing of
1003 the origin pointer with !flag_dump_noaddr.
1004 * region.cc (string_region::dump_to_pp): Likewise for
1005 m_string_cst.
1007 2020-10-27 David Malcolm <dmalcolm@redhat.com>
1009 PR analyzer/97568
1010 * region-model.cc (region_model::get_initial_value_for_global):
1011 Move check that !DECL_EXTERNAL from here to...
1012 * region.cc (decl_region::get_svalue_for_initializer): ...here,
1013 using it to reject zero initialization.
1015 2020-10-27 Markus Böck <markus.boeck02@gmail.com>
1017 PR analyzer/96608
1018 * store.h (hash): Cast to intptr_t instead of long
1020 2020-10-27 David Malcolm <dmalcolm@redhat.com>
1022 * constraint-manager.cc (svalue_cmp_by_ptr): Delete.
1023 (equiv_class::canonicalize): Use svalue::cmp_ptr_ptr instead.
1024 (equiv_class_cmp): Eliminate pointer comparison.
1025 * diagnostic-manager.cc (dedupe_key::comparator): If they are at
1026 the same location, also compare epath ength and pending_diagnostic
1027 kind.
1028 * engine.cc (readability_comparator): If two path_vars have the
1029 same readability, then impose an arbitrary ordering on them.
1030 (worklist::key_t::cmp): If two points have the same plan ordering,
1031 continue the comparison. Call sm_state_map::cmp rather than
1032 comparing hash values.
1033 * program-state.cc (sm_state_map::entry_t::cmp): New.
1034 (sm_state_map::cmp): New.
1035 * program-state.h (sm_state_map::entry_t::cmp): New decl.
1036 (sm_state_map::elements): New.
1037 (sm_state_map::cmp): New.
1039 2020-10-27 David Malcolm <dmalcolm@redhat.com>
1041 * engine.cc (setjmp_record::cmp): New.
1042 (supernode_cluster::dump_dot): Avoid embedding pointer in cluster
1043 name.
1044 (supernode_cluster::cmp_ptr_ptr): New.
1045 (function_call_string_cluster::dump_dot): Avoid embedding pointer
1046 in cluster name. Sort m_map when dumping child clusters.
1047 (function_call_string_cluster::cmp_ptr_ptr): New.
1048 (root_cluster::dump_dot): Sort m_map when dumping child clusters.
1049 * program-point.cc (function_point::cmp): New.
1050 (function_point::cmp_ptr): New.
1051 * program-point.h (function_point::cmp): New decl.
1052 (function_point::cmp_ptr): New decl.
1053 * program-state.cc (sm_state_map::print): Sort the values. Guard
1054 the printing of pointers with !flag_dump_noaddr.
1055 (program_state::prune_for_point): Sort the regions.
1056 (log_set_of_svalues): Sort the values. Guard the printing of
1057 pointers with !flag_dump_noaddr.
1058 * region-model-manager.cc (log_uniq_map): Sort the values.
1059 * region-model-reachability.cc (dump_set): New function template.
1060 (reachable_regions::dump_to_pp): Use it.
1061 * region-model.h (svalue::cmp_ptr): New decl.
1062 (svalue::cmp_ptr_ptr): New decl.
1063 (setjmp_record::cmp): New decl.
1064 (placeholder_svalue::get_name): New accessor.
1065 (widening_svalue::get_point): New accessor.
1066 (compound_svalue::get_map): New accessor.
1067 (conjured_svalue::get_stmt): New accessor.
1068 (conjured_svalue::get_id_region): New accessor.
1069 (region::cmp_ptrs): Rename to...
1070 (region::cmp_ptr_ptr): ...this.
1071 * region.cc (region::cmp_ptrs): Rename to...
1072 (region::cmp_ptr_ptr): ...this.
1073 * state-purge.cc
1074 (state_purge_per_ssa_name::state_purge_per_ssa_name): Sort
1075 m_points_needing_name when dumping.
1076 * store.cc (concrete_binding::cmp_ptr_ptr): New.
1077 (symbolic_binding::cmp_ptr_ptr): New.
1078 (binding_map::cmp): New.
1079 (get_sorted_parent_regions): Update for renaming of
1080 region::cmp_ptrs to region::cmp_ptr_ptr.
1081 (store::dump_to_pp): Likewise.
1082 (store::to_json): Likewise.
1083 (store::can_merge_p): Sort the base regions before considering
1084 them.
1085 * store.h (concrete_binding::cmp_ptr_ptr): New decl.
1086 (symbolic_binding::cmp_ptr_ptr): New decl.
1087 (binding_map::cmp): New decl.
1088 * supergraph.cc (supergraph::supergraph): Assign UIDs to the
1089 gimple stmts.
1090 * svalue.cc (cmp_cst): New.
1091 (svalue::cmp_ptr): New.
1092 (svalue::cmp_ptr_ptr): New.
1094 2020-10-27 David Malcolm <dmalcolm@redhat.com>
1096 * engine.cc (exploded_graph::get_or_create_node): Fix off-by-one
1097 when imposing param_analyzer_max_enodes_per_program_point limit.
1099 2020-10-27 David Malcolm <dmalcolm@redhat.com>
1101 * region-model.cc (region_model::get_representative_path_var):
1102 Implement case RK_LABEL.
1103 * region-model.h (label_region::get_label): New accessor.
1105 2020-10-22 David Malcolm <dmalcolm@redhat.com>
1107 PR analyzer/97514
1108 * engine.cc (exploded_graph::add_function_entry): Handle failure
1109 to create an enode, rather than asserting.
1111 2020-10-22 David Malcolm <dmalcolm@redhat.com>
1113 PR analyzer/97489
1114 * engine.cc (exploded_graph::add_function_entry): Assert that we
1115 have a function body.
1116 (exploded_graph::on_escaped_function): Reject fndecls that don't
1117 have a function body.
1119 2020-10-14 David Malcolm <dmalcolm@redhat.com>
1121 PR analyzer/93388
1122 * region-model.cc (region_model::get_initial_value_for_global):
1123 Fall back to returning an initial_svalue if
1124 decl_region::get_svalue_for_initializer fails.
1125 * region.cc (decl_region::get_svalue_for_initializer): Don't
1126 attempt to create a compound_svalue if the region has an unknown
1127 size.
1129 2020-10-14 David Malcolm <dmalcolm@redhat.com>
1131 PR analyzer/93723
1132 * store.cc (binding_map::apply_ctor_to_region): Remove redundant
1133 assertion.
1135 2020-10-12 David Malcolm <dmalcolm@redhat.com>
1137 PR analyzer/97258
1138 * engine.cc (impl_region_model_context::on_escaped_function): New
1139 vfunc.
1140 (exploded_graph::add_function_entry): Use m_functions_with_enodes
1141 to implement idempotency.
1142 (add_any_callbacks): New.
1143 (exploded_graph::build_initial_worklist): Use the above to find
1144 callbacks that are reachable from global initializers.
1145 (exploded_graph::on_escaped_function): New.
1146 * exploded-graph.h
1147 (impl_region_model_context::on_escaped_function): New decl.
1148 (exploded_graph::on_escaped_function): New decl.
1149 (exploded_graph::m_functions_with_enodes): New field.
1150 * region-model-reachability.cc
1151 (reachable_regions::reachable_regions): Replace "store" param with
1152 "model" param; use it to initialize m_model.
1153 (reachable_regions::add): When getting the svalue for the region,
1154 call get_store_value on the model rather than using an initial
1155 value.
1156 (reachable_regions::mark_escaped_clusters): Add ctxt param and
1157 use it to call on_escaped_function when a function_region escapes.
1158 * region-model-reachability.h
1159 (reachable_regions::reachable_regions): Replace "store" param with
1160 "model" param.
1161 (reachable_regions::mark_escaped_clusters): Add ctxt param.
1162 (reachable_regions::m_model): New field.
1163 * region-model.cc (region_model::handle_unrecognized_call): Update
1164 for change in reachable_regions ctor.
1165 (region_model::handle_unrecognized_call): Pass ctxt to
1166 mark_escaped_clusters.
1167 (region_model::get_reachable_svalues): Update for change in
1168 reachable_regions ctor.
1169 (region_model::get_initial_value_for_global): Read-only variables
1170 keep their initial values.
1171 * region-model.h (region_model_context::on_escaped_function): New
1172 vfunc.
1173 (noop_region_model_context::on_escaped_function): New.
1175 2020-10-12 David Malcolm <dmalcolm@redhat.com>
1177 * analyzer.opt (Wanalyzer-write-to-const): New.
1178 (Wanalyzer-write-to-string-literal): New.
1179 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
1180 Call check_for_writable_region.
1181 (region_model::impl_call_memset): Likewise.
1182 (region_model::impl_call_strcpy): Likewise.
1183 * region-model.cc (class write_to_const_diagnostic): New.
1184 (class write_to_string_literal_diagnostic): New.
1185 (region_model::check_for_writable_region): New.
1186 (region_model::set_value): Call check_for_writable_region.
1187 * region-model.h (region_model::check_for_writable_region): New
1188 decl.
1190 2020-10-07 David Malcolm <dmalcolm@redhat.com>
1192 PR analyzer/97116
1193 * sm-malloc.cc (method_p): New.
1194 (describe_argument_index): New.
1195 (inform_nonnull_attribute): Use describe_argument_index.
1196 (possible_null_arg::describe_final_event): Likewise.
1197 (null_arg::describe_final_event): Likewise.
1199 2020-09-29 David Malcolm <dmalcolm@redhat.com>
1201 PR analyzer/95188
1202 * engine.cc (stmt_requires_new_enode_p): Split enodes before
1203 "signal" calls.
1205 2020-09-29 David Malcolm <dmalcolm@redhat.com>
1207 * constraint-manager.cc
1208 (constraint_manager::add_constraint_internal): Whitespace fixes.
1209 Silence -Wsign-compare warning.
1210 * engine.cc (maybe_process_run_of_before_supernode_enodes):
1211 Silence -Wsign-compare warning.
1213 2020-09-28 David Malcolm <dmalcolm@redhat.com>
1215 * region-model.h (binop_svalue::dyn_cast_binop_svalue): Remove
1216 redundant "virtual". Add FINAL OVERRIDE.
1217 (widening_svalue::dyn_cast_widening_svalue): Add FINAL OVERRIDE.
1218 (compound_svalue::dyn_cast_compound_svalue): Likewise.
1219 (conjured_svalue::dyn_cast_conjured_svalue): Likewise.
1221 2020-09-28 David Malcolm <dmalcolm@redhat.com>
1223 * diagnostic-manager.cc (null_assignment_sm_context::m_visitor):
1224 Remove unused field.
1226 2020-09-28 David Malcolm <dmalcolm@redhat.com>
1228 PR analyzer/97233
1229 * analyzer.cc (is_longjmp_call_p): Require the initial argument
1230 to be a pointer.
1231 * engine.cc (exploded_node::on_longjmp): Likewise.
1233 2020-09-28 David Malcolm <dmalcolm@redhat.com>
1235 * program-state.cc (sm_state_map::print): Update check
1236 for m_global_state being the start state.
1238 2020-09-26 David Malcolm <dmalcolm@redhat.com>
1240 PR analyzer/96646
1241 PR analyzer/96841
1242 * region-model.cc (region_model::get_representative_path_var):
1243 When handling offset_region, wrap the MEM_REF's first argument in
1244 an ADDR_EXPR of pointer type, rather than simply using the tree
1245 for the parent region. Require the MEM_REF's second argument to
1246 be an integer constant.
1248 2020-09-24 David Malcolm <dmalcolm@redhat.com>
1250 * analyzer.h (struct rejected_constraint): New decl.
1251 * analyzer.opt (fanalyzer-feasibility): New option.
1252 * diagnostic-manager.cc (path_builder::path_builder): Add
1253 "problem" param and use it to initialize new field.
1254 (path_builder::get_feasibility_problem): New accessor.
1255 (path_builder::m_feasibility_problem): New field.
1256 (dedupe_winners::add): Remove inversion of logic in "if" clause,
1257 swapping if/else suites. In the !feasible_p suite, inspect
1258 flag_analyzer_feasibility and add code to handle when this
1259 is off, accepting the infeasible path, but recording the
1260 feasibility_problem.
1261 (diagnostic_manager::emit_saved_diagnostic): Pass the
1262 feasibility_problem to the path_builder.
1263 (diagnostic_manager::add_events_for_eedge): If we have
1264 a feasibility_problem at this edge, use it to add a custom event.
1265 * engine.cc (exploded_path::feasible_p): Pass a
1266 rejected_constraint ** to model.maybe_update_for_edge and transfer
1267 ownership of any created instance to any feasibility_problem.
1268 (feasibility_problem::dump_to_pp): New.
1269 * exploded-graph.h (feasibility_problem::feasibility_problem):
1270 Drop "model" param; add rejected_constraint * param.
1271 (feasibility_problem::~feasibility_problem): New.
1272 (feasibility_problem::dump_to_pp): New decl.
1273 (feasibility_problem::m_model): Drop field.
1274 (feasibility_problem::m_rc): New field.
1275 * program-point.cc (function_point::get_location): Handle
1276 PK_BEFORE_SUPERNODE and PK_AFTER_SUPERNODE.
1277 * program-state.cc (program_state::on_edge): Pass NULL to new
1278 param of region_model::maybe_update_for_edge.
1279 * region-model.cc (region_model::add_constraint): New overload
1280 adding a rejected_constraint ** param.
1281 (region_model::maybe_update_for_edge): Add rejected_constraint **
1282 param and pass it to the various apply_constraints_for_ calls.
1283 (region_model::apply_constraints_for_gcond): Add
1284 rejected_constraint ** param and pass it to add_constraint calls.
1285 (region_model::apply_constraints_for_gswitch): Likewise.
1286 (region_model::apply_constraints_for_exception): Likewise.
1287 (rejected_constraint::dump_to_pp): New.
1288 * region-model.h (region_model::maybe_update_for_edge):
1289 Add rejected_constraint ** param.
1290 (region_model::add_constraint): New overload adding a
1291 rejected_constraint ** param.
1292 (region_model::apply_constraints_for_gcond): Add
1293 rejected_constraint ** param.
1294 (region_model::apply_constraints_for_gswitch): Likewise.
1295 (region_model::apply_constraints_for_exception): Likewise.
1296 (struct rejected_constraint): New.
1298 2020-09-23 David Malcolm <dmalcolm@redhat.com>
1300 PR analyzer/97178
1301 * engine.cc (impl_run_checkers): Update for change to ext_state
1302 ctor.
1303 * program-state.cc (selftest::test_sm_state_map): Pass an engine
1304 instance to ext_state ctor.
1305 (selftest::test_program_state_1): Likewise.
1306 (selftest::test_program_state_2): Likewise.
1307 (selftest::test_program_state_merging): Likewise.
1308 (selftest::test_program_state_merging_2): Likewise.
1309 * program-state.h (extrinsic_state::extrinsic_state): Remove NULL
1310 default value for "eng" param.
1312 2020-09-23 Tobias Burnus <tobias@codesourcery.com>
1314 * analyzer-logging.cc: Guard '#pragma ... ignored "-Wformat-diag"'
1315 by '#if __GNUC__ >= 10'
1316 * analyzer.h: Likewise.
1317 * call-string.cc: Likewise.
1319 2020-09-23 David Malcolm <dmalcolm@redhat.com>
1321 * engine.cc (exploded_node::on_stmt): Replace sequence of dyn_cast
1322 with switch.
1324 2020-09-22 David Malcolm <dmalcolm@redhat.com>
1326 * analysis-plan.cc: Include "json.h".
1327 * analyzer.opt (fdump-analyzer-json): New.
1328 * call-string.cc: Include "json.h".
1329 (call_string::to_json): New.
1330 * call-string.h (call_string::to_json): New decl.
1331 * checker-path.cc: Include "json.h".
1332 * constraint-manager.cc: Include "json.h".
1333 (equiv_class::to_json): New.
1334 (constraint::to_json): New.
1335 (constraint_manager::to_json): New.
1336 * constraint-manager.h (equiv_class::to_json): New decl.
1337 (constraint::to_json): New decl.
1338 (constraint_manager::to_json): New decl.
1339 * diagnostic-manager.cc: Include "json.h".
1340 (saved_diagnostic::to_json): New.
1341 (diagnostic_manager::to_json): New.
1342 * diagnostic-manager.h (saved_diagnostic::to_json): New decl.
1343 (diagnostic_manager::to_json): New decl.
1344 * engine.cc: Include "json.h", <zlib.h>.
1345 (exploded_node::status_to_str): New.
1346 (exploded_node::to_json): New.
1347 (exploded_edge::to_json): New.
1348 (exploded_graph::to_json): New.
1349 (dump_analyzer_json): New.
1350 (impl_run_checkers): Call it.
1351 * exploded-graph.h (exploded_node::status_to_str): New decl.
1352 (exploded_node::to_json): New.
1353 (exploded_edge::to_json): New.
1354 (exploded_graph::to_json): New.
1355 * pending-diagnostic.cc: Include "json.h".
1356 * program-point.cc: Include "json.h".
1357 (program_point::to_json): New.
1358 * program-point.h (program_point::to_json): New decl.
1359 * program-state.cc: Include "json.h".
1360 (extrinsic_state::to_json): New.
1361 (sm_state_map::to_json): New.
1362 (program_state::to_json): New.
1363 * program-state.h (extrinsic_state::to_json): New decl.
1364 (sm_state_map::to_json): New decl.
1365 (program_state::to_json): New decl.
1366 * region-model-impl-calls.cc: Include "json.h".
1367 * region-model-manager.cc: Include "json.h".
1368 * region-model-reachability.cc: Include "json.h".
1369 * region-model.cc: Include "json.h".
1370 * region-model.h (svalue::to_json): New decl.
1371 (region::to_json): New decl.
1372 * region.cc: Include "json.h".
1373 (region::to_json: New.
1374 * sm-file.cc: Include "json.h".
1375 * sm-malloc.cc: Include "json.h".
1376 * sm-pattern-test.cc: Include "json.h".
1377 * sm-sensitive.cc: Include "json.h".
1378 * sm-signal.cc: Include "json.h".
1379 (signal_delivery_edge_info_t::to_json): New.
1380 * sm-taint.cc: Include "json.h".
1381 * sm.cc: Include "diagnostic.h", "tree-diagnostic.h", and
1382 "json.h".
1383 (state_machine::state::to_json): New.
1384 (state_machine::to_json): New.
1385 * sm.h (state_machine::state::to_json): New.
1386 (state_machine::to_json): New.
1387 * state-purge.cc: Include "json.h".
1388 * store.cc: Include "json.h".
1389 (binding_key::get_desc): New.
1390 (binding_map::to_json): New.
1391 (binding_cluster::to_json): New.
1392 (store::to_json): New.
1393 * store.h (binding_key::get_desc): New decl.
1394 (binding_map::to_json): New decl.
1395 (binding_cluster::to_json): New decl.
1396 (store::to_json): New decl.
1397 * supergraph.cc: Include "json.h".
1398 (supergraph::to_json): New.
1399 (supernode::to_json): New.
1400 (superedge::to_json): New.
1401 * supergraph.h (supergraph::to_json): New decl.
1402 (supernode::to_json): New decl.
1403 (superedge::to_json): New decl.
1404 * svalue.cc: Include "json.h".
1405 (svalue::to_json): New.
1407 2020-09-21 David Malcolm <dmalcolm@redhat.com>
1409 PR analyzer/97130
1410 * region-model-impl-calls.cc (call_details::get_arg_type): New.
1411 * region-model.cc (region_model::on_call_pre): Check that the
1412 initial arg is a pointer before calling impl_call_memset and
1413 impl_call_strlen.
1414 * region-model.h (call_details::get_arg_type): New decl.
1416 2020-09-21 David Malcolm <dmalcolm@redhat.com>
1418 PR analyzer/93355
1419 * sm-malloc.cc (malloc_state_machine::get_default_state): Look at
1420 the base region when considering pointers. Treat pointers to
1421 decls as being non-heap.
1423 2020-09-18 David Malcolm <dmalcolm@redhat.com>
1425 * checker-path.cc (warning_event::get_desc): Handle global state
1426 changes.
1428 2020-09-18 David Malcolm <dmalcolm@redhat.com>
1430 * sm-malloc.cc (malloc_state_machine::on_stmt): Handle strdup and
1431 strndup as being malloc-like allocators.
1433 2020-09-16 David Malcolm <dmalcolm@redhat.com>
1435 * engine.cc (strongly_connected_components::strong_connect): Only
1436 consider intraprocedural edges when creating SCCs.
1437 (worklist::key_t::cmp): Add comment. Treat call_string
1438 differences as more important than differences of program_point
1439 within a supernode.
1441 2020-09-16 David Malcolm <dmalcolm@redhat.com>
1443 * engine.cc (supernode_cluster::dump_dot): Show the SCC id
1444 in the per-supernode clusters in FILENAME.eg.dot output.
1445 (exploded_graph_annotator::add_node_annotations):
1446 Show the SCC of the supernode in FILENAME.supernode.eg.dot output.
1447 * exploded-graph.h (worklist::scc_id): New.
1448 (exploded_graph::get_scc_id): New.
1450 2020-09-16 David Malcolm <dmalcolm@redhat.com>
1452 * engine.cc (exploded_node::dump_dot): Show STATUS_BULK_MERGED.
1453 (exploded_graph::process_worklist): Call
1454 maybe_process_run_of_before_supernode_enodes.
1455 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
1456 New.
1457 (exploded_graph_annotator::print_enode): Show STATUS_BULK_MERGED.
1458 * exploded-graph.h (enum exploded_node::status): Add
1459 STATUS_BULK_MERGED.
1461 2020-09-16 David Malcolm <dmalcolm@redhat.com>
1463 * engine.cc
1464 (exploded_graph::process_node) <case PK_BEFORE_SUPERNODE>:
1465 Simplify by using program_point::get_next.
1466 * program-point.cc (program_point::get_next): New.
1467 * program-point.h (program_point::get_next): New decl.
1469 2020-09-16 David Malcolm <dmalcolm@redhat.com>
1471 * engine.cc (exploded_graph::get_or_create_node): Show the
1472 program point when issuing -Wanalyzer-too-complex due to hitting
1473 the per-program-point limit.
1475 2020-09-16 David Malcolm <dmalcolm@redhat.com>
1477 * region-model.cc (region_model::on_call_pre): Treat getchar as
1478 having no side-effects.
1480 2020-09-15 David Malcolm <dmalcolm@redhat.com>
1482 PR analyzer/96650
1483 * constraint-manager.cc (merger_fact_visitor::on_fact): Replace
1484 assertion that add_constraint succeeded with an assertion that
1485 if it fails, -fanalyzer-transitivity is off.
1487 2020-09-14 David Malcolm <dmalcolm@redhat.com>
1489 * analyzer.opt (-param=analyzer-max-constraints=): New param.
1490 * constraint-manager.cc
1491 (constraint_manager::add_constraint_internal): Silently reject
1492 attempts to add constraints when the above limit is reached.
1494 2020-09-14 David Malcolm <dmalcolm@redhat.com>
1496 PR analyzer/96653
1497 * constraint-manager.cc
1498 (constraint_manager::get_or_add_equiv_class): Don't accumulate
1499 transitive closure of all constraints on constants.
1501 2020-09-14 David Malcolm <dmalcolm@redhat.com>
1503 PR analyzer/97029
1504 * analyzer.cc (is_setjmp_call_p): Require the initial arg to be a
1505 pointer.
1506 * region-model.cc (region_model::deref_rvalue): Assert that the
1507 svalue is of pointer type.
1509 2020-09-11 David Malcolm <dmalcolm@redhat.com>
1511 PR analyzer/96798
1512 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
1513 New.
1514 (region_model::impl_call_strcpy): New.
1515 * region-model.cc (region_model::on_call_pre): Flag unhandled
1516 builtins that are non-pure as having unknown side-effects.
1517 Implement BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_STRCPY,
1518 BUILT_IN_STRCPY_CHK, BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED,
1519 BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_FPUTC,
1520 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
1521 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
1522 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR,
1523 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED,
1524 BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF.
1525 * region-model.h (region_model::impl_call_memcpy): New decl.
1526 (region_model::impl_call_strcpy): New decl.
1528 2020-09-09 David Malcolm <dmalcolm@redhat.com>
1530 PR analyzer/94355
1531 * analyzer.opt (Wanalyzer-mismatching-deallocation): New warning.
1532 * region-model-impl-calls.cc
1533 (region_model::impl_call_operator_new): New.
1534 (region_model::impl_call_operator_delete): New.
1535 * region-model.cc (region_model::on_call_pre): Detect operator new
1536 and operator delete.
1537 (region_model::on_call_post): Likewise.
1538 (region_model::maybe_update_for_edge): Detect EH edges and call...
1539 (region_model::apply_constraints_for_exception): New function.
1540 * region-model.h (region_model::impl_call_operator_new): New decl.
1541 (region_model::impl_call_operator_delete): New decl.
1542 (region_model::apply_constraints_for_exception): New decl.
1543 * sm-malloc.cc (enum resource_state): New.
1544 (struct allocation_state): New state subclass.
1545 (enum wording): New.
1546 (struct api): New.
1547 (malloc_state_machine::custom_data_t): New typedef.
1548 (malloc_state_machine::add_state): New decl.
1549 (malloc_state_machine::m_unchecked)
1550 (malloc_state_machine::m_nonnull)
1551 (malloc_state_machine::m_freed): Delete these states in favor
1552 of...
1553 (malloc_state_machine::m_malloc)
1554 (malloc_state_machine::m_scalar_new)
1555 (malloc_state_machine::m_vector_new): ...this new api instances,
1556 which own their own versions of these states.
1557 (malloc_state_machine::on_allocator_call): New decl.
1558 (malloc_state_machine::on_deallocator_call): New decl.
1559 (api::api): New ctor.
1560 (dyn_cast_allocation_state): New.
1561 (as_a_allocation_state): New.
1562 (get_rs): New.
1563 (unchecked_p): New.
1564 (nonnull_p): New.
1565 (freed_p): New.
1566 (malloc_diagnostic::describe_state_change): Use unchecked_p and
1567 nonnull_p.
1568 (class mismatching_deallocation): New.
1569 (double_free::double_free): Add funcname param for initializing
1570 m_funcname.
1571 (double_free::emit): Use m_funcname in warning message rather
1572 than hardcoding "free".
1573 (double_free::describe_state_change): Likewise. Use freed_p.
1574 (double_free::describe_call_with_state): Use freed_p.
1575 (double_free::describe_final_event): Use m_funcname in message
1576 rather than hardcoding "free".
1577 (double_free::m_funcname): New field.
1578 (possible_null::describe_state_change): Use unchecked_p.
1579 (possible_null::describe_return_of_state): Likewise.
1580 (use_after_free::use_after_free): Add param for initializing m_api.
1581 (use_after_free::emit): Use m_api->m_dealloc_funcname in message
1582 rather than hardcoding "free".
1583 (use_after_free::describe_state_change): Use freed_p. Change the
1584 wording of the message based on the API.
1585 (use_after_free::describe_final_event): Use
1586 m_api->m_dealloc_funcname in message rather than hardcoding
1587 "free". Change the wording of the message based on the API.
1588 (use_after_free::m_api): New field.
1589 (malloc_leak::describe_state_change): Use unchecked_p. Update
1590 for renaming of m_malloc_event to m_alloc_event.
1591 (malloc_leak::describe_final_event): Update for renaming of
1592 m_malloc_event to m_alloc_event.
1593 (malloc_leak::m_malloc_event): Rename...
1594 (malloc_leak::m_alloc_event): ...to this.
1595 (free_of_non_heap::free_of_non_heap): Add param for initializing
1596 m_funcname.
1597 (free_of_non_heap::emit): Use m_funcname in message rather than
1598 hardcoding "free".
1599 (free_of_non_heap::describe_final_event): Likewise.
1600 (free_of_non_heap::m_funcname): New field.
1601 (allocation_state::dump_to_pp): New.
1602 (allocation_state::get_nonnull): New.
1603 (malloc_state_machine::malloc_state_machine): Update for changes
1604 to state fields and new api fields.
1605 (malloc_state_machine::add_state): New.
1606 (malloc_state_machine::on_stmt): Move malloc/calloc handling to
1607 on_allocator_call and call it, passing in the API pointer.
1608 Likewise for free, moving it to on_deallocator_call. Handle calls
1609 to operator new and delete in an analogous way. Use unchecked_p
1610 when testing for possibly-null-arg and possibly-null-deref, and
1611 transition to the non-null for the correct API. Remove redundant
1612 node param from call to on_zero_assignment. Use freed_p for
1613 use-after-free check, and pass in API.
1614 (malloc_state_machine::on_allocator_call): New, based on code in
1615 on_stmt.
1616 (malloc_state_machine::on_deallocator_call): Likewise.
1617 (malloc_state_machine::on_phi): Mark node param with
1618 ATTRIBUTE_UNUSED; don't pass it to on_zero_assignment.
1619 (malloc_state_machine::on_condition): Mark node param with
1620 ATTRIBUTE_UNUSED. Replace on_transition calls with get_state and
1621 set_next_state pairs, transitioning to the non-null state for the
1622 appropriate API.
1623 (malloc_state_machine::can_purge_p): Port to new state approach.
1624 (malloc_state_machine::on_zero_assignment): Replace on_transition
1625 calls with get_state and set_next_state pairs. Drop redundant
1626 node param.
1627 * sm.h (state_machine::add_custom_state): New.
1629 2020-09-09 David Malcolm <dmalcolm@redhat.com>
1631 * diagnostic-manager.cc
1632 (null_assignment_sm_context::warn_for_state): Replace with...
1633 (null_assignment_sm_context::warn): ...this.
1634 * engine.cc (impl_sm_context::warn_for_state): Replace with...
1635 (impl_sm_context::warn): ...this.
1636 * sm-file.cc (fileptr_state_machine::on_stmt): Replace
1637 warn_for_state and on_transition calls with a get_state
1638 test guarding warn and set_next_state calls.
1639 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
1640 * sm-pattern-test.cc (pattern_test_state_machine::on_condition):
1641 Replace warn_for_state call with warn call.
1642 * sm-sensitive.cc
1643 (sensitive_state_machine::warn_for_any_exposure): Replace
1644 warn_for_state call with a get_state test guarding a warn call.
1645 * sm-signal.cc (signal_state_machine::on_stmt): Likewise.
1646 * sm-taint.cc (taint_state_machine::on_stmt): Replace
1647 warn_for_state and on_transition calls with a get_state
1648 test guarding warn and set_next_state calls.
1649 * sm.h (sm_context::warn_for_state): Replace with...
1650 (sm_context::warn): ...this.
1652 2020-09-09 David Malcolm <dmalcolm@redhat.com>
1654 * diagnostic-manager.cc
1655 (null_assignment_sm_context::null_assignment_sm_context): Add old_state
1656 and ext_state params, initializing m_old_state and m_ext_state.
1657 (null_assignment_sm_context::on_transition): Split into...
1658 (null_assignment_sm_context::get_state): ...this new vfunc
1659 implementation and...
1660 (null_assignment_sm_context::set_next_state): ...this new vfunc
1661 implementation.
1662 (null_assignment_sm_context::m_old_state): New field.
1663 (null_assignment_sm_context::m_ext_state): New field.
1664 (diagnostic_manager::add_events_for_eedge): Pass in old state and
1665 ext_state when creating sm_ctxt.
1666 * engine.cc (impl_sm_context::on_transition): Split into...
1667 (impl_sm_context::get_state): ...this new vfunc
1668 implementation and...
1669 (impl_sm_context::set_next_state): ...this new vfunc
1670 implementation.
1671 * sm.h (sm_context::get_state): New pure virtual function.
1672 (sm_context::set_next_state): Likewise.
1673 (sm_context::on_transition): Convert from a pure virtual function
1674 to a regular function implemented in terms of get_state and
1675 set_next_state.
1677 2020-09-09 David Malcolm <dmalcolm@redhat.com>
1679 * checker-path.cc (state_change_event::get_desc): Update
1680 state_machine::get_state_name calls to state::get_name.
1681 (warning_event::get_desc): Likewise.
1682 * diagnostic-manager.cc
1683 (null_assignment_sm_context::on_transition): Update comparison
1684 against 0 with comparison with m_sm.get_start_state.
1685 (diagnostic_manager::prune_for_sm_diagnostic): Update
1686 state_machine::get_state_name calls to state::get_name.
1687 * engine.cc (impl_sm_context::on_transition): Likewise.
1688 (exploded_node::get_dot_fillcolor): Use get_id when summing
1689 the sm states.
1690 * program-state.cc (sm_state_map::sm_state_map): Don't hardcode
1691 0 as the start state when initializing m_global_state.
1692 (sm_state_map::print): Use dump_to_pp rather than get_state_name
1693 when dumping states.
1694 (sm_state_map::is_empty_p): Don't hardcode 0 as the start state
1695 when examining m_global_state.
1696 (sm_state_map::hash): Use get_id when hashing states.
1697 (selftest::test_sm_state_map): Use state objects rather than
1698 arbitrary hardcoded integers.
1699 (selftest::test_program_state_merging): Likewise.
1700 (selftest::test_program_state_merging_2): Likewise.
1701 * sm-file.cc (fileptr_state_machine::m_start): Move to base class.
1702 (file_diagnostic::describe_state_change): Use get_start_state.
1703 (fileptr_state_machine::fileptr_state_machine): Drop m_start
1704 initialization.
1705 * sm-malloc.cc (malloc_state_machine::m_start): Move to base
1706 class.
1707 (malloc_diagnostic::describe_state_change): Use get_start_state.
1708 (possible_null::describe_state_change): Likewise.
1709 (malloc_state_machine::malloc_state_machine): Drop m_start
1710 initialization.
1711 * sm-pattern-test.cc (pattern_test_state_machine::m_start): Move
1712 to base class.
1713 (pattern_test_state_machine::pattern_test_state_machine): Drop
1714 m_start initialization.
1715 * sm-sensitive.cc (sensitive_state_machine::m_start): Move to base
1716 class.
1717 (sensitive_state_machine::sensitive_state_machine): Drop m_start
1718 initialization.
1719 * sm-signal.cc (signal_state_machine::m_start): Move to base
1720 class.
1721 (signal_state_machine::signal_state_machine): Drop m_start
1722 initialization.
1723 * sm-taint.cc (taint_state_machine::m_start): Move to base class.
1724 (taint_state_machine::taint_state_machine): Drop m_start
1725 initialization.
1726 * sm.cc (state_machine::state::dump_to_pp): New.
1727 (state_machine::state_machine): Move here from sm.h. Initialize
1728 m_next_state_id and m_start.
1729 (state_machine::add_state): Reimplement in terms of state objects.
1730 (state_machine::get_state_name): Delete.
1731 (state_machine::get_state_by_name): Reimplement in terms of state
1732 objects. Make const.
1733 (state_machine::validate): Delete.
1734 (state_machine::dump_to_pp): Reimplement in terms of state
1735 objects.
1736 * sm.h (state_machine::state): New class.
1737 (state_machine::state_t): Convert typedef from "unsigned" to
1738 "const state_machine::state *".
1739 (state_machine::state_machine): Move to sm.cc.
1740 (state_machine::get_default_state): Use m_start rather than
1741 hardcoding 0.
1742 (state_machine::get_state_name): Delete.
1743 (state_machine::get_state_by_name): Make const.
1744 (state_machine::get_start_state): New accessor.
1745 (state_machine::alloc_state_id): New.
1746 (state_machine::m_state_names): Drop in favor of...
1747 (state_machine::m_states): New field
1748 (state_machine::m_start): New field
1749 (start_start_p): Delete.
1751 2020-09-08 David Malcolm <dmalcolm@redhat.com>
1753 PR analyzer/96949
1754 * store.cc (binding_map::apply_ctor_val_to_range): Add
1755 error-handling for the cases where we have symbolic offsets.
1757 2020-09-08 David Malcolm <dmalcolm@redhat.com>
1759 PR analyzer/96950
1760 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
1761 where min_index == max_index.
1762 (binding_map::apply_ctor_val_to_range): Replace assertion that we
1763 don't have a CONSTRUCTOR value with error-handling.
1765 2020-09-08 David Malcolm <dmalcolm@redhat.com>
1767 PR analyzer/96962
1768 * region-model.cc (region_model::on_call_pre): Fix guard on switch
1769 on built-ins to only consider BUILT_IN_NORMAL, rather than other
1770 kinds of build-ins.
1772 2020-09-01 David Malcolm <dmalcolm@redhat.com>
1774 PR analyzer/96792
1775 * region-model.cc (region_model::deref_rvalue): Add the constraint
1776 that PTR_SVAL is non-NULL.
1778 2020-08-31 David Malcolm <dmalcolm@redhat.com>
1780 PR analyzer/96798
1781 * region-model.cc (region_model::on_call_pre): Handle
1782 BUILT_IN_MEMSET_CHK.
1784 2020-08-31 David Malcolm <dmalcolm@redhat.com>
1786 * region-model.cc (region_model::on_call_pre): Gather handling of
1787 builtins and of internal fns into switch statements. Handle
1788 "alloca" and BUILT_IN_ALLOCA_WITH_ALIGN.
1790 2020-08-31 David Malcolm <dmalcolm@redhat.com>
1792 PR analyzer/96860
1793 * region.cc (decl_region::get_svalue_for_constructor): Support
1794 apply_ctor_to_region failing.
1795 * store.cc (binding_map::apply_ctor_to_region): Add failure
1796 handling.
1797 (binding_map::apply_ctor_val_to_range): Likewise.
1798 (binding_map::apply_ctor_pair_to_child_region): Likewise. Replace
1799 assertion that child_base_offset is not symbolic with error
1800 handling.
1801 * store.h (binding_map::apply_ctor_to_region): Convert return type
1802 from void to bool.
1803 (binding_map::apply_ctor_val_to_range): Likewise.
1804 (binding_map::apply_ctor_pair_to_child_region): Likewise.
1806 2020-08-31 David Malcolm <dmalcolm@redhat.com>
1808 PR analyzer/96763
1809 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
1810 by calling a new binding_map::apply_ctor_val_to_range subroutine.
1811 Split out the existing non-CONSTRUCTOR-handling code to a new
1812 apply_ctor_pair_to_child_region subroutine.
1813 (binding_map::apply_ctor_val_to_range): New.
1814 (binding_map::apply_ctor_pair_to_child_region): New, split out
1815 from binding_map::apply_ctor_to_region as noted above.
1816 * store.h (binding_map::apply_ctor_val_to_range): New decl.
1817 (binding_map::apply_ctor_pair_to_child_region): New decl.
1819 2020-08-31 David Malcolm <dmalcolm@redhat.com>
1821 PR analyzer/96764
1822 * region-model-manager.cc
1823 (region_model_manager::maybe_fold_unaryop): Handle VIEW_CONVERT_EXPR.
1824 (region_model_manager::get_or_create_cast): Move logic for
1825 real->integer casting to...
1826 (get_code_for_cast): ...this new function, and add logic for
1827 real->non-integer casts.
1828 (region_model_manager::maybe_fold_sub_svalue): Handle
1829 VIEW_CONVERT_EXPR.
1830 * region-model.cc
1831 (region_model::add_any_constraints_from_gassign): Likewise.
1832 * svalue.cc (svalue::maybe_undo_cast): Likewise.
1833 (unaryop_svalue::dump_to_pp): Likewise.
1835 2020-08-26 David Malcolm <dmalcolm@redhat.com>
1837 PR analyzer/94858
1838 * region-model-manager.cc
1839 (region_model_manager::get_or_create_widening_svalue): Assert that
1840 neither of the inputs are themselves widenings.
1841 * store.cc (store::eval_alias_1): The initial value of a pointer
1842 can't point to a region that was allocated on the heap after the
1843 beginning of the path. A widened pointer value can't alias anything
1844 that the initial pointer value can't alias.
1845 * svalue.cc (svalue::can_merge_p): Merge BINOP (X, OP, CST) with X
1846 to a widening svalue. Merge
1847 BINOP(WIDENING(BASE, BINOP(BASE, X)), X) and BINOP(BASE, X) to
1848 to the LHS of the first BINOP.
1850 2020-08-26 David Malcolm <dmalcolm@redhat.com>
1852 PR analyzer/96777
1853 * region-model.h (class compound_svalue): Document that all keys
1854 must be concrete.
1855 (compound_svalue::compound_svalue): Move definition to svalue.cc.
1856 * store.cc (binding_map::apply_ctor_to_region): Handle
1857 initializers for trailing arrays with incomplete size.
1858 * svalue.cc (compound_svalue::compound_svalue): Move definition
1859 here from region-model.h. Add assertion that all keys are
1860 concrete.
1862 2020-08-22 David Malcolm <dmalcolm@redhat.com>
1864 PR analyzer/94851
1865 * region-model-manager.cc
1866 (region_model_manager::maybe_fold_binop): Fold bitwise "& 0" to 0.
1868 2020-08-22 David Malcolm <dmalcolm@redhat.com>
1870 * store.cc (store::eval_alias): Make const. Split out 2nd half
1871 into store::eval_alias_1 and call it twice for symmetry, avoiding
1872 test duplication.
1873 (store::eval_alias_1): New function, split out from the above.
1874 * store.h (store::eval_alias): Make const.
1875 (store::eval_alias_1): New decl.
1877 2020-08-22 David Malcolm <dmalcolm@redhat.com>
1879 * region-model.cc (region_model::push_frame): Bind the default
1880 SSA name for each parm if it exists, falling back to the parm
1881 itself otherwise, rather than doing both.
1883 2020-08-20 David Malcolm <dmalcolm@redhat.com>
1885 PR analyzer/96723
1886 * region-model-manager.cc
1887 (region_model_manager::get_field_region): Assert that field is a
1888 FIELD_DECL.
1889 * region.cc (region::get_subregions_for_binding): In
1890 union-handling, filter the TYPE_FIELDS traversal to just FIELD_DECLs.
1892 2020-08-20 David Malcolm <dmalcolm@redhat.com>
1894 PR analyzer/96713
1895 * region-model.cc (region_model::get_gassign_result): For
1896 comparisons, only use eval_condition when the lhs has boolean
1897 type, and use get_or_create_constant_svalue on the boolean
1898 constants directly rather than via get_rvalue.
1900 2020-08-19 David Malcolm <dmalcolm@redhat.com>
1902 PR analyzer/96643
1903 * region-model.cc (region_model::deref_rvalue): Rather than
1904 attempting to handle all svalue kinds in the switch, only cover
1905 the special cases, and move symbolic-region handling to after
1906 the switch, thus implicitly handling the missing case SK_COMPOUND.
1908 2020-08-19 David Malcolm <dmalcolm@redhat.com>
1910 PR analyzer/96705
1911 * region-model-manager.cc
1912 (region_model_manager::maybe_fold_binop): Check that we have an
1913 integral type before calling build_int_cst.
1915 2020-08-19 David Malcolm <dmalcolm@redhat.com>
1917 PR analyzer/96699
1918 * region-model-manager.cc
1919 (region_model_manager::get_or_create_cast): Use FIX_TRUNC_EXPR for
1920 casting from REAL_TYPE to INTEGER_TYPE.
1922 2020-08-19 David Malcolm <dmalcolm@redhat.com>
1924 PR analyzer/96651
1925 * region-model.cc (region_model::called_from_main_p): New.
1926 (region_model::get_store_value): Move handling for globals into...
1927 (region_model::get_initial_value_for_global): ...this new
1928 function, and add logic for extracting values from decl
1929 initializers.
1930 * region-model.h (decl_region::get_svalue_for_constructor): New
1931 decl.
1932 (decl_region::get_svalue_for_initializer): New decl.
1933 (region_model::called_from_main_p): New decl.
1934 (region_model::get_initial_value_for_global): New.
1935 * region.cc (decl_region::maybe_get_constant_value): Move logic
1936 for getting an svalue from a CONSTRUCTOR node to...
1937 (decl_region::get_svalue_for_constructor): ...this new function.
1938 (decl_region::get_svalue_for_initializer): New.
1939 * store.cc (get_svalue_for_ctor_val): Rewrite in terms of
1940 region_model::get_rvalue.
1941 * store.h (binding_cluster::get_map): New accessor.
1943 2020-08-19 David Malcolm <dmalcolm@redhat.com>
1945 PR analyzer/96648
1946 * region.cc (get_field_at_bit_offset): Gracefully handle negative
1947 values for bit_offset.
1949 2020-08-18 David Malcolm <dmalcolm@redhat.com>
1951 * region-model.cc (region_model::get_rvalue_1): Fix name of local.
1953 2020-08-18 David Malcolm <dmalcolm@redhat.com>
1955 PR analyzer/96641
1956 * region-model.cc (region_model::get_rvalue_1): Handle
1957 unrecognized tree codes by returning "UNKNOWN.
1959 2020-08-18 David Malcolm <dmalcolm@redhat.com>
1961 PR analyzer/96640
1962 * region-model.cc (region_model::get_gassign_result): Handle various
1963 VEC_* tree codes by returning UNKNOWN.
1964 (region_model::on_assignment): Handle unrecognized tree codes by
1965 setting lhs to an unknown value, rather than issuing a "sorry" and
1966 asserting.
1968 2020-08-17 David Malcolm <dmalcolm@redhat.com>
1970 PR analyzer/96644
1971 * region-model-manager.cc (get_region_for_unexpected_tree_code):
1972 Handle ctxt being NULL.
1974 2020-08-17 David Malcolm <dmalcolm@redhat.com>
1976 PR analyzer/96639
1977 * region.cc (region::get_subregions_for_binding): Check for "type"
1978 being NULL.
1980 2020-08-17 David Malcolm <dmalcolm@redhat.com>
1982 PR analyzer/96642
1983 * store.cc (get_svalue_for_ctor_val): New.
1984 (binding_map::apply_ctor_to_region): Call it.
1986 2020-08-14 David Malcolm <dmalcolm@redhat.com>
1988 PR testsuite/96609
1989 PR analyzer/96616
1990 * region-model.cc (region_model::get_store_value): Call
1991 maybe_get_constant_value on decl_regions first.
1992 * region-model.h (decl_region::maybe_get_constant_value): New decl.
1993 * region.cc (decl_region::get_stack_depth): Likewise.
1994 (decl_region::maybe_get_constant_value): New.
1995 * store.cc (get_subregion_within_ctor): New.
1996 (binding_map::apply_ctor_to_region): New.
1997 * store.h (binding_map::apply_ctor_to_region): New decl.
1999 2020-08-14 David Malcolm <dmalcolm@redhat.com>
2001 PR analyzer/96611
2002 * store.cc (store::mark_as_escaped): Reject attempts to
2003 get a cluster for an unknown pointer.
2005 2020-08-13 David Malcolm <dmalcolm@redhat.com>
2007 PR analyzer/93032
2008 PR analyzer/93938
2009 PR analyzer/94011
2010 PR analyzer/94099
2011 PR analyzer/94399
2012 PR analyzer/94458
2013 PR analyzer/94503
2014 PR analyzer/94640
2015 PR analyzer/94688
2016 PR analyzer/94689
2017 PR analyzer/94839
2018 PR analyzer/95026
2019 PR analyzer/95042
2020 PR analyzer/95240
2021 * analyzer-logging.cc: Ignore "-Wformat-diag".
2022 (logger::enter_scope): Use inc_indent in both overloads.
2023 (logger::exit_scope): Use dec_indent.
2024 * analyzer-logging.h (logger::inc_indent): New.
2025 (logger::dec_indent): New.
2026 * analyzer-selftests.cc (run_analyzer_selftests): Call
2027 analyzer_store_cc_tests.
2028 * analyzer-selftests.h (analyzer_store_cc_tests): New decl.
2029 * analyzer.cc (get_stmt_location): New function.
2030 * analyzer.h (class initial_svalue): New forward decl.
2031 (class unaryop_svalue): New forward decl.
2032 (class binop_svalue): New forward decl.
2033 (class sub_svalue): New forward decl.
2034 (class unmergeable_svalue): New forward decl.
2035 (class placeholder_svalue): New forward decl.
2036 (class widening_svalue): New forward decl.
2037 (class compound_svalue): New forward decl.
2038 (class conjured_svalue): New forward decl.
2039 (svalue_set): New typedef.
2040 (class map_region): Delete.
2041 (class array_region): Delete.
2042 (class frame_region): New forward decl.
2043 (class function_region): New forward decl.
2044 (class label_region): New forward decl.
2045 (class decl_region): New forward decl.
2046 (class element_region): New forward decl.
2047 (class offset_region): New forward decl.
2048 (class cast_region): New forward decl.
2049 (class field_region): New forward decl.
2050 (class string_region): New forward decl.
2051 (class region_model_manager): New forward decl.
2052 (class store_manager): New forward decl.
2053 (class store): New forward decl.
2054 (class call_details): New forward decl.
2055 (struct svalue_id_merger_mapping): Delete.
2056 (struct canonicalization): Delete.
2057 (class function_point): New forward decl.
2058 (class engine): New forward decl.
2059 (dump_tree): New function decl.
2060 (print_quoted_type): New function decl.
2061 (readability_comparator): New function decl.
2062 (tree_cmp): New function decl.
2063 (class path_var): Move here from region-model.h
2064 (bit_offset_t, bit_size_t, byte_size_t): New typedefs.
2065 (class region_offset): New class.
2066 (get_stmt_location): New decl.
2067 (struct member_function_hash_traits): New struct.
2068 (class consolidation_map): New class.
2069 Ignore "-Wformat-diag".
2070 * analyzer.opt (-param=analyzer-max-svalue-depth=): New param.
2071 (-param=analyzer-max-enodes-for-full-dump=): New param.
2072 * call-string.cc: Ignore -Wformat-diag.
2073 * checker-path.cc: Move includes of "analyzer/call-string.h" and
2074 "analyzer/program-point.h" to before "analyzer/region-model.h",
2075 and also include "analyzer/store.h" before it.
2076 (state_change_event::state_change_event): Replace "tree var" param
2077 with "const svalue *sval". Convert "origin" param from tree to
2078 "const svalue *".
2079 (state_change_event::get_desc): Call get_representative_tree to
2080 convert the var and origin from const svalue * to tree. Use
2081 svalue::get_desc rather than %qE when describing state changes.
2082 (checker_path::add_final_event): Use get_stmt_location.
2083 * checker-path.h (state_change_event::state_change_event): Port
2084 from tree to const svalue *.
2085 (state_change_event::get_lvalue): Delete.
2086 (state_change_event::get_dest_function): New.
2087 (state_change_event::m_var): Replace with...
2088 (state_change_event::m_sval): ...this.
2089 (state_change_event::m_origin): Convert from tree to
2090 const svalue *.
2091 * constraint-manager.cc: Include "analyzer/call-string.h",
2092 "analyzer/program-point.h", and "analyzer/store.h" before
2093 "analyzer/region-model.h".
2094 (struct bound, struct range): Move to constraint-manager.h.
2095 (compare_constants): New function.
2096 (range::dump): Rename to...
2097 (range::dump_to_pp): ...this. Support NULL constants.
2098 (range::dump): Reintroduce for dumping to stderr.
2099 (range::constrained_to_single_element): Return result, rather than
2100 writing to *OUT.
2101 (range::eval_condition): New.
2102 (range::below_lower_bound): New.
2103 (range::above_upper_bound): New.
2104 (equiv_class::equiv_class): Port from svalue_id to const svalue *.
2105 (equiv_class::print): Likewise.
2106 (equiv_class::hash): Likewise.
2107 (equiv_class::operator==): Port from svalue_id to const svalue *.
2108 (equiv_class::add): Port from svalue_id to const svalue *. Drop
2109 "cm" param.
2110 (equiv_class::del): Port from svalue_id to const svalue *.
2111 (equiv_class::get_representative): Likewise.
2112 (equiv_class::remap_svalue_ids): Delete.
2113 (svalue_id_cmp_by_id): Rename to...
2114 (svalue_cmp_by_ptr): ...this, porting from svalue_id to
2115 const svalue *.
2116 (equiv_class::canonicalize): Update qsort comparator.
2117 (constraint::implied_by): New.
2118 (constraint_manager::constraint_manager): Copy m_mgr in copy ctor.
2119 (constraint_manager::dump_to_pp): Add "multiline" param
2120 (constraint_manager::dump): Pass "true" for "multiline".
2121 (constraint_manager::add_constraint): Port from svalue_id to
2122 const svalue *. Split out second part into...
2123 (constraint_manager::add_unknown_constraint): ...this new
2124 function. Remove self-constraints when merging equivalence
2125 classes.
2126 (constraint_manager::add_constraint_internal): Remove constraints
2127 that would be implied by the new constraint. Port from svalue_id
2128 to const svalue *.
2129 (constraint_manager::get_equiv_class_by_sid): Rename to...
2130 (constraint_manager::get_equiv_class_by_svalue): ...this, porting
2131 from svalue_id to const svalue *.
2132 (constraint_manager::get_or_add_equiv_class): Port from svalue_id
2133 to const svalue *.
2134 (constraint_manager::eval_condition): Make const. Call
2135 compare_constants and return early if it provides a known result.
2136 (constraint_manager::get_ec_bounds): New.
2137 (constraint_manager::eval_condition): New overloads. Make
2138 existing one const, and use compare_constants.
2139 (constraint_manager::purge): Convert "p" param to a template
2140 rather that an abstract base class. Port from svalue_id to
2141 const svalue *.
2142 (class dead_svalue_purger): New class.
2143 (constraint_manager::remap_svalue_ids): Delete.
2144 (constraint_manager::on_liveness_change): New.
2145 (equiv_class_cmp): Port from svalue_id to const svalue *.
2146 (constraint_manager::canonicalize): Likewise. Combine with
2147 purging of redundant equivalence classes and constraints.
2148 (class cleaned_constraint_manager): Delete.
2149 (class merger_fact_visitor): Make "m_cm_b" const. Add "m_merger"
2150 field.
2151 (merger_fact_visitor::fact): Port from svalue_id to const svalue *.
2152 Add special case for widening.
2153 (constraint_manager::merge): Port from svalue_id to const svalue *.
2154 (constraint_manager::clean_merger_input): Delete.
2155 (constraint_manager::for_each_fact): Port from svalue_id to
2156 const svalue *.
2157 (constraint_manager::validate): Likewise.
2158 (selftest::test_constraint_conditions): Provide a
2159 region_model_manager when creating region_model instances.
2160 Add test for self-equality not creating equivalence classes.
2161 (selftest::test_transitivity): Provide a region_model_manager when
2162 creating region_model instances. Verify that EC-merging happens
2163 when constraints are implied.
2164 (selftest::test_constant_comparisons): Provide a
2165 region_model_manager when creating region_model instances.
2166 (selftest::test_constraint_impl): Likewise. Remove over-specified
2167 assertions.
2168 (selftest::test_equality): Provide a region_model_manager when
2169 creating region_model instances.
2170 (selftest::test_many_constants): Likewise. Provide a
2171 program_point when testing merging.
2172 (selftest::run_constraint_manager_tests): Move call to
2173 test_constant_comparisons to outside the transitivity guard.
2174 * constraint-manager.h (struct bound): Move here from
2175 constraint-manager.cc.
2176 (struct range): Likewise.
2177 (struct::eval_condition): New decl.
2178 (struct::below_lower_bound): New decl.
2179 (struct::above_upper_bound): New decl.
2180 (equiv_class::add): Port from svalue_id to const svalue *.
2181 (equiv_class::del): Likewise.
2182 (equiv_class::get_representative): Likewise.
2183 (equiv_class::remap_svalue_ids): Drop.
2184 (equiv_class::m_cst_sid): Convert to..
2185 (equiv_class::m_cst_sval): ...this.
2186 (equiv_class::m_vars): Port from svalue_id to const svalue *.
2187 (constraint::bool implied_by): New decl.
2188 (fact_visitor::on_fact): Port from svalue_id to const svalue *.
2189 (constraint_manager::constraint_manager): Add mgr param.
2190 (constraint_manager::clone): Delete.
2191 (constraint_manager::maybe_get_constant): Delete.
2192 (constraint_manager::get_sid_for_constant): Delete.
2193 (constraint_manager::get_num_svalues): Delete.
2194 (constraint_manager::dump_to_pp): Add "multiline" param.
2195 (constraint_manager::get_equiv_class): Port from svalue_id to
2196 const svalue *.
2197 (constraint_manager::add_constraint): Likewise.
2198 (constraint_manager::get_equiv_class_by_sid): Rename to...
2199 (constraint_manager::get_equiv_class_by_svalue): ...this, porting
2200 from svalue_id to const svalue *.
2201 (constraint_manager::add_unknown_constraint): New decl.
2202 (constraint_manager::get_or_add_equiv_class): Port from svalue_id
2203 to const svalue *.
2204 (constraint_manager::eval_condition): Likewise. Add overloads.
2205 (constraint_manager::get_ec_bounds): New decl.
2206 (constraint_manager::purge): Convert to template.
2207 (constraint_manager::remap_svalue_ids): Delete.
2208 (constraint_manager::on_liveness_change): New decl.
2209 (constraint_manager::canonicalize): Drop param.
2210 (constraint_manager::clean_merger_input): Delete.
2211 (constraint_manager::m_mgr): New field.
2212 * diagnostic-manager.cc: Move includes of
2213 "analyzer/call-string.h" and "analyzer/program-point.h" to before
2214 "analyzer/region-model.h", and also include "analyzer/store.h"
2215 before it.
2216 (saved_diagnostic::saved_diagnostic): Add "sval" param.
2217 (diagnostic_manager::diagnostic_manager): Add engine param.
2218 (diagnostic_manager::add_diagnostic): Add "sval" param, passing it
2219 to saved_diagnostic ctor. Update overload to pass NULL for it.
2220 (dedupe_winners::dedupe_winners): Add engine param.
2221 (dedupe_winners::add): Add "eg" param. Pass m_engine to
2222 feasible_p.
2223 (dedupe_winner::m_engine): New field.
2224 (diagnostic_manager::emit_saved_diagnostics): Pass engine to
2225 dedupe_winners. Pass &eg when adding candidates. Pass svalue
2226 rather than tree to prune_path. Use get_stmt_location to get
2227 primary location of diagnostic.
2228 (diagnostic_manager::emit_saved_diagnostic): Likewise.
2229 (get_any_origin): Drop.
2230 (state_change_event_creator::on_global_state_change): Pass NULL
2231 const svalue * rather than NULL_TREE trees to state_change_event
2232 ctor.
2233 (state_change_event_creator::on_state_change): Port from tree and
2234 svalue_id to const svalue *.
2235 (for_each_state_change): Port from svalue_id to const svalue *.
2236 (struct null_assignment_sm_context): New.
2237 (diagnostic_manager::add_events_for_eedge): Add state change
2238 events for assignment to NULL.
2239 (diagnostic_manager::prune_path): Update param from tree to
2240 const svalue *.
2241 (diagnostic_manager::prune_for_sm_diagnostic): Port from tracking
2242 by tree to by const svalue *.
2243 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add sval
2244 param.
2245 (saved_diagnostic::m_sval): New field.
2246 (diagnostic_manager::diagnostic_manager): Add engine param.
2247 (diagnostic_manager::get_engine): New.
2248 (diagnostic_manager::add_diagnostic): Add "sval" param.
2249 (diagnostic_manager::prune_path): Likewise.
2250 (diagnostic_manager::prune_for_sm_diagnostic): New overload.
2251 (diagnostic_manager::m_eng): New field.
2252 * engine.cc: Move includes of "analyzer/call-string.h" and
2253 "analyzer/program-point.h" to before "analyzer/region-model.h",
2254 and also include "analyzer/store.h" before it.
2255 (impl_region_model_context::impl_region_model_context): Update for
2256 removal of m_change field.
2257 (impl_region_model_context::remap_svalue_ids): Delete.
2258 (impl_region_model_context::on_svalue_leak): New.
2259 (impl_region_model_context::on_svalue_purge): Delete.
2260 (impl_region_model_context::on_liveness_change): New.
2261 (impl_region_model_context::on_unknown_change): Update param
2262 from svalue_id to const svalue *. Add is_mutable param.
2263 (setjmp_svalue::compare_fields): Delete.
2264 (setjmp_svalue::accept): New.
2265 (setjmp_svalue::add_to_hash): Delete.
2266 (setjmp_svalue::dump_to_pp): New.
2267 (setjmp_svalue::print_details): Delete.
2268 (impl_sm_context::impl_sm_context): Drop "change" param.
2269 (impl_sm_context::get_fndecl_for_call): Drop "m_change".
2270 (impl_sm_context::on_transition): Drop ATTRIBUTE_UNUSED from
2271 "stmt" param. Drop m_change. Port from svalue_id to
2272 const svalue *.
2273 (impl_sm_context::warn_for_state): Drop m_change. Port from
2274 svalue_id to const svalue *.
2275 (impl_sm_context::get_readable_tree): Rename to...
2276 (impl_sm_context::get_diagnostic_tree): ...this. Port from
2277 svalue_id to const svalue *.
2278 (impl_sm_context::is_zero_assignment): New.
2279 (impl_sm_context::m_change): Delete field.
2280 (leak_stmt_finder::find_stmt): Handle m_var being NULL.
2281 (readability): Increase penalty for MEM_REF. For SSA_NAMEs,
2282 slightly favor the underlying var over the SSA name. Heavily
2283 penalize temporaries. Handle RESULT_DECL.
2284 (readability_comparator): Make non-static. Consider stack depths.
2285 (impl_region_model_context::on_state_leak): Convert from svalue_id
2286 to const svalue *, updating for region_model changes. Use
2287 id_equal.
2288 (impl_region_model_context::on_inherited_svalue): Delete.
2289 (impl_region_model_context::on_cast): Delete.
2290 (impl_region_model_context::on_condition): Drop m_change.
2291 (impl_region_model_context::on_phi): Likewise.
2292 (impl_region_model_context::on_unexpected_tree_code): Handle t
2293 being NULL.
2294 (point_and_state::validate): Update stack checking for
2295 region_model changes.
2296 (eg_traits::dump_args_t::show_enode_details_p): New.
2297 (exploded_node::exploded_node): Initialize m_num_processed_stmts.
2298 (exploded_node::get_processed_stmt): New function.
2299 (exploded_node::get_dot_fillcolor): Add more colors.
2300 (exploded_node::dump_dot): Guard the printing of the point and
2301 state with show_enode_details_p. Print the processed stmts for
2302 this enode after the initial state.
2303 (exploded_node::dump_to_pp): Pass true for new multiline param
2304 of program_state::dump_to_pp.
2305 (exploded_node::on_stmt): Drop "change" param. Log the stmt.
2306 Set input_location. Implement __analyzer_describe. Update
2307 implementation of __analyzer_dump and __analyzer_eval.
2308 Remove purging of sm-state for unknown fncalls from here.
2309 (exploded_node::on_edge): Drop "change" param.
2310 (exploded_node::on_longjmp): Port from region_id/svalue_id to
2311 const region */const svalue *. Call program_state::detect_leaks.
2312 Drop state_change.
2313 (exploded_node::detect_leaks): Update for changes to region_model.
2314 Call program_state::detect_leaks.
2315 (exploded_edge::exploded_edge): Drop ext_state and change params.
2316 (exploded_edge::dump_dot): "args" is no longer used. Drop dumping
2317 of m_change.
2318 (exploded_graph::exploded_graph): Pass engine to
2319 m_diagnostic_manager ctor. Use program_point::origin.
2320 (exploded_graph::add_function_entry): Drop ctxt. Use
2321 program_state::push_frame. Drop state_change.
2322 (exploded_graph::get_or_create_node): Drop "change" param. Add
2323 "enode_for_diag" param. Update dumping calls for API changes.
2324 Pass point to can_merge_with_p. Show enode indices
2325 within -Wanalyzer-too-complex diagnostic for hitting the per-point
2326 limit.
2327 (exploded_graph::add_edge): Drop "change" param. Log which nodes
2328 are being connected. Update for changes to exploded_edge ctor.
2329 (exploded_graph::get_per_program_point_data): New.
2330 (exploded_graph::process_worklist): Pass point to
2331 can_merge_with_p. Drop state_change. Update dumping call for API
2332 change.
2333 (exploded_graph::process_node): Drop state_change. Split the
2334 node in-place if an sm-state-change occurs. Update
2335 m_num_processed_stmts. Update dumping calls for API change.
2336 (exploded_graph::log_stats): Call engine::log_stats.
2337 (exploded_graph::dump_states_for_supernode): Update dumping
2338 call.
2339 (exploded_path::feasible_p): Add "eng" and "eg" params.
2340 Rename "i" to "end_idx". Pass the manager to the region_model
2341 ctor. Update for every processed stmt in the enode, not just the
2342 first. Keep track of which snodes have been visited, and call
2343 loop_replay_fixup when revisiting one.
2344 (enode_label::get_text): Update dump call for new param.
2345 (exploded_graph::dump_exploded_nodes): Likewise.
2346 (exploded_graph::get_node_by_index): New.
2347 (impl_run_checkers): Create engine instance and pass its address
2348 to extrinsic_state ctor.
2349 * exploded-graph.h
2350 (impl_region_model_context::impl_region_model_context): Drop
2351 "change" params.
2352 (impl_region_model_context::void remap_svalue_ids): Delete.
2353 (impl_region_model_context::on_svalue_purge): Delete.
2354 (impl_region_model_context::on_svalue_leak): New.
2355 (impl_region_model_context::on_liveness_change): New.
2356 (impl_region_model_context::on_state_leak): Update signature.
2357 (impl_region_model_context::on_inherited_svalue): Delete.
2358 (impl_region_model_context::on_cast): Delete.
2359 (impl_region_model_context::on_unknown_change): Update signature.
2360 (impl_region_model_context::m_change): Delete.
2361 (eg_traits::dump_args_t::show_enode_details_p): New.
2362 (exploded_node::on_stmt): Drop "change" param.
2363 (exploded_node::on_edge): Likewise.
2364 (exploded_node::get_processed_stmt): New decl.
2365 (exploded_node::m_num_processed_stmts): New field.
2366 (exploded_edge::exploded_edge): Drop ext_state and change params.
2367 (exploded_edge::m_change): Delete.
2368 (exploded_graph::get_engine): New accessor.
2369 (exploded_graph::get_or_create_node): Drop "change" param. Add
2370 "enode_for_diag" param.
2371 (exploded_graph::add_edge): Drop "change" param.
2372 (exploded_graph::get_per_program_point_data): New decl.
2373 (exploded_graph::get_node_by_index): New decl.
2374 (exploded_path::feasible_p): Add "eng" and "eg" params.
2375 * program-point.cc: Include "analyzer/store.h" before including
2376 "analyzer/region-model.h".
2377 (function_point::function_point): Move here from
2378 program-point.h.
2379 (function_point::get_function): Likewise.
2380 (function_point::from_function_entry): Likewise.
2381 (function_point::before_supernode): Likewise.
2382 (function_point::next_stmt): New function.
2383 * program-point.h (function_point::function_point): Move
2384 implementation from here to program-point.cc.
2385 (function_point::get_function): Likewise.
2386 (function_point::from_function_entry): Likewise.
2387 (function_point::before_supernode): Likewise.
2388 (function_point::next_stmt): New decl.
2389 (program_point::operator!=): New.
2390 (program_point::origin): New.
2391 (program_point::next_stmt): New.
2392 (program_point::m_function_point): Make non-const.
2393 * program-state.cc: Move includes of "analyzer/call-string.h" and
2394 "analyzer/program-point.h" to before "analyzer/region-model.h",
2395 and also include "analyzer/store.h" before it.
2396 (extrinsic_state::get_model_manager): New.
2397 (sm_state_map::sm_state_map): Pass in sm and sm_idx to ctor,
2398 rather than pass the around.
2399 (sm_state_map::clone_with_remapping): Delete.
2400 (sm_state_map::print): Remove "sm" param in favor of "m_sm". Add
2401 "simple" and "multiline" params and support multiline vs single
2402 line dumping.
2403 (sm_state_map::dump): Remove "sm" param in favor of "m_sm". Add
2404 "simple" param.
2405 (sm_state_map::hash): Port from svalue_id to const svalue *.
2406 (sm_state_map::operator==): Likewise.
2407 (sm_state_map::get_state): Likewise. Call canonicalize_svalue on
2408 input. Handle inheritance of sm-state. Call get_default_state.
2409 (sm_state_map::get_origin): Port from svalue_id to const svalue *.
2410 (sm_state_map::set_state): Likewise. Pass in ext_state. Reject
2411 attempts to set state on UNKNOWN.
2412 (sm_state_map::impl_set_state): Port from svalue_id to
2413 const svalue *. Pass in ext_state. Call canonicalize_svalue on
2414 input.
2415 (sm_state_map::purge_for_unknown_fncall): Delete.
2416 (sm_state_map::on_svalue_leak): New.
2417 (sm_state_map::remap_svalue_ids): Delete.
2418 (sm_state_map::on_liveness_change): New.
2419 (sm_state_map::on_unknown_change): Reimplement.
2420 (sm_state_map::on_svalue_purge): Delete.
2421 (sm_state_map::on_inherited_svalue): Delete.
2422 (sm_state_map::on_cast): Delete.
2423 (sm_state_map::validate): Delete.
2424 (sm_state_map::canonicalize_svalue): New.
2425 (program_state::program_state): Update to pass manager to
2426 region_model's ctor. Constify num_states and pass state machine
2427 and index to sm_state_map ctor.
2428 (program_state::print): Update for changes to dump API.
2429 (program_state::dump_to_pp): Ignore the summarize param. Add
2430 "multiline" param.
2431 (program_state::dump_to_file): Add "multiline" param.
2432 (program_state::dump): Pass "true" for new "multiline" param.
2433 (program_state::push_frame): New.
2434 (program_state::on_edge): Drop "change" param. Call
2435 program_state::detect_leaks.
2436 (program_state::prune_for_point): Add enode_for_diag param.
2437 Reimplement based on store class. Call detect_leaks
2438 (program_state::remap_svalue_ids): Delete.
2439 (program_state::get_representative_tree): Port from svalue_id to
2440 const svalue *.
2441 (program_state::can_merge_with_p): Add "point" param. Add early
2442 reject for sm-differences. Drop id remapping.
2443 (program_state::validate): Drop region model and sm_state_map
2444 validation.
2445 (state_change::sm_change::dump): Delete.
2446 (state_change::sm_change::remap_svalue_ids): Delete.
2447 (state_change::sm_change::on_svalue_purge): Delete.
2448 (log_set_of_svalues): New.
2449 (state_change::sm_change::validate): Delete.
2450 (state_change::state_change): Delete.
2451 (state_change::add_sm_change): Delete.
2452 (state_change::affects_p): Delete.
2453 (state_change::dump): Delete.
2454 (state_change::remap_svalue_ids): Delete.
2455 (state_change::on_svalue_purge): Delete.
2456 (state_change::validate): Delete.
2457 (selftest::assert_dump_eq): Delete.
2458 (ASSERT_DUMP_EQ): Delete.
2459 (selftest::test_sm_state_map): Update for changes to region_model
2460 and sm_state_map, porting from svalue_id to const svalue *.
2461 (selftest::test_program_state_dumping): Likewise. Drop test of
2462 dumping, renaming to...
2463 (selftest::test_program_state_1): ...this.
2464 (selftest::test_program_state_dumping_2): Likewise, renaming to...
2465 (selftest::test_program_state_2): ...this.
2466 (selftest::test_program_state_merging): Update for changes to
2467 region_model.
2468 (selftest::test_program_state_merging_2): Likewise.
2469 (selftest::analyzer_program_state_cc_tests): Update for renamed
2470 tests.
2471 * program-state.h (extrinsic_state::extrinsic_state): Add logger
2472 and engine params.
2473 (extrinsic_state::get_logger): New accessor.
2474 (extrinsic_state::get_engine): New accessor.
2475 (extrinsic_state::get_model_manager): New accessor.
2476 (extrinsic_state::m_logger): New field.
2477 (extrinsic_state::m_engine): New field.
2478 (struct default_hash_traits<svalue_id>): Delete.
2479 (pod_hash_traits<svalue_id>::hash): Delete.
2480 (pod_hash_traits<svalue_id>::equal): Delete.
2481 (pod_hash_traits<svalue_id>::mark_deleted): Delete.
2482 (pod_hash_traits<svalue_id>::mark_empty): Delete.
2483 (pod_hash_traits<svalue_id>::is_deleted): Delete.
2484 (pod_hash_traits<svalue_id>::is_empty): Delete.
2485 (sm_state_map::entry_t::entry_t): Port from svalue_id to
2486 const svalue *.
2487 (sm_state_map::entry_t::m_origin): Likewise.
2488 (sm_state_map::map_t): Likewise.
2489 (sm_state_map::sm_state_map): Add state_machine and index params.
2490 (sm_state_map::clone_with_remapping): Delete.
2491 (sm_state_map::print): Drop sm param; add simple and multiline
2492 params.
2493 (sm_state_map::dump): Drop sm param; add simple param.
2494 (sm_state_map::get_state): Port from svalue_id to const svalue *.
2495 Add ext_state param.
2496 (sm_state_map::get_origin): Likewise.
2497 (sm_state_map::set_state): Likewise.
2498 (sm_state_map::impl_set_state): Likewise.
2499 (sm_state_map::purge_for_unknown_fncall): Delete.
2500 (sm_state_map::remap_svalue_ids): Delete.
2501 (sm_state_map::on_svalue_purge): Delete.
2502 (sm_state_map::on_svalue_leak): New.
2503 (sm_state_map::on_liveness_change): New.
2504 (sm_state_map::on_inherited_svalue): Delete.
2505 (sm_state_map::on_cast): Delete.
2506 (sm_state_map::validate): Delete.
2507 (sm_state_map::on_unknown_change): Port from svalue_id to
2508 const svalue *. Add is_mutable and ext_state params.
2509 (sm_state_map::canonicalize_svalue): New.
2510 (sm_state_map::m_sm): New field.
2511 (sm_state_map::m_sm_idx): New field.
2512 (program_state::operator=): Delete.
2513 (program_state::dump_to_pp): Drop "summarize" param, adding
2514 "simple" and "multiline".
2515 (program_state::dump_to_file): Likewise.
2516 (program_state::dump): Rename "summarize" to "simple".
2517 (program_state::push_frame): New.
2518 (program_state::get_current_function): New.
2519 (program_state::on_edge): Drop "change" param.
2520 (program_state::prune_for_point): Likewise. Add enode_for_diag
2521 param.
2522 (program_state::remap_svalue_ids): Delete.
2523 (program_state::get_representative_tree): Port from svalue_id to
2524 const svalue *.
2525 (program_state::can_purge_p): Likewise. Pass ext_state to get_state.
2526 (program_state::can_merge_with_p): Add point param.
2527 (program_state::detect_leaks): New.
2528 (state_change_visitor::on_state_change): Port from tree and
2529 svalue_id to a pair of const svalue *.
2530 (class state_change): Delete.
2531 * region.cc: New file.
2532 * region-model-impl-calls.cc: New file.
2533 * region-model-manager.cc: New file.
2534 * region-model-reachability.cc: New file.
2535 * region-model-reachability.h: New file.
2536 * region-model.cc: Include "analyzer/call-string.h",
2537 "analyzer/program-point.h", and "analyzer/store.h" before
2538 "analyzer/region-model.h". Include
2539 "analyzer/region-model-reachability.h".
2540 (dump_tree): Make non-static.
2541 (dump_quoted_tree): Make non-static.
2542 (print_quoted_type): Make non-static.
2543 (path_var::dump): Delete.
2544 (dump_separator): Delete.
2545 (class impl_constraint_manager): Delete.
2546 (svalue_id::print): Delete.
2547 (svalue_id::dump_node_name_to_pp): Delete.
2548 (svalue_id::validate): Delete.
2549 (region_id::print): Delete.
2550 (region_id::dump_node_name_to_pp): Delete.
2551 (region_id::validate): Delete.
2552 (region_id_set::region_id_set): Delete.
2553 (svalue_id_set::svalue_id_set): Delete.
2554 (svalue::operator==): Delete.
2555 (svalue::hash): Delete.
2556 (svalue::print): Delete.
2557 (svalue::dump_dot_to_pp): Delete.
2558 (svalue::remap_region_ids): Delete.
2559 (svalue::walk_for_canonicalization): Delete.
2560 (svalue::get_child_sid): Delete.
2561 (svalue::maybe_get_constant): Delete.
2562 (region_svalue::compare_fields): Delete.
2563 (region_svalue::add_to_hash): Delete.
2564 (region_svalue::print_details): Delete.
2565 (region_svalue::dump_dot_to_pp): Delete.
2566 (region_svalue::remap_region_ids): Delete.
2567 (region_svalue::merge_values): Delete.
2568 (region_svalue::walk_for_canonicalization): Delete.
2569 (region_svalue::eval_condition): Delete.
2570 (constant_svalue::compare_fields): Delete.
2571 (constant_svalue::add_to_hash): Delete.
2572 (constant_svalue::merge_values): Delete.
2573 (constant_svalue::eval_condition): Move to svalue.cc.
2574 (constant_svalue::print_details): Delete.
2575 (constant_svalue::get_child_sid): Delete.
2576 (unknown_svalue::compare_fields): Delete.
2577 (unknown_svalue::add_to_hash): Delete.
2578 (unknown_svalue::print_details): Delete.
2579 (poison_kind_to_str): Move to svalue.cc.
2580 (poisoned_svalue::compare_fields): Delete.
2581 (poisoned_svalue::add_to_hash): Delete.
2582 (poisoned_svalue::print_details): Delete.
2583 (region_kind_to_str): Move to region.cc and reimplement.
2584 (region::operator==): Delete.
2585 (region::get_parent_region): Delete.
2586 (region::set_value): Delete.
2587 (region::become_active_view): Delete.
2588 (region::deactivate_any_active_view): Delete.
2589 (region::deactivate_view): Delete.
2590 (region::get_value): Delete.
2591 (region::get_inherited_child_sid): Delete.
2592 (region_model::copy_region): Delete.
2593 (region_model::copy_struct_region): Delete.
2594 (region_model::copy_union_region): Delete.
2595 (region_model::copy_array_region): Delete.
2596 (region::hash): Delete.
2597 (region::print): Delete.
2598 (region::dump_dot_to_pp): Delete.
2599 (region::dump_to_pp): Delete.
2600 (region::dump_child_label): Delete.
2601 (region::validate): Delete.
2602 (region::remap_svalue_ids): Delete.
2603 (region::remap_region_ids): Delete.
2604 (region::add_view): Delete.
2605 (region::get_view): Delete.
2606 (region::region): Move to region.cc.
2607 (region::add_to_hash): Delete.
2608 (region::print_fields): Delete.
2609 (region::non_null_p): Delete.
2610 (primitive_region::clone): Delete.
2611 (primitive_region::walk_for_canonicalization): Delete.
2612 (map_region::map_region): Delete.
2613 (map_region::compare_fields): Delete.
2614 (map_region::print_fields): Delete.
2615 (map_region::validate): Delete.
2616 (map_region::dump_dot_to_pp): Delete.
2617 (map_region::dump_child_label): Delete.
2618 (map_region::get_or_create): Delete.
2619 (map_region::get): Delete.
2620 (map_region::add_to_hash): Delete.
2621 (map_region::remap_region_ids): Delete.
2622 (map_region::unbind): Delete.
2623 (map_region::get_tree_for_child_region): Delete.
2624 (map_region::get_tree_for_child_region): Delete.
2625 (tree_cmp): Move to region.cc.
2626 (map_region::can_merge_p): Delete.
2627 (map_region::walk_for_canonicalization): Delete.
2628 (map_region::get_value_by_name): Delete.
2629 (struct_or_union_region::valid_key_p): Delete.
2630 (struct_or_union_region::compare_fields): Delete.
2631 (struct_region::clone): Delete.
2632 (struct_region::compare_fields): Delete.
2633 (union_region::clone): Delete.
2634 (union_region::compare_fields): Delete.
2635 (frame_region::compare_fields): Delete.
2636 (frame_region::clone): Delete.
2637 (frame_region::valid_key_p): Delete.
2638 (frame_region::print_fields): Delete.
2639 (frame_region::add_to_hash): Delete.
2640 (globals_region::compare_fields): Delete.
2641 (globals_region::clone): Delete.
2642 (globals_region::valid_key_p): Delete.
2643 (code_region::compare_fields): Delete.
2644 (code_region::clone): Delete.
2645 (code_region::valid_key_p): Delete.
2646 (array_region::array_region): Delete.
2647 (array_region::get_element): Delete.
2648 (array_region::clone): Delete.
2649 (array_region::compare_fields): Delete.
2650 (array_region::print_fields): Delete.
2651 (array_region::validate): Delete.
2652 (array_region::dump_dot_to_pp): Delete.
2653 (array_region::dump_child_label): Delete.
2654 (array_region::get_or_create): Delete.
2655 (array_region::get): Delete.
2656 (array_region::add_to_hash): Delete.
2657 (array_region::remap_region_ids): Delete.
2658 (array_region::get_key_for_child_region): Delete.
2659 (array_region::key_cmp): Delete.
2660 (array_region::walk_for_canonicalization): Delete.
2661 (array_region::key_from_constant): Delete.
2662 (array_region::constant_from_key): Delete.
2663 (function_region::compare_fields): Delete.
2664 (function_region::clone): Delete.
2665 (function_region::valid_key_p): Delete.
2666 (stack_region::stack_region): Delete.
2667 (stack_region::compare_fields): Delete.
2668 (stack_region::clone): Delete.
2669 (stack_region::print_fields): Delete.
2670 (stack_region::dump_child_label): Delete.
2671 (stack_region::validate): Delete.
2672 (stack_region::push_frame): Delete.
2673 (stack_region::get_current_frame_id): Delete.
2674 (stack_region::pop_frame): Delete.
2675 (stack_region::add_to_hash): Delete.
2676 (stack_region::remap_region_ids): Delete.
2677 (stack_region::can_merge_p): Delete.
2678 (stack_region::walk_for_canonicalization): Delete.
2679 (stack_region::get_value_by_name): Delete.
2680 (heap_region::heap_region): Delete.
2681 (heap_region::compare_fields): Delete.
2682 (heap_region::clone): Delete.
2683 (heap_region::walk_for_canonicalization): Delete.
2684 (root_region::root_region): Delete.
2685 (root_region::compare_fields): Delete.
2686 (root_region::clone): Delete.
2687 (root_region::print_fields): Delete.
2688 (root_region::validate): Delete.
2689 (root_region::dump_child_label): Delete.
2690 (root_region::push_frame): Delete.
2691 (root_region::get_current_frame_id): Delete.
2692 (root_region::pop_frame): Delete.
2693 (root_region::ensure_stack_region): Delete.
2694 (root_region::get_stack_region): Delete.
2695 (root_region::ensure_globals_region): Delete.
2696 (root_region::get_code_region): Delete.
2697 (root_region::ensure_code_region): Delete.
2698 (root_region::get_globals_region): Delete.
2699 (root_region::ensure_heap_region): Delete.
2700 (root_region::get_heap_region): Delete.
2701 (root_region::remap_region_ids): Delete.
2702 (root_region::can_merge_p): Delete.
2703 (root_region::add_to_hash): Delete.
2704 (root_region::walk_for_canonicalization): Delete.
2705 (root_region::get_value_by_name): Delete.
2706 (symbolic_region::symbolic_region): Delete.
2707 (symbolic_region::compare_fields): Delete.
2708 (symbolic_region::clone): Delete.
2709 (symbolic_region::walk_for_canonicalization): Delete.
2710 (symbolic_region::print_fields): Delete.
2711 (region_model::region_model): Add region_model_manager * param.
2712 Reimplement in terms of store, dropping impl_constraint_manager
2713 subclass.
2714 (region_model::operator=): Reimplement in terms of store
2715 (region_model::operator==): Likewise.
2716 (region_model::hash): Likewise.
2717 (region_model::print): Delete.
2718 (region_model::print_svalue): Delete.
2719 (region_model::dump_dot_to_pp): Delete.
2720 (region_model::dump_dot_to_file): Delete.
2721 (region_model::dump_dot): Delete.
2722 (region_model::dump_to_pp): Replace "summarize" param with
2723 "simple" and "multiline". Port to store-based implementation.
2724 (region_model::dump): Replace "summarize" param with "simple" and
2725 "multiline".
2726 (dump_vec_of_tree): Delete.
2727 (region_model::dump_summary_of_rep_path_vars): Delete.
2728 (region_model::validate): Delete.
2729 (svalue_id_cmp_by_constant_svalue_model): Delete.
2730 (svalue_id_cmp_by_constant_svalue): Delete.
2731 (region_model::canonicalize): Drop "ctxt" param. Reimplement in
2732 terms of store and constraints.
2733 (region_model::canonicalized_p): Remove NULL arg to canonicalize.
2734 (region_model::loop_replay_fixup): New.
2735 (poisoned_value_diagnostic::emit): Tweak wording of warnings.
2736 (region_model::check_for_poison): Delete.
2737 (region_model::get_gassign_result): New.
2738 (region_model::on_assignment): Port to store-based implementation.
2739 (region_model::on_call_pre): Delete calls to check_for_poison.
2740 Move implementations to region-model-impl-calls.c and port to
2741 store-based implementation.
2742 (region_model::on_call_post): Likewise.
2743 (class reachable_regions): Move to region-model-reachability.h/cc
2744 and port to store-based implementation.
2745 (region_model::handle_unrecognized_call): Port to store-based
2746 implementation.
2747 (region_model::get_reachable_svalues): New.
2748 (region_model::on_setjmp): Port to store-based implementation.
2749 (region_model::on_longjmp): Likewise.
2750 (region_model::handle_phi): Drop is_back_edge param and the logic
2751 using it.
2752 (region_model::get_lvalue_1): Port from region_id to const region *.
2753 (region_model::make_region_for_unexpected_tree_code): Delete.
2754 (assert_compat_types): If the check fails, use internal_error to
2755 show the types.
2756 (region_model::get_lvalue): Port from region_id to const region *.
2757 (region_model::get_rvalue_1): Port from svalue_id to const svalue *.
2758 (region_model::get_rvalue): Likewise.
2759 (region_model::get_or_create_ptr_svalue): Delete.
2760 (region_model::get_or_create_constant_svalue): Delete.
2761 (region_model::get_svalue_for_fndecl): Delete.
2762 (region_model::get_region_for_fndecl): Delete.
2763 (region_model::get_svalue_for_label): Delete.
2764 (region_model::get_region_for_label): Delete.
2765 (build_cast): Delete.
2766 (region_model::maybe_cast_1): Delete.
2767 (region_model::maybe_cast): Delete.
2768 (region_model::get_field_region): Delete.
2769 (region_model::get_store_value): New.
2770 (region_model::region_exists_p): New.
2771 (region_model::deref_rvalue): Port from svalue_id to const svalue *.
2772 (region_model::set_value): Likewise.
2773 (region_model::clobber_region): New.
2774 (region_model::purge_region): New.
2775 (region_model::zero_fill_region): New.
2776 (region_model::mark_region_as_unknown): New.
2777 (region_model::eval_condition): Port from svalue_id to
2778 const svalue *.
2779 (region_model::eval_condition_without_cm): Likewise.
2780 (region_model::compare_initial_and_pointer): New.
2781 (region_model::add_constraint): Port from svalue_id to
2782 const svalue *.
2783 (region_model::maybe_get_constant): Delete.
2784 (region_model::get_representative_path_var): New.
2785 (region_model::add_new_malloc_region): Delete.
2786 (region_model::get_representative_tree): Port to const svalue *.
2787 (region_model::get_representative_path_var): Port to
2788 const region *.
2789 (region_model::get_path_vars_for_svalue): Delete.
2790 (region_model::set_to_new_unknown_value): Delete.
2791 (region_model::update_for_phis): Don't pass is_back_edge to handle_phi.
2792 (region_model::update_for_call_superedge): Port from svalue_id to
2793 const svalue *.
2794 (region_model::update_for_return_superedge): Port to store-based
2795 implementation.
2796 (region_model::update_for_call_summary): Replace
2797 set_to_new_unknown_value with mark_region_as_unknown.
2798 (region_model::get_root_region): Delete.
2799 (region_model::get_stack_region_id): Delete.
2800 (region_model::push_frame): Delete.
2801 (region_model::get_current_frame_id): Delete.
2802 (region_model::get_current_function): Delete.
2803 (region_model::pop_frame): Delete.
2804 (region_model::on_top_level_param): New.
2805 (region_model::get_stack_depth): Delete.
2806 (region_model::get_function_at_depth): Delete.
2807 (region_model::get_globals_region_id): Delete.
2808 (region_model::add_svalue): Delete.
2809 (region_model::replace_svalue): Delete.
2810 (region_model::add_region): Delete.
2811 (region_model::get_svalue): Delete.
2812 (region_model::get_region): Delete.
2813 (make_region_for_type): Delete.
2814 (region_model::add_region_for_type): Delete.
2815 (region_model::on_top_level_param): New.
2816 (class restrict_to_used_svalues): Delete.
2817 (region_model::purge_unused_svalues): Delete.
2818 (region_model::push_frame): New.
2819 (region_model::remap_svalue_ids): Delete.
2820 (region_model::remap_region_ids): Delete.
2821 (region_model::purge_regions): Delete.
2822 (region_model::get_descendents): Delete.
2823 (region_model::delete_region_and_descendents): Delete.
2824 (region_model::poison_any_pointers_to_bad_regions): Delete.
2825 (region_model::can_merge_with_p): Delete.
2826 (region_model::get_current_function): New.
2827 (region_model::get_value_by_name): Delete.
2828 (region_model::convert_byte_offset_to_array_index): Delete.
2829 (region_model::pop_frame): New.
2830 (region_model::get_or_create_mem_ref): Delete.
2831 (region_model::get_stack_depth): New.
2832 (region_model::get_frame_at_index): New.
2833 (region_model::unbind_region_and_descendents): New.
2834 (struct bad_pointer_finder): New.
2835 (region_model::get_or_create_pointer_plus_expr): Delete.
2836 (region_model::poison_any_pointers_to_descendents): New.
2837 (region_model::get_or_create_view): Delete.
2838 (region_model::can_merge_with_p): New.
2839 (region_model::get_fndecl_for_call): Port from svalue_id to
2840 const svalue *.
2841 (struct append_ssa_names_cb_data): New.
2842 (get_ssa_name_regions_for_current_frame): New.
2843 (region_model::append_ssa_names_cb): New.
2844 (model_merger::dump_to_pp): Add "simple" param. Drop dumping of
2845 remappings.
2846 (model_merger::dump): Add "simple" param to both overloads.
2847 (model_merger::can_merge_values_p): Delete.
2848 (model_merger::record_regions): Delete.
2849 (model_merger::record_svalues): Delete.
2850 (svalue_id_merger_mapping::svalue_id_merger_mapping): Delete.
2851 (svalue_id_merger_mapping::dump_to_pp): Delete.
2852 (svalue_id_merger_mapping::dump): Delete.
2853 (region_model::create_region_for_heap_alloc): New.
2854 (region_model::create_region_for_alloca): New.
2855 (region_model::record_dynamic_extents): New.
2856 (canonicalization::canonicalization): Delete.
2857 (canonicalization::walk_rid): Delete.
2858 (canonicalization::walk_sid): Delete.
2859 (canonicalization::dump_to_pp): Delete.
2860 (canonicalization::dump): Delete.
2861 (inchash::add): Delete overloads for svalue_id and region_id.
2862 (engine::log_stats): New.
2863 (assert_condition): Add overload comparing svalues.
2864 (assert_dump_eq): Pass "true" for multiline.
2865 (selftest::test_dump): Update for rewrite of region_model.
2866 (selftest::test_dump_2): Rename to...
2867 (selftest::test_struct): ...this. Provide a region_model_manager
2868 when creating region_model instance. Remove dump test. Add
2869 checks for get_offset.
2870 (selftest::test_dump_3): Rename to...
2871 (selftest::test_array_1): ...this. Provide a region_model_manager
2872 when creating region_model instance. Remove dump test.
2873 (selftest::test_get_representative_tree): Port from svalue_id to
2874 new API. Add test coverage for various expressions.
2875 (selftest::test_unique_constants): Provide a region_model_manager
2876 for the region_model. Add test coverage for comparing const vs
2877 non-const.
2878 (selftest::test_svalue_equality): Delete.
2879 (selftest::test_region_equality): Delete.
2880 (selftest::test_unique_unknowns): New.
2881 (class purge_all_svalue_ids): Delete.
2882 (class purge_one_svalue_id): Delete.
2883 (selftest::test_purging_by_criteria): Delete.
2884 (selftest::test_initial_svalue_folding): New.
2885 (selftest::test_unaryop_svalue_folding): New.
2886 (selftest::test_binop_svalue_folding): New.
2887 (selftest::test_sub_svalue_folding): New.
2888 (selftest::test_purge_unused_svalues): Delete.
2889 (selftest::test_descendent_of_p): New.
2890 (selftest::test_assignment): Provide a region_model_manager for
2891 the region_model. Drop the dump test.
2892 (selftest::test_compound_assignment): Likewise.
2893 (selftest::test_stack_frames): Port to new implementation.
2894 (selftest::test_get_representative_path_var): Likewise.
2895 (selftest::test_canonicalization_1): Rename to...
2896 (selftest::test_equality_1): ...this. Port to new API, and add
2897 (selftest::test_canonicalization_2): Provide a
2898 region_model_manager when creating region_model instances.
2899 Remove redundant canicalization.
2900 (selftest::test_canonicalization_3): Provide a
2901 region_model_manager when creating region_model instances.
2902 Remove param from calls to region_model::canonicalize.
2903 (selftest::test_canonicalization_4): Likewise.
2904 (selftest::assert_region_models_merge): Constify
2905 out_merged_svalue. Port to new API.
2906 (selftest::test_state_merging): Provide a
2907 region_model_manager when creating region_model instances.
2908 Provide a program_point point when merging them. Replace
2909 set_to_new_unknown_value with usage of placeholder_svalues.
2910 Drop get_value_by_name. Port from svalue_id to const svalue *.
2911 Add test of heap allocation.
2912 (selftest::test_constraint_merging): Provide a
2913 region_model_manager when creating region_model instances.
2914 Provide a program_point point when merging them. Eliminate use
2915 of set_to_new_unknown_value.
2916 (selftest::test_widening_constraints): New.
2917 (selftest::test_iteration_1): New.
2918 (selftest::test_malloc_constraints): Port to store-based
2919 implementation.
2920 (selftest::test_var): New test.
2921 (selftest::test_array_2): New test.
2922 (selftest::test_mem_ref): New test.
2923 (selftest::test_POINTER_PLUS_EXPR_then_MEM_REF): New.
2924 (selftest::test_malloc): New.
2925 (selftest::test_alloca): New.
2926 (selftest::analyzer_region_model_cc_tests): Update for renamings.
2927 Call new functions.
2928 * region-model.h (class path_var): Move to analyzer.h.
2929 (class svalue_id): Delete.
2930 (class region_id): Delete.
2931 (class id_map): Delete.
2932 (svalue_id_map): Delete.
2933 (region_id_map): Delete.
2934 (id_map<T>::id_map): Delete.
2935 (id_map<T>::put): Delete.
2936 (id_map<T>::get_dst_for_src): Delete.
2937 (id_map<T>::get_src_for_dst): Delete.
2938 (id_map<T>::dump_to_pp): Delete.
2939 (id_map<T>::dump): Delete.
2940 (id_map<T>::update): Delete.
2941 (one_way_svalue_id_map): Delete.
2942 (one_way_region_id_map): Delete.
2943 (class region_id_set): Delete.
2944 (class svalue_id_set): Delete.
2945 (struct complexity): New.
2946 (class visitor): New.
2947 (enum svalue_kind): Add SK_SETJMP, SK_INITIAL, SK_UNARYOP,
2948 SK_BINOP, SK_SUB,SK_UNMERGEABLE, SK_PLACEHOLDER, SK_WIDENING,
2949 SK_COMPOUND, and SK_CONJURED.
2950 (svalue::operator==): Delete.
2951 (svalue::operator!=): Delete.
2952 (svalue::clone): Delete.
2953 (svalue::hash): Delete.
2954 (svalue::dump_dot_to_pp): Delete.
2955 (svalue::dump_to_pp): New.
2956 (svalue::dump): New.
2957 (svalue::get_desc): New.
2958 (svalue::dyn_cast_initial_svalue): New.
2959 (svalue::dyn_cast_unaryop_svalue): New.
2960 (svalue::dyn_cast_binop_svalue): New.
2961 (svalue::dyn_cast_sub_svalue): New.
2962 (svalue::dyn_cast_unmergeable_svalue): New.
2963 (svalue::dyn_cast_widening_svalue): New.
2964 (svalue::dyn_cast_compound_svalue): New.
2965 (svalue::dyn_cast_conjured_svalue): New.
2966 (svalue::maybe_undo_cast): New.
2967 (svalue::unwrap_any_unmergeable): New.
2968 (svalue::remap_region_ids): Delete
2969 (svalue::can_merge_p): New.
2970 (svalue::walk_for_canonicalization): Delete
2971 (svalue::get_complexity): New.
2972 (svalue::get_child_sid): Delete
2973 (svalue::accept): New.
2974 (svalue::live_p): New.
2975 (svalue::implicitly_live_p): New.
2976 (svalue::svalue): Add complexity param.
2977 (svalue::add_to_hash): Delete
2978 (svalue::print_details): Delete
2979 (svalue::m_complexity): New field.
2980 (region_svalue::key_t): New struct.
2981 (region_svalue::region_svalue): Port from region_id to
2982 const region_id *. Add complexity.
2983 (region_svalue::compare_fields): Delete.
2984 (region_svalue::clone): Delete.
2985 (region_svalue::dump_dot_to_pp): Delete.
2986 (region_svalue::get_pointee): Port from region_id to
2987 const region_id *.
2988 (region_svalue::remap_region_ids): Delete.
2989 (region_svalue::merge_values): Delete.
2990 (region_svalue::dump_to_pp): New.
2991 (region_svalue::accept): New.
2992 (region_svalue::walk_for_canonicalization): Delete.
2993 (region_svalue::eval_condition): Make params const.
2994 (region_svalue::add_to_hash): Delete.
2995 (region_svalue::print_details): Delete.
2996 (region_svalue::m_rid): Replace with...
2997 (region_svalue::m_reg): ...this.
2998 (is_a_helper <region_svalue *>::test): Convert to...
2999 (is_a_helper <const region_svalue *>::test): ...this.
3000 (template <> struct default_hash_traits<region_svalue::key_t>):
3001 New.
3002 (constant_svalue::constant_svalue): Add complexity.
3003 (constant_svalue::compare_fields): Delete.
3004 (constant_svalue::clone): Delete.
3005 (constant_svalue::add_to_hash): Delete.
3006 (constant_svalue::dump_to_pp): New.
3007 (constant_svalue::accept): New.
3008 (constant_svalue::implicitly_live_p): New.
3009 (constant_svalue::merge_values): Delete.
3010 (constant_svalue::eval_condition): Make params const.
3011 (constant_svalue::get_child_sid): Delete.
3012 (constant_svalue::print_details): Delete.
3013 (is_a_helper <constant_svalue *>::test): Convert to...
3014 (is_a_helper <const constant_svalue *>::test): ...this.
3015 (class unknown_svalue): Update leading comment.
3016 (unknown_svalue::unknown_svalue): Add complexity.
3017 (unknown_svalue::compare_fields): Delete.
3018 (unknown_svalue::add_to_hash): Delete.
3019 (unknown_svalue::dyn_cast_unknown_svalue): Delete.
3020 (unknown_svalue::print_details): Delete.
3021 (unknown_svalue::dump_to_pp): New.
3022 (unknown_svalue::accept): New.
3023 (poisoned_svalue::key_t): New struct.
3024 (poisoned_svalue::poisoned_svalue): Add complexity.
3025 (poisoned_svalue::compare_fields): Delete.
3026 (poisoned_svalue::clone): Delete.
3027 (poisoned_svalue::add_to_hash): Delete.
3028 (poisoned_svalue::dump_to_pp): New.
3029 (poisoned_svalue::accept): New.
3030 (poisoned_svalue::print_details): Delete.
3031 (is_a_helper <poisoned_svalue *>::test): Convert to...
3032 (is_a_helper <const poisoned_svalue *>::test): ...this.
3033 (template <> struct default_hash_traits<poisoned_svalue::key_t>):
3034 New.
3035 (setjmp_record::add_to_hash): New.
3036 (setjmp_svalue::key_t): New struct.
3037 (setjmp_svalue::compare_fields): Delete.
3038 (setjmp_svalue::clone): Delete.
3039 (setjmp_svalue::add_to_hash): Delete.
3040 (setjmp_svalue::setjmp_svalue): Add complexity.
3041 (setjmp_svalue::dump_to_pp): New.
3042 (setjmp_svalue::accept): New.
3043 (setjmp_svalue::void print_details): Delete.
3044 (is_a_helper <const setjmp_svalue *>::test): New.
3045 (template <> struct default_hash_traits<setjmp_svalue::key_t>): New.
3046 (class initial_svalue : public svalue): New.
3047 (is_a_helper <const initial_svalue *>::test): New.
3048 (class unaryop_svalue): New.
3049 (is_a_helper <const unaryop_svalue *>::test): New.
3050 (template <> struct default_hash_traits<unaryop_svalue::key_t>): New.
3051 (class binop_svalue): New.
3052 (is_a_helper <const binop_svalue *>::test): New.
3053 (template <> struct default_hash_traits<binop_svalue::key_t>): New.
3054 (class sub_svalue): New.
3055 (is_a_helper <const sub_svalue *>::test): New.
3056 (template <> struct default_hash_traits<sub_svalue::key_t>): New.
3057 (class unmergeable_svalue): New.
3058 (is_a_helper <const unmergeable_svalue *>::test): New.
3059 (class placeholder_svalue): New.
3060 (is_a_helper <placeholder_svalue *>::test): New.
3061 (class widening_svalue): New.
3062 (is_a_helper <widening_svalue *>::test): New.
3063 (template <> struct default_hash_traits<widening_svalue::key_t>): New.
3064 (class compound_svalue): New.
3065 (is_a_helper <compound_svalue *>::test): New.
3066 (template <> struct default_hash_traits<compound_svalue::key_t>): New.
3067 (class conjured_svalue): New.
3068 (is_a_helper <conjured_svalue *>::test): New.
3069 (template <> struct default_hash_traits<conjured_svalue::key_t>): New.
3070 (enum region_kind): Delete RK_PRIMITIVE, RK_STRUCT, RK_UNION, and
3071 RK_ARRAY. Add RK_LABEL, RK_DECL, RK_FIELD, RK_ELEMENT, RK_OFFSET,
3072 RK_CAST, RK_HEAP_ALLOCATED, RK_ALLOCA, RK_STRING, and RK_UNKNOWN.
3073 (region_kind_to_str): Delete.
3074 (region::~region): Move implementation to region.cc.
3075 (region::operator==): Delete.
3076 (region::operator!=): Delete.
3077 (region::clone): Delete.
3078 (region::get_id): New.
3079 (region::cmp_ids): New.
3080 (region::dyn_cast_map_region): Delete.
3081 (region::dyn_cast_array_region): Delete.
3082 (region::region_id get_parent): Delete.
3083 (region::get_parent_region): Convert to a simple accessor.
3084 (region::void set_value): Delete.
3085 (region::svalue_id get_value): Delete.
3086 (region::svalue_id get_value_direct): Delete.
3087 (region::svalue_id get_inherited_child_sid): Delete.
3088 (region::dyn_cast_frame_region): New.
3089 (region::dyn_cast_function_region): New.
3090 (region::dyn_cast_decl_region): New.
3091 (region::dyn_cast_field_region): New.
3092 (region::dyn_cast_element_region): New.
3093 (region::dyn_cast_offset_region): New.
3094 (region::dyn_cast_cast_region): New.
3095 (region::dyn_cast_string_region): New.
3096 (region::accept): New.
3097 (region::get_base_region): New.
3098 (region::base_region_p): New.
3099 (region::descendent_of_p): New.
3100 (region::maybe_get_frame_region): New.
3101 (region::maybe_get_decl): New.
3102 (region::hash): Delete.
3103 (region::rint): Delete.
3104 (region::dump_dot_to_pp): Delete.
3105 (region::get_desc): New.
3106 (region::dump_to_pp): Convert to vfunc, changing signature.
3107 (region::dump_child_label): Delete.
3108 (region::remap_svalue_ids): Delete.
3109 (region::remap_region_ids): Delete.
3110 (region::dump): New.
3111 (region::walk_for_canonicalization): Delete.
3112 (region::non_null_p): Drop region_model param.
3113 (region::add_view): Delete.
3114 (region::get_view): Delete.
3115 (region::get_active_view): Delete.
3116 (region::is_view_p): Delete.
3117 (region::cmp_ptrs): New.
3118 (region::validate): Delete.
3119 (region::get_offset): New.
3120 (region::get_byte_size): New.
3121 (region::get_bit_size): New.
3122 (region::get_subregions_for_binding): New.
3123 (region::region): Add complexity param. Convert parent from
3124 region_id to const region *. Drop svalue_id. Drop copy ctor.
3125 (region::symbolic_for_unknown_ptr_p): New.
3126 (region::add_to_hash): Delete.
3127 (region::print_fields): Delete.
3128 (region::get_complexity): New accessor.
3129 (region::become_active_view): Delete.
3130 (region::deactivate_any_active_view): Delete.
3131 (region::deactivate_view): Delete.
3132 (region::calc_offset): New.
3133 (region::m_parent_rid): Delete.
3134 (region::m_sval_id): Delete.
3135 (region::m_complexity): New.
3136 (region::m_id): New.
3137 (region::m_parent): New.
3138 (region::m_view_rids): Delete.
3139 (region::m_is_view): Delete.
3140 (region::m_active_view_rid): Delete.
3141 (region::m_cached_offset): New.
3142 (is_a_helper <region *>::test): Convert to...
3143 (is_a_helper <const region *>::test): ... this.
3144 (class primitive_region): Delete.
3145 (class space_region): New.
3146 (class map_region): Delete.
3147 (is_a_helper <map_region *>::test): Delete.
3148 (class frame_region): Reimplement.
3149 (template <> struct default_hash_traits<frame_region::key_t>):
3150 New.
3151 (class globals_region): Reimplement.
3152 (is_a_helper <globals_region *>::test): Convert to...
3153 (is_a_helper <const globals_region *>::test): ...this.
3154 (class struct_or_union_region): Delete.
3155 (is_a_helper <struct_or_union_region *>::test): Delete.
3156 (class code_region): Reimplement.
3157 (is_a_helper <const code_region *>::test): New.
3158 (class struct_region): Delete.
3159 (is_a_helper <struct_region *>::test): Delete.
3160 (class function_region): Reimplement.
3161 (is_a_helper <function_region *>::test): Convert to...
3162 (is_a_helper <const function_region *>::test): ...this.
3163 (class union_region): Delete.
3164 (is_a_helper <union_region *>::test): Delete.
3165 (class label_region): New.
3166 (is_a_helper <const label_region *>::test): New.
3167 (class scope_region): Delete.
3168 (class stack_region): Reimplement.
3169 (is_a_helper <stack_region *>::test): Convert to...
3170 (is_a_helper <const stack_region *>::test): ...this.
3171 (class heap_region): Reimplement.
3172 (is_a_helper <heap_region *>::test): Convert to...
3173 (is_a_helper <const heap_region *>::test): ...this.
3174 (class root_region): Reimplement.
3175 (is_a_helper <root_region *>::test): Convert to...
3176 (is_a_helper <const root_region *>::test): ...this.
3177 (class symbolic_region): Reimplement.
3178 (is_a_helper <const symbolic_region *>::test): New.
3179 (template <> struct default_hash_traits<symbolic_region::key_t>):
3180 New.
3181 (class decl_region): New.
3182 (is_a_helper <const decl_region *>::test): New.
3183 (class field_region): New.
3184 (template <> struct default_hash_traits<field_region::key_t>): New.
3185 (class array_region): Delete.
3186 (class element_region): New.
3187 (is_a_helper <array_region *>::test): Delete.
3188 (is_a_helper <const element_region *>::test): New.
3189 (template <> struct default_hash_traits<element_region::key_t>):
3190 New.
3191 (class offset_region): New.
3192 (is_a_helper <const offset_region *>::test): New.
3193 (template <> struct default_hash_traits<offset_region::key_t>):
3194 New.
3195 (class cast_region): New.
3196 (is_a_helper <const cast_region *>::test): New.
3197 (template <> struct default_hash_traits<cast_region::key_t>): New.
3198 (class heap_allocated_region): New.
3199 (class alloca_region): New.
3200 (class string_region): New.
3201 (is_a_helper <const string_region *>::test): New.
3202 (class unknown_region): New.
3203 (class region_model_manager): New.
3204 (struct append_ssa_names_cb_data): New.
3205 (class call_details): New.
3206 (region_model::region_model): Add region_model_manager param.
3207 (region_model::print_svalue): Delete.
3208 (region_model::dump_dot_to_pp): Delete.
3209 (region_model::dump_dot_to_file): Delete.
3210 (region_model::dump_dot): Delete.
3211 (region_model::dump_to_pp): Drop summarize param in favor of
3212 simple and multiline.
3213 (region_model::dump): Likewise.
3214 (region_model::summarize_to_pp): Delete.
3215 (region_model::summarize): Delete.
3216 (region_model::void canonicalize): Drop ctxt param.
3217 (region_model::void check_for_poison): Delete.
3218 (region_model::get_gassign_result): New.
3219 (region_model::impl_call_alloca): New.
3220 (region_model::impl_call_analyzer_describe): New.
3221 (region_model::impl_call_analyzer_eval): New.
3222 (region_model::impl_call_builtin_expect): New.
3223 (region_model::impl_call_calloc): New.
3224 (region_model::impl_call_free): New.
3225 (region_model::impl_call_malloc): New.
3226 (region_model::impl_call_memset): New.
3227 (region_model::impl_call_strlen): New.
3228 (region_model::get_reachable_svalues): New.
3229 (region_model::handle_phi): Drop is_back_edge param.
3230 (region_model::region_id get_root_rid): Delete.
3231 (region_model::root_region *get_root_region): Delete.
3232 (region_model::region_id get_stack_region_id): Delete.
3233 (region_model::push_frame): Convert from region_id and svalue_id
3234 to const region * and const svalue *.
3235 (region_model::get_current_frame_id): Replace with...
3236 (region_model::get_current_frame): ...this.
3237 (region_model::pop_frame): Convert from region_id to
3238 const region *. Drop purge and stats param. Add out_result.
3239 (region_model::function *get_function_at_depth): Delete.
3240 (region_model::get_globals_region_id): Delete.
3241 (region_model::add_svalue): Delete.
3242 (region_model::replace_svalue): Delete.
3243 (region_model::add_region): Delete.
3244 (region_model::add_region_for_type): Delete.
3245 (region_model::get_svalue): Delete.
3246 (region_model::get_region): Delete.
3247 (region_model::get_lvalue): Convert from region_id to
3248 const region *.
3249 (region_model::get_rvalue): Convert from svalue_id to
3250 const svalue *.
3251 (region_model::get_or_create_ptr_svalue): Delete.
3252 (region_model::get_or_create_constant_svalue): Delete.
3253 (region_model::get_svalue_for_fndecl): Delete.
3254 (region_model::get_svalue_for_label): Delete.
3255 (region_model::get_region_for_fndecl): Delete.
3256 (region_model::get_region_for_label): Delete.
3257 (region_model::get_frame_at_index (int index) const;): New.
3258 (region_model::maybe_cast): Delete.
3259 (region_model::maybe_cast_1): Delete.
3260 (region_model::get_field_region): Delete.
3261 (region_model::id deref_rvalue): Convert from region_id and
3262 svalue_id to const region * and const svalue *. Drop overload,
3263 passing in both a tree and an svalue.
3264 (region_model::set_value): Convert from region_id and svalue_id to
3265 const region * and const svalue *.
3266 (region_model::set_to_new_unknown_value): Delete.
3267 (region_model::clobber_region (const region *reg);): New.
3268 (region_model::purge_region (const region *reg);): New.
3269 (region_model::zero_fill_region (const region *reg);): New.
3270 (region_model::mark_region_as_unknown (const region *reg);): New.
3271 (region_model::copy_region): Convert from region_id to
3272 const region *.
3273 (region_model::eval_condition): Convert from svalue_id to
3274 const svalue *.
3275 (region_model::eval_condition_without_cm): Likewise.
3276 (region_model::compare_initial_and_pointer): New.
3277 (region_model:maybe_get_constant): Delete.
3278 (region_model::add_new_malloc_region): Delete.
3279 (region_model::get_representative_tree): Convert from svalue_id to
3280 const svalue *.
3281 (region_model::get_representative_path_var): Delete decl taking a
3282 region_id in favor of two decls, for svalue vs region, with an
3283 svalue_set to ensure termination.
3284 (region_model::get_path_vars_for_svalue): Delete.
3285 (region_model::create_region_for_heap_alloc): New.
3286 (region_model::create_region_for_alloca): New.
3287 (region_model::purge_unused_svalues): Delete.
3288 (region_model::remap_svalue_ids): Delete.
3289 (region_model::remap_region_ids): Delete.
3290 (region_model::purge_regions): Delete.
3291 (region_model::get_num_svalues): Delete.
3292 (region_model::get_num_regions): Delete.
3293 (region_model::get_descendents): Delete.
3294 (region_model::get_store): New.
3295 (region_model::delete_region_and_descendents): Delete.
3296 (region_model::get_manager): New.
3297 (region_model::unbind_region_and_descendents): New.
3298 (region_model::can_merge_with_p): Add point param. Drop
3299 svalue_id_merger_mapping.
3300 (region_model::get_value_by_name): Delete.
3301 (region_model::convert_byte_offset_to_array_index): Delete.
3302 (region_model::get_or_create_mem_ref): Delete.
3303 (region_model::get_or_create_pointer_plus_expr): Delete.
3304 (region_model::get_or_create_view): Delete.
3305 (region_model::get_lvalue_1): Convert from region_id to
3306 const region *.
3307 (region_model::get_rvalue_1): Convert from svalue_id to
3308 const svalue *.
3309 (region_model::get_ssa_name_regions_for_current_frame): New.
3310 (region_model::append_ssa_names_cb): New.
3311 (region_model::get_store_value): New.
3312 (region_model::copy_struct_region): Delete.
3313 (region_model::copy_union_region): Delete.
3314 (region_model::copy_array_region): Delete.
3315 (region_model::region_exists_p): New.
3316 (region_model::make_region_for_unexpected_tree_code): Delete.
3317 (region_model::loop_replay_fixup): New.
3318 (region_model::poison_any_pointers_to_bad_regions): Delete.
3319 (region_model::poison_any_pointers_to_descendents): New.
3320 (region_model::dump_summary_of_rep_path_vars): Delete.
3321 (region_model::on_top_level_param): New.
3322 (region_model::record_dynamic_extents): New.
3323 (region_model::m_mgr;): New.
3324 (region_model::m_store;): New.
3325 (region_model::m_svalues;): Delete.
3326 (region_model::m_regions;): Delete.
3327 (region_model::m_root_rid;): Delete.
3328 (region_model::m_current_frame;): New.
3329 (region_model_context::remap_svalue_ids): Delete.
3330 (region_model_context::can_purge_p): Delete.
3331 (region_model_context::on_svalue_leak): New.
3332 (region_model_context::on_svalue_purge): Delete.
3333 (region_model_context::on_liveness_change): New.
3334 (region_model_context::on_inherited_svalue): Delete.
3335 (region_model_context::on_cast): Delete.
3336 (region_model_context::on_unknown_change): Convert from svalue_id to
3337 const svalue * and add is_mutable.
3338 (class noop_region_model_context): Update for region_model_context
3339 changes.
3340 (model_merger::model_merger): Add program_point. Drop
3341 svalue_id_merger_mapping.
3342 (model_merger::dump_to_pp): Add "simple" param.
3343 (model_merger::dump): Likewise.
3344 (model_merger::get_region_a): Delete.
3345 (model_merger::get_region_b): Delete.
3346 (model_merger::can_merge_values_p): Delete.
3347 (model_merger::record_regions): Delete.
3348 (model_merger::record_svalues): Delete.
3349 (model_merger::m_point): New field.
3350 (model_merger::m_map_regions_from_a_to_m): Delete.
3351 (model_merger::m_map_regions_from_b_to_m): Delete.
3352 (model_merger::m_sid_mapping): Delete.
3353 (struct svalue_id_merger_mapping): Delete.
3354 (class engine): New.
3355 (struct canonicalization): Delete.
3356 (inchash::add): Delete decls for hashing svalue_id and region_id.
3357 (test_region_model_context::on_unexpected_tree_code): Require t to
3358 be non-NULL.
3359 (selftest::assert_condition): Add overload comparing a pair of
3360 const svalue *.
3361 * sm-file.cc: Include "tristate.h", "selftest.h",
3362 "analyzer/call-string.h", "analyzer/program-point.h",
3363 "analyzer/store.h", and "analyzer/region-model.h".
3364 (fileptr_state_machine::get_default_state): New.
3365 (fileptr_state_machine::on_stmt): Remove calls to
3366 get_readable_tree in favor of get_diagnostic_tree.
3367 * sm-malloc.cc: Include "tristate.h", "selftest.h",
3368 "analyzer/call-string.h", "analyzer/program-point.h",
3369 "analyzer/store.h", and "analyzer/region-model.h".
3370 (malloc_state_machine::get_default_state): New.
3371 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New.
3372 (malloc_diagnostic::describe_state_change): Handle change.m_expr
3373 being NULL.
3374 (null_arg::emit): Avoid printing "NULL '0'".
3375 (null_arg::describe_final_event): Avoid printing "(0) NULL".
3376 (malloc_leak::emit): Handle m_arg being NULL.
3377 (malloc_leak::describe_final_event): Handle ev.m_expr being NULL.
3378 (malloc_state_machine::on_stmt): Don't call get_readable_tree.
3379 Call get_diagnostic_tree when creating pending diagnostics.
3380 Update for is_zero_assignment becoming a member function of
3381 sm_ctxt.
3382 Don't transition to m_non_heap for ADDR_EXPR(MEM_REF()).
3383 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New
3384 vfunc implementation.
3385 * sm-sensitive.cc (sensitive_state_machine::warn_for_any_exposure): Call
3386 get_diagnostic_tree and pass the result to warn_for_state.
3387 * sm-signal.cc: Move includes of "analyzer/call-string.h" and
3388 "analyzer/program-point.h" to before "analyzer/region-model.h",
3389 and also include "analyzer/store.h" before it.
3390 (signal_unsafe_call::describe_state_change): Use
3391 get_dest_function to get handler.
3392 (update_model_for_signal_handler): Pass manager to region_model
3393 ctor.
3394 (register_signal_handler::impl_transition): Update for changes to
3395 get_or_create_node and add_edge.
3396 * sm-taint.cc (taint_state_machine::on_stmt): Remove calls to
3397 get_readable_tree, replacing them when calling warn_for_state with
3398 calls to get_diagnostic_tree.
3399 * sm.cc (is_zero_assignment): Delete.
3400 (any_pointer_p): Move to within namespace ana.
3401 * sm.h (is_zero_assignment): Remove decl.
3402 (any_pointer_p): Move decl to within namespace ana.
3403 (state_machine::get_default_state): New vfunc.
3404 (state_machine::reset_when_passed_to_unknown_fn_p): New vfunc.
3405 (sm_context::get_readable_tree): Rename to...
3406 (sm_context::get_diagnostic_tree): ...this.
3407 (sm_context::is_zero_assignment): New vfunc.
3408 * store.cc: New file.
3409 * store.h: New file.
3410 * svalue.cc: New file.
3412 2020-05-22 Mark Wielaard <mark@klomp.org>
3414 * sm-signal.cc(signal_unsafe_call::emit): Possibly add
3415 gcc_rich_location note for replacement.
3416 (signal_unsafe_call::get_replacement_fn): New private function.
3417 (get_async_signal_unsafe_fns): Add "exit".
3419 2020-04-28 David Malcolm <dmalcolm@redhat.com>
3421 PR analyzer/94816
3422 * engine.cc (impl_region_model_context::on_unexpected_tree_code):
3423 Handle NULL tree.
3424 * region-model.cc (region_model::add_region_for_type): Handle
3425 NULL type.
3426 * region-model.h
3427 (test_region_model_context::on_unexpected_tree_code): Handle NULL
3428 tree.
3430 2020-04-28 David Malcolm <dmalcolm@redhat.com>
3432 PR analyzer/94447
3433 PR analyzer/94639
3434 PR analyzer/94732
3435 PR analyzer/94754
3436 * analyzer.opt (Wanalyzer-use-of-uninitialized-value): Delete.
3437 * program-state.cc (selftest::test_program_state_dumping): Update
3438 expected dump result for removal of "uninit".
3439 * region-model.cc (poison_kind_to_str): Delete POISON_KIND_UNINIT
3440 case.
3441 (root_region::ensure_stack_region): Initialize stack with null
3442 svalue_id rather than with a typeless POISON_KIND_UNINIT value.
3443 (root_region::ensure_heap_region): Likewise for the heap.
3444 (region_model::dump_summary_of_rep_path_vars): Remove
3445 summarization of uninit values.
3446 (region_model::validate): Remove check that the stack has a
3447 POISON_KIND_UNINIT value.
3448 (poisoned_value_diagnostic::emit): Remove POISON_KIND_UNINIT
3449 case.
3450 (poisoned_value_diagnostic::describe_final_event): Likewise.
3451 (selftest::test_dump): Update expected dump result for removal of
3452 "uninit".
3453 (selftest::test_svalue_equality): Remove "uninit" and "freed".
3454 * region-model.h (enum poison_kind): Remove POISON_KIND_UNINIT.
3456 2020-04-01 David Malcolm <dmalcolm@redhat.com>
3458 PR analyzer/94378
3459 * checker-path.cc: Include "bitmap.h".
3460 * constraint-manager.cc: Likewise.
3461 * diagnostic-manager.cc: Likewise.
3462 * engine.cc: Likewise.
3463 (exploded_node::detect_leaks): Pass null region_id to pop_frame.
3464 * program-point.cc: Include "bitmap.h".
3465 * program-state.cc: Likewise.
3466 * region-model.cc (id_set<region_id>::id_set): Convert to...
3467 (region_id_set::region_id_set): ...this.
3468 (svalue_id_set::svalue_id_set): New ctor.
3469 (region_model::copy_region): New function.
3470 (region_model::copy_struct_region): New function.
3471 (region_model::copy_union_region): New function.
3472 (region_model::copy_array_region): New function.
3473 (stack_region::pop_frame): Drop return value. Add
3474 "result_dst_rid" param; if it is non-null, use copy_region to copy
3475 the result to it. Rather than capture and pass a single "known
3476 used" return value to be used by purge_unused_values, instead
3477 gather and pass a set of known used return values.
3478 (root_region::pop_frame): Drop return value. Add "result_dst_rid"
3479 param.
3480 (region_model::on_assignment): Use copy_region.
3481 (region_model::on_return): Likewise for the result.
3482 (region_model::on_longjmp): Pass null for pop_frame's
3483 result_dst_rid.
3484 (region_model::update_for_return_superedge): Pass the region for the
3485 return value of the call, if any, to pop_frame, rather than setting
3486 the lvalue for the lhs of the result.
3487 (region_model::pop_frame): Drop return value. Add
3488 "result_dst_rid" param.
3489 (region_model::purge_unused_svalues): Convert third param from an
3490 svalue_id * to an svalue_id_set *, updating the initial populating
3491 of the "used" bitmap accordingly. Don't remap it when done.
3492 (struct selftest::coord_test): New selftest fixture, extracted from...
3493 (selftest::test_dump_2): ...here.
3494 (selftest::test_compound_assignment): New selftest.
3495 (selftest::test_stack_frames): Pass null to new param of pop_frame.
3496 (selftest::analyzer_region_model_cc_tests): Call the new selftest.
3497 * region-model.h (class id_set): Delete template.
3498 (class region_id_set): Reimplement, using old id_set implementation.
3499 (class svalue_id_set): Likewise. Convert from auto_sbitmap to
3500 auto_bitmap.
3501 (region::get_active_view): New accessor.
3502 (stack_region::pop_frame): Drop return value. Add
3503 "result_dst_rid" param.
3504 (root_region::pop_frame): Likewise.
3505 (region_model::pop_frame): Likewise.
3506 (region_model::copy_region): New decl.
3507 (region_model::purge_unused_svalues): Convert third param from an
3508 svalue_id * to an svalue_id_set *.
3509 (region_model::copy_struct_region): New decl.
3510 (region_model::copy_union_region): New decl.
3511 (region_model::copy_array_region): New decl.
3513 2020-03-27 David Malcolm <dmalcolm@redhat.com>
3515 * program-state.cc (selftest::test_program_state_dumping): Update
3516 expected dump to include symbolic_region's possibly_null field.
3517 * region-model.cc (symbolic_region::print_fields): New vfunc
3518 implementation.
3519 (region_model::add_constraint): Clear m_possibly_null from
3520 symbolic_regions now known to be non-NULL.
3521 (selftest::test_malloc_constraints): New selftest.
3522 (selftest::analyzer_region_model_cc_tests): Call it.
3523 * region-model.h (region::dyn_cast_symbolic_region): Add non-const
3524 overload.
3525 (symbolic_region::dyn_cast_symbolic_region): Implement it.
3526 (symbolic_region::print_fields): New vfunc override decl.
3528 2020-03-27 David Malcolm <dmalcolm@redhat.com>
3530 * analyzer.h (class feasibility_problem): New forward decl.
3531 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
3532 Initialize new fields m_status, m_epath_length, and m_problem.
3533 (saved_diagnostic::~saved_diagnostic): Delete m_problem.
3534 (dedupe_candidate::dedupe_candidate): Convert "sd" param from a
3535 const ref to a mutable ptr.
3536 (dedupe_winners::add): Convert "sd" param from a const ref to a
3537 mutable ptr. Record the length of the exploded_path. Record the
3538 feasibility/infeasibility of sd into sd, capturing a
3539 feasibility_problem when feasible_p fails, and storing it in sd.
3540 (diagnostic_manager::emit_saved_diagnostics): Update for pass by
3541 ptr rather than by const ref.
3542 * diagnostic-manager.h (class saved_diagnostic): Add new enum
3543 status. Add fields m_status, m_epath_length and m_problem.
3544 (saved_diagnostic::set_feasible): New member function.
3545 (saved_diagnostic::set_infeasible): New member function.
3546 (saved_diagnostic::get_feasibility_problem): New accessor.
3547 (saved_diagnostic::get_status): New accessor.
3548 (saved_diagnostic::set_epath_length): New member function.
3549 (saved_diagnostic::get_epath_length): New accessor.
3550 * engine.cc: Include "gimple-pretty-print.h".
3551 (exploded_path::feasible_p): Add OUT param and, if non-NULL, write
3552 a new feasibility_problem to it on failure.
3553 (viz_callgraph_node::dump_dot): Convert begin_tr calls to
3554 begin_trtd. Convert end_tr calls to end_tdtr.
3555 (class exploded_graph_annotator): New subclass of dot_annotator.
3556 (impl_run_checkers): Add a second -fdump-analyzer-supergraph dump
3557 after the analysis runs, using exploded_graph_annotator. dumping
3558 to DUMP_BASE_NAME.supergraph-eg.dot.
3559 * exploded-graph.h (exploded_node::get_dot_fillcolor): Make
3560 public.
3561 (exploded_path::feasible_p): Add OUT param.
3562 (class feasibility_problem): New class.
3563 * state-purge.cc (state_purge_annotator::add_node_annotations):
3564 Return a bool, add a "within_table" param.
3565 (print_vec_of_names): Convert begin_tr calls to begin_trtd.
3566 Convert end_tr calls to end_tdtr.
3567 (state_purge_annotator::add_stmt_annotations): Add "within_row"
3568 param.
3569 * state-purge.h ((state_purge_annotator::add_node_annotations):
3570 Return a bool, add a "within_table" param.
3571 (state_purge_annotator::add_stmt_annotations): Add "within_row"
3572 param.
3573 * supergraph.cc (supernode::dump_dot): Call add_node_annotations
3574 twice: as before, passing false for "within_table", then again
3575 with true when within the TABLE element. Convert some begin_tr
3576 calls to begin_trtd, and some end_tr calls to end_tdtr.
3577 Repeat each add_stmt_annotations call, distinguishing between
3578 calls that add TRs and those that add TDs to an existing TR.
3579 Add a call to add_after_node_annotations.
3580 * supergraph.h (dot_annotator::add_node_annotations): Add a
3581 "within_table" param.
3582 (dot_annotator::add_stmt_annotations): Add a "within_row" param.
3583 (dot_annotator::add_after_node_annotations): New vfunc.
3585 2020-03-27 David Malcolm <dmalcolm@redhat.com>
3587 * diagnostic-manager.cc (dedupe_winners::add): Show the
3588 exploded_node index in the log messages.
3589 (diagnostic_manager::emit_saved_diagnostics): Log a summary of
3590 m_saved_diagnostics at entry.
3592 2020-03-27 David Malcolm <dmalcolm@redhat.com>
3594 * supergraph.cc (superedge::dump): Add space before description;
3595 move newline to non-pretty_printer overload.
3597 2020-03-18 David Malcolm <dmalcolm@redhat.com>
3599 * region-model.cc: Include "stor-layout.h".
3600 (region_model::dump_to_pp): Rather than calling
3601 dump_summary_of_map on each of the current frame and the globals,
3602 instead get a vec of representative path_vars for all regions,
3603 and then dump a summary of all of them.
3604 (region_model::dump_summary_of_map): Delete, rewriting into...
3605 (region_model::dump_summary_of_rep_path_vars): ...this new
3606 function, working on a vec of path_vars.
3607 (region_model::set_value): New overload.
3608 (region_model::get_representative_path_var): Rename
3609 "parent_region" local to "parent_reg" and consolidate with other
3610 local. Guard test for grandparent being stack on parent_reg being
3611 non-NULL. Move handling for parent being an array_region to
3612 within guard for parent_reg being non-NULL.
3613 (selftest::make_test_compound_type): New function.
3614 (selftest::test_dump_2): New selftest.
3615 (selftest::test_dump_3): New selftest.
3616 (selftest::test_stack_frames): Update expected output from
3617 simplified dump to show "a" and "b" from parent frame and "y" in
3618 child frame.
3619 (selftest::analyzer_region_model_cc_tests): Call test_dump_2 and
3620 test_dump_3.
3621 * region-model.h (region_model::set_value): New overload decl.
3622 (region_model::dump_summary_of_map): Delete.
3623 (region_model::dump_summary_of_rep_path_vars): New.
3625 2020-03-18 David Malcolm <dmalcolm@redhat.com>
3627 * region-model.h (class noop_region_model_context): New subclass
3628 of region_model_context.
3629 (class tentative_region_model_context): Inherit from
3630 noop_region_model_context rather than from region_model_context;
3631 drop redundant vfunc implementations.
3632 (class test_region_model_context): Likewise.
3634 2020-03-18 David Malcolm <dmalcolm@redhat.com>
3636 * engine.cc (exploded_node::exploded_node): Move implementation
3637 here from header; accept point_and_state by const reference rather
3638 than by value.
3639 * exploded-graph.h (exploded_node::exploded_node): Pass
3640 point_and_state by const reference rather than by value. Move
3641 body to engine.cc.
3643 2020-03-18 Jakub Jelinek <jakub@redhat.com>
3645 * sm-malloc.cc (malloc_state_machine::on_stmt): Fix up duplicated word
3646 issue in a comment.
3647 * region-model.cc (region_model::make_region_for_unexpected_tree_code,
3648 region_model::delete_region_and_descendents): Likewise.
3649 * engine.cc (class exploded_cluster): Likewise.
3650 * diagnostic-manager.cc (class path_builder): Likewise.
3652 2020-03-13 David Malcolm <dmalcolm@redhat.com>
3654 PR analyzer/94099
3655 PR analyzer/94105
3656 * diagnostic-manager.cc (for_each_state_change): Bulletproof
3657 against errors in get_rvalue by passing a
3658 tentative_region_model_context and rejecting if there's an error.
3659 * region-model.cc (region_model::get_lvalue_1): When handling
3660 ARRAY_REF, handle results of error-handling. Handle NOP_EXPR.
3662 2020-03-06 David Malcolm <dmalcolm@redhat.com>
3664 * analyzer.h (class array_region): New forward decl.
3665 * program-state.cc (selftest::test_program_state_dumping_2): New.
3666 (selftest::analyzer_program_state_cc_tests): Call it.
3667 * region-model.cc (array_region::constant_from_key): New.
3668 (region_model::get_representative_tree): Handle region_svalue by
3669 generating an ADDR_EXPR.
3670 (region_model::get_representative_path_var): In view handling,
3671 remove erroneous TREE_TYPE when determining the type of the tree.
3672 Handle array regions and STRING_CST.
3673 (selftest::assert_dump_tree_eq): New.
3674 (ASSERT_DUMP_TREE_EQ): New macro.
3675 (selftest::test_get_representative_tree): New selftest.
3676 (selftest::analyzer_region_model_cc_tests): Call it.
3677 * region-model.h (region::dyn_cast_array_region): New vfunc.
3678 (array_region::dyn_cast_array_region): New vfunc implementation.
3679 (array_region::constant_from_key): New decl.
3681 2020-03-06 David Malcolm <dmalcolm@redhat.com>
3683 * analyzer.h (dump_quoted_tree): New decl.
3684 * engine.cc (exploded_node::dump_dot): Pass region model to
3685 sm_state_map::print.
3686 * program-state.cc: Include diagnostic-core.h.
3687 (sm_state_map::print): Add "model" param and use it to print
3688 representative trees. Only print origin information if non-null.
3689 (sm_state_map::dump): Pass NULL for model to print call.
3690 (program_state::print): Pass region model to sm_state_map::print.
3691 (program_state::dump_to_pp): Use spaces rather than newlines when
3692 summarizing. Pass region_model to sm_state_map::print.
3693 (ana::selftest::assert_dump_eq): New function.
3694 (ASSERT_DUMP_EQ): New macro.
3695 (ana::selftest::test_program_state_dumping): New function.
3696 (ana::selftest::analyzer_program_state_cc_tests): Call it.
3697 * program-state.h (program_state::print): Add model param.
3698 * region-model.cc (dump_quoted_tree): New function.
3699 (map_region::print_fields): Use dump_quoted_tree rather than
3700 %qE to avoid lang-dependent output.
3701 (map_region::dump_child_label): Likewise.
3702 (region_model::dump_summary_of_map): For SK_REGION, when
3703 get_representative_path_var fails, print the region id rather than
3704 erroneously printing NULL.
3705 * sm.cc (state_machine::get_state_by_name): New function.
3706 * sm.h (state_machine::get_state_by_name): New decl.
3708 2020-03-04 David Malcolm <dmalcolm@redhat.com>
3710 * region-model.cc (region::validate): Convert model param from ptr
3711 to reference. Update comment to reflect that it's now a vfunc.
3712 (map_region::validate): New vfunc implementation.
3713 (array_region::validate): New vfunc implementation.
3714 (stack_region::validate): New vfunc implementation.
3715 (root_region::validate): New vfunc implementation.
3716 (region_model::validate): Pass a reference rather than a pointer
3717 to the region::validate vfunc.
3718 * region-model.h (region::validate): Make virtual. Convert model
3719 param from ptr to reference.
3720 (map_region::validate): New vfunc decl.
3721 (array_region::validate): New vfunc decl.
3722 (stack_region::validate): New vfunc decl.
3723 (root_region::validate): New vfunc decl.
3725 2020-03-04 David Malcolm <dmalcolm@redhat.com>
3727 PR analyzer/93993
3728 * region-model.cc (region_model::on_call_pre): Handle
3729 BUILT_IN_EXPECT and its variants.
3730 (region_model::add_any_constraints_from_ssa_def_stmt): Split out
3731 gassign handling into add_any_constraints_from_gassign; add gcall
3732 handling.
3733 (region_model::add_any_constraints_from_gassign): New function,
3734 based on the above. Add handling for NOP_EXPR.
3735 (region_model::add_any_constraints_from_gcall): New function.
3736 (region_model::get_representative_path_var): Handle views.
3737 * region-model.h
3738 (region_model::add_any_constraints_from_ssa_def_stmt): New decl.
3739 (region_model::add_any_constraints_from_gassign): New decl.
3741 2020-03-04 David Malcolm <dmalcolm@redhat.com>
3743 PR analyzer/93993
3744 * checker-path.h (state_change_event::get_lvalue): Add ctxt param
3745 and pass it to region_model::get_value call.
3746 * diagnostic-manager.cc (get_any_origin): Pass a
3747 tentative_region_model_context to the calls to get_lvalue and reject
3748 the comparison if errors occur.
3749 (can_be_expr_of_interest_p): New function.
3750 (diagnostic_manager::prune_for_sm_diagnostic): Replace checks for
3751 CONSTANT_CLASS_P with calls to update_for_unsuitable_sm_exprs.
3752 Pass a tentative_region_model_context to the calls to
3753 state_change_event::get_lvalue and reject the comparison if errors
3754 occur.
3755 (diagnostic_manager::update_for_unsuitable_sm_exprs): New.
3756 * diagnostic-manager.h
3757 (diagnostic_manager::update_for_unsuitable_sm_exprs): New decl.
3758 * region-model.h (class tentative_region_model_context): New class.
3760 2020-03-04 David Malcolm <dmalcolm@redhat.com>
3762 * engine.cc (worklist::worklist): Remove unused field m_eg.
3763 (class viz_callgraph_edge): Remove unused field m_call_sedge.
3764 (class viz_callgraph): Remove unused field m_sg.
3765 * exploded-graph.h (worklist::::m_eg): Remove unused field.
3767 2020-03-02 David Malcolm <dmalcolm@redhat.com>
3769 * analyzer.opt (fanalyzer-show-duplicate-count): New option.
3770 * diagnostic-manager.cc
3771 (diagnostic_manager::emit_saved_diagnostic): Use the above to
3772 guard the printing of the duplicate count.
3774 2020-03-02 David Malcolm <dmalcolm@redhat.com>
3776 PR analyzer/93959
3777 * analyzer.cc (is_std_function_p): New function.
3778 (is_std_named_call_p): New functions.
3779 * analyzer.h (is_std_named_call_p): New decl.
3780 * sm-malloc.cc (malloc_state_machine::on_stmt): Check for "std::"
3781 variants when checking for malloc, calloc and free.
3783 2020-02-26 David Malcolm <dmalcolm@redhat.com>
3785 PR analyzer/93950
3786 * diagnostic-manager.cc
3787 (diagnostic_manager::prune_for_sm_diagnostic): Assert that var is
3788 either NULL or not a constant. When updating var, bulletproof
3789 against constant values.
3791 2020-02-26 David Malcolm <dmalcolm@redhat.com>
3793 PR analyzer/93947
3794 * region-model.cc (region_model::get_fndecl_for_call): Gracefully
3795 fail for fn_decls that don't have a cgraph_node.
3797 2020-02-26 David Malcolm <dmalcolm@redhat.com>
3799 * bar-chart.cc: New file.
3800 * bar-chart.h: New file.
3801 * engine.cc: Include "analyzer/bar-chart.h".
3802 (stats::log): Only log the m_num_nodes kinds that are non-zero.
3803 (stats::dump): Likewise when dumping.
3804 (stats::get_total_enodes): New.
3805 (exploded_graph::get_or_create_node): Increment the per-point-data
3806 m_excess_enodes when hitting the per-program-point limit on
3807 enodes.
3808 (exploded_graph::print_bar_charts): New.
3809 (exploded_graph::log_stats): Log the number of unprocessed enodes
3810 in the worklist. Call print_bar_charts.
3811 (exploded_graph::dump_stats): Print the number of unprocessed
3812 enodes in the worklist.
3813 * exploded-graph.h (stats::get_total_enodes): New decl.
3814 (struct per_program_point_data): Add field m_excess_enodes.
3815 (exploded_graph::print_bar_charts): New decl.
3816 * supergraph.cc (superedge::dump): New.
3817 (superedge::dump): New.
3818 * supergraph.h (supernode::get_function): New.
3819 (superedge::dump): New decl.
3820 (superedge::dump): New decl.
3822 2020-02-24 David Malcolm <dmalcolm@redhat.com>
3824 * engine.cc (exploded_graph::get_or_create_node): Dump the
3825 program_state to the pp, rather than to stderr.
3827 2020-02-24 David Malcolm <dmalcolm@redhat.com>
3829 PR analyzer/93032
3830 * sm.cc (make_checkers): Require the "taint" checker to be
3831 explicitly enabled.
3833 2020-02-24 David Malcolm <dmalcolm@redhat.com>
3835 PR analyzer/93899
3836 * engine.cc
3837 (impl_region_model_context::impl_region_model_context): Add logger
3838 param.
3839 * engine.cc (exploded_graph::add_function_entry): Create an
3840 impl_region_model_context and pass it to the push_frame call.
3841 Bail if the resulting state is invalid.
3842 (exploded_graph::build_initial_worklist): Likewise.
3843 (exploded_graph::build_initial_worklist): Handle the case where
3844 add_function_entry fails.
3845 * exploded-graph.h
3846 (impl_region_model_context::impl_region_model_context): Add logger
3847 param.
3848 * region-model.cc (map_region::get_or_create): Add ctxt param and
3849 pass it to add_region_for_type.
3850 (map_region::can_merge_p): Pass NULL as a ctxt to call to
3851 get_or_create.
3852 (array_region::get_element): Pass ctxt to call to get_or_create.
3853 (array_region::get_or_create): Add ctxt param and pass it to
3854 add_region_for_type.
3855 (root_region::push_frame): Pass ctxt to get_or_create calls.
3856 (region_model::get_lvalue_1): Likewise.
3857 (region_model::make_region_for_unexpected_tree_code): Assert that
3858 ctxt is non-NULL.
3859 (region_model::get_rvalue_1): Pass ctxt to get_svalue_for_fndecl
3860 and get_svalue_for_label calls.
3861 (region_model::get_svalue_for_fndecl): Add ctxt param and pass it
3862 to get_region_for_fndecl.
3863 (region_model::get_region_for_fndecl): Add ctxt param and pass it
3864 to get_or_create.
3865 (region_model::get_svalue_for_label): Add ctxt param and pass it
3866 to get_region_for_label.
3867 (region_model::get_region_for_label): Add ctxt param and pass it
3868 to get_region_for_fndecl and get_or_create.
3869 (region_model::get_field_region): Add ctxt param and pass it to
3870 get_or_create_view and get_or_create.
3871 (make_region_for_type): Replace gcc_unreachable with return NULL.
3872 (region_model::add_region_for_type): Add ctxt param. Handle a
3873 return of NULL from make_region_for_type by calling
3874 make_region_for_unexpected_tree_code.
3875 (region_model::get_or_create_mem_ref): Pass ctxt to calls to
3876 get_or_create_view.
3877 (region_model::get_or_create_view): Add ctxt param and pass it to
3878 add_region_for_type.
3879 (selftest::test_state_merging): Pass ctxt to get_or_create_view.
3880 * region-model.h (region_model::get_or_create): Add ctxt param.
3881 (region_model::add_region_for_type): Likewise.
3882 (region_model::get_svalue_for_fndecl): Likewise.
3883 (region_model::get_svalue_for_label): Likewise.
3884 (region_model::get_region_for_fndecl): Likewise.
3885 (region_model::get_region_for_label): Likewise.
3886 (region_model::get_field_region): Likewise.
3887 (region_model::get_or_create_view): Likewise.
3889 2020-02-24 David Malcolm <dmalcolm@redhat.com>
3891 * checker-path.cc (superedge_event::should_filter_p): Update
3892 filter for empty descriptions to cover verbosity level 3 as well
3893 as 2.
3894 * diagnostic-manager.cc: Include "analyzer/reachability.h".
3895 (class path_builder): New class.
3896 (diagnostic_manager::emit_saved_diagnostic): Create a path_builder
3897 and pass it to build_emission_path, rather passing eg; similarly
3898 for add_events_for_eedge and ext_state.
3899 (diagnostic_manager::build_emission_path): Replace "eg" param
3900 with a path_builder, pass it to add_events_for_eedge.
3901 (diagnostic_manager::add_events_for_eedge): Replace ext_state
3902 param with path_builder; pass it to add_events_for_superedge.
3903 (diagnostic_manager::significant_edge_p): New.
3904 (diagnostic_manager::add_events_for_superedge): Add path_builder
3905 param. Reject insignificant edges at verbosity levels below 3.
3906 (diagnostic_manager::prune_for_sm_diagnostic): Update highest
3907 verbosity level to 4.
3908 * diagnostic-manager.h (class path_builder): New forward decl.
3909 (diagnostic_manager::build_emission_path): Replace "eg" param
3910 with a path_builder.
3911 (diagnostic_manager::add_events_for_eedge): Replace ext_state
3912 param with path_builder.
3913 (diagnostic_manager::significant_edge_p): New.
3914 (diagnostic_manager::add_events_for_superedge): Add path_builder
3915 param.
3916 * reachability.h: New file.
3918 2020-02-18 David Malcolm <dmalcolm@redhat.com>
3920 PR analyzer/93692
3921 * analyzer.opt (fdump-analyzer-callgraph): Rewrite description.
3923 2020-02-18 David Malcolm <dmalcolm@redhat.com>
3925 PR analyzer/93777
3926 * region-model.cc (region_model::maybe_cast_1): Replace assertion
3927 that build_cast returns non-NULL with a conditional, falling
3928 through to the logic which returns a new unknown value of the
3929 desired type if it fails.
3931 2020-02-18 David Malcolm <dmalcolm@redhat.com>
3933 PR analyzer/93778
3934 * engine.cc (impl_region_model_context::on_unknown_tree_code):
3935 Rename to...
3936 (impl_region_model_context::on_unexpected_tree_code): ...this and
3937 convert first argument from path_var to tree.
3938 (exploded_node::on_stmt): Pass ctxt to purge_for_unknown_fncall.
3939 * exploded-graph.h (region_model_context::on_unknown_tree_code):
3940 Rename to...
3941 (region_model_context::on_unexpected_tree_code): ...this and
3942 convert first argument from path_var to tree.
3943 * program-state.cc (sm_state_map::purge_for_unknown_fncall): Add
3944 ctxt param and pass on to calls to get_rvalue.
3945 * program-state.h (sm_state_map::purge_for_unknown_fncall): Add
3946 ctxt param.
3947 * region-model.cc (region_model::handle_unrecognized_call): Pass
3948 ctxt on to call to get_rvalue.
3949 (region_model::get_lvalue_1): Move body of default case to
3950 region_model::make_region_for_unexpected_tree_code and call it.
3951 Within COMPONENT_REF case, reject attempts to handle types other
3952 than RECORD_TYPE and UNION_TYPE.
3953 (region_model::make_region_for_unexpected_tree_code): New
3954 function, based on default case of region_model::get_lvalue_1.
3955 * region-model.h
3956 (region_model::make_region_for_unexpected_tree_code): New decl.
3957 (region_model::on_unknown_tree_code): Rename to...
3958 (region_model::on_unexpected_tree_code): ...this and convert first
3959 argument from path_var to tree.
3960 (class test_region_model_context): Update vfunc implementation for
3961 above change.
3963 2020-02-18 David Malcolm <dmalcolm@redhat.com>
3965 PR analyzer/93774
3966 * region-model.cc
3967 (region_model::convert_byte_offset_to_array_index): Use
3968 int_size_in_bytes before calling size_in_bytes, to gracefully fail
3969 on incomplete types.
3971 2020-02-17 David Malcolm <dmalcolm@redhat.com>
3973 PR analyzer/93775
3974 * region-model.cc (region_model::get_fndecl_for_call): Handle the
3975 case where the code_region's get_tree_for_child_region returns
3976 NULL.
3978 2020-02-17 David Malcolm <dmalcolm@redhat.com>
3980 PR analyzer/93388
3981 * engine.cc (impl_region_model_context::on_unknown_tree_code):
3982 New.
3983 (exploded_graph::get_or_create_node): Reject invalid states.
3984 * exploded-graph.h
3985 (impl_region_model_context::on_unknown_tree_code): New decl.
3986 (point_and_state::point_and_state): Assert that the state is
3987 valid.
3988 * program-state.cc (program_state::program_state): Initialize
3989 m_valid to true.
3990 (program_state::operator=): Copy m_valid.
3991 (program_state::program_state): Likewise for move constructor.
3992 (program_state::print): Print m_valid.
3993 (program_state::dump_to_pp): Likewise.
3994 * program-state.h (program_state::m_valid): New field.
3995 * region-model.cc (region_model::get_lvalue_1): Implement the
3996 default case by returning a new symbolic region and calling
3997 the context's on_unknown_tree_code, rather than issuing an
3998 internal_error. Implement VIEW_CONVERT_EXPR.
3999 * region-model.h (region_model_context::on_unknown_tree_code): New
4000 vfunc.
4001 (test_region_model_context::on_unknown_tree_code): New.
4003 2020-02-17 David Malcolm <dmalcolm@redhat.com>
4005 * sm-malloc.cc (malloc_diagnostic::describe_state_change): For
4006 transition to the "null" state, only say "assuming" when
4007 transitioning from the "unchecked" state.
4009 2020-02-17 David Malcolm <dmalcolm@redhat.com>
4011 * diagnostic-manager.h (diagnostic_manager::get_saved_diagnostic):
4012 Add const overload.
4013 * engine.cc (exploded_node::dump_dot): Dump saved_diagnostics.
4014 * exploded-graph.h (exploded_graph::get_diagnostic_manager): Add
4015 const overload.
4017 2020-02-11 David Malcolm <dmalcolm@redhat.com>
4019 PR analyzer/93288
4020 * analysis-plan.cc (analysis_plan::use_summary_p): Look through
4021 the ultimate_alias_target when getting the called function.
4022 * engine.cc (exploded_node::on_stmt): Rename second "ctxt" to
4023 "sm_ctxt". Use the region_model's get_fndecl_for_call rather than
4024 gimple_call_fndecl.
4025 * region-model.cc (region_model::get_fndecl_for_call): Use
4026 ultimate_alias_target on fndecl.
4027 * supergraph.cc (get_ultimate_function_for_cgraph_edge): New
4028 function.
4029 (supergraph_call_edge): Use it when rejecting edges without
4030 functions.
4031 (supergraph::supergraph): Use it to get the function for the
4032 cgraph_edge when building interprocedural superedges.
4033 (callgraph_superedge::get_callee_function): Use it.
4034 * supergraph.h (supergraph::get_num_snodes): Make param const.
4035 (supergraph::function_to_num_snodes_t): Make first type param
4036 const.
4038 2020-02-11 David Malcolm <dmalcolm@redhat.com>
4040 PR analyzer/93374
4041 * engine.cc (exploded_edge::exploded_edge): Add ext_state param
4042 and pass it to change.validate.
4043 (exploded_graph::get_or_create_node): Move purging of change
4044 svalues to also cover the case of reusing an existing enode.
4045 (exploded_graph::add_edge): Pass m_ext_state to exploded_edge's
4046 ctor.
4047 * exploded-graph.h (exploded_edge::exploded_edge): Add ext_state
4048 param.
4049 * program-state.cc (state_change::sm_change::validate): Likewise.
4050 Assert that m_sm_idx is sane. Use ext_state to validate
4051 m_old_state and m_new_state.
4052 (state_change::validate): Add ext_state param and pass it to
4053 the sm_change validate calls.
4054 * program-state.h (state_change::sm_change::validate): Add
4055 ext_state param.
4056 (state_change::validate): Likewise.
4058 2020-02-11 David Malcolm <dmalcolm@redhat.com>
4060 PR analyzer/93669
4061 * engine.cc (exploded_graph::dump_exploded_nodes): Handle missing
4062 case of STATUS_WORKLIST in implementation of
4063 "__analyzer_dump_exploded_nodes".
4065 2020-02-11 David Malcolm <dmalcolm@redhat.com>
4067 PR analyzer/93649
4068 * constraint-manager.cc (constraint_manager::add_constraint): When
4069 merging equivalence classes and updating m_constant, also update
4070 m_cst_sid.
4071 (constraint_manager::validate): If m_constant is non-NULL assert
4072 that m_cst_sid is non-null and is valid.
4074 2020-02-11 David Malcolm <dmalcolm@redhat.com>
4076 PR analyzer/93657
4077 * analyzer.opt (fdump-analyzer): Reword description.
4078 (fdump-analyzer-stderr): Likewise.
4080 2020-02-11 David Malcolm <dmalcolm@redhat.com>
4082 * region-model.cc (print_quoted_type): New function.
4083 (svalue::print): Use it to replace %qT.
4084 (region::dump_to_pp): Likewise.
4085 (region::dump_child_label): Likewise.
4086 (region::print_fields): Likewise.
4088 2020-02-10 David Malcolm <dmalcolm@redhat.com>
4090 PR analyzer/93659
4091 * analyzer.opt (-param=analyzer-max-recursion-depth=): Fix "tha"
4092 -> "that" typo.
4093 (Wanalyzer-use-of-uninitialized-value): Fix "initialized" ->
4094 "uninitialized" typo.
4096 2020-02-10 David Malcolm <dmalcolm@redhat.com>
4098 PR analyzer/93350
4099 * region-model.cc (region_model::get_lvalue_1):
4100 Handle BIT_FIELD_REF.
4101 (make_region_for_type): Handle VECTOR_TYPE.
4103 2020-02-10 David Malcolm <dmalcolm@redhat.com>
4105 PR analyzer/93647
4106 * diagnostic-manager.cc
4107 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof against
4108 VAR being constant.
4109 * region-model.cc (region_model::get_lvalue_1): Provide a better
4110 error message when encountering an unhandled tree code.
4112 2020-02-10 David Malcolm <dmalcolm@redhat.com>
4114 PR analyzer/93405
4115 * region-model.cc (region_model::get_lvalue_1): Implement
4116 CONST_DECL.
4118 2020-02-06 David Malcolm <dmalcolm@redhat.com>
4120 * region-model.cc (region_model::maybe_cast_1): Attempt to provide
4121 a region_svalue if either type is a pointer, rather than if both
4122 types are pointers.
4124 2020-02-05 David Malcolm <dmalcolm@redhat.com>
4126 * engine.cc (exploded_node::dump_dot): Show merger enodes.
4127 (worklist::add_node): Assert that the node's m_status is
4128 STATUS_WORKLIST.
4129 (exploded_graph::process_worklist): Likewise for nodes from the
4130 worklist. Set status of merged nodes to STATUS_MERGER.
4131 (exploded_graph::process_node): Set status of node to
4132 STATUS_PROCESSED.
4133 (exploded_graph::dump_exploded_nodes): Rework handling of
4134 "__analyzer_dump_exploded_nodes", splitting enodes by status into
4135 "processed" and "merger", showing the count of just the processed
4136 enodes at the call, rather than the count of all enodes.
4137 * exploded-graph.h (exploded_node::status): New enum.
4138 (exploded_node::exploded_node): Initialize m_status to
4139 STATUS_WORKLIST.
4140 (exploded_node::get_status): New getter.
4141 (exploded_node::set_status): New setter.
4143 2020-02-04 David Malcolm <dmalcolm@redhat.com>
4145 PR analyzer/93543
4146 * engine.cc (pod_hash_traits<function_call_string>::mark_empty):
4147 Eliminate reinterpret_cast.
4148 (pod_hash_traits<function_call_string>::is_empty): Likewise.
4150 2020-02-03 David Malcolm <dmalcolm@redhat.com>
4152 * constraint-manager.cc (range::constrained_to_single_element):
4153 Replace fold_build2 with fold_binary. Remove unnecessary newline.
4154 (constraint_manager::get_or_add_equiv_class): Replace fold_build2
4155 with fold_binary in two places, and remove out-of-date comment.
4156 (constraint_manager::eval_condition): Replace fold_build2 with
4157 fold_binary.
4158 * region-model.cc (constant_svalue::eval_condition): Likewise.
4159 (region_model::on_assignment): Likewise.
4161 2020-02-03 David Malcolm <dmalcolm@redhat.com>
4163 PR analyzer/93544
4164 * diagnostic-manager.cc
4165 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof
4166 against bad choices due to bad paths.
4167 * engine.cc (impl_region_model_context::on_phi): New.
4168 * exploded-graph.h (impl_region_model_context::on_phi): New decl.
4169 * region-model.cc (region_model::on_longjmp): Likewise.
4170 (region_model::handle_phi): Add phi param. Call the ctxt's on_phi
4171 vfunc.
4172 (region_model::update_for_phis): Pass phi to handle_phi.
4173 * region-model.h (region_model::handle_phi): Add phi param.
4174 (region_model_context::on_phi): New vfunc.
4175 (test_region_model_context::on_phi): New.
4176 * sm-malloc.cc (malloc_state_machine::on_phi): New.
4177 (malloc_state_machine::on_zero_assignment): New.
4178 * sm.h (state_machine::on_phi): New vfunc.
4180 2020-02-03 David Malcolm <dmalcolm@redhat.com>
4182 * engine.cc (supernode_cluster::dump_dot): Show BB index as
4183 well as SN index.
4184 * supergraph.cc (supernode::dump_dot): Likewise.
4186 2020-02-03 David Malcolm <dmalcolm@redhat.com>
4188 PR analyzer/93546
4189 * region-model.cc (region_model::on_call_pre): Update for new
4190 param of symbolic_region ctor.
4191 (region_model::deref_rvalue): Likewise.
4192 (region_model::add_new_malloc_region): Likewise.
4193 (make_region_for_type): Likewise, preserving type.
4194 * region-model.h (symbolic_region::symbolic_region): Add "type"
4195 param and pass it to base class ctor.
4197 2020-02-03 David Malcolm <dmalcolm@redhat.com>
4199 PR analyzer/93547
4200 * constraint-manager.cc
4201 (constraint_manager::get_or_add_equiv_class): Ensure types are
4202 compatible before comparing constants.
4204 2020-01-31 David Malcolm <dmalcolm@redhat.com>
4206 PR analyzer/93457
4207 * region-model.cc (make_region_for_type): Use VOID_TYPE_P rather
4208 than checking against void_type_node.
4210 2020-01-31 David Malcolm <dmalcolm@redhat.com>
4212 PR analyzer/93373
4213 * region-model.cc (ASSERT_COMPAT_TYPES): Convert to...
4214 (assert_compat_types): ...this, and bail when either type is NULL,
4215 or when VOID_TYPE_P (dst_type).
4216 (region_model::get_lvalue): Update for above conversion.
4217 (region_model::get_rvalue): Likewise.
4219 2020-01-31 David Malcolm <dmalcolm@redhat.com>
4221 PR analyzer/93379
4222 * region-model.cc (region_model::update_for_return_superedge):
4223 Move check for null result so that it also guards setting the
4224 lhs.
4226 2020-01-31 David Malcolm <dmalcolm@redhat.com>
4228 PR analyzer/93438
4229 * region-model.cc (stack_region::can_merge_p): Split into a two
4230 pass approach, creating all stack regions first, then populating
4231 them.
4232 (selftest::test_state_merging): Add test coverage for (a) the case
4233 of self-merging a model in which a local in an older stack frame
4234 points to a local in a more recent stack frame (which previously
4235 would ICE), and (b) the case of self-merging a model in which a
4236 local points to a global (which previously worked OK).
4238 2020-01-31 David Malcolm <dmalcolm@redhat.com>
4240 * analyzer.cc (is_named_call_p): Replace tests for fndecl being
4241 extern at file scope and having a non-NULL DECL_NAME with a call
4242 to maybe_special_function_p.
4243 * function-set.cc (function_set::contains_decl_p): Add call to
4244 maybe_special_function_p.
4246 2020-01-31 David Malcolm <dmalcolm@redhat.com>
4248 PR analyzer/93450
4249 * constraint-manager.cc
4250 (constraint_manager::get_or_add_equiv_class): Only compare constants
4251 if their types are compatible.
4252 * region-model.cc (constant_svalue::eval_condition): Replace check
4253 for identical types with call to types_compatible_p.
4255 2020-01-30 David Malcolm <dmalcolm@redhat.com>
4257 * program-state.cc (extrinsic_state::dump_to_pp): New.
4258 (extrinsic_state::dump_to_file): New.
4259 (extrinsic_state::dump): New.
4260 * program-state.h (extrinsic_state::dump_to_pp): New decl.
4261 (extrinsic_state::dump_to_file): New decl.
4262 (extrinsic_state::dump): New decl.
4263 * sm.cc: Include "pretty-print.h".
4264 (state_machine::dump_to_pp): New.
4265 * sm.h (state_machine::dump_to_pp): New decl.
4267 2020-01-30 David Malcolm <dmalcolm@redhat.com>
4269 * diagnostic-manager.cc (for_each_state_change): Use
4270 extrinsic_state::get_num_checkers rather than accessing m_checkers
4271 directly.
4272 * program-state.cc (program_state::program_state): Likewise.
4273 * program-state.h (extrinsic_state::m_checkers): Make private.
4275 2020-01-30 David Malcolm <dmalcolm@redhat.com>
4277 PR analyzer/93356
4278 * region-model.cc (region_model::eval_condition): In both
4279 overloads, bail out immediately on floating-point types.
4280 (region_model::eval_condition_without_cm): Likewise.
4281 (region_model::add_constraint): Likewise.
4283 2020-01-30 David Malcolm <dmalcolm@redhat.com>
4285 PR analyzer/93450
4286 * program-state.cc (sm_state_map::set_state): For the overload
4287 taking an svalue_id, bail out if the set_state on the ec does
4288 nothing. Convert the latter's return type from void to bool,
4289 returning true if anything changed.
4290 (sm_state_map::impl_set_state): Convert the return type from void
4291 to bool, returning true if the state changed.
4292 * program-state.h (sm_state_map::set_state): Convert return type
4293 from void to bool.
4294 (sm_state_map::impl_set_state): Likewise.
4295 * region-model.cc (constant_svalue::eval_condition): Only call
4296 fold_build2 if the types are the same.
4298 2020-01-29 Jakub Jelinek <jakub@redhat.com>
4300 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Remove.
4301 * constraint-manager.cc: Include diagnostic-core.h before graphviz.h.
4302 (range::dump, equiv_class::print): Don't use PUSH_IGNORE_WFORMAT or
4303 POP_IGNORE_WFORMAT.
4304 * state-purge.cc: Include diagnostic-core.h before
4305 gimple-pretty-print.h.
4306 (state_purge_annotator::add_node_annotations, print_vec_of_names):
4307 Don't use PUSH_IGNORE_WFORMAT or POP_IGNORE_WFORMAT.
4308 * region-model.cc: Move diagnostic-core.h include before graphviz.h.
4309 (path_var::dump, svalue::print, constant_svalue::print_details,
4310 region::dump_to_pp, region::dump_child_label, region::print_fields,
4311 map_region::print_fields, map_region::dump_dot_to_pp,
4312 map_region::dump_child_label, array_region::print_fields,
4313 array_region::dump_dot_to_pp): Don't use PUSH_IGNORE_WFORMAT or
4314 POP_IGNORE_WFORMAT.
4316 2020-01-28 David Malcolm <dmalcolm@redhat.com>
4318 PR analyzer/93316
4319 * engine.cc (rewind_info_t::update_model): Get the longjmp call
4320 stmt via get_longjmp_call () rather than assuming it is the last
4321 stmt in the longjmp's supernode.
4322 (rewind_info_t::add_events_to_path): Get the location_t for the
4323 rewind_from_longjmp_event via get_longjmp_call () rather than from
4324 the supernode's get_end_location ().
4326 2020-01-28 David Malcolm <dmalcolm@redhat.com>
4328 * region-model.cc (poisoned_value_diagnostic::emit): Update for
4329 renaming of warning_at overload to warning_meta.
4330 * sm-file.cc (file_leak::emit): Likewise.
4331 * sm-malloc.cc (double_free::emit): Likewise.
4332 (possible_null_deref::emit): Likewise.
4333 (possible_null_arg::emit): Likewise.
4334 (null_deref::emit): Likewise.
4335 (null_arg::emit): Likewise.
4336 (use_after_free::emit): Likewise.
4337 (malloc_leak::emit): Likewise.
4338 (free_of_non_heap::emit): Likewise.
4339 * sm-sensitive.cc (exposure_through_output_file::emit): Likewise.
4340 * sm-signal.cc (signal_unsafe_call::emit): Likewise.
4341 * sm-taint.cc (tainted_array_index::emit): Likewise.
4343 2020-01-27 David Malcolm <dmalcolm@redhat.com>
4345 PR analyzer/93451
4346 * region-model.cc (tree_cmp): For the REAL_CST case, impose an
4347 arbitrary order on NaNs relative to other NaNs and to non-NaNs;
4348 const-correctness tweak.
4349 (ana::selftests::build_real_cst_from_string): New function.
4350 (ana::selftests::append_interesting_constants): New function.
4351 (ana::selftests::test_tree_cmp_on_constants): New test.
4352 (ana::selftests::test_canonicalization_4): New test.
4353 (ana::selftests::analyzer_region_model_cc_tests): Call the new
4354 tests.
4356 2020-01-27 David Malcolm <dmalcolm@redhat.com>
4358 PR analyzer/93349
4359 * engine.cc (run_checkers): Save and restore input_location.
4361 2020-01-27 David Malcolm <dmalcolm@redhat.com>
4363 * call-string.cc (call_string::cmp_1): Delete, moving body to...
4364 (call_string::cmp): ...here.
4365 * call-string.h (call_string::cmp_1): Delete decl.
4366 * engine.cc (worklist::key_t::cmp_1): Delete, moving body to...
4367 (worklist::key_t::cmp): ...here. Implement hash comparisons
4368 via comparison rather than subtraction to avoid overflow issues.
4369 * exploded-graph.h (worklist::key_t::cmp_1): Delete decl.
4370 * region-model.cc (tree_cmp): Eliminate buggy checking for
4371 symmetry.
4373 2020-01-27 David Malcolm <dmalcolm@redhat.com>
4375 * analyzer.cc (is_named_call_p): Check that fndecl is "extern"
4376 and at file scope. Potentially disregard prefix _ or __ in
4377 fndecl's name. Bail if the identifier is NULL.
4378 (is_setjmp_call_p): Expect a gcall rather than plain gimple.
4379 Remove special-case check for leading prefix, and also check for
4380 sigsetjmp.
4381 (is_longjmp_call_p): Also check for siglongjmp.
4382 (get_user_facing_name): New function.
4383 * analyzer.h (is_setjmp_call_p): Expect a gcall rather than plain
4384 gimple.
4385 (get_user_facing_name): New decl.
4386 * checker-path.cc (setjmp_event::get_desc): Use
4387 get_user_facing_name to avoid hardcoding the function name.
4388 (rewind_event::rewind_event): Add rewind_info param, using it to
4389 initialize new m_rewind_info field, and strengthen the assertion.
4390 (rewind_from_longjmp_event::get_desc): Use get_user_facing_name to
4391 avoid hardcoding the function name.
4392 (rewind_to_setjmp_event::get_desc): Likewise.
4393 * checker-path.h (setjmp_event::setjmp_event): Add setjmp_call
4394 param and use it to initialize...
4395 (setjmp_event::m_setjmp_call): New field.
4396 (rewind_event::rewind_event): Add rewind_info param.
4397 (rewind_event::m_rewind_info): New protected field.
4398 (rewind_from_longjmp_event::rewind_from_longjmp_event): Add
4399 rewind_info param.
4400 (class rewind_to_setjmp_event): Move rewind_info field to parent
4401 class.
4402 * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
4403 Update setjmp-handling for is_setjmp_call_p requiring a gcall;
4404 pass the call to the new setjmp_event.
4405 * engine.cc (exploded_node::on_stmt): Update for is_setjmp_call_p
4406 requiring a gcall.
4407 (stale_jmp_buf::emit): Use get_user_facing_name to avoid
4408 hardcoding the function names.
4409 (exploded_node::on_longjmp): Pass the longjmp_call when
4410 constructing rewind_info.
4411 (rewind_info_t::add_events_to_path): Pass the rewind_info_t to the
4412 rewind_from_longjmp_event's ctor.
4413 * exploded-graph.h (rewind_info_t::rewind_info_t): Add
4414 longjmp_call param.
4415 (rewind_info_t::get_longjmp_call): New.
4416 (rewind_info_t::m_longjmp_call): New.
4417 * region-model.cc (region_model::on_setjmp): Update comment to
4418 indicate this is also for sigsetjmp.
4419 * region-model.h (struct setjmp_record): Likewise.
4420 (class setjmp_svalue): Likewise.
4422 2020-01-27 David Malcolm <dmalcolm@redhat.com>
4424 PR analyzer/93276
4425 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Guard these
4426 macros with GCC_VERSION >= 4006, making them no-op otherwise.
4427 * engine.cc (exploded_edge::exploded_edge): Specify template for
4428 base class initializer.
4429 (exploded_graph::add_edge): Specify template when chaining up to
4430 base class add_edge implementation.
4431 (viz_callgraph_node::dump_dot): Drop redundant "typename".
4432 (viz_callgraph_edge::viz_callgraph_edge): Specify template for
4433 base class initializer.
4434 * program-state.cc (sm_state_map::clone_with_remapping): Drop
4435 redundant "typename".
4436 (sm_state_map::print): Likewise.
4437 (sm_state_map::hash): Likewise.
4438 (sm_state_map::operator==): Likewise.
4439 (sm_state_map::remap_svalue_ids): Likewise.
4440 (sm_state_map::on_svalue_purge): Likewise.
4441 (sm_state_map::validate): Likewise.
4442 * program-state.h (sm_state_map::iterator_t): Likewise.
4443 * supergraph.h (superedge::superedge): Specify template for base
4444 class initializer.
4446 2020-01-23 David Malcolm <dmalcolm@redhat.com>
4448 PR analyzer/93375
4449 * supergraph.cc (callgraph_superedge::get_arg_for_parm): Fail
4450 gracefully is the number of parameters at the callee exceeds the
4451 number of arguments at the call stmt.
4452 (callgraph_superedge::get_parm_for_arg): Likewise.
4454 2020-01-22 David Malcolm <dmalcolm@redhat.com>
4456 PR analyzer/93382
4457 * program-state.cc (sm_state_map::on_svalue_purge): If the
4458 entry survives, but the origin is being purged, then reset the
4459 origin to null.
4461 2020-01-22 David Malcolm <dmalcolm@redhat.com>
4463 * sm-signal.cc: Fix nesting of CHECKING_P and namespace ana.
4465 2020-01-22 David Malcolm <dmalcolm@redhat.com>
4467 PR analyzer/93378
4468 * engine.cc (setjmp_svalue::compare_fields): Update for
4469 replacement of m_enode with m_setjmp_record.
4470 (setjmp_svalue::add_to_hash): Likewise.
4471 (setjmp_svalue::get_index): Rename...
4472 (setjmp_svalue::get_enode_index): ...to this.
4473 (setjmp_svalue::print_details): Update for replacement of m_enode
4474 with m_setjmp_record.
4475 (exploded_node::on_longjmp): Likewise.
4476 * exploded-graph.h (rewind_info_t::m_enode_origin): Replace...
4477 (rewind_info_t::m_setjmp_record): ...with this.
4478 (rewind_info_t::rewind_info_t): Update for replacement of m_enode
4479 with m_setjmp_record.
4480 (rewind_info_t::get_setjmp_point): Likewise.
4481 (rewind_info_t::get_setjmp_call): Likewise.
4482 * region-model.cc (region_model::dump_summary_of_map): Likewise.
4483 (region_model::on_setjmp): Likewise.
4484 * region-model.h (struct setjmp_record): New struct.
4485 (setjmp_svalue::m_enode): Replace...
4486 (setjmp_svalue::m_setjmp_record): ...with this.
4487 (setjmp_svalue::setjmp_svalue): Update for replacement of m_enode
4488 with m_setjmp_record.
4489 (setjmp_svalue::clone): Likewise.
4490 (setjmp_svalue::get_index): Rename...
4491 (setjmp_svalue::get_enode_index): ...to this.
4492 (setjmp_svalue::get_exploded_node): Replace...
4493 (setjmp_svalue::get_setjmp_record): ...with this.
4495 2020-01-22 David Malcolm <dmalcolm@redhat.com>
4497 PR analyzer/93316
4498 * analyzer.cc (is_setjmp_call_p): Check for "setjmp" as well as
4499 "_setjmp".
4501 2020-01-22 David Malcolm <dmalcolm@redhat.com>
4503 PR analyzer/93307
4504 * analysis-plan.h: Wrap everything namespace "ana".
4505 * analyzer-logging.cc: Likewise.
4506 * analyzer-logging.h: Likewise.
4507 * analyzer-pass.cc (pass_analyzer::execute): Update for "ana"
4508 namespace.
4509 * analyzer-selftests.cc: Wrap everything namespace "ana".
4510 * analyzer-selftests.h: Likewise.
4511 * analyzer.h: Likewise for forward decls of types.
4512 * call-string.h: Likewise.
4513 * checker-path.cc: Likewise.
4514 * checker-path.h: Likewise.
4515 * constraint-manager.cc: Likewise.
4516 * constraint-manager.h: Likewise.
4517 * diagnostic-manager.cc: Likewise.
4518 * diagnostic-manager.h: Likewise.
4519 * engine.cc: Likewise.
4520 * engine.h: Likewise.
4521 * exploded-graph.h: Likewise.
4522 * function-set.cc: Likewise.
4523 * function-set.h: Likewise.
4524 * pending-diagnostic.cc: Likewise.
4525 * pending-diagnostic.h: Likewise.
4526 * program-point.cc: Likewise.
4527 * program-point.h: Likewise.
4528 * program-state.cc: Likewise.
4529 * program-state.h: Likewise.
4530 * region-model.cc: Likewise.
4531 * region-model.h: Likewise.
4532 * sm-file.cc: Likewise.
4533 * sm-malloc.cc: Likewise.
4534 * sm-pattern-test.cc: Likewise.
4535 * sm-sensitive.cc: Likewise.
4536 * sm-signal.cc: Likewise.
4537 * sm-taint.cc: Likewise.
4538 * sm.cc: Likewise.
4539 * sm.h: Likewise.
4540 * state-purge.h: Likewise.
4541 * supergraph.cc: Likewise.
4542 * supergraph.h: Likewise.
4544 2020-01-21 David Malcolm <dmalcolm@redhat.com>
4546 PR analyzer/93352
4547 * region-model.cc (int_cmp): Rename to...
4548 (array_region::key_cmp): ...this, using key_t rather than int.
4549 Rewrite in terms of comparisons rather than subtraction to
4550 ensure qsort is anti-symmetric when handling extreme values.
4551 (array_region::walk_for_canonicalization): Update for above
4552 renaming.
4553 * region-model.h (array_region::key_cmp): New decl.
4555 2020-01-17 David Malcolm <dmalcolm@redhat.com>
4557 PR analyzer/93290
4558 * region-model.cc (region_model::eval_condition_without_cm): Avoid
4559 gcc_unreachable for unexpected operations for the case where
4560 we're comparing an svalue against itself.
4562 2020-01-17 David Malcolm <dmalcolm@redhat.com>
4564 PR analyzer/93281
4565 * region-model.cc
4566 (region_model::convert_byte_offset_to_array_index): Convert to
4567 ssizetype before dividing by byte_size. Use fold_binary rather
4568 than fold_build2 to avoid needlessly constructing a tree for the
4569 non-const case.
4571 2020-01-15 David Malcolm <dmalcolm@redhat.com>
4573 * engine.cc (class impl_region_model_context): Fix comment.
4575 2020-01-14 David Malcolm <dmalcolm@redhat.com>
4577 PR analyzer/93212
4578 * region-model.cc (make_region_for_type): Use
4579 FUNC_OR_METHOD_TYPE_P rather than comparing against FUNCTION_TYPE.
4580 * region-model.h (function_region::function_region): Likewise.
4582 2020-01-14 David Malcolm <dmalcolm@redhat.com>
4584 * program-state.cc (sm_state_map::clone_with_remapping): Copy
4585 m_global_state.
4586 (selftest::test_program_state_merging_2): New selftest.
4587 (selftest::analyzer_program_state_cc_tests): Call it.
4589 2020-01-14 David Malcolm <dmalcolm@redhat.com>
4591 * checker-path.h (checker_path::get_checker_event): New function.
4592 (checker_path): Add DISABLE_COPY_AND_ASSIGN; make fields private.
4593 * diagnostic-manager.cc
4594 (diagnostic_manager::prune_for_sm_diagnostic): Replace direct
4595 access to checker_path::m_events with accessor functions. Fix
4596 overlong line.
4597 (diagnostic_manager::prune_interproc_events): Replace direct
4598 access to checker_path::m_events with accessor functions.
4599 (diagnostic_manager::finish_pruning): Likewise.
4601 2020-01-14 David Malcolm <dmalcolm@redhat.com>
4603 * checker-path.h (checker_event::clone): Delete vfunc decl.
4604 (debug_event::clone): Delete vfunc impl.
4605 (custom_event::clone): Delete vfunc impl.
4606 (statement_event::clone): Delete vfunc impl.
4607 (function_entry_event::clone): Delete vfunc impl.
4608 (state_change_event::clone): Delete vfunc impl.
4609 (start_cfg_edge_event::clone): Delete vfunc impl.
4610 (end_cfg_edge_event::clone): Delete vfunc impl.
4611 (call_event::clone): Delete vfunc impl.
4612 (return_event::clone): Delete vfunc impl.
4613 (setjmp_event::clone): Delete vfunc impl.
4614 (rewind_from_longjmp_event::clone): Delete vfunc impl.
4615 (rewind_to_setjmp_event::clone): Delete vfunc impl.
4616 (warning_event::clone): Delete vfunc impl.
4618 2020-01-14 David Malcolm <dmalcolm@redhat.com>
4620 * supergraph.cc (supernode::dump_dot): Ensure that the TABLE
4621 element has at least one TR.
4623 2020-01-14 David Malcolm <dmalcolm@redhat.com>
4625 PR analyzer/58237
4626 * engine.cc (leak_stmt_finder::find_stmt): Use get_pure_location
4627 when comparing against UNKNOWN_LOCATION.
4628 (stmt_requires_new_enode_p): Likewise.
4629 (exploded_graph::dump_exploded_nodes): Likewise.
4630 * supergraph.cc (supernode::get_start_location): Likewise.
4631 (supernode::get_end_location): Likewise.
4633 2020-01-14 David Malcolm <dmalcolm@redhat.com>
4635 PR analyzer/58237
4636 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
4637 selftest::analyzer_sm_file_cc_tests.
4638 * analyzer-selftests.h (selftest::analyzer_sm_file_cc_tests): New
4639 decl.
4640 * sm-file.cc: Include "analyzer/function-set.h" and
4641 "analyzer/analyzer-selftests.h".
4642 (get_file_using_fns): New function.
4643 (is_file_using_fn_p): New function.
4644 (fileptr_state_machine::on_stmt): Return true for known functions.
4645 (selftest::analyzer_sm_file_cc_tests): New function.
4647 2020-01-14 David Malcolm <dmalcolm@redhat.com>
4649 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
4650 selftest::analyzer_sm_signal_cc_tests.
4651 * analyzer-selftests.h (selftest::analyzer_sm_signal_cc_tests):
4652 New decl.
4653 * sm-signal.cc: Include "analyzer/function-set.h" and
4654 "analyzer/analyzer-selftests.h".
4655 (get_async_signal_unsafe_fns): New function.
4656 (signal_unsafe_p): Reimplement in terms of the above.
4657 (selftest::analyzer_sm_signal_cc_tests): New function.
4659 2020-01-14 David Malcolm <dmalcolm@redhat.com>
4661 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
4662 selftest::analyzer_function_set_cc_tests.
4663 * analyzer-selftests.h (selftest::analyzer_function_set_cc_tests):
4664 New decl.
4665 * function-set.cc: New file.
4666 * function-set.h: New file.
4668 2020-01-14 David Malcolm <dmalcolm@redhat.com>
4670 * analyzer.h (fndecl_has_gimple_body_p): New decl.
4671 * engine.cc (impl_region_model_context::on_unknown_change): New
4672 function.
4673 (fndecl_has_gimple_body_p): Make non-static.
4674 (exploded_node::on_stmt): Treat __analyzer_dump_exploded_nodes as
4675 known. Track whether we have a call with unknown side-effects and
4676 pass it to on_call_post.
4677 * exploded-graph.h (impl_region_model_context::on_unknown_change):
4678 New decl.
4679 * program-state.cc (sm_state_map::on_unknown_change): New function.
4680 * program-state.h (sm_state_map::on_unknown_change): New decl.
4681 * region-model.cc: Include "bitmap.h".
4682 (region_model::on_call_pre): Return a bool, capturing whether the
4683 call has unknown side effects.
4684 (region_model::on_call_post): Add arg "bool unknown_side_effects"
4685 and if true, call handle_unrecognized_call.
4686 (class reachable_regions): New class.
4687 (region_model::handle_unrecognized_call): New function.
4688 * region-model.h (region_model::on_call_pre): Return a bool.
4689 (region_model::on_call_post): Add arg "bool unknown_side_effects".
4690 (region_model::handle_unrecognized_call): New decl.
4691 (region_model_context::on_unknown_change): New vfunc.
4692 (test_region_model_context::on_unknown_change): New function.
4694 2020-01-14 David Malcolm <dmalcolm@redhat.com>
4696 * diagnostic-manager.cc (saved_diagnostic::operator==): Move here
4697 from header. Replace pointer equality test on m_var with call to
4698 pending_diagnostic::same_tree_p.
4699 * diagnostic-manager.h (saved_diagnostic::operator==): Move to
4700 diagnostic-manager.cc.
4701 * pending-diagnostic.cc (pending_diagnostic::same_tree_p): New.
4702 * pending-diagnostic.h (pending_diagnostic::same_tree_p): New.
4703 * sm-file.cc (file_diagnostic::subclass_equal_p): Replace pointer
4704 equality on m_arg with call to pending_diagnostic::same_tree_p.
4705 * sm-malloc.cc (malloc_diagnostic::subclass_equal_p): Likewise.
4706 (possible_null_arg::subclass_equal_p): Likewise.
4707 (null_arg::subclass_equal_p): Likewise.
4708 (free_of_non_heap::subclass_equal_p): Likewise.
4709 * sm-pattern-test.cc (pattern_match::operator==): Likewise.
4710 * sm-sensitive.cc (exposure_through_output_file::operator==):
4711 Likewise.
4712 * sm-taint.cc (tainted_array_index::operator==): Likewise.
4714 2020-01-14 David Malcolm <dmalcolm@redhat.com>
4716 * diagnostic-manager.cc (dedupe_winners::add): Add logging
4717 of deduplication decisions made.
4719 2020-01-14 David Malcolm <dmalcolm@redhat.com>
4721 * ChangeLog: New file.
4722 * analyzer-selftests.cc: New file.
4723 * analyzer-selftests.h: New file.
4724 * analyzer.opt: New file.
4725 * analysis-plan.cc: New file.
4726 * analysis-plan.h: New file.
4727 * analyzer-logging.cc: New file.
4728 * analyzer-logging.h: New file.
4729 * analyzer-pass.cc: New file.
4730 * analyzer.cc: New file.
4731 * analyzer.h: New file.
4732 * call-string.cc: New file.
4733 * call-string.h: New file.
4734 * checker-path.cc: New file.
4735 * checker-path.h: New file.
4736 * constraint-manager.cc: New file.
4737 * constraint-manager.h: New file.
4738 * diagnostic-manager.cc: New file.
4739 * diagnostic-manager.h: New file.
4740 * engine.cc: New file.
4741 * engine.h: New file.
4742 * exploded-graph.h: New file.
4743 * pending-diagnostic.cc: New file.
4744 * pending-diagnostic.h: New file.
4745 * program-point.cc: New file.
4746 * program-point.h: New file.
4747 * program-state.cc: New file.
4748 * program-state.h: New file.
4749 * region-model.cc: New file.
4750 * region-model.h: New file.
4751 * sm-file.cc: New file.
4752 * sm-malloc.cc: New file.
4753 * sm-malloc.dot: New file.
4754 * sm-pattern-test.cc: New file.
4755 * sm-sensitive.cc: New file.
4756 * sm-signal.cc: New file.
4757 * sm-taint.cc: New file.
4758 * sm.cc: New file.
4759 * sm.h: New file.
4760 * state-purge.cc: New file.
4761 * state-purge.h: New file.
4762 * supergraph.cc: New file.
4763 * supergraph.h: New file.
4765 2019-12-13 David Malcolm <dmalcolm@redhat.com>
4767 * Initial creation
4769 \f
4770 Copyright (C) 2019-2021 Free Software Foundation, Inc.
4772 Copying and distribution of this file, with or without modification,
4773 are permitted in any medium without royalty provided the copyright
4774 notice and this notice are preserved.